1、ACI方案,現(xiàn)時(shí)較為熱門的話題,互聯(lián)網(wǎng)電商 大數(shù)據(jù),應(yīng)用程序,應(yīng)用服務(wù)器,文件,文件服務(wù)器,數(shù)據(jù)庫(kù),數(shù)據(jù)庫(kù)服務(wù)器,小型電商網(wǎng)站架構(gòu),中型電商網(wǎng)站架構(gòu),大型電商網(wǎng)站架構(gòu),項(xiàng)目梳理流程,每一個(gè)步驟都是一個(gè)需求翻譯的過(guò)程,應(yīng)用系統(tǒng)與基礎(chǔ)架構(gòu)是兩種不同類型的語(yǔ)言,應(yīng)用系統(tǒng) 語(yǔ)言,人工翻譯 由于相互之間的不熟悉，如何確保需求翻譯的正確性？,高并發(fā)，大流量 高可用： 7*24 海量數(shù)據(jù) 用戶分布廣泛 安全： 網(wǎng)站受攻擊，密碼泄露 需求快速變更，發(fā)布頻繁,基礎(chǔ)架構(gòu) 語(yǔ)言,端口數(shù)量 核心層、接入層帶寬速率 VLAN劃分 IP地址規(guī)劃 防火墻 QoS 負(fù)載均衡 CPU、內(nèi)存、網(wǎng)卡、存儲(chǔ),姑且稱之為應(yīng)用與基礎(chǔ)架構(gòu)

2、之間的語(yǔ)言障礙,應(yīng)用系統(tǒng) 和 基礎(chǔ)架構(gòu)人員必須相互翻譯自己的語(yǔ)言,如何跨越這個(gè)障礙？,架構(gòu)師,懂業(yè)務(wù),熟系統(tǒng),熟悉網(wǎng)絡(luò)、服務(wù)器、防火墻,在哪里？,有其他的辦法嗎？,Soni Jiandani,Application Centric Infrastucture 以應(yīng)用為中心的基礎(chǔ)架構(gòu),應(yīng)用需求,應(yīng)用（web）,中間件,數(shù)據(jù)庫(kù),ACI 理解并翻譯 APP的需要,Aci將應(yīng)用的語(yǔ)言翻譯成網(wǎng)絡(luò)的語(yǔ)言,網(wǎng)絡(luò)需求,開放標(biāo)準(zhǔn)，擁抱開源,ACI 以應(yīng)用為中心的基礎(chǔ)架構(gòu) 并不是單一的產(chǎn)品,先來(lái)看一個(gè)傳統(tǒng)的案例,Web Servers,L3,FW,SLB,SSL,DB Servers,www,www,www,Ap

3、p Servers,FW,SLB,app,app,FW,db,db,switch1(config)# switch1(config)# int eth 1/1 switch1(config)# switch mode acc switch1(config)# switch acc vlan 666 switch1(config)# no shut,router(config)# router(config)# int eth 1 router(config)# ip add router(config)# not shut router(config

4、)# int eth 2 router(config)# ip addr router(config)# no shut router(config)# router eigrp 100 router(config)# network mask router(config)# network mask router(config)# ip route 54,switch2(config)# switch2(config

5、)# int eth 1/2 - 3 switch2(config)# switch mode acc switch2(config)# switch acc vlan 111 switch2(config)# no shut,fw1(config)# fw1(config)# int eth 0/1 fw1(config)# nameif outside 0 fw1(config)# int eth 0/2 fw1(config)# nameif webfront 20 fw1(config)# object network webfront_vip fw1(config)# host 6.

6、6.6.6 fw1(config)# static (webfront,outside) fw1(config)# access-list outside_web permit tcp any host eq 80 fw1(config)# access-list outside_web permit tcp any host eq 443 fw1(config)# access-group outside_web in interface outside,switch3(config)# switch3(config)# int eth 1/4

7、 - 5 switch3(config)# switch mode acc switch3(config)# switch acc vlan 222 switch3(config)# no shut,switch4(config)# switch4(config)# int eth 1/6 switch4(config)# switch mode acc switch4(config)# switch acc vlan 333 switch4(config)# no shut switch4(config)# int eth 1/7 - 9 switch4(config)# switch mo

8、de acc switch4(config)# switch acc vlan 333 switch4(config)# no shut,IDS/IPS,IDS/IPS,switch5(config)# switch5(config)# int eth 1/10 - 11 switch5(config)# switch mode acc switch5(config)# switch acc vlan 444 switch5(config)# no shut switch5(config)# int eth 1/11 - 15 switch5(config)# switch mode acc

9、switch5(config)# switch acc vlan 555 switch5(config)# no shut switch5(config)# monitor session 1 source vlan 555 switch5(config)# monitor session 1 dest eth 1/16,switch6(config)# switch6(config)# int eth 1/16 - 19 switch6(config)# switch mode acc switch6(config)# switch acc vlan 777 switch6(config)#

10、 no shut switch6(config)# monitor session 1 source vlan 777 switch6(config)# monitor session 1 dest eth 1/20,slb1 (CONFIG) probe http http-probe interval 30 expect status 200 200 rserver host websrvr1 description foo web server ip address inservice rserver host websrvr2 description foo web s

11、erver ip address inservice rserver host websrvr3 description foo web server ip address inservice serverfarm host FOOWEBFARM probe http-probe rserver websrvr1 80 inservice rserver websrvr2 80 inservice rserver websrvr3 80 inservice crypto generate key 1024 fooyou.key crypto csr-params

12、 testparms country US state California locality San Jose organization-name foo organization-unit you common-name serial-number crisco123 crypto generate csr testparms fooyou.key crypto import ftp 5 anonymous fooyou.cer parameter-map type ssl SSL_PARAMETERS cipher RSA_WITH_RC4_128_MD5 versi

13、on TLS1 ssl-proxy service FOOWEB_SSL key fooyou.key cert fooyou.cer class-map match-all FOOSSL_VIP_CLASS 2 match virtual-address 2 tcp eq https policy-map type loadbalance first-match L7-SSL-MATCH class L7_WEB sticky-serverfarm sn_cookie policy-map multi-match FOOWEB-VIP class FOOWEB_VIP_CLAS

14、S loadbalance vip inservice loadbalance policy FOOWEB-MATCH loadbalance vip icmp-reply loadbalance vip advertise active class FOOSSL_VIP_CLASS loadbalance vip inservice loadbalance policy FOOSSL-MATCH loadbalance vip icmp-reply loadbalance vip advertise active ssl-proxy server FOOWEB_SSL interface v

15、lan 222 service-policy input FOOWEB_SSL,fw2(config)# fw2(config)# int eth 0/1 fw2(config)# nameif webfront 20 fw2(config)# int eth 0/2 fw2(config)# nameif appfront 50 fw2(config)# object network appfarm_vip fw2(config)# host fw2(config)# nat (appfront,webfront) static fw2(config)# ac

16、cess-list web_to_app permit tcp any host eq 8081,slb2 (CONFIG) rserver host appsrvr1 description foo app server ip address inservice rserver host appsrvr2 description foo app server ip address inservice rserver host appsrvr3 description foo app server ip address inser

17、vice serverfarm host FOOAPPFARM probe http-probe rserver appsrvr1 8081 inservice rserver appsrvr2 8081 inservice rserver appsrvr3 8081 inservice class-map type http loadbalance match-any FOO_APP 2 match http virtual-address 4 tcp eq 8081 class-map match-all FOO_APP_VIP_CLASS policy-map type l

18、oadbalance first-match FOO_APP-MATCH class FOO_APP sticky-serverfarm sn_cookie policy-map multi-match FOO_APP-VIP class FOO_APP_VIP_CLASS loadbalance vip inservice loadbalance policy FOO_APP-MATCH loadbalance vip icmp-reply loadbalance vip advertise active,fw3(config)# fw3(config)# int eth 0/1 fw3(c

19、onfig)# nameif appfront 70 fw3(config)# int eth 0/2 fw3(config)# nameif dbfront 90 fw3(config)# object network db_cluster fw3(config)# host fw3(config)# nat (dbfront,appfront) static 0 fw3(config)# access-list web_to_app permit tcp any host 0 eq 1433,Web Servers,L3,FW,SLB,SSL,D

20、B Servers,www,www,www,App Servers,FW,SLB,app,app,FW,db,db,switch1(config)# switch1(config)# int eth 1/1 switch1(config)# switch mode acc switch1(config)# switch acc vlan 666 switch1(config)# no shut,router(config)# router(config)# int eth 1 router(config)# ip add router(config)

21、# not shut router(config)# int eth 2 router(config)# ip addr router(config)# no shut router(config)# router eigrp 100 router(config)# network mask router(config)# network mask router(config)# ip route 54,switch2

22、(config)# switch2(config)# int eth 1/2 - 3 switch2(config)# switch mode acc switch2(config)# switch acc vlan 111 switch2(config)# no shut,fw1(config)# fw1(config)# int eth 0/1 fw1(config)# nameif outside 0 fw1(config)# int eth 0/2 fw1(config)# nameif webfront 20 fw1(config)# object network webfront_

23、vip fw1(config)# host fw1(config)# static (webfront,outside) fw1(config)# access-list outside_web permit tcp any host eq 80 fw1(config)# access-list outside_web permit tcp any host eq 443 fw1(config)# access-group outside_web in interface outside,switch3(config)# swit

24、ch3(config)# int eth 1/4 - 5 switch3(config)# switch mode acc switch3(config)# switch acc vlan 222 switch3(config)# no shut,switch4(config)# switch4(config)# int eth 1/6 switch4(config)# switch mode acc switch4(config)# switch acc vlan 333 switch4(config)# no shut switch4(config)# int eth 1/7 - 9 sw

25、itch4(config)# switch mode acc switch4(config)# switch acc vlan 333 switch4(config)# no shut,IDS/IPS,IDS/IPS,switch5(config)# switch5(config)# int eth 1/10 - 11 switch5(config)# switch mode acc switch5(config)# switch acc vlan 444 switch5(config)# no shut switch5(config)# int eth 1/11 - 15 switch5(c

26、onfig)# switch mode acc switch5(config)# switch acc vlan 555 switch5(config)# no shut switch5(config)# monitor session 1 source vlan 555 switch5(config)# monitor session 1 dest eth 1/16,switch6(config)# switch6(config)# int eth 1/16 - 19 switch6(config)# switch mode acc switch6(config)# switch acc v

27、lan 777 switch6(config)# no shut switch6(config)# monitor session 1 source vlan 777 switch6(config)# monitor session 1 dest eth 1/20,slb1 (CONFIG) probe http http-probe interval 30 expect status 200 200 rserver host websrvr1 description foo web server ip address inservice rserver host websrv

28、r2 description foo web server ip address inservice rserver host websrvr3 description foo web server ip address inservice serverfarm host FOOWEBFARM probe http-probe rserver websrvr1 80 inservice rserver websrvr2 80 inservice rserver websrvr3 80 inservice crypto generate key 1024 fooy

29、ou.key crypto csr-params testparms country US state California locality San Jose organization-name foo organization-unit you common-name serial-number crisco123 crypto generate csr testparms fooyou.key crypto import ftp 5 anonymous fooyou.cer parameter-map type ssl SSL_PARAMETERS cipher RS

30、A_WITH_RC4_128_MD5 version TLS1 ssl-proxy service FOOWEB_SSL key fooyou.key cert fooyou.cer class-map match-all FOOSSL_VIP_CLASS 2 match virtual-address 2 tcp eq https policy-map type loadbalance first-match L7-SSL-MATCH class L7_WEB sticky-serverfarm sn_cookie policy-map multi-match FOOWEB-V

31、IP class FOOWEB_VIP_CLASS loadbalance vip inservice loadbalance policy FOOWEB-MATCH loadbalance vip icmp-reply loadbalance vip advertise active class FOOSSL_VIP_CLASS loadbalance vip inservice loadbalance policy FOOSSL-MATCH loadbalance vip icmp-reply loadbalance vip advertise active ssl-proxy serve

32、r FOOWEB_SSL interface vlan 222 service-policy input FOOWEB_SSL,fw2(config)# fw2(config)# int eth 0/1 fw2(config)# nameif webfront 20 fw2(config)# int eth 0/2 fw2(config)# nameif appfront 50 fw2(config)# object network appfarm_vip fw2(config)# host fw2(config)# nat (appfront,webfront) static

33、 fw2(config)# access-list web_to_app permit tcp any host eq 8081,slb2 (CONFIG) rserver host appsrvr1 description foo app server ip address inservice rserver host appsrvr2 description foo app server ip address inservice rserver host appsrvr3 description foo app server

34、ip address inservice serverfarm host FOOAPPFARM probe http-probe rserver appsrvr1 8081 inservice rserver appsrvr2 8081 inservice rserver appsrvr3 8081 inservice class-map type http loadbalance match-any FOO_APP 2 match http virtual-address 4 tcp eq 8081 class-map match-all FOO_APP_VIP

35、_CLASS policy-map type loadbalance first-match FOO_APP-MATCH class FOO_APP sticky-serverfarm sn_cookie policy-map multi-match FOO_APP-VIP class FOO_APP_VIP_CLASS loadbalance vip inservice loadbalance policy FOO_APP-MATCH loadbalance vip icmp-reply loadbalance vip advertise active,fw3(config)# fw3(co

36、nfig)# int eth 0/1 fw3(config)# nameif appfront 70 fw3(config)# int eth 0/2 fw3(config)# nameif dbfront 90 fw3(config)# object network db_cluster fw3(config)# host fw3(config)# nat (dbfront,appfront) static 0 fw3(config)# access-list web_to_app permit tcp any host 0 eq 1433,www

37、,www,需要增加更多的WEB服務(wù)器,switch4(config)# switch4(config)# int eth 2/7 - 9 switch4(config)# switch mode acc switch4(config)# switch acc vlan 333 switch4(config)# no shut,slb1 (ADDED CONFIG) rserver host websrvr4 description foo web server ip address inservice rserver host websrvr5 description foo

38、web server ip address inservice serverfarm host FOOWEBFARM rserver websrvr4 80 inservice rserver websrvr5 80 inservice,在這個(gè)傳統(tǒng)案例中 每臺(tái)相關(guān)的設(shè)備：路由器、交換機(jī)、防火墻、負(fù)載均衡都要去一一的進(jìn)行配置 網(wǎng)絡(luò)是一種層級(jí)拓?fù)?，各類設(shè)備需要放在相關(guān)的位置 一旦發(fā)生變更，例如增加應(yīng)用服務(wù)器，相關(guān)網(wǎng)絡(luò)設(shè)備也要發(fā)生配置變更,傳統(tǒng)的案例,如果是ACI，會(huì)怎么樣.,ACI的方式,4-7層網(wǎng)絡(luò)服務(wù)器,虛擬機(jī)或者物理服務(wù)器,ACI 核心交換機(jī),ACI 接入交換機(jī),APIC集群

39、,1) 應(yīng)用服務(wù)器，無(wú)論是WEB、中間件、數(shù)據(jù)庫(kù)（VM或者物理機(jī)）連接進(jìn)了ACI網(wǎng)絡(luò),2) ACI 接入交換機(jī)（或者是VMM，例如vCenter）檢測(cè)到了有設(shè)備接入，于是將設(shè)備接入信息轉(zhuǎn)發(fā)給APIC,3) APIC 檢測(cè)到接入的是一臺(tái)WEB服務(wù)器，于是將WEB應(yīng)用的策略和配置推送到Leaf交換機(jī),定義策略 .,DB_contract Consumer: App EPG Provider: DB EPG Filter: TCP port 1433 Contract: use firewall+NAT copy to IDS/IPS,定義網(wǎng)絡(luò)服務(wù),定義應(yīng)用,WEB 服務(wù)器,數(shù)據(jù)庫(kù) 服務(wù)器,中間件

40、服務(wù)器,入侵檢測(cè),APP_contract Consumer: Web EPG Provider: App EPG Filter: TCP port 8081 Contract: use firewall NAT use SLB copy pkt to IDS/IPS,負(fù)載均衡,防火墻,WEB_contract Consumer: Outside EPG Provider: Web EPG Filter: TCP ports 80 and 443 Contract: use firewall NAT + SLB + SSL offload,ACI：抽象出一個(gè)邏輯模型來(lái)支持應(yīng)用程序的部署,定義策

41、略 .,DB_contract Consumer: App EPG Provider: DB EPG Filter: TCP port 1433 Contract: use firewall+NAT copy to IDS/IPS,定義網(wǎng)絡(luò)服務(wù),定義應(yīng)用,WEB 服務(wù)器,數(shù)據(jù)庫(kù) 服務(wù)器,中間件 服務(wù)器,IDS/IPS,Outside EPG,APP_contract Consumer: Web EPG Provider: App EPG Filter: TCP port 8081 Contract: use firewall NAT use SLB copy pkt to IDS/IPS,SL

42、B,FW,WEB_contract Consumer: Outside EPG Provider: Web EPG Filter: TCP ports 80 and 443 Contract: use firewall NAT + SLB + SSL offload,在APIC中定義所有策略,定義策略,定義網(wǎng)絡(luò)服務(wù),定義應(yīng)用,WEB 服務(wù)器,數(shù)據(jù)庫(kù) 服務(wù)器,中間件 服務(wù)器,IDS/IPS,Outside EPG,SLB,FW,由APIC統(tǒng)一下發(fā)給基礎(chǔ)架構(gòu),ACI 以應(yīng)用為中心的基礎(chǔ)架構(gòu)無(wú)狀態(tài)網(wǎng)絡(luò),ADC,app,db,f/w ADC,WEB,互聯(lián)策略,安全策略,QOS帶寬設(shè)置,存儲(chǔ)和計(jì)算單元,

43、應(yīng)用的4-7層服務(wù),可擴(kuò)展的腳本語(yǔ)言模型,ACI如何能夠自動(dòng)識(shí)別應(yīng)用？,DNS *,DNS,DHCP Pool,VM Attribute,Subnet,VLAN,VxLAN,NVGRE,Phys Port,Virtual Port,Systems Telemetry,ACI: 將應(yīng)用快速部署到網(wǎng)絡(luò)中，同時(shí)保證擴(kuò)展性，安全性和應(yīng)用可見性,讓物理網(wǎng)絡(luò)和虛擬化環(huán)境相結(jié)合,Tenant HEALTH SCORE,LATENCY,VISIBILITY,VMs,Physical,Application Delivery Controller,Firewall,3,35,2,Packet Drops,0,S

44、ystems Telemetry,Application HEALTH SCORE,LATENCY,VISIBILITY,VMs,Physical,Application Delivery Controller,Firewall,5,16,8,Packet Drops,25,ACI提供強(qiáng)大的排錯(cuò)和監(jiān)控,隨時(shí)監(jiān)控為應(yīng)用提供服務(wù)的基礎(chǔ)架構(gòu)的健康狀況,ACI知道應(yīng)用的結(jié)構(gòu)和組成部分,82%,10,25,研發(fā)部門,法律部門,銷售部門,人事,財(cái)務(wù),ACI 更靈活完善的安全管控,PolicyEngine,動(dòng)態(tài)的企業(yè)安全策略,市場(chǎng)部門,ACI L4-L7層服務(wù)策略,L4-L7層的服務(wù)根據(jù)策略自動(dòng)生效 匹配策略的報(bào)文自動(dòng)被處理,ACI提供了新一代的應(yīng)用分析引擎,Physical And Virtual As One,VXLAN Per hop Visibility,粒度可調(diào)整：按照應(yīng)用、租戶、數(shù)據(jù)中心 健康打分 時(shí)延 原子級(jí)的計(jì)數(shù)器 資源消耗比例,應(yīng)用級(jí)別的可視化,Triggered Events or Queries,自動(dòng)測(cè)量： 原子級(jí)的計(jì)數(shù)器,