There has been some seismic activity happening in Bay Area and the epicenter for all Virtual Networking shifts is right here at Cisco HQ in San Jose. (Our sympathies go to all those affected by the real earthquake further to the north.) At Cisco, it’s all about the applications and the shift to dynamic network virtualization. Cisco pioneered virtual networking with Nexus 1000V virtual switch and recently incorporated it in the application aware Application Virtual Switch (AVS), for Cisco ACI-enabled networks. Cisco is excited to announce the availability of Nexus 1000 Release 3.1 of Nexus1000V for vSphere (available for download here). We are showing the upcoming generation of the virtual switch at VMworld in San Francisco this week.
Nexus1000V is the edge switch for virtual environments, bringing the network edge right up to the virtual machine, and connecting virtual ports to the physical network and beyond. The Nexus 1000V is the foundation for our virtual network overlay portfolio, including all of our virtual L4-7 application and security services, our cloud orchestration software, VXLANs and more. It is also at the heart of AVS, a purpose-built, hypervisor-resident virtual network edge switch designed for the Application Centric Infrastructure.
Release 3.1 is a new major release enabling enterprise and cloud provider customers running the vSphere hypervisor to leverage the distributed virtual firewall VSG, expand VXLAN footprint in the datacenter, improve secure isolation thru Cisco TrustSec and dramatically simplify updates through Cisco VSUM (Virtual Switch Update Manager). Most of the new features are value add to the Advanced Edition. New customers will need a Ver 3 specific license to use the full functionality of Ver 3. Existing customers with support contract are automatically entitled to free upgrade to Ver 3. AVS incorporates Nexus 1000V capabilities with consistent application policy enforcement for virtual workloads and unprecedented end-to-end visibility for applications in your data center.
Increased Scalability (Advanced Edition)– More than doubles the scale from the previous release. The virtual switch now supports 250 hosts/servers per switch with 10,000 ports per switch. In addition it supports 4094 active VLANs and 16 million VXLAN (6144 active VXLANs) per switch across 6144 port profiles.
VXLAN control plane: BGP based control plane across multiple virtual switches provide expanded Layer 2 domain footprint that can potentially support nearly 40,000 VMs in a single domain
Increased Resiliency – Supports headless Port bring up where Virtual Machines can be bought up on the host even if VEM is offline i.e. the VSM is not reachable by VEM. Both VSM headful and headless VM vMotion is supported.
Cisco TrustSec 2.0 (Advanced Edition) – Continues to extended Cisco TrustSec solutions for network based segmentation of users and physical workloads, leveraging Security Group Tags (SGT) for defining security segments and SGACL support (Enforcement) and Native(in-line) SGT tagging.
BPDU Guard -- Keeps virtual network safe from misconfigured VLANs and strictly enforces VLAN boundries. It prevents Misconfigured VLAN Rogue devices from flooding the network
Storm Control -- Prevent network disruptions from a broadcast, multicast, or unknown-unicast traffic storm.
Simplified Deployment, upgrade and visibility with Cisco VSUM – Cisco VSUM is a FREE virtual appliance that enables Server and Network administrators to Deploy, Upgrade and Monitor Nexus1000V and to Deploy and Upgrade Cisco AVS from within their vCenter web interface.
Customer Experience -Here’s what one of our Beta customers, Josh Coen says about Cisco VSUM. Josh is a Principal Cloud Architect with Varrow and has been working in the IT industry since 1999, with a heavy focus on virtualization and storage since 2008.
Nexus 1000V has already reached the 10,000 customer milestone with some customers purchasing 1000+ CPU licenses. Nexus 1000V continues to provide the foundation for the most advanced virtual networks by supporting, 1) multiple hypervisor environments, such as VMware vSphere, Microsoft Hyper-V and Openstack KVM 2) the most extensive set of virtual network services, including ASA 1000V Cloud Firewall, distributed zone-based virtual firewall, vWAAS WAN optimization, the Cloud Services Router (CSR) 1000V, Cisco Prime Network Analysis Module (NAM) and advanced service insertion and chaining technology, vPath and 3) a true management control plane that provides greater policy and control features for richer networking functionality.
We’ll be showing a lot of these features this week. Come by our booth and check it out. If you are around #VMworld this week, give us a shout out on twitter using Cisco hash tag #ciscovmw. For those of you that can’t make it out to VMworld, listen to the review of these new features in Ver 3.1 in this webcast.
A couple weeks ago, we wrapped up a very successful Cisco Live event in Orlando for more than 20,000 attendees. During the conference, we announced a new name for our software product formerly known as Cisco Virtual Network Management Center (VNMC).
Over the last couple of years, Cisco Prime Network Service Controller (Prime NSC) has developed into Cisco’s primary management platform for Layer 4 through 7 network services deployment in a cloud or virtualized environment. Today the software supports multiple different use cases for network services, with several hundred customers worldwide.
Cisco Prime Network Services Controller is the control point and management software for the InterCloud solution – providing VM workload mobility between a private and public cloud while retaining the same IP address and Layer 2 connectivity. As outlined in a recent blog post by my colleague Gary Kinghorn, our new Nexus 1000V InterCloud solution for hybrid cloud was a big hit at Cisco Live. During the InterCloud demonstration at Cisco Live, we showed how this Cisco-created technology allows enterprise organizations to extend their Layer 2 network to public clouds like Amazon Web Services.
The screenshots below illustrate how InterCloud enables the secure migration of a VM to a public cloud environment:
At Cisco Live, we also announced our new fabric path technology called Cisco Dynamic Fabric Automation (DFA). This new Unified Fabric technology enables simplified network automation and provisioning for both physical server and VM deployments. In the DFA architecture, Cisco Prime Network Services Controller is responsible for managing network services insertion – including firewalls and load balancers – when provisioning or moving VMs.
Cisco continues to roll out innovations that will enable the next generations of multi-cloud computing. I’m a product manager working on Cisco’s Cloud Management software, and we’re all about the high-level, self-service, automatic provisioning of services that the end-user cares about. The network just moves ones and zeros, and all protocols of interest (HTTP, SSH, RDP, SQL, etc.) work fine over TCP/IP. The hypervisor takes care of putting that pesky motherboard chipset and storage bus into a black box, right? The end-user doesn’t care about that stuff, or at least doesn’t want to have to care about it.
A common perspective, except among the engineers who manage the network, is that network infrastructure is a bunch of mysterious plumbing that “just works” and how it does what it does doesn’t matter. Indeed, many vendors in the “cloud” arena would like to perpetuate this perspective on the network. They would like you to believe a bunch of dumb pipes can carry traffic and that determination of the traffic (content, flow, etc.) is determined at higher levels in the stack.
In some cases, this is true, but operating this way doesn’t unlock anything new. The model they describe would be brilliant if all of your network requirements were defined in 1998. Few companies can afford to operate technology today like they did in 1998 and remain competitive.
Cisco is announcing a newNexus 1000V(N1KV), and this one changes the game.In brief, the Nexus 1000V is the foundation of the networking services that Cisco brings to virtual computing. The N1KV can be managed using the same NX-OS commands and practices used to manage the Nexus 5K and 7K switches, and extends network control down to the VM and virtual port into which a VM is “plugged in”, even across different vendors’ hypervisors.
The N1KV is also the platform for additional L2 and L3 network services such as those provided by the vASA Firewall, vNAM, and VSG. The new Nexus 1000V InterCloud extends this ability to cloud service providers, such as Amazon, but is “cross-provider” (in fact, it doesn’t even depend on the Cloud Service Provider). For me, in my role as a Cloud Product Manager, this is an important new addition to basic networking capabilities, and is exactly the kind of thing that Cisco can and should do in its role as “Networking Giant” to open up the promise of hybrid or multi-cloud.
I have a mental image of what this can do, and I tried to put this into images to the right. Animation would have been better, I just don’t have the Flash skills to put it together for a quick blog post. I envision a virtual machine as a ghostly “physical” server tower with network cables plugged into it. These network connections can come from end-users in a client-server model, or any of our web-and-mobile constructs. After all, we still are end-users connecting to machines. Of course, the “client” for a compute function could be another compute function, so there is a network cable coming from another nearby ghost server. These ghost servers can today float from blade to blade thanks to most mainstream virtual machine managers (VMM) and a virtual switch like the N1KV, and the cords stay connected throughout. With the new N1KV, that VM can float right out of that VMM and into another VMM (such as across VMware datacenters, or even from VMware to Hyper-V), or out to a public or hosted provider. The cord just magically uncoils to remain connected wherever that machine goes! I love magic.
The N1KV provides that cable that can float after its ethereal virtual machine. It also provides the platform to maintain monitoring by the vNAM, even as the machine moves. You simply can’t economically achieve this using basic dumb pipes. Add to this the new Virtual Network Management Console (VNMC) InterCloud management capabilities. In order for that cord to stay connected, there do have to be network switches or routers along the way that understand how to make that network cable follow the machine. VNMC InterCloud manages these devices, but adds another particularly important capability: actually moving the workload.
VNMC InterCloud adds the ability to discover virtual machines, and convert them to a cloud-provider’s instance format, move what could possibly be a fairly large set of files, and get that machine started back up in a far-away environment, with seamless network consistency. VNMC InterCloud is like a puff of wind that pushes the ghostly VM from my corporate VMWare-based cloud to float over to my hosted private cloud. Remember, ghosts can float through walls.
This is groundbreaking. Workload mobility is one of those hard-to-do core capabilities required for all of us to realize the promise of multi-cloud, and it requires a network that is both dynamic and very high performing. I’ve been looking forward to this from Cisco for some time now.
Today marks the general availability of the eagerly-awaited Microsoft Windows Server 2012 platform. According to Microsoft, “Windows Server 2012 redefines the server category, delivering hundreds of new features and enhancements spanning virtualization, networking, storage, user experience, cloud computing, automation, and more.” Earlier Cisco blog posts discussed how Cisco has collaborated with Microsoft to achieve Windows 2012 certification for our UCS servers, as well as integrating our management tools into Microsoft System Center and PowerShell.
In this post, I’d like to highlight the integration of the Nexus 1000V virtual switch into the Windows Server 2012 platform, and particularly the Hyper-V hypervisor. We have been working closely with the Windows Server 2012 team for the past few years towards this goal, and announced Nexus 1000V and VM-FEX support for it at the Microsoft BUILD conference last year. Read More »
VNMC 2.0 is a template-driven policy management tool that is now bundled with Cisco Virtual Security Gateway (VSG) and Cisco ASA 1000V Cloud Firewall. This new release now has expanded capabilities to configure the security of your virtual cloud environment. Because VNMC 2.0 is such a step up from prior releases, and fewer people are familiar with its functionality, this is going to be a bit longer of a post than usual (but with lots of screen shots).
Let’s take a look at some of the key VNMC features and how it works with the two virtual firewalls:
Resource Objects for ASA 1000V
Cisco VNMC abstracts the devices it manages. As part of provisioning, devices are configured to point to Cisco VNMC for policy management. Cisco VNMC discovers all devices and lists them under the Resources pane. In addition to the ASA 1000V, the Resources pane has other resources such as Cisco VSGs, VSMs, and VMs.