introduction to cloudstack networking

Introduction to CloudStack Networking

Geoff HigginbottomCTO ShapeBlue

geoff.higginbottom@shapeblue.comTwitter: @CloudStackGuru @ShapeBlue

@ShapeBlue #CloudStack #CCCEU13

Cloud Architect & ShapeBlue CTO Specialise in….

Designing & Building Clouds based on Apache CloudStack / Citrix CloudPlatform

Developing CloudStack training Blogging and sharing CloudStack knowledge

Involved with CloudStack before donation to Apache Designed Clouds for SunGard, Ascenty, BskyB, Trader Media,

M5 Hosting, Team Cymru, Interoute, University of Pennsylvania.…

CloudStack Committer (non-developer)

About Me

“ShapeBlue are expert builders of public & private clouds. They are the leading global independent CloudStack / CloudPlatform

integrator & consultancy”

About ShapeBlue

Why NaaS – The Use CasesVPS Cloud

Why NaaS – The Use CasesTier 1

Tier 2

Tier 3

NaaSVMVM

AWS Style L3 isolation – Massive Scale Simple Flat Network Each POD has a unique CIDR Optional Guest Isolation via Security Groups Optional NetScaler Integration - Elastic IPs and Elastic

LB Optional Nicira NVP Integration

Basic Networking

Isolate traffic between VMs Available for both Basic and Advanced Networking Only supported on XenServer 6.x and KVM XenServer 6.0.x requires the Cloud Support Package XenServer must use Linux Bridge and not Open

vSwitch xe-switch-network-backend bridge Must be implemented before adding to CloudStack

Security Groups

Security Groups Rules can be mapped to CIDR or another

Account/Security Group

This network model provides the most flexibility in defining guest networks and providing custom network offerings such as firewall, VPN, Load Balancer & VPC functionality.

Guest isolation is provided through layer-2 means such as VLANs or SDN technologies

Advanced Networking

Private and Shared Guest Networks Multiple Physical Networks Virtual Router for each Network providing:

DNS & DHCP Firewall Client VPN Load Balancing Source / Static NAT Port Forwarding

Advanced Networking

Effectively enables the deployment of multiple ‘Basic’ style networks which use Security Groups for isolation of VMs, but with each Network encapsulated within a unique VLAN.

Advanced Networking & Security Groups

Management Network

Secondary Storage

Management

Server(s)

MySQLDB(s)

Traffic between CloudStack Management Servers and the various cloud components (Hosts, System VMs, Storage*, vCenter etc)

Guest Network – Advanced Zone

Virtual Router

Traffic between VMs within an Account, and their Virtual Router, Physical Load Balancer or Physical Firewall

Guest Network – Basic Zone

wwwTraffic between VMs on the network and their Internet Gateway

Guest Network – Basic Zone EIP / ELB

Citrix NetScaler

Traffic between VMs and the Internal Interface of the NetScaler

Public Network – Advanced Zone

Virtual Router

Traffic between the Virtual Router and the Internet Gateway

Public Network - Basic Zone EIP / ELB

Citrix NetScaler

Only present in a Basic Zone when a Citrix NetScaler is used to provide Elastic IP and Elastic LB

Public Network – System VMs

CPVM & SSVM both have a connection to the Public Network

Storage Network

Secondary Storage

Management

Server(s)

Traffic between SSVM and the Secondary Storage

Optional Network, traffic will use the Management Network if not configured.

If configured, there must be a route between Management and Storage Networks

It is NOT for Primary Storage Traffic

Physical ConnectivityUsers

Router

PrimaryStorage

Secondary Storage

Management

Server(s)

MySQLDB(s)

Admins & Users

Basic Zone – Example IP Schema

L3 Switch

Host n

Host 1

POD 1192.168.0.0/2

6Res IPs 0.10 -

0.29Hosts 0.30 –

DHCPDNSUserDataSec Groups

L2 Switch

Host n

Host 1

POD 2192.168.0.64/26

Res IPs 0.73 - 0.92Hosts 0.93 - 0.126

Guest IPs:172.16.2.2- 3.254

GW 172.16.2.1

L2 Switch

Host n

Host 1

POD 3192.168.0.128/26

Res IPs 0.138 – 0.147Hosts 0.149 – 0.190

Guest IPs:172.16.4.2 - 5.254

GW 172.16.4.1

L2 Switch

Guest IPs:172.16.0.2 -

1.254GW 172.16.0.1

Advanced Zone – Example IP Schema

L3 Switch

Host n

Host 2

POD 1 - XenServer

192.168.0.0/26Res IPs 0.10 -

0.29Hosts 0.30 –

Host 1

L2 SwitchVMb1

VRb VMb2

VRaVMa2

VMa3Host n

Host 2

POD 2 - vSphere

192.168.2.0/22Res IPs 2.43 -

3.254Hosts 2.10 –

Host 1

L2 Switch

Guest Networks10.1.1.0/24GW 10.1.1.1

Guest IPs 1.2 - 1.254

A Hardware or Virtual Appliance that provide Network Services to CloudStack e.g.

Network Service Providers

Virtual Router VPC Virtual Router Internal LBVM Citrix NetScaler F5 Load Balancer Juniper SRX Firewall

Nicira Nvp Midokura Midonet BigSwitch Vns Cisco VNMC

Private multi-tiered Virtual Networks ACLs to control traffic isolation Inter VLAN Routing Site-2-Site VPN Private Gateway

Virtual Private Clouds (VPC)

VPC Components

Virtual Router – Connects all the VPC Components

Network Tiers – Isolated Networks, each with unique VLAN and CIDR

Tier 1VLAN 101

Tier 2VLAN 102

Tier 3VLAN 103

Virtual Router

VPC Components

Public Gateway

Tier 1VLAN 101

Tier 2VLAN 102

Tier 3VLAN 103

Site-2-Site VPNLinked to Public Gateway

Remote DC or

Corporate Office

Virtual Router

Private GatewayCreated by Root AdminsConfigured by Users (Static Routes)

VPC Components

Tier 1VLAN 101

Tier 2VLAN 102

Tier 3VLAN 103

Virtual Router

VPC Components

Physical Equipme

Remote DC

Router

Tier 1VLAN 101

Tier 2VLAN 102

Tier 3VLAN 103

Virtual Router

VPC Components

Tier 1VLAN 101

Tier 2VLAN 102

Tier 3VLAN 103

Virtual Router

VPC Components

wwwVMVM

Tier 1VLAN 101

Tier 2VLAN 102

Tier 3VLAN 103

Virtual Router

Communication Ports

HTTPSConsole Access

80/443

HTTPFile

ESXiKVM

XenServervCenter

2222/80/443

User – CSMAN 8080/8096CSMAN – CSMAN 9090/8250

CloudStack Management Servers

Virtual Router

CSMAN – MySQL 3306MySQL – MySQL 3306

MySQL Master & Slave

Secondary Storage

111/2049

System VMs & Their NetworksVirtual Router

Virtual Router

Public Networke.g. 82.64.20.2

Guest Networke.g. 10.1.1.17

Link Local (XenServer / KVM) e.g. 169.254.3.24Management (vSphere) e.g. 192.168.2.57

System VMs & Their NetworksVirtual Router

Virtual Router

DHCP, DNS , User Data, Source NAT, Static NAT, VPN,Firewall, Port Forwarding, Load Balancing

System VMs & Their NetworksSecondary Storage VM

Managemente.g. 192.168.3.28

Storage NetworkIP address from Management OR Storage IP Ranges

System VMs & Their NetworksSSVM – VM Image / ISO Upload

Workflow

HTTP Server

1. User uploads VM Image / ISO to Public Web Server

CloudStack Management Server

2. User specifies VM Image / ISO Location via GUI or API SSVM

3. CloudStack sends request information to SSVM

Secondary Storage

4. SSVM fetches VM Image/ISO from HTTP Server and writes it to Secondary Storage

Management / LiLo

Public Storage

System VMs & Their NetworksConsole Proxy VM

Managemente.g. 192.168.2.58

System VMs & Their NetworksCPVM – Remote

Connection

Management / LiLo

Public Management

CloudStack Management Server

1. User initiates a Console session

3. CS Forwards user identity and ticket to CPVM

2. CS chooses suitable CPVM and creates a logon ticket for user

4. CS sends user redirection URL

realhostip.com

5. User resolves URL via realhostip.com

6. User is connected to CPVM via HTTPS Hypervisor

7. CPVM connects to Hypervisor via HTTPS

Numerous VPC Improvements Add & Remove NICs / Networks Multiple IPs on Single NIC Persistent Networks Configurable Default Egress Behaviour Non Contiguous VLAN Ranges Enhanced SRX & F5 Support PVLANs GLSB IPv6 – (Technical Demo)

Recent Networking Improvements (4.1 & 4.2)

Lots of great technical info on http://shapeblue.com/blog/

These slides can be found at www.slideshare.net/shapeblue

geoff.higginbottom@shapeblue.com @CloudStackGuru

Further Information

introduction to cloudstack networking

shapeblue shapeblue

cloudstack knowledgeinvolved

cloudstack e

cloudstack management

cloudstack training

storage network traffic

management network traffic

network services

Technology

cloudstack eu user group - making stuff better through...

cloudstack talk

introduction and cloudstack news

cloudstack eu user group - cloudstack news

linuxcon introduction to cloudstack

1 introduction at cloudstack developer day

three perspectives on the...

cloudstack api developer's guide - svn.apache.org fileapache...

introduction to cloudstack: how to deploy and manage...

knife cloudstack

cloudstack the best kept secret in the cloud · bt cloud ....

netscaler and advanced networking in cloudstack

cloudstack documentation - media.readthedocs.org ·...

apache cloudstack networking by chiradeep vittal

software defined networking in apache cloudstack chiradeep...

silicon valley cloudstack user group - designing cloudstack...

prescriptive analytics for apache cloudstack · actonmagic...

cloudstack 101 - an introduction to coudstack

cloudstack dc meetup - apache cloudstack overview and...

3 networking cloudstack developer day