Components of the Cloud DCN Solution
This chapter describes the following Huawei components, as well as their functions, used for building cloud DCNs: physical CloudEngine switches, virtual CloudEngine switches, HiSecEngine series firewalls, SDN controller iMaster NCE-Fabric, and security manager SecoManager.
PHYSICAL CLOUDENGINE SWITCHES
Huawei CloudEngine DC switches are available as either physical or virtual switches and responsible for forwarding traffic on the network. These switches are the cornerstone of the cloud DCN solution. This section describes Huawei physical CloudEngine switches.
Overview
Huawei physical CloudEngine switches are high-performance switches designed for DC scenarios. These switches are used to construct intelligent, high-quality networks that are elastic, virtual, and agile, providing a solid foundation for building cloud DCNs.
Chapter 2 summarized the challenges faced by cloud DCNs: Big data requires big pipes, networks need pooling and automation, networks need to provide a reliable foundation for services, and DC O&M needs to be intelligent. The following describes how CloudEngine DC switches address these challenges.
1. Big data requires big pipes.
With the rapid development of services such as big data, smart city, mobile Internet, and cloud computing, network traffic increases significantly every year. This places a major burden on DC switches, requiring their capacity to scale as network capacity is expanded in the future. For example, the access bandwidth of servers has been increased to 10 Gbit/s and is developing toward 25 Gbit/s. In addition, 100GE interfaces are used as uplink interfaces on networks and will soon evolve to 400GE uplink interfaces. CloudEngine DC switches support smooth evolution from 25 Gbit/s and 100 Gbit/s to 400 Gbit/s, supporting the future expansion of networks. For details about the evolution from 25 Gbit/s and 100 Gbit/s to 400 Gbit/s, see Section 12.1.2.
2. Networks need pooling and automation.
To meet elastic scheduling requirements for compute and storage resources, cloud DCNs must have large resource pools and networks need to achieve resource pooling. For elastic provisioning of services, which are updated rapidly in the cloud computing era, automatic network deployment is required.
Network resource pooling enables cloud DCNs to evolve from traditional networks to virtual networks. The evolution requires DC switches to support a variety of virtualization technologies, which are classified into device virtualization and network virtualization. Device virtualization optimizes the reliability of a single node and the efficiency of links on the network. For example, CloudEngine DC switches support VS, CSS and iStack, and M-LAG. VS virtualizes a single physical device into multiple logical devices, whereas CSS and iStack virtualize multiple physical devices into a single logical device. For details about CSS, iStack, and M-LAG, see Chapter 3. Network virtualization constructs a virtual overlay network on top of the traditional physical network. This decouples the logical network from the physical network for services, thereby implementing flexible allocation and pooling of network resources. An example of a typical network virtualization technology is VXLAN BGP EVPN, which CloudEngine DC switches support. Given the urgent need to evolve toward IPv6, due to the exhaustion of IPv4 addresses, these switches also support IPv6-based VXLAN technology. For details about VXLAN BGP EVPN, see Chapter 6. For details about VXLAN applications in IPv6 and how IPv4 VXLAN evolves to IPv6, see Section 12.1.2.
The following analyzes automatic network deployment, which is classified into automatic deployment of physical network services (such as interfaces, IP addresses, and routes) and automatic deployment of logical network services (such as VXLAN and tenant VRF). To achieve automatic deployment of physical network services, external tools are typically used. Such tools invoke DC switches’ interfaces to deliver configurations to these switches automatically rather than manually. CloudEngine DC switches support ZTP, which is Python-based and automatically delivers configurations to switches by invoking their RESTCONF interfaces. To achieve automatic deployment of logical network services, SDN controllers or third-party tools are often used to orchestrate logical networks. In this process, switches need to provide APIs to connect to various management devices. In addition, switches also need to support some standard network models, such as standard NSH and segment routing. CloudEngine DC switches meet these requirements, providing APIs for connection with various SDN controllers (such as Huawei iMaster NCE-Fabric and VMware) and third-party tools (such as DevOps) as well as supporting standard NSH and segment routing.
3. Networks need to provide a reliable foundation for services.
High reliability emphasizes physical stability. Cloud DCNs need to provide device-, network-, and controller-level high reliability. DC switches need to provide device-level reliability and support for network-layer high-reliability solutions.
Device-level high reliability is often achieved on a per-device basis, relying on the hardware and software of each device being highly reliable. CloudEngine DC switches support a wide range of high-reliability and security features, such as CPU attack defense, graceful restart (GR), and BFD. In addition, these switches use traditional hardware-based reliability mechanisms, such as dual main processing units (MPUs), dual power supplies, and separation of the forwarding plane and control plane. They also use an orthogonal architecture with no wiring on the backplane, adopt a strict front-to-back airflow design, and support cell switching and virtual output queuing (VOQ) to implement non-blocking switching.
High-reliability network solutions involve the high-reliability design of switching networks and distributed network solutions, providing reliable gateways for compute, storage, and L4-L7 service devices. The high-reliability design of switching networks includes redundant access, loop-free network, ECMP, and single-node reliability. Currently, redundant access is implemented using virtual chassis technologies or inter-device link aggregation technology. Loop-free networks and ECMP depend on the underlay routing design and overlay VXLAN technology, and single-node reliability can be achieved using the virtual chassis technology. Because VXLAN BGP EVPN is widely used to construct logical networks, DC switches need to function as distributed VXLAN gateways to provide reliable gateways for compute and storage VAS devices. DC switches are also required to support the preceding technologies in order to facilitate the high-reliability design of network solutions. In this context, CloudEngine DC switches support up to 128 ECMP paths for load balancing and support stack or iStack, M-LAG, and VXLAN BGP EVPN distributed gateways.
4. DC O&M needs to be intelligent.
Intelligent O&M is becoming a necessity as the scale, traffic, and number of NEs on a cloud DCN continue to increase sharply. To support intelligent O&M, CloudEngine DC switches provide the following functions:
High-precision collection of subscription data in less than one second: Information on traditional networks is typically collected through SNMP. This is inefficient because a collection task requires multiple interactions and the polling period is usually several minutes. Within the polling period, some microburst traffic and packet loss may not be identified, affecting delay-sensitive services such as videos and online games. To resolve this issue for the collection of DCN information, telemetry based on the Google Remote Procedure Call (gRPC) interface is used. Telemetry, which is supported by CloudEngine DC switches, enables the polling period to be reduced to less than one second and can combine multiple tasks for processing, thereby improving the collection efficiency. For details, see Section 12.1.2.
Full-path detection and real-time monitoring: In legacy DCNs, link faults and packet loss are manually located and rectified using detection methods such as ping and trace. By working with the SDN controller, CloudEngine DC switches can implement full- path detection. Specifically, the controller quickly locates faults and learns the network status by simulating service packets and sending them to switches to detect paths on the entire network and generate a network-wide path heatmap. Packet Conservation Algorithm for Internet (iPCA) can be used to accurately locate service faults based on real service packets and work with the controller to implement visualized real-time monitoring.
