V4ACICisco_Cloud_ACI_TDM_Deck

TechnicalMarketingEngineeringINSBU,TechnicalDecisionMakerslides,CiscoCloudACI,cpaggenv1.03Jan122019,CiscoApplicationCentricInfrastructure,RemoteLeaf/VirtualPoD,APIC/Multi-Site,Multi-CloudExtensions,ACIAnywhere,RemoteLocation,PublicCloud,OnPremise,CiscoACIAnywhereAnyWorkload,AnyLocation,AnyCloud,ACIAnywhereExtendtheSimplicityMultiplelocationsmanagedfromasinglepoint,ACIMulti-POD,ACIRemote-Leaf,ACIMulti-Site,CloudACI,VirtualACI,ACI2.0,ACI3.0,ACI3.1,ACI4.0,H1CY19,#1SDNsolutionontheplanet!,Multi-SiteOrchestratorArchitectureandcapabilitiesrecap,BuildandextendpolicyacrossACIsites,DataCenterInterconnect(DCI)madesimple,ACIMulti-SiteSeamlessextensionofnetworkandsecuritypoliciesacrossregions,7,ACIMulti-SiteOverview,SeparateACIFabricswithindependentAPICclustersACIMulti-Sitepushescross-fabricconfigurationtomultipleAPICclustersprovidingscopingofallconfigurationchanges,MP-BGPEVPNcontrolplanebetweensitesDataPlaneVXLANencapsulationacrosssitesEnd-to-endpolicydefinitionandenforcement,MP-BGP-EVPN,AvailabilityZoneA,AvailabilityZoneB,IPNetwork,RESTAPI,GUI,RegionC,ACI3.0Release,VXLAN,8,IPNetwork,VTEPIP,VNID,TenantPacket,MP-BGP-EVPN,NoMulticastRequirementinBackbone,Head-EndReplication(HER)foranyLayer2BUMtraffic),Class-ID,NetworkinformationcarriedacrossFabrics(AvailabilityZones),IdentityinformationcarriedacrossFabrics(AvailabilityZones),ACIMulti-SiteNetworkandIdentityExtendedbetweenFabrics,9,SitetoSiteVTEPtraffic(VTEPs,VNIDandClass-IDaremappedonspine),LeaftoLeafVTEP,Class-IDislocaltotheFabric,LeaftoLeafVTEP,Class-IDislocaltotheFabric,MaintainseparatenamespaceswithIDtranslationperformedonthespinenodesRequiresspecificHWonthespinetosupportforthisfunctionality,ACIMulti-SiteNamespaceNormalization,Site1,MP-BGP-EVPN,Siten,TranslationofSourceVTEPaddress,IPNetwork,TranslationofClass-ID,VNID(scopingofnamespaces),10,SupportallACIleafswitches(1stGeneration,-EXand-FX)Butonly-EXorFXspinenodes(ornewer)forCiscoCloudACIinterconnect!1stgenerationspines(including9336PQ)arenotsupportedCanstillleveragethoseforintra-siteleaftoleafcommunication,1stGen,IPNetwork,-EX,-EX,CanhaveonlyasubsetofspinesconnectingtotheIPnetwork,1stGen,ACIMulti-SiteHardwareRequirements,11,EP2,EP1,ACIMulti-SiteTheEasiestDCISolutionintheIndustry!,=VXLANEncap/Decap,Site2,S1,S2,S3,S4,S5,S6,S7,S8,Communicationbetweenendpointsinseparatesites(Layer2and/orLayer3)isenabledsimplybycreatingandpushingacontractbetweentheendpointsEPGs,IP,DP-ETEPA,DP-ETEPB,Site1,Defineandpushinter-sitepolicy,12,IPNetwork,VTEPIP,MACSEC,TenantPacket,VTEPInformationClearText,MP-BGP-EVPN,VXLAN,EncryptedFabrictoFabricTrafficGCM-AES-128(32-bitPN),GCM-AES-256(32-bitPN),GCM-AES-128-XPN(64-bitPN),GCM-AES-256-XPN(64-bitPN),ACIMulti-SiteCloudSecEncryptionforVXLANTraffic,13,ACIMulti-SiteNetworkingOptionsPerBridgeDomainBehavior,Multi-SiteOrchestratorWhatsnew?,ChallengesinbuildingaMultiCloudenvironment,Maintainconsistentpolicy,securityandanalyticsforworkloadsdeployedacrosson-premandcloudlocations.,Buildinganautomatedandsecureinterconnectbetweenon-premandclouddatacenterswitheaseofprovisioningandmonitoringatscale.,Requiresasinglepaneofglasstomanagepoliciesacrosson-premandcloudlocations.,IPNetwork,On-PremiseDC,PublicCloud,Monitoringprovidesabroaderstrokethansecuritygroups.SortofaVLANACL(VACL)thoughthereisnoLayer2inVPCsNetworkACLsareorderedandhavepermitanddenyactions,withanimplicitdenyanyNetworkACLs,unlikesecuritygroups,arestateless.NetworkACLsworkonlyonCIDRrangesandcantreferenceotherobjectssuchasinstancesDefaultnetworkACLallowsallpackets.Usecase:blockSSHforanentiresubnetaddadenyentryforTCP22inthesubnetsnetworkACL.Otherwise,youneedtoblockSSHoneachinstancessecuritygroup.,VPC:instanceinterfaces(ENI),Elasticnetworkinterface(ENI):likeaNIC.YoucanapplymultipleENIstoaninstance,andmovetheENItoanotherinstanceinthesamesubnet.Multipleaddresses(elasticornot)canbeappliedtoanENI.AnENIhasadynamicallyassignedprivateaddressintheassignedsubnet,andcanoptionallyhaveadynamicallyassignedpublicIPaddressaswell.,VPC:instancesIPaddressing,PublicIPaddress:reachablefromtheInternet.TwotypesofpublicIPaddressesinaVPC:dynamicallyassignedaddressesandElasticIPaddresses.Bydefault,instancesconnectedtotheInternetreceiveadynamicallyassignedpublicaddress.Whentheinstanceisterminated,theaddressisreleased.Ifyourequirethataddresstobepersistent,youneedanElasticIPaddress.Thepublicaddresswillnotchangewhiletheinstanceisoperating.ElasticIPaddress(EIP):staticpublicIPaddressthatisappliedtoanENI,andcanbeassociatedtoanotherinstanceafteraninstanceisterminated.ThismakesiteasierforthingslikeACLrules,DNSentries,andwhitelistinginothersystems.Everypublicaddresshasaprivateaddressassociatedwithit.ThisprivateaddressisstaticunlesstheElasticIPaddressismovedtoanothersubnet.RememberthatsubnetsarelocaltoasingleAvailabilityZone,VPC:externalconnectivity,Internetgateway:similartoanECMProutetoasetofAWSInternetrouters.AsingleInternetgatewayisconsideredhighlyavailablewithinaregion.NATgateway:ANATgatewayactslikeanECMProutetoasetofAWSNATdevices.DoesNATandPATformultiplehostsinaVPCtoasinglepublicElasticIPaddress.YoucanpointadefaultroutetoaNATgatewayattachedtoyourVPC.NATGWsoperateinasingleAvailabilityZone(differsfromInternetGWsandvirtualprivateGWsthatarehighlyavailableacrossaregion)Virtualprivategateway(VGW):likeanECMProutetoasetofAWSWANrouters.Terminatestwoservices:VPNandAWSDirectConnect.VGWterminatesVPNtunnelsandcanpropagateBGProutesintoselectedroutingtables.DirectConnectcircuitswillbepointedtowardthevirtualprivategatewayforconnectivityintotheVPC.VGWishighlyavailablewithoutadditionalconfiguration.,VPC:externalconnectivitycontinued,AVGWdoesnotcreateaback-to-backVPNwithanotherVGW,sincebothonlyrespondtoVPNconnections.RoutingworksthroughBorderGatewayProtocol(BGP)orstaticrouting,withamaximumof100additionalroutes.Customergateway(CGW):Acustomergatewayistheon-premisesfirewall,router,orotherdevicethatterminatestheVPNconfiguration.,VPCroutingandswitchingconcepts,Alltrafficisunicast.ThereisnoARPinsideAWS.TheVPCknowswhereallIPaddressesare,andproxiesARPresponsesforallARPrequestslocallyatthehypervisor.AllsubnetsinaVPChavedirectaccesstooneanother,unlesstheyarefilteredinthehostorinsecuritygroupsornetworkACLs.VPCsandVPCpeeringarelocaltoasingleregion.TrafficbetweenregionscanconnectusingtheInternet,VPNs,orDirectConnect.Alltrafficbetweentwopoints(instances,virtualgateways,Internetgateways,orNATgateways)inthesameVPCisforwardeddirectly.Configuringadifferentdefaultgateway,suchascreatingafirewalltobethedefaultgatewaybetweensubnets,willnotchangethisbehavior.TheVPCCIDRrangeisautomaticallyaddedasalocalroute(uptoa/16netmask),anditcantbeoverriddenwithamorespecificroute.Ifaninstancewillbeactingasaproxy,router,firewall,orotherwisesendingorreceivingpacketswithadifferentIPaddressthantheassignedENIIPaddress,source/destinationcheckingmustbedisabled.Formoreinformation,seetheAmazonVPCdocumentation.,VPCpeering:notransitiverouting,IfyoupeermultipleVPCsinahub-and-spokedesign,spokescanttransitthroughthehubtoreacheachother.IfapacketissourcedfromoutsideaVPC,itmustbeterminatedonanIPaddressintheVPCThisrulecomesintoplaywhenyoutalkaboutInternetgateways,virtualprivategateways,DirectConnect,orVPCendpoints.AnotherexampleofthislimitationisthattrafficsourcedfromavirtualprivategatewaycantdirectlyreachanInternetgateway.,VPCpeeringsolution:transitVPC,Typicaldesign:deployaCSR1KVperAZinsideadedicatedtransitVPC.SpokeVPCsareconnectedtothetransitVPCthroughdynamicallyroutedVPNconnectionsbetweentheirvirtualprivategateways(VGWs)andtheCSRinstances.ThisdesignusesVPNconnectionstoenableroutingbetweenanyconnectednetwork,includingexternalnetworksorspokeVPCsinotherAWSRegions.VPNconnectionsalsoallowspokeVPCresourcestoleverageVGWcapabilitiesforroutingandfailoverinordertomaintainhighlyavailablenetworkconnectionstothetransitVPCinstances.RemotenetworksalsoconnecttothetransitVPCusingredundant,dynamicallyroutedVPNconnectionsbetweentheircustomergatewaysandtheCSRinstances.CommunicationwiththeCSRs(includingVPNconnectionsbetweenon-premandthetransitVPC)usesthetransitVPCInternetgatewayandtheinstancesElasticIPaddresses.,AWSTransitGateway(newfeatureQ4CY18),Note:AtFCS,CiscoCloudACIdoesnotsupportAWSTGWthisisplannedforafuturerelease.,AWSDirectConnect(DX),DX:physicalconnectionintoAWSnetworkDXlocationsarepublicDCsthathaveAWSoperatedprivatebackboneconnectivitytoAWSregionsYouconnectintoDXrouters(1G/10G)toextendyournetworkintoAWSDXallowsforprivatecommunicationoveradedicatedlineThevirtualinterfaceislikeasubinterfaceonarouterinaVRF,witharouteintheVRFtowardaspecificlocation.ThislocationcouldbeasingleVPC,orthecollectionofpublicAWSservicessuchasAmazonS3,AmazonDynamoDB,andmore.Virtualinterfacescanbeprivateorpublic.AsingleDXconnectioncancontainmanyvirtualinterfaces,eachwiththeirownVLAN,whichonlyhaslocalsignificancebecauseallconnectivityisrouted.YoucanrunIPSecoranyothertunnelingprotocoloverDX.,VPC:puttingitalltogether,ThisdiagramshouldnowmakesensetoyouItshowsasingleinstancewithtwoENIsOneENI(eth1)connectstothecorporatenetworkwiththeotherENI(eth0)connectstotheinternetPayattentiontotheroleoftheIGW,VGWandCGWaswellastheroutetablesandsecuritygroupsTheseconceptsareessentialtounderstandingAWSnetworking,CiscoCloudACIOverallarchitecture,AWSRegion,On-Premise,PublicCloud,SiteA,SiteB,Multi-Site,Golf,AWSDirectConnectRouter,CSR1000V,DXLocation,Colocation,CustomerRouter,AWSVGW,CustomerPremiseRouter(CPE),InfraVPC,AWSDirectConnectRouter,Logicalhigh-levelarchitectureWithorWithoutVPNandDirectConnect,IPN,IPN,Zoominginonthelogicalarchitecture,CiscoCloudACIcAPIC,IntroducingCloudAPIC(cAPIC),cAPIC,VirtualFormFactorofAPIC,TranslatesACIPolicytoCloudNativePolicyConstructs,AutomatesthedeploymentandconfigurationofInfrastructurecomponentsintheCloud,NorthBoundRestInterfacetoconfigureclouddeployments,SimilarlookandfeelasAPIC,cAPICclustercanmanageoneormoreregions,cAPIC:whyandwhat?,cAPICallowsMSOtoremaincloud-agnosticPublishedasanAMIimageinsideAWSItactsasacloud-nativetranslatorforMSOwhichconsiderseachcAPICasauniquesitecAPICisdeployedinafullyautomatedmannerthroughtheuseofAWSCloudFormationanAWS-providedserviceorchestratorcAPICdeploystherequiredVPCsandcloud-basedCSR1000VroutersautomaticallyGreatlysimplifiesVPCtransitscenarioAttheendoftheautomatedrollout,youobtaintheElasticIPassignedtocAPICYoucanusethatIPtologontocAPICandperforminitialconfigurationsteps,CiscoCloudACIRolesofMSO&CloudAPIC,cAPIC:directlymanagingcloudassets,CSR-1000V,AWSInternetGateway(IGW),CloudAPIC,On-Premise,Multi-SiteOrchestrator(MSO),InfraVPC,UserVPC,AWSInstances,PublicCloud,Region2,UserVPC,InfraVPC,AWSInstances,SingleorgroupofmultipleregionsinAWSrepresentsanACIsite,EachRegioninAWSissimilartoACIPODinthecloud,OnecAPICsisspunupintheinfraVPCateachSite.,ACIExtensiontoAWSArchitecture,SiteA,On-Premise,Multi-SiteOrchestrator(MSO),PublicCloud,SiteB,InfraVPC,UserVPC-2,AZ-1,AZ-2,VGW,UserVPC-1,CSR,IPSec/GRETunnel,AWSconfigservices,IPSecTunnel,Region1,CSR-1000V,AWSInternetGateway(IGW),CloudAPIC,CSR,CSR,AWSVirtualPrivateGateway(VGW),UserDeploysanewinstanceinAWSAWSconfigservicesnotifiestheeventtocAPICcAPIClearnstheendpointandregistersitBasedonthepolicies(EPGsandContracts),securitygroup(SG)isattachedtotheinstance,EndPointLearningonAWS,SiteA,VGW,On-Premise,Multi-SiteOrchestrator(MSO),PublicCloud,SiteB,InfraVPC,AZ-1,AZ-2,Region1,CSR,CSR,SiteA,AlltrafficbetweeninstanceswithinthesameVPCcandirectlycommunicatetoeachotherbasedontherespectivesecuritygrouppoliciesprogrammedbycAPIC,UserVPC-2,VGW,UserVPC-1,CSR,IPSec/GRETunnel,IPSecTunnel,EPG-1,EPG-3,EPG-2,EPG-1,SG-1,SG-1,SG-3,SG-2,Instance01,Instance02,Instance03,Instance04,InstancesintwodifferentVPCscommunicatingtoeachothertrafficexitstheVPCeitherviaCSRorVGWoftheuserVPCandreachCSRininfraVPC.OncethetrafficreachestheCSRininfraVPC,packetsareroutedtothedestinationbasedontheconfiguredpolicies,CSR-1000V,AWSInternetGateway(IGW),CloudAPIC,AWSVirtualPrivateGateway(VGW),Instanceswithin&acrossVPC,On-Premise,Multi-SiteOrchestrator(MSO),PublicCloud,SiteB,InfraVPC,AZ-1,AZ-2,Region1,CSR,CSR,FortrafficfrominstancesinaVPCtoon-premises,trafficreachesCSRinInfraVPCandovertheVXLANtunneltotheACISpineson-premisesSpineforwardsthetraffictothecorrespondingleafonwhichtheEPislocated,UserVPC-2,VGW,UserVPC-1,CSR,IPSec/GRETunnel,IPSecTunnel,EPG-1,EPG-3,EPG-2,EPG-1,SG-1,SG-1,SG-3,SG-2,Instance01,Instance02,Instance03,Instance04,BGPEVPNControlPlane,VXLANTUNNEL(DATAPLANE),CSR-1000V,AWSInternetGateway(IGW),CloudAPIC,AWSVirtualPrivateGateway(VGW),InstancesinaVPCandon-premises,MappingbetweenACIandAWSconstructs,Reference,CiscoCloudACIFCSScaleConsiderations(subjecttomodifications),CiscoCloudACI4.1ReleaseScaleNumbers(checkreleasenotesatFCS),CiscoCloudACIAnnexA:deploymentsteps,Inthissection,weproceedthroughthefollowingstepsLogintothecAPICandgoovertheFirstTimeSetupWizardConfiguretheAWSRegionstobemanagedbycAPICConfigureinter-siteconnectivitydetailstoconnecttoon-premProvidetheAWSAccountdetailstobeusedfortheinfraVPCVerifythecreationofinfraVPC&CSRinAWSVerifytheIPSectunnelbetweenon-premCSRandAWSCSR,Steps,OncecAPICisdeployed,logintocAPICUI,CloudAPICdeploymentSequence,WelcomewizardguidesusersthroughtheFirstTimeSetup,selectingtheRegionstobemanagedinAWScAPIChandlestheinfraVPCcreation,CloudAPICdeploymentSequence,SelecttheAWSregion(s)tobemanagedbycAPIC,CloudAPICdeploymentSequence,OneormoreregionscanbeselectedfromcAPIC,CloudAPICdeploymentSequence,CloudAPICdeploymentSequence,Inter-SiteConnectivitydetermineswhethertheregionneedstoconnecttoothersitessuchason-premInfraVPCsaredeployedonallsitesselectedforInter-Siteconnectivity,Inter-RegionConnectivitydeterminesifthisregionneedstoconnecttootherAWSRegions,Selecttheregionstobemanaged,regionstobeusedforinter-siteandinter-regionconnectivity,CloudAPICdeploymentSequence,LogintothecAPICandgoovertheFirsttimeSetupWizardConfiguretheAWSRegionstobemanagedbycAPICConfiguretheinter-siteconnectivitydetailstoconnecttoon-premProvideAWSAccountdetailstobeusedforinfraVPCVerifytheCreationofinfraVPC&CSRinAWSVerifytheIPSectunnelbetweenon-premCSRandAWSCSR,Steps,ProvidetheunderlayOSPFareaID.,CloudAPICdeploymentSequence,ConfigurethepeerIPAddressforIPSecTunnelfromCSRininfraVPCtoon-premCSR,CloudAPICdeploymentSequence,ConfiguretheSubnetTEPpool(CloudTEP)tobeusedinAWSThisTEPpoolisusedforallcloudtunnelendpointIPaddressesThishastobenon-overlappingwithotherIPranges,CloudAPICdeploymentSequence,CloudAPICdeploymentSequence,CloudAPICdeploymentSequence,ClickSaveandcontinuetofinishtheregionmanagementconfiguration,CloudAPICdeploymentSequence,LogintothecAPICandgoovertheFirsttimeSetupWizardConfiguretheAWSRegionstobemanagedbycAPICConfigureinter-siteconnectivitydetailstoconnecttoon-premProvidetheAWSAccountdetailstobeusedforinfraVPCVerifythecreationofinfraVPC&CSRinAWSVerifytheIPSectunnelbetweenon-premCSRandAWSCSR,Steps,ClickonInfraTenanttoconfiguretheAWSAccountdetailsforthistenant,CloudAPICdeploymentSequence,ClicktheEditsymbolatthetoptoprovidetheAWSaccesskeyandsecretIDdetails,CloudAPICdeploymentSequence,ProvidetheAWSaccesskeyandsecretIDdetails,CloudAPICdeploymentSequence,TenantInfraisconfiguredwiththerequiredparameters,CloudAPICdeploymentSequence,LogintothecAPICandgoovertheFirsttimeSetupWizardConfiguretheAWSRegionstobemanagedbycAPICConfigureinter-siteconnectivitydetailstoconnecttoOn-premProvidetheAWSAccountdetailstobeusedforinfraVPCVerifythecreationofInfraVPC&CSRinAWSVerifytheIPSectunnelbetweenon-premCSRandAWSCSR,Steps,InfraVPCiscreatedinAWSbycAPIC,CloudAPICdeploymentSequence,c,TwoCSRswerecreatedininfraVPC,CloudAPICdeploymentSequence,CSRsinInfraVPCareupandrunning.,CloudAPICdeploymentSequence,LogintothecAPICandgoovertheFirsttimeSetupWizardConfiguretheAWSRegionstobemanagedbycAPICConfigureinter-siteconnectivitydetailstoconnecttoon-premProvidetheAWSAccountdetailstobeusedforInfraVPCVerifythecreationofInfraVPC&CSRinAWSVerifytheIPSectunnelbetweenon-premCSRtoAWSCSR,Steps,ConfigurethefollowingdetailsontheIPSecterminatoron-premTunnelinterfaceIPinthesamesubnetasCSRonAWStunnelinterfaceTunneldestinationIPasCSRonAWS3rdInterfacePublicIPAddressISAKMPmatchrulestomatchtheIPaddressKeyringtomatchthekeyringonCSRonAWSThegoalistoautomatethesestepsatFCS(scriptprobably,thenMSOinalaterphaseconsultthereleasenotesandroadmap!),CloudAPICdeploymentSequence,CloudAPICdeploymentSequence,IPSecTunnelisupbetweenCSRon-premandCSRinAWS.,LogintothecAPICandgoovertheFirsttimeSetupWizardConfiguretheAWSRegionstobemanagedbycAPICConfigureinter-siteconnectivitydetailstoconnecttoon-premProvidetheAWSAccountdetailstobeusedforInfraVPCVerifythecreationofInfraVPC&CSRinAWSVerifytheIPSectunnelbetweenon-premCSRandAWSCSR,Steps,ThiscompletesthedeploymentandconfigurationofcAPICandtheInfraVPCcreationandconfiguration.Next:proceedtocreationofTenantsfromtheMSOUI,CloudAPICdeploymentSequence,Multi-SiteConfiguration,AddSitestoMSOConfigureInfrastructureforbothon-premandcloudsitesCreateaTenantCreateaSchemaCreateaApplicationProfileCreateaVRF,BD,EPG,ContractsandfiltersAddSitestotheSchemaConfigureSitelocalpropertiesfortheSchemaDeploytheSchematoSitesandVerify,Multi-SiteConfigurationSteps,DeploytheMSOVMLogintotheUIClickonSitesAddSites,Multi-SiteConfiguration,ProvideanamefortheSiteProvidetheURLofcAPICProvidetheusernameandpasswordofcAPICProvideaSite-IDClickSave,Multi-SiteConfigurationAddingcAPIC,Multi-SiteConfigurationAddingon-premfabric,ProvideaNamefortheSiteProvideURLoftheon-premAPICProvidetheusernameandpasswordofthecAPICProvideaSite-IDClickSave,BothsiteareaddedtoMSOMSOautomaticallydetectsifitisaregularAPICorcAPICandadjustthedisplaysaccordingly,Multi-SiteConfiguration,AddSitestoMSOConfigureInfrastructureforboththesitesCreateaTenantCreateaSchemaCreateaApplicationProfileCreateaVRF,BD,EPG,ContractsandfiltersAddSitestotheSchemaConfigureSitelocalpropertiesfortheSchemaDeploytheSchematoSitesVerifytheSchemaispushedtoMSO,Multi-SiteConfigurationSteps,Next,select“ConfigureInfra”tostartinfraconfigurationforon-premandcloudsites,Multi-SiteConfiguration-ConfigureInfra,ConfiguretheFabricconnectivityinfraparamete