2. 2
Agenda
Networking Overview
External Network
Network Pools
Organization Networks
vApp Networks
Example Use Cases
Q & A
3. 3
Networking Overview
Layers of Networking
• External
• Network Pools
• Organization
• vApp
Managed at two layers: Consumers & Providers
An External Network is an network that is outside of VMware
vCloud Director.
• This is set up by the Provider
An Organization Network is contained within an organization.
• This is also set up by the Provider
vApp Network is a contained within a vApp.
• This is set up by Consumers Note: Both organization networks and vApp networks are entirely
within VMware vCloud Director-managed infrastructure..
4. 4
External Network: Overview
a.k.a ‘Provided Network’
• Network that is external to VMware vCloud Director
• Created in vSphere/vCenter environment and consumed by VMware vCloud
Director to provide external connectivity to Organizations
• Mapped to a portgroup at the VMware vSphere layer
• vSS or vDS
• The portgroup is attached to VMware vCloud Director as an “External Network”
Use cases
• Internet access
• Provider supplied network endpoints
• IP based storage
• Backup servers
• Backhauled networking to a customer datacenter
• VPN access to a private cloud
• MPLS termination
Set up by Provider
5. 5
External Networks: In vSphere
• VMware vCloud Director does NOT create portgroups when you create an External
Network
• The VI Admin must create the portgroups first, before a VMware vCloud Director
Provider Admin can map External Networks to them.
• It is recommended that you define these port groups on a dedicated “Provider” vDS vs.
creating them on a vSS on each ESX host in your cluster. (Can use Cisco Nexus 1000V)
• Below is an example of VLAN isolated External Networks:
6. 6
External Networks: In VMware vCloud Director
• In VMware vCloud Director, create an External Network and attach it to one of the
portgroups
• Note if done using the VIM SDK you should create an ephemeral port group; otherwise,
you get static portgroups when created with the vCenter UI
7. 7
Network Pools: Overview
A set of pre-configured network resources that can be used for
Organization and vApp Networks
• Use to facilitate VM to VM communication
Three Types of Network Pools in VMware vCloud Director
• Portgroup-backed
• Reference pre-created portgroups
• These have to be created in vSphere manually or through orchestration
• Do not have to be VLAN isolated (but should for L2 isolation)
• Attach a collection of them to VMware vCloud Director
• VLAN-backed
• Exactly like portgroup-backed…but VMware vCloud Director will automatically
create the portgroups as needed, and use a range of VLANs to isolate them.
• vCloud Network Isolation-backed (vCD-NI)
• VMware proprietary network isolation technology
8. 8
Network Pools: Portgroup-backed
Requires
• Preconfigured portgroups at the vSphere layer
• Assign meaningful names so its obvious what is being mapped
• If using vSS portgroups, they must exist on all ESX/ESXi hosts in the cluster
How it works
• The system administrator manually creates the portgroups.
• When creating the network pool, you are given a list of unused portgroups that
exist in the cluster.
Advantages
• Works with all types of vSwitches.
Disadvantages
• Requires manual work or orchestration to create all of the portgroups
• Portgroups needs to be keep in sync on a vSS
• To ensure isolation portgroups rely on VLANs for L2 isolation
9. 9
Network Pools: VLAN-backed
Requires
• A vDS that’s connected to all ESX/ESXi hosts in your cluster
• A range of unused VLANs
How it works
• vCD admin creates the network pool and chooses an “Organization” vDS to
attach it to, then provides a range of valid VLANs, for example, 10 – 15.
• When an isolated network is needed, vCD will automatically create a portgroup
on the vDS and assign it one of the unused VLAN numbers.
• Many isolated portgroups can coexist on the same vDS because they are
isolated by the VLAN tag
Advantages
• Isolated networks
• Best network performance.
Disadvantages
• Requires VLANs to exist in the physical network hardware (physical switches)
• VLANs are limited and may not be available at all
• Not compatible with Cisco Nexus 1000V
• Use portgroup-backed network pool of portgroups that happen to have VLAN tags
10. 10
Network Pools: VLAN-backed in VMware vCloud Director
VLAN-backed:
• define the VLAN range for the pool and select the vDS to provision the portgoups on
11. 11
Network Pools: VLAN-backed in vSphere
VLAN-backed Example:
• The VLAN-backed network pool was defined to use the range 10-15
• The External Org Network was called Emca External.
• An ephemeral port group was created for you with a vShield edge, vse-1821527865.
• Editing properties shows the switch is named with V10 matching the consumed VLAN
and the name is dvs.VC1098296841DVS1CM1-V10-Emca External
12. 12
Network Pools: vCloud Network Isolation
VMware proprietary network isolation technology
• vCD-NI “networks” span hosts and are represented as portgroups on a vDS.
• Setup:
• Designate a “Transport Network” – an actual layer 2 segment to carry the
packets for vCD-NI networks
• Decide how many networks you want in the pool
• Individual vCD-NI Networks are isolated from each other and the Transport
Network via MAC-in-MAC encapsulation
• Works with vmkernel functionality in ESX/ESXi 4.0U2 or 4.1 and above
• (vCD Beta required Service VM on older ESX/ESXi hosts)
• Technical details:
• Implemented with MAC-in-MAC encapsulation
• Can cause frame fragmentation with default MTU
• Requires a small increase in MTU to 1524 or higher
In Lab Manager, this was
called “Cross-Host Fencing”
13. 13
Network Pools: vCloud Network Isolation-backed
Requires
• A vDS that’s connected to all ESX/ESXi hosts in your cluster.
How it works:
• vCD creates an overlay “transport” network for each isolated network to carry
encapsulated traffic
• Each overlay network is assigned a Network ID number.
• Encapsulation contains source and destination MAC addresses of ESX/ESXi
hosts where VM endpoints reside as well as the Network ID
• ESX/ESXi host strips the vCD-NI packet to expose the VM source and
destination MAC addressed packet that is delivered to the destination VM
Advantages:
• Does not require VLANs (can optionally set a VLAN ID for the transport
network; leaving blank defaults to 0)
• More secure than VLAN-backed
Disadvantages:
• Small performance overhead due to encapsulation (dvFilter).
• Added MAC header require an increase in MTU same as in MPLS networks
• vCD-NI is for layer 2 adjacency and not for routed networks
• vCD-NI is only for VMs and cannot be accessed by physical hosts
14. 14
Network Pools: vCloud Network Isolation in vSphere
vCD-NI-backed Example:
• A vCD-NI-Backed Pool where transport VLAN is 99 was created.
• The VI portgroup does not reflect isolation, just the transport VLAN used for the vCD-NI
• The name of the portgroup gives you a hint that it’s isolated. It contains, in this instance,
with “V99-F1” meaning it’s using VLAN 99 and isolation network ID 1.
15. 15
Organization Networks: Overview
Contained within an organization
Allows vApps within the organization to communicate with each
other or to outside the organization
Can be connected to External Networks as:
• Public (External Org Direct)
• Bridged connection to an External Network
• Others outside the organization can see
• Private Routed (External Org NAT-Routed)
• Connected to an External Network through a vShield Edge
• Can be configured for NAT & Firewall
…or left unconnected to external
• Private Internal (Internal Org)
• No External connectivity
Backed By Network Pools
Set up by Provider
16. 16
Organization Networks: In VMware vCloud Director
Creating NAT-Routed and Isolated Org Networks:
• Select the type of Org Network to create using the typical radio button and
dropdown box
17. 17
Organization Networks: In VMware vCloud Director
Creating NAT-Routed and Isolated Org Networks:
• Select the Network Pool to use for the Internal Network
• Assign internal addressing for the Internal Network
18. 18
Organization Networks: In VMware vCloud Director
Creating NAT-Routed and Isolated Org Networks:
• For the External Network select the External Network to attach to as well as the internal
• Also select the Network Pool to use for the Internal Network behind the vShield Edge.
• Assign internal addressing for the Inside portion of Org Network
19. 19
vApp Networks: Overview
Contained within a vApp
• Inherently Private Internal
Allows VMs in a vApp to communicate with each other
or...by connecting them to Org Networks, other vApps
Can be connected to Org Networks as
• Public (Direct)
• Bridged connection to a organization network
• Private Routed
• Connected to a organization network through a vShield Edge
• Can be configured for NAT & Firewall
Backed by a Network Pool
Set up by Consumers
20. 20
Putting it Together: vCloud Networking Options – Examples
vApp network
vApp
External Network (set up by system admin)
External Organization Network (set up by system admin)
Organization
Internal Organization network (set up by system admin)
vApp network
(set up by org admin/vApp author, internal to vApp)
External Organization Network
vApp network1 2 3
4
56
7
8
21. 21
Putting it Together: vCloud Networking Options – Examples
Organization Network 1
External Network 1
Organization Network 2
Organization Network 3
External Organization Network –
Direct Connection
External Organization Network –
NAT-routed Connection
Internal Organization Network
vApp 4
vApp Network
(Private)
vApp 3
Connected to Organization Network
(vApp network with NAT-routed connection
and IP masquerading defined)
vApp 1
Connected to
Organization network
(vNICs connected to
Organization network)
vSphere Network 1
External Network 2
vSphere Network 2
vShield Edge
(NAT/firewall)
vShield Edge
(NAT/firewall)
.11 .12
.111 .112
Internal vSphere network
(backed by Network Pool)
Isolated
VM
Internal vSphere network
(backed by Network Pool)
Internal vSphere network
(backed by Network Pool)
vApp 2
Connected to Organization network
(vApp network with direct connection)
Internal vSphere network
(backed by Network Pool)
vApp Network
Internal vSphere network
(backed by Network Pool)
vApp Network
Isolated vApp Network
Organization
28. 28
vSphere Dependencies
Network Pools: Backing for private networks in vCloud Director
• vSphere Port Group backed
• Requires vSS or vDS or N1KV Switches
• VLAN-backed
• Requires vDS and VLANs
• vCloud Director Network Isolation-backed (vCD-NI)
• Requires vDS and VLANs
• Mac-in-Mac Encapsulation (1524 bytes MTU)
External Networks: for Internet, VPN/MPLS, IP SAN connectivity
• Requires vSS or vDS or N1KV Switches
29. 29
Network Security
vShield Edge
• Integrated with vCloud Director
• Network security services
• Firewall
• NAT
• DHCP
• Port forwarding
• IP masquerading
Option for internal only or connected externally
• Internal only – within vApp or within organization
