mmc2623bu the integrated multi- cloud management solution ... · integrated multi cloud management...

Doug Bourgeois, Managing DirectorSean Vandruff, Sr. Technology Fellow

MMC2623BU

#VMworld #MMC2623BU

The Integrated Multi-Cloud Management Solution (iMCM)

VMworld 2017 Content: Not fo

r publication or distri

bution

Copyright © 2017 Deloitte Development LLC. All rights reserved. Integrated Multi Cloud Management solution 2

Integrated Multi-Cloud Management (iMCM)

Agenda

TOPIC SLIDES

Context and Solution Overview

Common Challenges and Opportunities 4-5

Key Elements and Features of iMCM 6-7

Technical Architecture

Technical Architecture Framework and Impact 8-10

iMCM Features, Capabilities and Use Cases 12-13

iMCM Demonstration 14-18

Project Approach

Key Considerations and Approach 20-22



bution


Context and Solution Overview

Integrated Multi-Cloud Management Solution Overview (iMCM)



bution


Mission-driven goals

• Comply with mandates

• Respond to mission area requests

for technical support

• Support technology-enabled

innovation across the agency

Obstacles

• Lack of agility due to legacy

hardware and software

• Siloed support teams

• Change-resistant organization and

culture

Results

• Lack of overall governance

• No comprehensive reporting

• Overall disconnection between

Mission expectations and IT’s

delivery

Outcome: Frustrated mission areas

resort to developing their own

insolated solutions.

Common Problems of the ExecutiveA typical scenario for IT Executives



bution


Integrated Multi-Cloud Management (iMCM) Use Cases What We can Deliver for You

Business Management

CloudNative

HybridCloud

Disaster Recovery (DR)

SecurityAutomation

Enhance efficiency through optimization

Enable incremental adoption of modern technology

Provide cost and usage transparency

Optimize cloud utilization across environments

Support cloud native development with on-demand containers and tools

Provide tools, management, and reporting for container deployment and configuration

Reduce risk of IaaS vendor lock-in through abstraction layer

Enhance cross-cloud management efficiency through a standard toolset and interface

Provide demand agility through workload portability

Monitor and report on all cloud resources in single feed

Consistently provision workloads/environments to multiple clouds

Automate to lower operations cost and speed delivery

Rapidly standup workloads in cloud in DR scenarios

Backup data to cloud for low-cost, high-availability access

Automate DR testing

FedRAMP ready for Federal Audiences

Provide ready-to-use profiles for security settings

Consistent enforcement and compliance



bution


Clo

ud

Nativ

e D

evelo

pm

en

tTech

no

log

y A

dvis

ory a

nd

Ris

kiMCM Solution OverviewDeloitte’s Integrated Multi-Cloud Management (iMCM) solution built on VMware technologies

Infrastructure and Cloud Services

Foundation for modernized applications

• Cloud-native applications

• Application optimization

• Digital services

Security policy and governance

• Microsegmentation

• Policy enforcement

• Monitoring and logging

Automation

• Provisioning

• Security profile deployment

• Disaster recovery

• Migration

• Policy-based management

Integrated cloud management

• Orchestration

• Dashboarding

• Business management

• API integration

Deloitte’s IntegratedMulti-Cloud Management

(MCM) Solution

Organizational and Business Transformation

Clo

ud

Nativ

e D

evelo

pm

en

tTech

no

log

y A

dvis

ory a

nd

Ris

k



bution


Integrated Multi-Cloud Management (iMCM) The Value Proposition

Cost Reduction

Risk Mitigation

IT staff Productivity

Agility and Scalablity

Security Compliance

Can deliver significant savings over siloedinfrastructure

Enables right-size resources based on demand

Helps optimize OpExspend across physical and cloud infrastructure

Provides stable, reliable platform for business deployment

Designed to minimize application downtime and reduces downtime risk

Provides consistent security profiles across cloud

Requires less time to manage, administer, and update

Allows IT to focus on generating business value

Accelerates deployment and migration

Enables choice of cloud for innovationand speed

Automatically scales to meet demand

Enables future product service enhancements

Facilitates increased responsiveness to the core business and mission

Standardizes policies and controls

Enhances security within the perimeter through micro-segmentation

Automates security controls

FedRAMP-ready to improve solution time-to-market

Consistently enforces and monitors

Enhances ability to align with FITARA and DCOI



bution


Accelerates cloud adoption

Operationalizes mission capabilities in a

cloud native ecosystem

Automates provisioning and deployment

of complex multi-tier applications

Provides orchestration across:

o External CSPs

o On-premises management cloud

services

o On-premises virtual and physical

infrastructure

Helps prevent cloud vendor lock-in

iMCM High Level Architecture

Deloitte’s multi-cloud solution helps drive value and can offer more flexibility than single-cloud deployments, providing fully integrated multi-cloud analysis and orchestration.

iMCM



bution


Security & Compliance through Integrated Multi-Cloud Management (iMCM)Accelerating controls to reduce customer burden while maintaining efficacy

Real-time Asset Management

GO

VER

NA

NC

E &

CO

MP

LIA

NC

E Vulnerability Management

Privileged Account Management

Continuous Monitoring

Incident Response & Management

DR Management

App 1 App 2 App 3Application

Layer

iMCM

VMware Validated

DesignSDDC

Hardening

Encryption

Automation

Orchestration

Compute

Storage

Network

Physical Infrastructure

System owner’s responsibility

Provided by iMCM Stack

Provided by Data Center



bution


VMware Validated Design Deploy and Operate All Components of the Software-Defined Data Center

Software Defined

Data Center

vSAN

vSphere

NSX

vRA

vROps

VVD designs

encompass the

entire set of

VMware software-

defined data center

(SDDC) products

Standardized and streamlined design for each deployment scenario and use case, for example, single-region SDDC Clouds

VMware Validated Designs (VVD) are architectures and designs are created and validated by VMware experts

Validation SDCCDesigned to Deploy



bution


iMCM Use Case Demo



bution


Multi-Cloud Deployment and Management DemoUnified dashboards and the multi-layered service catalog demonstrate the immediate value leveraging iMCM with multiple clouds can offer

Multi-layered Service Catalog

Unified Multi-cloud Operations Dashboards

Multi-cloud Business Dashboard

▪ The service catalog supports deployment across 3 CSP environments

▪ 4 business groups, supporting different functions (Dev, Test, Prod-low, Prod-high)

▪ “Production” VMs are deployed from hardened images, replete with encryption and distributed firewall

network security

▪ VMs are deployed to networks that are open to others of their function, but isolated from other VMs (App,

DB, Web)

▪ Using vRealize Operations Manager, we have created dashboards that depict the resources allocated to, and

consumed by each cloud deployment

▪ Dashboards are available for business groups (App & dev/test/prod environments) depicting the cross-cloud

resources consumed by each business group

▪ vRealize Business for Cloud is leveraged to provide the estimated cost of compute resources prior to

deployment

▪ Dashboards for business groups depicting cross-cloud resources consumed by each business group, application

or function

▪ View cloud consumption and spend across private and external CSPs



bution


iMCM Use Case Technical Elements

Use Case Name Description Technical Tool

1AUTOMATED PROVISIONING

• Provision workloads (simple server and multi-machine) to on-prem and off-prem

• Integrate workloads with Active Directory and other enterprise services• BluePrints can deploy complex systems with the security built into

automated workflows.

vRA, NSX, vSAN, vRB, AD Federation

2NSX CONTINUOUS MONITORING

Identify malicious action and respond as required:• Changed setting/port• VM is quarantined• Action is logged

vROps, NSX, Cloud Control

3CLOUD TO ON-PREM MIGRATION

Pilot solution in cloud and then migrate to on-prem for operational use vRO, vRA

4 SURFACING NSX SECURITY PROFILES IN vRA

Microsegmentation of VM to meet security profile NSX, VRA

5 AGENTLESS AV Demonstrate use of agentless AV across multiple clouds NSX, VRA, McAfee, etc.

6 UNIFIED DASHBOARD Single 'Pane of Glass' view into the cross-cloud environment vROps, Blue Medora

7 MULTI-VM ENVIRONMENTDeploy a multi-machine blueprint that is a complete development environment with a jump sever

NSX, VRA

8 DR/COOP Replicate and migrate workloads from On-Premise to Cloud to DR/COOP vRO, vRA, vROps

9 ENCRYPTION• Request encryption as service• Deploy workloads to encrypted datastores by policy

vCenter, HyTrust

10 BACKUP Backup as a service (on-prem to cloud) VDP, vRA

11 COST TRANSPARENCYAs part of the user portal demonstrate cost transparency with costs depicted across clouds

vRB, Digital Fuel



bution


Use Case 1- External Cloud Deployment

ON

-PR

EM

IS

ES

CLO

UD

CSP 2CSP 1

VM

OSHARDENED OS‏

VM

OS

HyTrust KeyControl Pivotal Cloud Foundry

vROPs vRA vROvRB

Digital FuelLog Insight

vSphere NSXvSAN



bution


Use Case 1 - Private Cloud Deployment

ON

-PR

EM

IS

ES

CLO

UD

SECURED NETWORK .1‏

VM

ENCRYPTED .2‏

HARDENED OS .3‏

OS

CSP 1 CSP 2

HyTrust KeyControl Pivotal Cloud Foundry

vROPs vRA vROvRB

Digital FuelLog Insight

vSphere NSXvSAN



bution


Sample Approval Workflow

Customer Requests New VM with Approval Chain

Proj

ect

Man

ager

Req

uest

orvR

ea

lize

A

uto

mat

ion

(V

RA

)

Fin

an

cia

l M

anag

erTe

chni

cal T

eam

Secu

rity

Off

icer

Phase

Process VM Request

Yes

Analyze VM Requirements

Does VM Meet Business Needs?

Join VM to OU

Yes

Inform Customer of Completed VM

New VM RequiredReceive Requested

VM

Is there Funding For The VM?

Yes

Is Tech Review Necessary

No

Does VM Meet Technical

Requirements?Yes

No

Yes

Create Computer Object in relevant

OU

Submit VM Request via VRA

Is Approval Required?

Build VM

Receive Rejection Notification

No

Does the Request Meet IA

Requirements

Yes

No



bution


Use Case 2 - Unified Multi-Cloud Operations Dashboards

‏ 1. SECURED NETWORK

‏ 2. ENCRYPTED

‏ 3. HARDENED OS

• Dashboards depict

the resources

allocated and

consumed by cloud

deployments

• Dashboards are

available for

business groups

(aligning to

dev/test/prod

functions)

• Depicts cross-cloud

resources

consumed by each

business group

vRealize

Operations

Manager

CSP 1 CSP 2

Pivotal Cloud Foundry

vROPs vRA vRO Log Insight

vSphere vSAN

HyTrust KeyControl

NSX

VM

OS

vRB

Digital Fuel

ON

-PR

EM

IS

ES

CLO

UD



bution


Use Case 3 - Multi-Cloud Business Dashboard

IT Cloud Spend – Across Clouds and Trending of Spend vs. Founded

Questions Answered:

o Where do significant variances exist between spend, vs. plan/funding?

o What is being consumed and spent across clouds providers?

Results & Value:

o Manage spend to hit plan while preserving service

o Cost with projections vs budget (Application/environment/services/pool of resources)

Multi-CSP Application Spend – Track and analyze costs related to

applications and their environments (Dev, Test, Prod)

Questions Answered:

o Where is my application running and what is the cost breakout by provider?

o How do infrastructure costs differ by provider?

o IaaS/PaaS cost YTD

Results & Value:

o Understand the total cost of an application across environments and clouds

o Enhanced reporting related to FITARA, DCOI and others for Federal Customers

CSP1 CSP2 CSP3

$3,500 $500 $200

Compute

Storage

Network

$1,000

$500

$2,000

$200

$200

$100

$50

$150

$100

CSP2

CSP1

Private

$150

$100

$200

Application 1

Total application cost = $450



bution


The Multi-Cloud Approach

Lessons Learned and Considerations for your Multi or Hybrid Cloud Project



bution


Key Considerations to Take AwayConsider the following points as the enterprise moves toward the implementation of cloud services in support of their mission

• Understand how new cloud technology will integrate with current architectures and environments

• Evaluate current technology skillsets and capabilities of current staff and contracts and map proposed technology skillsets where they most appropriately align

• Evaluate the implications of the cloud platform options

• Perform IT landscape assessment and risk framework impact

• The integration of core infrastructure services and providers is critical to automation planning and design efforts

• Understand the Pain Points for 1) The IT service organization 2) The consumers of the services

• Align to/develop common enterprise framework and taxonomy for cloud service consumption and reporting

• Build stakeholder consensus across organization through Proof of Concept and Demos of real-life solution

• Build credibility through incremental enhancement of foundational services – start simple and add complexity over time

Technology Considerations

Organizational Considerations



bution


Accelerated Implementation Approach

• Analyze current environment

• Identify success criteria

• Develop detailed project plan

• Identify POC use case

• Complete business case

• Design and validate POC

• Build and demonstrate POC

• Finalize project plan

• Identify security requirements

• Develop productionuse cases

• Launch system for Dev and Test

• Ensure compliance with FISMA/FedRAMP

• Connect to external clouds

• Deliver fully operational multi-cloud management tool

• Accelerate FedRAMP and ATO activities for FISMA moderate data

• Complete and authorize security documents

Governance, cyber security, documentation, and program management occur across the entire timeline

Discovery Proof of Concept Initial Offering Full Solution



bution


Software Defined Data Center (SDCC) Logical Design

ToRSwitch

Management pod(4 ESXi hosts)

Edge pod(4 ESXi hosts)

ToRSwitch

Compute pod(4 ESXi hosts)



ToR Switch ToR Switch

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16




4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16

4 8 12 16


4 8 12 16

4 8 12 16

Managed by:Compute vCenter Server

Managed by:Management vCenter Server

NSX Transport zone (compute) NSX Transport zone (Mgmt)

vDS (compute) vDS (Mgmt)

Aggregating these various VMware components allows for total virtualization of the Data Center Environment

vCenter manages the

virtual infrastructure

NSX provides cross platform security and network automation

ESXi hosts coordinate the

allocation of resources

SDDC Payload

Virtual Infrastructure Compute Edge

Virtual Infrastructure Management

NSX Controller (Mgmt)

NSX Edge (Mgmt)

NSX Manager

(compute)

NSX Manager (Mgmt)

vCenter server

(compute)

vCenter server

(mgmt)

Other Management Applications

Shared Edge and Computer Cluster Management Cluster

Management and Shared Edge and Compute Pod

APP

OS

ESXi

ESXi

ESXi

ESXi

ESXi

ESXi

ESXi

ESXi

Network: Internal SDDCFabric (spine/Lead)

Network: External(Internet/MPLS

APP

OS

NSX Controller (compute)

NSX Edge (compute)

APP

OS

APP

OS

APP

OS



bution

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms.

This communication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms or their related entities (collectively, the "Deloitte Network"), is, by means of this communication, rendering professional advice or services. Before making any decisions or taking any action that may affect your finances, or your business, you should consult a qualified professional adviser. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this communication.

.

Thank you.

Doug BourgeoisManaging Director

Deloitte Consulting LLP

[email protected]

Sean VandruffSr. Technology Fellow

Deloitte Consulting LLP

[email protected] 2017 Content: N

ot for publicatio

n or distribution

mailto:[email protected]

mailto:[email protected]



bution

mmc2623bu the integrated multi- cloud management solution ... · integrated multi cloud management...

Documents