cisco intercloud techdays...cisco intercloud fabric architecture is modularized to achieve the...
TRANSCRIPT
Cisco Intercloud Intercloud Fabric for Business: Technical Overview
Tanja Hess
Systems Engineer
September 2014
Cisco Confidential 2 © 2014 Cisco and/or its affiliates. All rights reserved.
Agenda
Overview
Architecture
Intercloud Fabric Services
Deployment Considerations
Summary
Cisco Confidential 3 © 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Confidential 4 © 2014 Cisco and/or its affiliates. All rights reserved.
Together with our partners, we’re building an Intercloud to include all the cloud services you’re using today, and so much more!
HCS
Microsoft Suite aaS
DRaaS
PaaS
IaaS
Enterprise Private Clouds
Public Clouds
Partner Clouds Cloud Services and Applications
Meraki
Security
Analytics
vDesktop aaS
WebEx
HANA aaS
IOE aaS
Collaboration and Video
Big Data and Analytics
Native Cloud Applications
Enterprise Workloads
Cisco Confidential 5 © 2014 Cisco and/or its affiliates. All rights reserved.
Why Hybrid?
Fixed workloads Elastic workloads Choice to build / rent across providers
Workload portability Consistent security
DC/Private Clouds Provider Clouds Economics
Speed
Scale
Data
Sovereignty
Security
Control
Cisco Confidential 6 © 2014 Cisco and/or its affiliates. All rights reserved.
Reality of Hybrid Cloud and Key Challenges
Loss of Security Siloed Infrastructure Slow and Complex
• Unsecure Connection
• Limited Workload Protection
• Inconsistent Cloud Architectures
• Fragmented Solutions Solving Networking and Security Challenges
• Different Management Tools
• Require App Re-configuration
• Slow and Manual Process of Discovering Infrastructure Dependencies
• No Visibility or Control
Cisco Confidential 7 © 2014 Cisco and/or its affiliates. All rights reserved.
DC/Private Cloud
End User and IT Admin Portals
Secure Fabric Extender Network,
Compute, and Storage
vSphere
Hyper-V*
KVM*
Xen*
Intercloud Fabric
for Business
EC2 APIs
Azure APIs
Intercloud Fabric for Providers
Provider Clouds
Intercloud Ecosystem
Intercloud Fabric for Providers
Cisco Powered Services and Cloud
Providers
Cisco Intercloud Fabric: Solution Overview
* Available in subsequent releases
Cisco Confidential 8 © 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Confidential 9 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric for
Business
Cisco Intercloud Fabric: Software-based Solution
DC or Private Hybrid Public
Intercloud Fabric for
Provider
GUI APIs
Cloud APIs
Cisco Confidential 10 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Secure Extender
(Secure Network Extension)
DC/Private Cloud
Provider Cloud
Cisco Intercloud Fabric Architectural Details
Intercloud Switch
VM Manager
Intercloud Fabric
for Providers
Intercloud
Fabric Services
Intercloud Extender
Intercloud
Fabric Director
End User and IT Admin Portal Workload and Fabric Management IT Admins End Users
VM VM
VM VM Intercloud Fabric
for Business
Cisco Confidential 11 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Secure Extender
(Secure Network Extension)
Intercloud Fabric for Business
DC/Private Cloud
VM Manager Intercloud
Fabric Director
IT Admins End Users
VM VM
Cisco Intercloud Fabric Director Features
• End User Portal • Choice of workload
placement
• Admin Portal • Policy-based
Cloud Management
• Open API for integration with other cloud management platforms
Cisco Confidential 12 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric for Business
Intercloud Secure Extender
Provider Cloud
Intercloud Switch
Intercloud Extender
Intercloud
Fabric Services VM VM
Cisco Intercloud Fabric Secure Extender Features
Extend VLAN/VXLAN
with TLS Tunnel
Inter-VM firewalling and routing Enterprise IP Address or Provider IP Address
Intercloud
Fabric Director
Cisco Confidential 13 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Provider Platform Features
Cloud API
API Translation Logic
South Bound API
VCD Adapter
Open stack
Adapter
Cloud Stack
Adapter
Custom Adapter
Intercloud Fabric Cloud API
Provider
Platform
Intercloud Fabric Provider API
Enable Cloud Provider to Quickly
Offer Hybrid Cloud Services
For Integration with Cloud
Provider Infrastructure
Abstraction over Cloud Provider Infrastructure
Core Logic Tenant DB
Intercloud Fabric Provider Southbound API
To Provider OS / BSS
To Provider Infrastructure
To Intercloud
Fabric for
Business
Securely stores tenant
records and templates
Custom Adapter
Cisco Confidential 14 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Structure
Cross-clouds app portability and mobility
Any App on Any Cloud
Hybrid, Public and Private ICF: A Platform for Cloud Services
Cisco and/or 3rd party service offerings
supporting applications in cloud environments ICF Extended Services
Fundamental service functions and
capabilities integrated natively ICF Core Services
Fundamental technologies and components
that support ICF aaS functions ICF Core Infrastructure
Cisco Confidential 15 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Structure
Cisco Intercloud Fabric Architecture is Modularized to Achieve the
Elasticity Needed to Support Evolving Cloud Environments
ICF Extended Services + External Partners (storage, load balancing, etc.)
ICF Core Services
Security Management and Visibility
Automation Networking VM Portability
ICF Core Infrastructure ICFD PNSC ICFPP Secure
Communications
Private Cloud: Enterprise Public Cloud: Provider
Cisco Confidential 16 © 2014 Cisco and/or its affiliates. All rights reserved.
ICF Core Infrastructure
ICF Core Infrastructure
PNSC
ICFPP
Secure Communications
Enterprise tool to manage and orchestrate hybrid clouds
Enterprise Service orchestration function for private and public services
Site-to-site and VM-to-VM communication technology
Cloud Provider Public Cloud management tool
Fundamental Technologies and Components
That Support Intercloud Fabric Functions
Intercloud
Fabric Director
Cisco Confidential 17 © 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Confidential 18 © 2014 Cisco and/or its affiliates. All rights reserved.
ICF Core Services
ICF Core Services Fundamental Service Functions and Capabilities
Integrated Natively to ICF and its Operation
Security
Management
and Visibility
Automation
and APIs
Networking
VM
Portability
Switching, routing and other advanced network-based capabilities
VM to VM and App-to-App security controls
VM format conversion and mobility
Private and hybrid cloud monitoring capabilities
VM lifecycle capabilities, automated operations and Programmatic APIs
Cisco Confidential 19 © 2014 Cisco and/or its affiliates. All rights reserved.
Core Services: VM Portability
VM portability is the process or converting an existing image from
the source cloud format to the destination cloud format, and placing it on the destination cloud with its associated policy
Value: VMs can be placed on any cloud independently from the origin cloud and hypervisor flavor, yet conserving the application related policies
Key VM
Portability Functions:
Format
Conversion
Policy
Portability and Control
Driver
(Agent) Application
Instantiation
Cisco Confidential 20 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud
Fabric Services
VM is powered up on public cloud and management continues through Intercloud Fabric Director 4
VM Portability: Migration Across Hybrid Cloud
Intercloud Fabric Secure Extender
DC/Private Cloud
Provider Cloud
Intercloud Switch
Cloud Providers
Intercloud Extender
IT Admins End Users
VM
VM VM
Image is converted to public cloud format (e.g., AMI) and migrated to public cloud
3
End user triggers VM migration to cloud 1
VM is shut down and Intercloud Fabric driver added 2
VM Manager Intercloud
Fabric Director
Intercloud Fabric for Business
Cisco Confidential 21 © 2014 Cisco and/or its affiliates. All rights reserved.
ICF VM Image Conversion
Install Driver and
Normalize to Raw
Convert Normalized Image
to Provider Format
Provider Image
Storage
Image
Install Driver
and Keys
Import Source
Image
ISO RAW
VMDK OVA VM
Manager
Convert Raw
Image to
Provider
Format
Converted
Raw
Image
RAW
Upload VM
Image to
Datastore
Private Cloud
Public Cloud
Converted
Image
AMI VDH
VMDK OVA
Uninstall Driver and
Normalize to Private Format
Convert Cloud Image to
RAW Format
Remove
Driver and
Keys
Dow nload
Source Image
ISO RAW
VMDK OVA VM
Manager
Convert
Image to
RAW Format
Converted
Raw
Image
RAW
Download
VM Image
from
Datastore
Downloaded
Image
AMI VDH
VMDK OVA
Provider Image
Storage
Image
Cisco Confidential 22 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric for Business
Intercloud Secure Extender
Intercloud
Fabric Director
DC/Private Cloud
Provider Cloud
Core Services: Network Extension
Enterprise Virtual Switch
Application
VM
Provider Network Switch
Enterprise VM
access port
Tunnel Port
Trunk Port
Enterprise Ports
Outer MAC/
IP/UDP Tunnel L2X
Application
VM
IC Driver
Data
Data
Data
1
2 3
Intercloud Switch
Intercloud Extender
Outer MAC/
IP/UDP Tunnel L2X Data
Cisco Confidential 23 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Secure Extender
(Secure Network Extension)
DC/Private Cloud
Provider Cloud
Intercloud Switch
Intercloud Extender
Intercloud
Fabric Director
Intercloud Fabric for Business
Core Services: Firewalling/Zoning
IT Admins Intercloud Fabric
Intercloud Fabric
VSG: Protects VMs
in Provider Cloud
Test VM
Test VM
Enterprise VSG: Protects VMs in Private Cloud
Single Security
Policy for Private and
Provider Clouds
Web VM
Cisco Confidential 24 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric for Business
Intercloud
Fabric Director
Enterprise VPN Access to Public cloud VMs
Core Services: Routing Across Hybrid Cloud
Direct access to public
cloud VMs through NAT
Intercloud Fabric Secure Extender
DC/Private Cloud
Provider Cloud
Intercloud Extender
VM VM
VM VM
VLAN App
19.2.168.x.x
Def ault Gateway f or VLAN A &B
VLAN Web
VM VM
VM VM
Prov ider Gateway
10.x..x.x
54.x..x.x
VLAN A Intercloud
Fabric CSR
Inter-VLAN communication
through ICF Routing
VLAN B
192.168.x.x
Remote/ Branch Office
ISR
VPN VPN
Mobile
Worker
Mobile
Worker
Intercloud Switch
Cisco Confidential 25 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Secure Extender
(Secure Network Extension)
DC/Private Cloud
Provider Cloud
Intercloud Switch
Intercloud Extender
Intercloud
Fabric Director
Intercloud Fabric for Business
Core Services: Establishing Trust
Web VM
IT Admins
IT Admin configures an icfCloud 1
Generate SSH key pair 2
SSH public key passed as part of creating VM along with SSH username
3
SSH public key downloaded as part of VM startup and made as authorized key for SSH user
4
HTTP/HTTPS
Cisco Confidential 26 © 2014 Cisco and/or its affiliates. All rights reserved.
Intercloud Fabric Secure Extender
(Secure Network Extension)
DC/Private Cloud
Provider Cloud
Intercloud Switch
Intercloud Extender
Intercloud
Fabric Director
Intercloud Fabric for Business
Core Services: Establishing Secure Communications
Web VM
IT Admins
Select encryption algorithm and hash for an icfCloud
1
S2S Tunnel Profile: Control Channel PSK
2
S2S and Access Tunnel Profile: Control Channel PSK Data Tunnel Encryption Key Data Tunnel Hash Key
3 Control Channel PSK 4
Encryption algorithm – AES-128-GCM, AES-128-CBC,
AES-256-GCM (Suite B), AES-256-CBC
Hashing algorithm – SHA-1, SHA-256, SHA-384
HTTPS/XML API
SCP
Cisco Confidential 27 © 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Intercloud Fabric Management Options Flexibility to integrate cloud and on-premise infrastructure operations
On-Premise Infrastructure Off-Premise / Cloud
Included
Optional
Intercloud Fabric for Business
UCS Director (On-Premise Converged Infrastructure
Mgmt. & Automation)
Off-premise Hybrid Cloud Infrastructure Management
Prime Services Catalog (Unified application centric consumption for end users)
Cisco & 3rd Party Management Systems (CIAC, custom, etc.)
IaaS
A
pplic
atio
n
Unit of Operations –
VM, VPC, Service Nodes, and Infrastructure policy
End User and IT
Admin portals for IaaS consumption
Unit of operation –
application blueprint/deployment profile
Business policy ,
Governance and Regulatory
compliance
Cisco Confidential 28 © 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Confidential 29 © 2014 Cisco and/or its affiliates. All rights reserved.
Consistency
Security/Networking as an extension of
Private Cloud
Control
Unified workload management across clouds
Choice
Freedom to place workloads across
heterogeneous Clouds
Compliance
Policy-based deployment/governance
in cloud
Cisco Intercloud Fabric Value Proposition: Secure Workload Mobility
DC/Private Cloud Cisco Intercloud Fabric
Fixed Workloads Variable Workloads
Provider Cloud
Thank you.