1EDITOR’S DESK

2HYBRID CLOUD NETWORKING FALLS SHORT, BUT NOT FOR LONG

3INTEGRATING PHYSICAL AND VIRTUAL NETWORKS

4OVERLAYS MAY BE THE BEST PATH FORWARD FOR NETWORKING

BUILDING THE INFRASTRUCTURE TO ENABLE THE CHANGING FACE OF IT

APRIL 2013 \ VOL. 4 \ N0. 2

k

k

k

k

Hybrid Cloud Networking Falls Short, But Not for LongWith SDN and network virtualization, it may finally be possible to network across disparate clouds.

2   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

After Much Talk, Network Virtualization Finally Becomes Reality

Almost five years ago, I set out to write a story about network virtualization. I knew almost nothing about the topic, and after a lot of research, I basically ended up understanding it just as little.

At the time, Cisco Vice President Marie Hattar sat with me in the basement of the Javits Center in New York City for an hour trying to explain the future of network vir-tualization—the intelligent network, the application-aware network, the flexible network.

The problem was, the technology wasn’t truly in action yet, so I had a hard time comprehending it. I kept asking, “How is

this any different than using VLANs?” And Hattar finally gave up and offered me the familiar, “oh-you-poor-dear” look that tech reporters often get when we hit a wall.

All these years later, the promise of net-work virtualization is finally becoming a reality. We are starting to see the use of dynamic, flexible network virtualization platforms that allow virtual network seg-ments to be automated and provisioned on demand along with compute and storage for a whole new approach to data center networking.

I wasn’t so wrong back then in asking about VLANs. After all, they are virtual

Dynamic virtualnetworkprovisioning isfinally coming to life.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

3   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

instances or segments of a network. The problem was, they were just as static as the underlying physical network, and they were limited in number. That’s all begin-ning to change – and that’s a big part of net-work virtualization.

We’ve figured out protocols, such as VX-LAN and NVGRE, to create network tun-nels or software overlays that allow for thousands of VLANs to be provisioned dynamically. Using these protocols, there

will be multiple paths to network software over-lays and virtualization, as we uncover in the feature, “Overlays Enable Virtual Network Abstractions.”

It was the swift up-take of server virtualiza-tion that forced network

engineers to create dynamic virtual net-works inside the stack in order to route virtual machines. Now it’s time to connect those virtual networks to physical infra-structure outside the stack. In his feature, “Integrating Virtual and Physical Net-works,” tech journalist David Geers ex-plores multiple methods to bring network virtualization outside of the stack.

As engineers learn to bridge physical and virtual networks, network virtualization and software overlays will play a key role in networking hybrid clouds for total orches-tration. The cover story, “Hybrid Cloud Networking Falls Short, But Not for Long,” explains how a combination of software-defined networking, network virtualization platforms and orchestration tools will soon enable engineers to manage two disparate clouds as one.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

Network virtualization and software overlays will play

a key role in networking hybrid clouds for total orches tration.

4   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

Looking back on my quest all those years ago, if I had been a bit swifter, I probably could have gleaned a lot of this from what Hattar was trying to explain to me. After all, Cisco had much of this in its sights then. And even now, hardware vendors includ-ing Cisco, Arista and Juniper have enticing strategies for network programmability

and virtualization, alongside startups like Big Switch and Embrane. It will be inter-esting to see how they bring these tech-nologies to life and to market in the coming year. n

Rivka Gewirtz Little

Executive Editor, Networking Media Group

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

5   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

Hybrid Cloud Networking

Hybrid Cloud Networking Falls Short, But Not for Long

BY SHAMUS MCGILLICUDDY AND RIVKA GEWIRTZ LITTLE

Ω It’s the network’s fault thatthere isn’t total orchestrationreaching across hybrid cloudresources. But change is on the horizon.

When it comes to the hybrid cloud, enterprises live in a world of parallel play where some applications live in the pub-lic cloud while others reside safely in the on-premises cloud. Yet the two are barely interconnected.

This scenario falls far short of the promise of a hybrid cloud where virtual machines (VMs) could be provisioned, mi-grated and managed as one across multiple sets of data center resources. And in large part, it’s the network that stands in the way.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

6   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

“You can create dynamic network infra-structures within [a hosted cloud] environ-ment, and you can create dynamic internal network infrastructures, but they have to stay within those environments,” said Eric Hanselman, chief analyst at 451 Research. Binding a dynamic network in the hosted cloud to the on-premises data center be-comes complicated.

The problem starts with plain old phys-ics—or the speed of light. Once you break up tiered applications and place the dif-ferent elements far away from each in dis-persed data centers, latency becomes an issue. Requesting more fibre in the ground for capacity is not only costly, but takes too long in a world of dynamic provisioning.

In addition, companies struggle to stretch network services, like firewalling and load balancing, across disparate sets of

resources. Then there’s the issue of man-aging two separate sets of IP ranges that would have to be combined to enable au-tomated VM provisioning and migration across clouds.

Yet with so many more cloud providers offering hosted virtual private clouds, and enterprises realizing they needed distrib-uted computing, both are seeking answers. These solutions will likely emerge in a combination of software-defined network-ing (SDN), network virtualization and ex-panded orchestration tools.

Hybrid Cloud Networking: Connectivity Is ImmatureNetwork connectivity for hybrid cloud in-frastructure is still immature and can be expensive.

Network connectivity

for hybrid cloud in fra-structure is

still immature and can be expensive.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

7   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

Most enterprises connect into the hosted cloud over Layer 3 using either an IP VPN or MPLS connection, but both require heavy lifting and can be costly.

“A lot of cloud providers have various VPN technologies, but you need someone to help set that up,” said Bob Plankers, a vir-tualization and cloud architect at the Uni-versity of Wisconsin at Madison.

Providers typically charge an enterprise to establish and maintain the connection, and the enterprise will need engineering resources to maintain its own end of the tunnel.

Additionally, VPN-based hybrid cloud networks can also become a bottleneck on a global WAN.

“If they are public-facing Web systems, a VPN may not be too much of a drawback because [users] are accessing them through

the public cloud,” said Jason Edelman, a senior solutions architect at Presidio.

But for internal enterprise applications, the VPN can become complex. “If you have four or five sites in an enterprise that have access to a system in the public cloud, and that public cloud is building a VPN tunnel to a corporate head-end VPN concentra-tor, then all four of your other sites have to go through corporate and then through the Internet to the VPN tunnel. So you lose that any-to-any [architecture],” Edelman added.

An enterprise could avoid the bottlenecks by establishing a full mesh VPN network with the cloud provider, but that arrange-ment will add complexity to the network, and the enterprise will be paying for mul-tiple VPN connections with its cloud pro-vider, he said.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

8   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

Some enterprises with deep pockets can bypass VPNs and try direct Layer 3 peering to a provider. “I was talking to a large customer last week who was doing a one-off scenario for [high performance computing],” Edelman said. “They’re going to peer directly to a cloud provider leverag-ing BGP.”

Extending Services Across Hybrid Cloud Networks Z Gallerie, a Los Angeles-based furniture retail chain, uses a typical example of what’s possible with hybrid cloud network-ing. It hosts its customer-facing website in a Virtual Private Cloud (VPC) on Amazon Web Services while maintaining its enter-prise systems in both a traditional private data center and a hosted private cloud.

Z Gallerie wanted to integrate its Amazon VPC into its corporate network to connect its enterprise resource planning (ERP) and point of sale systems with its website.

“We needed one single, unified network so we could work seamlessly [between those systems],” said Howard Kolodny, vice president of IT at Z Gallierie. “We wanted to integrate our firewall and VPN con-centrator between our public and private clouds to provide a pathway to move data between systems securely and easily.”

Z Gallerie, however, is a Cisco shop and Amazon does not support Cisco firewalls and routers natively. Kolodny turned to virtual routing and VPN technology from Vyatta, a company recently acquired by Brocade. The Vyatta technology, which is billed as an alternative to a Cisco ASR 1000, is supported natively by Amazon and was

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

9   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

able to establish the necessary VPN tunnel with Kolodny’s Cisco infrastructure.

With Vyatta’s technology, Kolodny was able to get the VPN between his private and public cloud resources up and running. Now “it just runs,” he said.

Cisco is launching a software-based Cloud Services Router (CSR) 1000v that will eventually work in Amazon and Micro-soft’s Azure cloud. But Z Gallerie’s expe-rience with unsupported firewalls points

directly to the challenges enterprises face with hy-brid cloud networking. Establishing network con-nections between public and private clouds, and maintaining consistent network policies and Layer 4 through 7 services

in both environments, isn’t easy when cloud providers don’t always support an en-terprise’s vendor of choice.

“We’re just starting to see tools come out that can help manage both sides of things simultaneously,” said Plankers of the Uni-versity of Wisconsin. “Extending security controls and networking [from private to public cloud] is a big problem. It depends on the cloud provider and what technolo-gies they might have installed to enable people. It’s a pretty immature space right now.”

Cloud provider Tier3 is one of these com-panies. Its enterprise customers can create MPLS VPN connections into the hosted cloud from their own enterprise clouds and then establish an isolated VLAN to route traffic back and forth that is protected by their own firewalls and policy. Through a

Cisco is launching a software-based Cloud Services Router

1000v that will eventually work in Amazon and Mi crosoft’s

Azure cloud.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

10   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

simple user interface, they can apply these policies to VMs and resources inside the hosted cloud.

“They can actually extend core services for identity management,” said Jared Wray, Tier3 CTO. Through Tier3’s interface, cus-tomers have visibility of resources in both public and private clouds, which helps them apply policy.

Stretching Layer 2 Across Hybrid Cloud NetworksIntegrating network services is one thing, but if the true promise of the hybrid cloud is to enable provisioning and migration of VMs across clouds using a single orchestra-tion system, it will take an extended Layer 2. A shared Layer 2 network will mean that both sets of cloud resources could be

managed as a single IP range. The problem is, the technology to do this, doesn’t quite exist yet.

But NTT, which provides a fully dynamic software-defined network inside its virtual private clouds, sees the technology very close on the horizon.

In NTT’s virtual private cloud, software-defined networking (SDN) and OpenFlow give users an interface to provision net-work segmentation on demand. The NTT cloud has VMware hypervisors that are controlled by VMware’s vCloud Direc-tor. But NTT also runs NEC’s OpenFlow switches and controllers to enable dynamic network provisioning.

“Through the customer portal, an engi-neer would define different network seg-ments and create the virtual machines, deciding which network segments to place

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

1 1   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

them on,” said Len Padilla, senior director of technology at NTT. “Then they would connect them directly to firewalls and load balancers.”

NTT’s homegrown orchestration system ties all of these resources together and then feeds connectivity into Cisco Catalyst 6500 series switches that sit on the edges of the virtual data center and connect out to the enterprise’s VPN. Everything in the net-work can be automated all the way until it reaches the outside connection.

“The next step is to let those [outside] connections be manipulated,” said Padilla. “We are looking at giving customers one pipe that connects them to the NTT net-work, but within that, being able to estab-lish virtual network segments. Then they can come in through the portal and config-ure an IPSec tunnel.”

Once NTT’s network is extended into the enterprise data center, NTT will enable us-ers to establish overlay networks, which will allow them to use a single IP address-ing scheme for the VMs in both data cen-ters, he said.

Currently, NTT’s orchestration system makes sure that “everything is going out on the right VLAN” once it hits the Cisco switches at the edge. The company has even been able to customize individual use cases where this process is automated, but “the next step is getting that to happen in a stan-dardized way,” Padilla explained.

“As these edge and core and backbone switches become SDN aware—whether that’s with OpenFlow or not—we will strip away pieces of the control software we have built and replace it,” he said.

Cisco’s new Nexus 1000v Intercloud

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

12   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

software will enable Layer 2 overlays be-tween public and private cloud infrastruc-ture when it is available later this year. Nicira, the SDN and network virtualization startup acquired by VMware, appears to be working on a similar solution, Edelman noted. Many engineers also believe that tunneling protocols like VXLAN could ex-tend Layer 2 domains into the public cloud if the protocol’s requirements for mul-ticast networks are eliminated in future iterations.

In Hybrid Cloud Networking, Getting Smarter about Application PlacementIn early hybrid cloud scenarios, many en-terprises looked to divide tiered applica-tions between public and private clouds. The goal was to host the tiers that required

rapid scaling in the cloud, while placing static, core components like database serv-ers in the enterprise data center.

“When people say the word ‘workload’, they usually are thinking about a single vir-tual machine,” said Dante Malagrino, CEO and co-founder of Embrane, a developer of SDN services appliances. “In reality, cus-tomers’ IT organizations think in terms of applications … a combination of multiple virtual machines interconnected by net-work segments and secured by firewalls and accelerated by load balancers.” Split-ting those segments across public and pri-vate clouds can cause countless problems, including the inability to extend firewall and load-balancing policy across disparate IP schemes.

So some enterprises are approaching the hybrid cloud differently. Rather than

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

13   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

splitting application tiers across public and private infrastructure, they choose to migrate an entire application to the cloud, leaving only small but necessary hooks to the applications within the private cloud, such as authentication and authorization systems.

“If you have 10,000 applications, it’s more interesting to think about migrating 100 applications into the cloud because you

want to free resources for more mission-critical ap-plications in your data center, versus splitting your applications in half,” said Marco De Benedetto, CTO and co-founder of Embrane.

In those cases, De Bene-detto said the enterprise

can free up internal resources for the criti-cal applications that have much stricter service level agreements (SLAs).

Application Replication in the Hybrid Cloud Other enterprises choose to place appli-cation replications in the hosted cloud to tackle the problem of distance and latency, or simply to provide redundancy.

“You could have one instance of an ap-plication that runs in your own data center and one that runs in [a hosted environ-ment],” said Hanselman. “Then you don’t have to build a second data center. This buys you a separate location where you have the same operational capability.”

When using this strategy, it is important to ensure that the data source is consistent

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

“If you have 10,000 applications, it’s more interesting to think

about migrating 100 applications

into the cloud.” —Marco De Benedetto,

CTO and co-founder, Embrane

14   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

in different environments, and that can be a challenge, said George Reese, CTO at en-Stratus, a provider of cloud infrastructure management tools. In some cases, even if the data can’t be as equally consistent, en-terprises take the chance to avoid latency.

Using an orchestration system that pro-vides visibility into available resources in private and hosted clouds allows enter-prises to account for geography, available capacity and even the need for failover

when doing VM provisioning.“We get visibility into what exists, and we

use our own automation logic to construct network pathways to talk to virtual ma-chines and monitor them. If we detect fail-ure in one part, we can bring up resources [somewhere else] so we can move data around,” said Reese.

Nevertheless, Reese has high hopes for deeper levels of hybrid cloud integration that won’t involve taking such risks. n

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

15   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

Ω In order to make networksflexible enough to supportcloud orchestration, engineershave to bridge physical and virtual infrastructures?

Now that virtualization has taken hold in the data center, engineers have pushed the network into the virtual stack in order to route virtual machine (VM) traffic. But as virtual networks proliferate, network and server pros are forced to find ways to better integrate virtual and physi-cal infrastructures.

This integration is essential to the or-chestration and automation of VM provi-sioning and migration. Virtual networks route traffic between VMs in the stack, but

Network Integration

Integrating Physical and Virtual Networks

BY DAVID GEER

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

16   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

it takes physical networks to connect these virtual environments to the outside world and to interconnect data centers.

If the promise of automation and orches-tration is the fluid provisioning and migra-tion of VMs, virtual and physical networks have to be just as flexible, and manual net-work configuration for VMs won’t remain an option. What’s more, engineers must be able to move VMs across both virtual and physical networks with their security and management policies intact. All of this re-quires communication between physical and virtual networks.

Many Virtual Switching Strategies EmergeThe process of bridging physical and virtual networks starts with virtual switches that

provide visibility inside the virtualization stack.

Both VMware and Microsoft have virtual switches built into their hypervisors, the vSphere Virtual Distributed Switch and the Hyper-V Virtual Switch, which provide vis-ibility and make forwarding decisions.

Until recently—before these switches were improved—the virtualization team had to ask the networking team to create VLANs with Quality of Service (QoS) poli-cies and to allot bandwidth for new VMs, according to Justin Giardina, chief technol-ogy officer of Iland, a cloud provider and VMware customer. Once the network team provisioned these resources, they couldn’t share administration of these networks with the virtualization team.

“One of the best things to come out of VMware’s technology for the distributed

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

17   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

virtual switch is the ability to pass down administration capabilities to the virtual-ization engineer while keeping the physical network visible to the networking team as well,” said Giardina.

But VMware’s approach to switching left network pros without the ability to ap-ply their networking skills to the virtual network. To address this, Cisco launched the Nexus 1000v, which provides visibil-ity into the stack, but also more network-ing control. The 1000v replaces switching in VMware or Microsoft’s hypervisors and extends traffic and security policy across virtual networks and VM paths. It also en-ables deep network monitoring and analy-sis within the virtual environment, with features like Switch Port Analyzer (SPAN), Encapsulated Remote SPAN (ERSPAN), NetFlow, packet capture/analysis, and

DHCP/IGMPv3 snooping. Arista Networks took a different ap-

proach to expanding networking capabili-ties in the virtual environment, integrated its EOS operating system with VMware’s vSphere environment, thereby extending its own network programmability features into the virtual network.

SDN and Overlays for Physical and Virtual Network BridgingPart of the goal of orchestration and auto-mation is to enable cloud networks with au-tomated provisioning of multiple distinct virtual network segments. The idea of these multi-tenant networks is to be able to turn up network segments on demand to sup-port VM provisioning and migration.

Many enterprises are looking to use

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

18   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

software-defined networking (SDN) con-trollers combined with distributed virtual switches to provision network segments or tunnels and to communicate back to the underlying physical network.

These network software overlays are used to move traffic between virtual ma-chines, as well to reach over Layer 2 or Layer 3 physical networks in order to con-nect servers and interconnect data centers. VMware relies on the VXLAN standard to build these overlays, while Microsoft uses NVGRE. To integrate the virtual edge, some vendors have made it so these controllers can communicate back to a Layer 2 switch outside the virtual switching infrastructure that is used to direct traffic.

The Open vSwitch, which has gained the most traction next to VMware’s vswitch, has led the way in combining virtual

switching with a centralized controller to provision and manage overlays, as well as to more tightly integrate virtual and physical networks.

The Open vSwitch works with a central-ized OpenFlow-based controller to manage distributed virtual switches as one logical switch. Using the controller, the technol-ogy has a full view of every component and node on the virtual network and can direct individual data flows along with linked net-work services. The switch and controller software can institute cluster-level net-work configurations across many servers, eliminating the need to separately config-ure the network for each VM and physical machine. The switch also enables VLAN trunking, visibility via NetFlow, sFlow and RSPAN.

The technology, which supports

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

19   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

XenServer, Virtual Box, KVM environ-ments, was largely initiated by Nicira Networks, which has since been acquired by VMware. VMware maintains that it will continue Nicira’s support of Open vSwitch.

IBM, Big Switch and NEC have also launched virtual switching technology that uses SDN with centralized controllers to gain a broader view of both physical and virtual resources, as well as to provision network segments on demand. In these strategies, an OpenFlow controller man-ages flows within the overlay network, but also communicates out to the physical network.

IBM offers the Distributed Virtual Switch 5000v, which lives on a VMware hypervisor and creates tunnels between endpoints across the underlying network

infrastructure. IBM has its own virtual net-work overlay strategy, using distributed vir-tual switches deployed on hypervisor hosts to create tunnels between endpoints across the underlying network infrastructure.

NEC’s ProgrammableFlow 1000 vswitch, which works in a Microsoft environment, also combines an OpenFlow controller and virtual switches. Together, the technol-ogy maps all of the VMs and enables net-work provisioning for migration, making sure QoS and ACL policy can be applied throughout.

Similarly, BigSwitch’s Big Virtual Switch, works with the Big Network Controller, to gain a view of the entire virtual and physi-cal network and to provision network seg-ments on demand, applying and managing forwarding policy across virtual and physi-cal environments.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

20   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

Virtual Switching In Action Many companies have made headway in integrating

physical and virtual infrastructure. Here’s how.

vSphere Meets Cisco Discovery Protocol: Not every

company is ready to move to full SDN or network virtual-

ization, but there are plenty of measures to take to be sure

the virtual and physical worlds are communicating.

Cloud provider Iland, which is primarily a Cisco switch

and router shop, takes advantage of VMware’s integration

of the Cisco Discovery Protocol (CDP) Messaging System

into its VMware virtual switches.

When a network team member adds network compo-

nents, creates a VLAN on a physical switch, or works with

MAC addresses, the CDP Messaging System integration

makes these things clear, said Iland’s Giardina. “When we

bring up a VM, whether we need to make sure it follows an

IP address policy or a port security policy or a VLAN policy, (Sidebar continues on page 21)

this is all transparent to the hardware side,” he said.

Engineers trained on Cisco hardware can easily apply

what they know to the virtualization stack and they can use

this communication to apply virtual network components

and services to network segments.

“In the past, we had to deal with multiple firewalls and

multiple routers for each customer. VMware enables us to

spin up iterations of its virtual firewall called the vShield

Edge [a part of vCloud Networking and Security] and still

have transparency at the network layer to administer every-

thing. And now we don’t have to provision that extra hard-

ware,” Giardina said. This creates savings in time, CAPEX,

person hours, and training. “We can virtualize everything

and the only cost is the monthly recurring cost to run the

existing gear,” Giardina said.

Rackforce Uses Cisco Nexus 1000v: For Rackforce, a pro-

vider of data center services, Cisco’s Nexus 1000v virtual

21   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

switch met challenges to integrating the virtual edge. First,

all of Rackforce’s equipment is dual-homed, using multiple

upstream switch fabrics. Rackforce uses IBM blade centers

and Cisco UCS chassis with dual home switching, using

fabric A and fabric B. VMware did not support two fabrics

in an active-active mode when Rackforce was looking for

a vswitch solution. “The only way to do that was using the

Cisco Nexus 1000v with MAC pinning,” said Denis Skrin-

nikoff, director of network at Rackforce, a Cisco customer.

This created an active-active port channel to different

fabrics without having to rely on the LACP or VPC proto-

cols that were typically used to do multi-chassis link ag-

gregation, but that Cisco UCS and IBM blade center did not

support.

The second challenge for Rackforce was policy en-

forcement. “Using the Cisco Nexus 1000v, we identify and

observe the traffic to each VM. I can use SNMP from the

virtual switch and integrate my existing monitoring tools

to see each VM and the amount of traffic it is using, and to

look at the flows and where the traffic is going,” said Skrin-

nikoff. This enables end-to-end QoS and policy enforcement.

With the Cisco Nexus 1000v, an engineer can integrate ex-

isting provisioning engines, script the network deployments,

and have a single consistent network configuration from the

virtual to the physical, Skrinnikoff explains.

Rackforce’s existing virtual networking topology uses

Layer 2 isolation in which VLANs segment traffic in isolated,

secure environments for each tenant’s traffic. “We have

hundreds to thousands of VLANs running to each of our

cloud infrastructures. We broke it out into multiple clouds.

We are in the process of deploying a VXLAN overlay using

vCloud Director,” said Skrinnikoff. This will ease scaling for

Rackforce’s virtual network.

“VXLAN is simple to integrate, easy to implement, and

is the most widely supported by the switch vendors we

use,” said Skrinnikoff. The Cisco Nexus 1000v supports

VXLAN. n

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

(Sidebar continued from page 20)

22   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

The Big Virtual Switch integrates or communicates at the virtual edge with any physical switch from one of Big Switch’s vendor partners, allowing for policy to stretch across physical and virtual networks.

Big Switch is promoting its Big Virtual Switch as a solution that integrates the virtual edge without undoing the physical network beneath. “Some of the more siloed solutions that are focused on network vir-tualization only, rather than SDN, leave you an environment where the work of building the virtual networks can undo the network

engineering underneath,” said Dan Hersey, a network virtualization product manager at Big Switch.

Overlay strategies in which the control-ler doesn’t talk to the physical network can lead to network conflicts, along with com-plexities in debugging and troubleshooting, he said. These overlay networks require software gateways and processing serv-ers that cannot be configured without du-plicating the underlying physical network control plane configuration. This leads to increased costs and troubleshooting com-plexity, Hersey said. n

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

23   S D N   G ETS   R E A L

Ω Vendors VMware, Big Switch,Cisco, and others are workingto come up with the ‘winning’ overlay approach to creating virtual network abstractions.

The network must virtualize, and over-lay networks may be the best path available. The demand for network virtualization is prompted by the cloud provider communi-ty’s quest for a new way to manage, orches-trate and automate network management. Traditional networks just can’t keep pace with the cloud’s requirements for agility, flexibility and manageability.

In an effort to evolve, the networking in-dustry is virtualizing networks to give them properties similar to server virtualization.

Overlay Networks

Overlays May Be the Best Path Forward for Networking

BY SALLY JOHNSON

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

24   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

This network virtualization involves net-works being decoupled from hardware, with the flexibility of virtualization and quick provisioning speeds.

One way to decouple networks is to cre-ate a virtual network abstraction. Just like server virtualization provided a virtual machine abstraction from x86 hardware, networks can provide virtual network ab-stractions with the same properties and operational simplicity.

How can you create virtual network ab-stractions? This is where overlay networks come into play.

Role of Overlays in Network VirtualizationAn overlay is essentially a software con-struct that lives around the edges of a

physical network. Typically this overlay consists of virtual switches that reside on the virtualized servers connected to the edges of a data center network. The overlay network relies on a network control plane to handle virtual switching on the server hosts, much like a physical network does. Depending on the vendor, these control planes can use traditional network proto-cols, or they can rely on a software-defined networking (SDN) controller.

Network operators can decouple net-works from the physical infrastructure with overlay networks by introducing a new addressing layer.

“If you use overlays to do network vir-tualization, when a virtual machine (VM) sends a packet, this packet lives in an ad-dress space that’s totally virtual,” explained Martin Casado, Nicira co-founder and now

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

25   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

VMware’s chief architect for networking. “But the overlay adds a header to the out-side of the packet, and that’s in the physical world. So if you look at the packet on the wire, it has a virtual address space on the inside and the physical address space on the outside.”

This enables virtual networks to have dif-ferent service properties than the physical networks. “Using a very simple L3 fabric, I can build a complex L2, L3, with access control lists (ACLs), virtual network. And this, in turn, makes it possible to use sim-ple-to-manage physical hardware to reim-plement much of networking in software at the edge,” said Casado.

Overlay networks aren’t new. Wireless local area networks (LANs) have long ex-isted as overlays on campus networks. And virtual private networks (VPNs) establish

overlays on wide area networks (WANs).“The new part is bringing the overlay to

the entire network and into the data cen-ter network—at scale and without adding complexity to the overall deployment,” said Andrew Harding, senior director of product marketing at Big Switch Networks. “This delivers not only dramatic cost effec-tiveness, but also dramatic improvement in managing, deploying and maintaining a data center network.”

For overlays to be successful, engineers need to focus on the big picture. The ad-vent of tunneling protocols like VXLAN, NVGRE and STT has led many people to focus too heavily on protocols rather than architecture.

“Tunneling protocols are just mecha-nisms, but providing the overlay and the overall virtualization are the important

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

26   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

parts of the story,” according to Brad Case-more, IDC research director of Datacenter Networks. “In the long run, the industry will support whichever tunneling protocol makes the most sense—possibly even all of them. The bigger story is what overlays are capable of doing and how this supports net-work virtualization.”

A Look at the Main Overlay ApproachesVendors including VMware, Big Switch, Midokura, IBM and Cisco are all develop-ing overlay network technologies. Here’s a look at the vendors whose overlay products have been on the market longest: VMware-Nicira, Big Switch, and Cisco.

SDN vendors are offering control-ler-based network overlays, in which a

controller tells vswitches what to do via tunneling protocols. Cisco and some others are using a more old-school approach with a virtual switch—the Nexus 1000v—that operates like one of its physical switches and replaces the native virtual switches embedded in software from VMware.

“One of the most significant differences in approaches is the degree to which it’s considered a software-only solution or is a solution that involves a hardware element,” noted Casemore.

n VMware’s Nicira Network Virtual-ization Platform. Last year, VMware acquired Nicira and its Network Virtual-ization Platform (NVP) software solution, which can create an intelligent abstraction layer between virtualized hosts and an ex-isting physical network. NVP is managed by

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

27   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

a distributed controller system.“Just like VMware created virtual ma-

chines, our focus now is on creating virtual networks that are fairly complete—with L2, L3 and ACLs—and work just like physical networks, so you can have tens and thou-sands of isolated virtual networks at scale,” said Casado.

NVP reduces provisioning time, one of the most immediate problems in virtu-alized data centers. “Rather than taking seven days, it now takes 30 seconds to pro-

vision a network,” said Casado. “And we’re solving isolation issues and mo-bility issues. We’re solving immediate customer pain points, and then we’ll to-tally change the paradigm. Next up: new methods of

debugging and security. We’ll come up with new methods of operational flexibility that we can’t even imagine today. During the next three to four years, we’ll see network-ing move into areas we can’t even fathom today.”

n Big Switch’s Big Virtual Switch. Big Switch’s Big Virtual Switch is an Open-Flow-based network virtualization applica-tion that runs at the top of the company’s SDN stack where the northbound API is located.

“Our Big Network Controller, which is based on the open source Floodlight Project, is in the middle of the stack and ties together the physical and virtual net-works and makes it simple to deploy SDN. Beneath that, we interface to physical switches through OpenFlow,” said Harding.

“We’re solving immediate

customer pain points.” —Martin Casado,

chief architect for networking, VMware

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

28   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

Big Switch dynamically segments the network into tenant or user networks, through virtual network segments (VNS) that can support a spectrum of topologies and use cases within a data center—from a pure overlay, a kind of tunnel-only net-work, to a pure OpenFlow one with physi-cal switches.

“A pure overlay works in environments with a legacy physical network and Open-Flow-enabled on the virtual switches only,” said Harding. “In a pure OpenFlow en-vironment, which is likely in a new data

center deployment or a build-out for a spe-cific application, it has all the benefits of physi-cal switches—essentially hardware acceleration of the network that can work

with virtual switches. Along this virtual spectrum, we also support hybrid network virtualization, which is required to inte-grate physical firewalls and physical appli-cation delivery controllers.”

n Cisco’s Nexus 1000v. Cisco has adopted an open approach toward network virtual-ization and its cloud strategy by providing customers with a choice of hypervisor and orchestration stacks, according to Prashant Gandhi, director of Cisco’s Data Center Group.

The Nexus 1000v is a virtual switch de-signed to function much like its physi-cal switch counterparts in Cisco’s Nexus series of data center switches. Like those physical switches, the Nexus 1000v relies on traditional network protocols for its control plane. It also relies on the VXLAN

The Nexus 1000v relies on traditional network protocols

for its control plane.

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

29   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

protocol for added scalability, with the ability to build bare metal workloads and physical services through VXLAN-VLAN functionality.

Cisco’s switch has a modular architec-ture, with a Virtual Supervisor Module (VSM) controlling the behavior of multiple Virtual Ethernet Modules (VEMs). The ar-chitecture is similar to a physical modular switch. Unlike Big Switch and Nicira, Cisco recommends a hardware element for the Nexus 1000v. While the VEMs are embed-ded on individual hypervisor hosts, Cisco advocates running the VSM on the Nexus 1010 Virtual Services Appliance for scal-ability and performance.

“Our Nexus 1000v secure multi-tenant

solution supports customers using many different solutions: VMware ESX, Micro-soft HyperV, Citrix Xen, and KVM. It also integrates with many orchestration plat-forms, including open source OpenStack, CloudStack, VMware vCloud Director and Microsoft’s SVCMM platforms,” Gandhi said.

Moving forward, exactly how all of the vendors’ differentiate themselves from each other will come into clearer focus. “Not just from a subjective standpoint, but also qualitatively in terms of what they’re offering, how they’re offering it, and how they’re positioning it. Many of the vendor strategies are in flux right now,” Casemore said. n

EDITOR’S DESKHYBRID CLOUD NETWORKING

FALLS SHORT, BUT NOT FOR LONGINTEGRATING PHYSICAL

AND VIRTUAL NETWORKSOVERLAYS MAY BE THE BEST PATH

FORWARD FOR NETWORKING

30   N E T W O R K E V O L U T I O N, A P R I L 2 0 1 3

RIVKA GEWIRTZ LITTLE is the executive edi-tor for TechTarget’s Networking Media.

SHAMUS MCGILLICUDDY is the director of news and features for TechTarget Network-ing Media.

DAVID GEER writes about security and enterprise technology for international trade and business publications.

SALLY JOHNSON is the feature writer for TechTarget Networking Media.

ABOUT THE AUTHORS

Network Evolution  is a SearchNetworking.com e-publication.

Kate Gerwig, Editorial Director

Kara Gattine, Senior Managing Editor

Rivka Gewirtz Little, Executive Editor

Shamus McGillicuddy, News Director

Sally Johnson, Feature Writer

Rachel Shuster, Associate Managing Editor

Linda Koury, Director of Online Design

Neva Maniscalco, Graphic Designer

Doug Olender, Vice President/Group Publisher dolender@techtarget.com

TechTarget, 275 Grove Street, Newton, MA 02466

© 2013 TechTarget Inc. No part of this publication may be transmitted or repro-duced in any form or by any means without written permission from the pub-lisher. TechTarget reprints are available through The YGS Group.

About TechTarget: TechTarget publishes media for information technology pro-fessionals. More than 100 focused websites enable quick access to a deep store of news, advice and analysis about the technologies, products and processes crucial to your job. Our live and virtual events give you direct access to independent ex-pert commentary and advice. At IT Knowledge Exchange, our social community, you can get advice and share solutions with peers and experts.

@WEBSITE

Visit us E-MAIL

Contact usTWITTER Follow us