Continuing with my series recap of VMworld 2014, here is the third installment.
- VMworld: The Numbers
- VMware EVO: RAIL
- VMware NSX
- NetApp All-Flash FAS for VMware Horizon 6
- VMware VVols
- VMware CloudVolumes
- Veeam Backup and Recovery 8.0 for NetApp
- Zerto Disaster Recovery
- New Companies of Interest
VMware NSX: What's All the fuss About?
NSX was borne out of VMware's acquisition of software-defined networking (SDN) company Nicira. But the entirety of the product category was borne out of the need to make workloads and configurations faster and more flexible—in other words, to make the hardware more agile. Business needs are changing so fast today, and technology is making progress in keeping up; but networking is still operating on principles that were originally developed 20 years ago, and have largely remained unchanged today. Time for that to change.
Now, everyone won't change at once, for sure. In fact, it may be many years before the software-defined networking because the normal for our customers. But it is the shape of the future, on that, everyone—Cisco, VMware, Arista, Juniper, you name it—agrees.
Now, everyone won't change at once, for sure. In fact, it may be many years before the software-defined networking because the normal for our customers. But it is the shape of the future, on that, everyone—Cisco, VMware, Arista, Juniper, you name it—agrees.
Abstraction & Automation
When I did my series on 7 Reasons Cisco UCS Rocks!, I started off first by talking about Abstraction and Automation—these are the key components to make hardware less siloed and more agile for business needs. Cisco was the first company to really change the game with server hardware-level abstraction, and in just five years they are the #1 server in North America.
SDN is all about this same kind of separation, only this time with the components of networking itself, allowing network services to break free from the constraints levied upon them by 20-year-old traditional networking technologies.
SDN is all about this same kind of separation, only this time with the components of networking itself, allowing network services to break free from the constraints levied upon them by 20-year-old traditional networking technologies.
At the same time, the separation of these elements allow for the consolidation of management, control/configuration, and data services of a variety of types into a single virtualized network environment. Subnets, VLANs, DMZs and the limitations of each can now be bypassed to create a much more highly agile, reliable, and secure environment.
VMware NSX | Logical Network Topology
Once services are abstracted into software, then they can likewise be combined and applied at the ready, at any level, and to any object. That's what we call agility. And it is something that is very hard to do in a port-VLAN-subnet-based world.
Take for example a common use-case in a medium sized organization; let's say 500 users. No multi-tenancy, just a normal company. They are rolling out a new e-commerce website, where none previously existed. They will have all the traditional components:
- (5) Network load-balancers web-facing servers
- (2) Application logic servers
- (2) Clustered database servers
| Traditional Configuration
And then repeat if you need to scale out to more servers! | NSX Software-Defined Configuration
|
Again, that's a bit simplified on both sides of the equation, but you understand the difference between the two. First, you don't have to go to 17 devices and configure them over and over, which lends itself to fat-finger errors. Second, the ability to apply dynamic policies means that things can be configured once, applied many times, and reapplied to new systems with little to no extra effort.
Micro-Segmentation
Micro-segmentation is best explained, I think in terms of basketball defense: traditional networking applies a "zone" configuration; software-defined networking, or micro-segmentation within SDN, uses a man-to-man scheme, or more like a men-man scheme. Check out this overview video from VMware:
Micro-segmentation enables something called "service adjacency." I am not sure if that's my term I or I heard it somewhere else (probably the latter). Service adjacency means that the services consumed by the VM are adjacent or right next to the VM itself. Consider the following example from a UCS chassis with a VM that needs to go between the Web tier through the DMZ to the App tier on the internal network, when both VMs reside on the same physical host (which is often the case for reduced latency between application tiers).
Micro-segmentation means that all of my network L2-L7 services live "next to" the VM itself, and each VM gets its own "distributed instance" of that service. And each ESX host can provide up to 20Gbps of NSX throughput. Boom.
And now imagine that you are a service provider or an organization that has compliance needs. Now with every separate security group you can still share hardware, but you can apply your policies granularly, at the VM level. More intelligence in the software means you need less physical equipment, physical separation, which saves your company both money and time.
And now imagine that you are a service provider or an organization that has compliance needs. Now with every separate security group you can still share hardware, but you can apply your policies granularly, at the VM level. More intelligence in the software means you need less physical equipment, physical separation, which saves your company both money and time.
Favorite Feature: Dynamic Security Groups
My favorite feature is the implementation of Security Groups. Security groups speed the configuration and application times of rules to both existing and new (future) virtual machines. Here's a few screenshots showing how security groups can be configured in NSX:
So let's look at it again from the example of our test case: adding a 3-tier web application. Using dynamic security groups, I can create the group and policies for my web server security group, for example, and automatically apply it to all 5 servers, without having to create 5 different entries. And, when I add another web server, if I have setup dynamic membership, it will automatically inherit the same network logic.
Now, let's look to future: imagine dynamic security groups tied to network policies, storage policies, compute policies, and such: "deploy from a template" will take on a whole new meaning!
Now, let's look to future: imagine dynamic security groups tied to network policies, storage policies, compute policies, and such: "deploy from a template" will take on a whole new meaning!
RSS Feed