CloudStack Networking Paul Angus Cloud Architect ShapeBlue - PowerPoint PPT Presentation

CloudStack Networking Paul Angus Cloud Architect ShapeBlue paul.angus@shapeblue.com @CloudyAngus @ShapeBlue

About Me  Cloud Architect with ShapeBlue  Worked with CloudStack since 2.2.13  Specialising in deployment of CloudStack and supporting infrastructure  Orange, TomTom, PaddyPower, Ascenty, BSkyB, SunGard, T ‐ Mobile  I view CloudStack from a ‘What can cloud consumers practically do with it’ point ‐ of ‐ view @ShapeBlue #CloudStack #CCCNA14

About ShapeBlue “ShapeBlue are expert builders of public & private clouds. They are the leading global CloudStack / CloudPlatform integrator & consultancy” @ShapeBlue #CloudStack #CCCNA14

@ShapeBlue #CloudStack #CCCNA14

Why NaaS – The Use Cases VPS Cloud NaaS @ShapeBlue #CloudStack #CCCNA14

CloudStack Networking  Logical Networking Models  Basic  Advanced @ShapeBlue #CloudStack #CCCNA14

Basic Networking  AWS Style L3 isolation – Massive Scale  Simple Flat Network  Each POD has a unique CIDR  Optional Guest Isolation via Security Groups  Optional NetScaler Integration ‐ Elastic IPs and Elastic LB  Optional Nicira NVP Integration @ShapeBlue #CloudStack #CCCNA14

Security Groups  Isolate traffic between VMs  Available for both Basic and Advanced Networking  XenServer must use Linux Bridge and not Open vSwitch  xe ‐ switch ‐ network ‐ backend bridge  Edit sysctl to enable net.bridge.bridge ‐ nf ‐ call ‐ iptables and net.bridge.bridge ‐ nf ‐ call ‐ arptables  Must be implemented before adding to CloudStack @ShapeBlue #CloudStack #CCCNA14

Security Groups  Rules can be mapped to CIDR or another Account/Security Group @ShapeBlue #CloudStack #CCCNA14

Advanced Networking  This network model provides the most flexibility in defining guest networks and providing custom network offerings such as firewall, VPN, Load Balancer & VPC functionality.  Guest isolation is provided through layer ‐ 2 means such as VLANs or SDN technologies @ShapeBlue #CloudStack #CCCNA14

Advanced Networking  Private and Shared Guest Networks  Multiple Physical Networks  Virtual Router for each Network providing:  DNS & DHCP  Firewall  Client VPN  Load Balancing  Source / Static NAT  Port Forwarding @ShapeBlue #CloudStack #CCCNA14

Advanced Networking & Security Groups  Effectively enables the deployment of multiple ‘Basic’ style networks which use Security Groups for isolation of VMs, but with each Network encapsulated within a unique VLAN. @ShapeBlue #CloudStack #CCCNA14

Management Network Traffic between CloudStack Management Servers and the various cloud components (Hosts, System VMs, Storage*, vCenter etc) @ShapeBlue #CloudStack #CCCNA14

Guest Network – Basic & Advanced @ShapeBlue #CloudStack #CCCNA14

Guest Network – Basic Zone EIP / ELB @ShapeBlue #CloudStack #CCCNA14

Public Network – Basic & Advanced @ShapeBlue #CloudStack #CCCNA14

Public Network – System VMs CPVM, SSVM & VRs have a connection to the Public Network *VRs only have public connection in Advanced Network @ShapeBlue #CloudStack #CCCNA14

Storage Network @ShapeBlue #CloudStack #CCCNA14

Physical Connectivity @ShapeBlue #CloudStack #CCCNA14

Basic Zone – Example IP Schema @ShapeBlue #CloudStack #CCCNA14

Advanced Zone – Example IP Schema @ShapeBlue #CloudStack #CCCNA14

Network Service Providers  A Hardware or Virtual Appliance that provide Network Services to CloudStack e.g.  Virtual Router  Midokura Midonet  VPC Virtual Router  BigSwitch Vns  Internal LBVM  Cisco VNMC  Citrix NetScaler  Baremetal DHCP*  F5 Load Balancer  Baremetal PXE*  Juniper SRX Firewall  Palo Alto*  Nicira Nvp  Ovs (GRE/VXLAN) *new in 4.3 @ShapeBlue #CloudStack #CCCNA14

Virtual Private Clouds (VPC)  Private multi ‐ tiered Virtual Networks  ACLs to control traffic isolation  Inter VLAN Routing  Site ‐ 2 ‐ Site VPN  Private Gateway  VPC ‐ 2 ‐ VPC VPN*  User VPN* *new in 4.3 @ShapeBlue #CloudStack #CCCNA14

VPC Components Virtual Router – Connects all the VPC Components Network Tiers – Isolated Networks, each with unique VLAN and CIDR @ShapeBlue #CloudStack #CCCNA14

VPC Components Public Gateway @ShapeBlue #CloudStack #CCCNA14

VPC Components Site ‐ 2 ‐ Site VPN Linked to Public Gateway @ShapeBlue #CloudStack #CCCNA14

VPC Components User VPN Linked to Public Gateway @ShapeBlue #CloudStack #CCCNA14

VPC Components VPC ‐ 2 ‐ VPC VPN Linked to Public Gateway @ShapeBlue #CloudStack #CCCNA14

VPC Components Private Gateway Created by Root Admins Configured by Users (Static Routes) @ShapeBlue #CloudStack #CCCNA14

VPC Components @ShapeBlue #CloudStack #CCCNA14

VPC Components @ShapeBlue #CloudStack #CCCNA14

VPC Components @ShapeBlue #CloudStack #CCCNA14

Communication Ports @ShapeBlue #CloudStack #CCCNA14