利用NSX构建双活数据中心ppt课件

1、基于NSX的双活数据中心架构,王培久 资深网络技术顾问议程,数据中心容灾架构的发展趋势 基于单VC的NSX双活解决方案 基于多VC的NSX双活解决方案 总结,CONFIDENTIAL,2, 2006 Cisco Systems, Inc. All rights reserved.,Cisco Confidential,Cisco Expo Czech Republic,5,数据中心容灾架构的演进,灾备 Disaster Recovery,通过异地的数据复制和备份保护数据,持续高可用 (continuous availability ) 业务失败的快速恢复,业务弹性和敏

2、捷性 (Business Resilience&Agility) 故障时业务的持续运行能力,High Availability,Business Agility,基于灾备的 数据中心,双活数据中心,基于云计算的 分布式虚拟化数据中心,Active/Active 应用服务器层,Active/Active Active/Query Active/Standby 数据库层,Active/Active Web 层,InternalNetwork,Service Provider A,Service Provider B,InternalNetwork,INTERNET,数据中心容灾总体架构,VM-Mo

3、bility,客户端切换inbound/outbound DNS+全局站点选择 负载均衡 健康路由注入RHI 热备份路由本地化,LAN Extensions,数据中心容灾总体架构技术领域,数据复制 存储 数据库 虚拟化,数据中心的二层互联 传统网络厂商提供的二层互联技术 Vmware NSX 网络虚拟化技术:,传输网络和存储的扩展 SAN 网络扩展 基于DWDM/SDH/IP的传输网络,安全策略的一致性：防火墙等,高层模式：冷备/暖备/热备/双活,虚拟机感知和移动性服务,CONFIDENTIAL,6,传统网络厂商的大二层技术的局限性,主备数据中心需要采用同一厂商的高端网络设备 绝大多少数大二层

4、技术虽然可以实现二层STP协议跨站点的隔离 但对二层的Flooding仍然缺乏有效的控制手段 网络层不支持上层虚拟机自动感知的功能，无法提供跨数据中心的防火墙策略的一致性 只关注网络层的二层扩展，无法为上层应用按需地提供逻辑交换、逻辑路由、 逻辑防火墙、逻辑负载均衡、VPN等服务，更无法提供网络服务的自动化部署,议程,数据中心容灾架构的发展趋势 基于单VC的NSX双活解决方案 基于多VC的NSX双活解决方案 总结,CONFIDENTIAL,7,基于单VC的数据中心双活解决方案option1跨数据中心集群模式,Active / Active Storage vSphere Metro Stora

5、ge Cluster,Datastore 1,Datastore 1,vCenter Server,L3 Network,Site A,Site B,解决方案要点 主机需要配置vSphere Metro Storage Cluster 集群 在vMSC的部署中存储是跨数据中心双活。 双活的存储架构可以是: EMC VPLEX, NetApp Metro Cluster 等(更多信息参考 VMware HCL ) 扩展集群可以跨数据中心支持虚拟机的 Live vMotion 所有 Vmkernel 网段采用三层网络: Management, vMotion, IP Storage 所有管理节点位

6、于主数据中心，但可以故障时可以切换到另外一个数据中心 vMSC集群所需的存储双活架构对时延和带宽有同的要求，如EMC VPLEX要求时延不高于10ms RTT 数据中心网络互联故障或NSX组件故障时，两数据中心网络将按现有的网络转发状态转发数据，不会导致网络中断,基于单VC的数据中心双活解决方案option1跨数据中心集群模式,Datastore 1,Datastore 2,vCenter Server,L3 Network,Site A,Site B,由于两数据中心无共享存储 跨数据中心虚机迁移 需要Storage vMotion,基于单VC的数据中心双活解决方案option2数据中心采用不

7、同集群,解决方案要点 不同数据中心采用不同的集群，因此不支持跨数据中心的DRS等功能 存储本地化，两数据中心中心无共享存储 Enhanced vMotion (simultaneous vMotion and svMotion) 提供跨数据中心vMotion 所有Vmkernel 网络采用三层网络: Management, vMotion, IP Storage 所有管理组件部署在主中心，包括：vCenter Server, NSX Manager and Controllers 跨数据中心时延需求：Enhanced vMotion is also 10ms RTT. 每个vMotion se

8、ssion:250 Mbps 如不需要live vMotion,NSX可以支持的最大时延为：100ms RTT 通过vmotion提供资源移动性和灾难避免功能 不提供跨数据中心的自动容灾恢复功能,基于单VC的数据中心双活解决方案option2数据中心采用不同集群,192.168.0.0/24,192.168.0.1,2.2.2.2,2.2.2.0/28,192.168.0.0/24,3.3.3.0/28,VXLAN,VXLAN,VLAN,VLAN,Distributed Logical Router,Dynamic Routing (OSPF, BGP),Primary VMs,Placeho

9、lder VMs,192.168.10.2,192.168.10.1,192.168.0.1,3.3.3.3,Distributed Logical Router,Dynamic Routing (OSPF, BGP),192.168.10.2,192.168.10.1,Site1,Site2,SRM,基于单VC的数据中心双活解决方案option3SRMNSX容灾模式,目标： 在两个数据中心之间实现自动容灾切换 网络： 1、内网：主备数据中心采用同样的网段和IP地址段，同时可以基于虚拟机部署DFW防火墙和 负载均衡等 2、外联：每个数据中心通过NSX Edge和外部路由器实现动态路由互通，Ed

10、ge连接外部路由器的地址和公网地址 采用不同网段 3、数据中心互联DCI:两中心之间只需提供高带宽三层IP路由网络互联即可，具体带宽需求需要参考SRM数据复制 的要求 数据备份：采用SRA 实现两中心之间数据的异步复制，根据RPO/RTO要求可以采用SRM本身自带的软件复制 技术实现RPO/RTO要求较高的也可以通过合作伙伴的硬件存储备份方案来实现如:EMC SRDF等 切换： 1、整体切换：当主数据中心出现整体故障可以实现主备数据中心的自动切换； 2、单应用切换：当主数据中心单个应用出现故障时，SRM会在备份数据中心实现此应用的自己切换,基于单VC的数据中心双活解决方案option3SRMN

11、SX容灾模式,议程,数据中心容灾架构的发展趋势 基于单VC的NSX双活解决方案 基于多VC的NSX双活解决方案 总结,CONFIDENTIAL,14,NSX 逻辑网络 (今天),CONFIDENTIAL,Logical Switch,Local VC Inventory,Local VC Inventory,Local VC Inventory,vCenter A,vCenter B,vCenter C,NSX Controller Cluster,NSX Controller Cluster,NSX Controller Cluster,Single NSX Domain can spanm

12、ore than one site,Logical Switch,Logical Switch,NSX 逻辑网络 (6.2),CONFIDENTIAL,16,Logical Switch,Local VC Inventory,Local VC Inventory,Local VC Inventory,vCenter A,vCenter B,vCenter C,NSX Controller Cluster,Logical Switch,NSX Controller Cluster,NSX Controller Cluster,Logical Switch,Single NSX Domain ca

13、n spanmore than one site,Logical Switches,多VC使用场景,Increase the span of NSX logical networks to enable: Capacity Pooling across multiple vCenter Servers Non disruptive migrations Cloud and VDI deployments,CONFIDENTIAL,17,Centralized security policy management One place to Manage FW rules Rules enforc

14、ed regardless of VM location and VC,CONFIDENTIAL,18,Universal Firewall Policy,多VC使用场景,NSX 6.2 supports new mobility boundaries in vSphere 6 Enable Cross VC, Cross vSwitch and Long Distance vMotion On existing networks, with no new hardware required,CONFIDENTIAL,19,vCenter-A,VDS-A,VXLAN Transport (L3

15、) & vMotion Network (L3),vCenter-B,VDS-B,= 150ms RTT,多VC使用场景,Enhance NSX Multi-Site Support Active-Active (From Metro to 150ms RTT) Disaster Recovery,CONFIDENTIAL,20,vCenter-A,vCenter-B,N-S Connectivity,NSX Mgr A,NSX Mgr B,SRM A,SRM B,Web,Web,App,=150ms,Web,DB,DB,DB,App,App,Web,App,DB,App,DB,DB,Web,

16、App,Web,多VC使用场景,Multi-VC with NSX,How it Works,Multi-VC Logical Networks (NSX 6.2),CONFIDENTIAL,22,Local VC Inventory,Local VC Inventory,Local VC Inventory,vCenter & NSX Manager A,Universal Object Configuration (NSX UI & API),Universal Configuration Synchronization,Universal Controller Cluster,Prima

17、ry,Secondary,vCenter & NSX Manager B,vCenter & NSX Manager H,Secondary,Multi-VC Logical Networks (NSX 6.2),Universal Controller Cluster size remains at 3 nodes NSX Controllers always run within a single vCenter Server and single Site Unique Universal Segment ID Pool: Ensures ULS VNIs are consistent

18、across all VCs UDLR IDs are also automatically derived from this pool The Universal Controller Cluster continues to manage Local VXLAN/DLR objects in addition to Universal ones Transport Zone determines whether Logical Switches are Local or Universal Segment ID pool is now required for any DLR, even

19、 without VXLAN LIFs NSX 6.2 Distributed Logical Routing supports Local Egress Cross VC vMotion will be validated with both Universal Logical Switches and L2VPN,CONFIDENTIAL,23,Multi-VC Primary and Secondary NSX Managers,Multi-VC Universal Segment ID Pool,Multi-VC Universal Transport Zones,Multi-VC U

20、niversal Logical Switches,Multi-VC Universal Distributed Logical Routing,Multi-VC Distributed Firewall (NSX 6.2),NSX vSphere 6.2 will also support Multi-VC Distributed Firewall for centralized management of Firewall rules for universal objects This is performed through Universal sections in the DFW

21、rule table These section will automatically be synchronized to all Secondary NSX Managers Universal Section is managed on the Primary NSX Manager andread only on Secondary NSX Managers Universal DFW rules are based on IP/MAC Sets as VC inventory remains local to an NSX Manager Supports both VXLAN an

22、d VLAN backed deployments vMotion across VCs with Universal DFW policy be fully supported,CONFIDENTIAL,29,Multi-VC Universal Distributed Firewall,30,Universal Section,Local Section,Multi-VC Universal Distributed Firewall,31,Universal DFW RulesSupported Configuration Objects,CONFIDENTIAL,L2 rules:,L3

23、 rules:,Universal MAC Set Universal SG (containing Universal MAC Set),Global IP Set Global SG (containing Global IP Set),Universal LS DFW-only (in case of VLAN backed dvPg),Note: Rule-ID (32 bit format) is the same across all NSX instances,Universal Services (pre-defined and user-defined),Universal

24、Services (pre-defined and user-defined),Multi-VC Universal Security Groups, IP/MAC Sets & Services,32,Security Groups,IP Sets, MAC Sets, Services and Service Groups all have a Universal context in addition to theexisting Local context,多VC 部署模式,单点多VC 部署场景 1,34,UniversalLogical Switches,Universal Cont

25、rol VM,E1,Route Updates,Physical Router,Universal Transit VXLAN Uplink,Site A,NSX EdgeServices GW,VC B with NSX Manager (Secondary),Route Updates,E8,UCC,单点多VC Edge部署在一个 VC,35,Universal Control VM,E1,E4,Physical Router,Site A,NSX EdgeServices GW,vC with NSX Manager (Secondary),E2,E3,E8,E7,E5,E6,Unive

26、rsalLogical Switches,Universal Transit VXLAN,36,Universal Control VM,Physical Router,Universal Transit VXLAN,Site A,NSX EdgeServices GW,vC with NSX Manager (Secondary),UniversalLogical Switches,E8,单点多VC Edge部署在多个 VC,vCenter Server,L3 Network,Site A,Site B,Multi-Site Enhancement: Locale ID NSX 6.2 in

27、troduces the concept of Locale ID for routes sent to the NSX Controller. This value is set to the NSX Manager UUID by default If Local Egress is not enabled on the UDLR, the Locale ID value is ignored When Local Egress is enabled, the NSX Controller will only send routes to ESXi hosts with a matching Loc