Datacenter Design IV ( VPC , MEC, Fabric Extenders )

What is a vPC (virtual Port Channel)

  • Nexus series Network Virtualisation Technology.
  • “Lightweight” VSS – Combine ports, not switches.
  • Links on different switches to appear as the same device.
  • Downstream device can be anything supoprting 802.3ad (LACP).
  • Commonly called Multi Chassis Etherchannel ( MEC ).

(more…)

IS-IS Design Principles

IS-IS History

https://en.wikipedia.org/wiki/IS-IS
https://en.wikipedia.org/wiki/OSI_protocols
https://en.wikipedia.org/wiki/Type-length-value

  • Created for the OSI Protocol Suite
  • Integrated IS-IS: the mutation.
  • IS-IS dictionary:
    • IS = Intermediate System  (Routers)
    • ES = End System
    • TLV = Type Length Value
    • NSAP = Network Service Access Point
      • (OSI protocols equivilent of the TCP/IP’s IP Address)
  • IS-IS features:
    • Link State Routing Protocol  (Same as OSPF)
    • NSAP address assigned per router
    • Dijkstra SPF powered (Same as OSPF)
      • PRC efficient
    • Hellos Establisch neighbors at Layer 2 ( source MAC, Multicast Mac )
    • Two routing levels ( Level 1 and Level 2 )
    • Area Based Design ( Routers know their area )
    • default link cost = 10

IS-IS High level Design

  • Two routing databases
    • Level1 and Level2
      • Level 1 routers find closest Level2 Exit.
    • Area defined by
    • 49.0001  ( Area 1 )
      • 49 private adressing , 0001 is area 1
  • Three router types

IS-IS Neighbors and Area Design

(more…)

Network Management (Tools, Netflow, NBAR, IP SLA)

Monitoring and Managing

  • Know your network is doing well.
  • Understand the trends in your network performance.
  • Identify your bottlenecks and propose solutions.
  • Proact – Don’t react.

Phases of optimizations and the tools

  1. Create a baseline – Netflow, NBAR, IP SLA
  2. Optimize Network – QoS, AutoQoS VoIP, AutoQoS Enterprise
  3. Measure / Adjust – Netflow, NBAR, IP SLA, Syslog
  4. Deploy Apps – Netflow, NBAR

(more…)

Wireless Design Principles

 

 

 

  • Wireless Signal Mesured in dBm ( Power referenced against one Milliwatt )
  • Range is roughly -30dBm to -90dBm
    • -30dBm = Max Achievable ( not desired ).
    • -67dBm = Mininum for real-time Apps.
    • -80dBm = Minimum for communication.
  • Noise is always a challenge
  • Signal to Noise Ratio ( SNR ) = ( SignalNoise ) = Value
    • Mininum SNR of 25 is needed for real-time apps.

(more…)

Multicast and Multicast Routing

Unicast vs Multicast

  • Routed via PIM ( Protocol Independent Multicast ).
  • Always UDP-Based ( Video, Audiostreams, some kinds of data ).
  • Typical network challenges ( QoS, Security, Bandwidth consumption).
  • Began as a ‘speciality’ technology, becoming heavily adopted in modern times.

Multicast Addresses

  • Multicast group members receive all data center to a group.
  • Multicast IPv4 Range: [ 224.0.0.0  239.255.255.255 ]
    • Filtering tip:
      • Last 23 bits of IP mapped to MAC
        • Can lead to overlapping addresses

(more…)

VPN Design

Remote Access VPN design

  • For a VPN you need a termination device (vpn concentrator / Firewall), a client and the connecting technology for tunneling.
  • Cisco Easy VPN.
  • Client options
    • IPSEC VPN client
    • SSLVPN Clientless Access
    • SSLVPN Thin client
    • SSLVPN Thick client

Placement of the VPN Termination Device:

(more…)

E-Commerce Implementation

Core layer

  • Cisco 6509.
  • Static routing used to ISP ( or basic BGP ).
  • FWSM or ACE module used as initial filter.
  • Static route down to VIP of aggregation layer FHRP.

Aggregation Layer

  • Cisco 6506 ( MSFC ).
  • Traffic received from core routed to CSM
  • CSM load balances to VLANs at the access layer
  • Simple Design allows inter-vlan routering ( web, app, db )
    • Inter-vlan routing without a FWSM can lead to access from the VLANs.

Access Layer

  • Cisco 6509
  • Servers typically devided into web, app, and database VLANS.
  • Server gateways set to CSM, FWSM, or VIP of the FHRP on L3.
  • Firewall restrictions between layers common.

E-Commerce

A design that must stay up

  • Public face of an organization
  • The place where downtime is incredibily harmful
  • The place where budgets are approved\

Ultra Redundant, Ultra secure Firewall Design

  • Only Method through layers is via servers
  • Option of using different firewall vendors at different layers
  • Supports virtual firewall using FWSM (Firewall Services Module) or ACE (Application controle engine) module

(more…)

IPv6 Review

  • Unicast:  One-to-one.
  • Multicast: One-to-many.
  • Anycast: One-to-closest.

 

  • Link-local scope address:  layer2 domain
  • Unique / Site-local scope address: Organization
  • Global scope address: Internet

(more…)