{"id":35973,"date":"2019-10-31T22:08:54","date_gmt":"2019-10-31T19:08:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/avtomatizatsiya-dlya-samyh-malenkih-chast-pervaya-kotoraya-posle-nulevoj-virtualizatsiya-seti\/"},"modified":"2019-10-31T22:08:54","modified_gmt":"2019-10-31T19:08:54","slug":"avtomatizatsiya-dlya-samyh-malenkih-chast-pervaya-kotoraya-posle-nulevoj-virtualizatsiya-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/avtomatizatsiya-dlya-samyh-malenkih-chast-pervaya-kotoraya-posle-nulevoj-virtualizatsiya-seti","title":{"rendered":"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/453516\/\">p\u0159edchoz\u00edm vyd\u00e1n\u00ed<\/a><\/noindex> Popisoval jsem r\u00e1mec s\u00ed\u0165ov\u00e9 automatizace. Podle n\u00e1zor\u016f se u n\u011bkter\u00fdch lid\u00ed dokonce tento prvn\u00ed p\u0159\u00edstup k probl\u00e9mu rozlo\u017eil n\u011bkter\u00e9 ot\u00e1zky na jednotliv\u00e9 \u010d\u00e1sti. A to m\u011b velmi t\u011b\u0161\u00ed, proto\u017ee na\u0161\u00edm c\u00edlem v cyklu nen\u00ed pokr\u00fdt Ansible skripty, ale vybudovat syst\u00e9m.<\/p>\n<p>Tento r\u00e1mec ur\u010duje po\u0159\u00e1dek, ve kter\u00e9m se budeme zab\u00fdvat ot\u00e1zkou.<br \/>\nA virtualizace s\u00edt\u011b, kter\u00e9 se tento d\u00edl v\u011bnuje, se p\u0159\u00edli\u0161 nehod\u00ed do tematiky ADSM, kde se zab\u00fdv\u00e1me automatikou. <\/p>\n<p>Ale poj\u010fme se na ni pod\u00edvat z jin\u00e9ho \u00fahlu.<\/p>\n<p>U\u017e d\u00e1vno pou\u017e\u00edv\u00e1 jednu s\u00ed\u0165 mnoho slu\u017eeb. V p\u0159\u00edpad\u011b oper\u00e1tora je to 2G, 3G, LTE, \u0160P a B2B, nap\u0159\u00edklad. V p\u0159\u00edpad\u011b datov\u00fdch center: konektivita pro r\u016fzn\u00e9 klienty, internet, blokov\u00e9 \u00falo\u017ei\u0161t\u011b, objektov\u00e9 \u00falo\u017ei\u0161t\u011b.<\/p>\n<p>A v\u0161echny slu\u017eby vy\u017eaduj\u00ed izolaci navz\u00e1jem. Tak vznikly overlayov\u00e9 s\u00edt\u011b.<\/p>\n<p>A v\u0161echny slu\u017eby necht\u011bj\u00ed \u010dekat, a\u017e je n\u011bkdo nastav\u00ed ru\u010dn\u011b. Tak se objevily orchestr\u00e1tory a SDN.<\/p>\n<p>Prvn\u00ed p\u0159\u00edstup k systematick\u00e9 automatizaci s\u00edt\u011b, p\u0159esn\u011bji jej\u00ed \u010d\u00e1sti, byl ji\u017e d\u00e1vno podniknut a na mnoha m\u00edstech zaveden do praxe: VMWare, OpenStack, Google Compute Cloud, AWS, Facebook.<\/p>\n<p>S t\u00edm se dnes tak\u00e9 pod\u00edv\u00e1me. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/kdpv.jpg\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/e0bf73b7b71c383c5526da48a6f6b776.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Obsah<\/h1>\n<p><\/p>\n<ul>\n<li><b>D\u016fvody<\/b><\/li>\n<li><b>Terminologie<\/b><\/li>\n<li><b>Underlay \u2014 fyzick\u00e1 s\u00ed\u0165<\/b><\/li>\n<li><b>Overlay \u2014 virtu\u00e1ln\u00ed s\u00ed\u0165<\/b>\n<ul>\n<li>Overlay na ToR&#8217;a<\/li>\n<li>Overlay z hostitele<\/li>\n<li>Na p\u0159\u00edkladu Tungsten Fabric\n<ul>\n<li>Komunikace uvnit\u0159 jednoho fyzick\u00e9ho stroje<\/li>\n<li>Komunikace mezi VM um\u00edst\u011bn\u00fdmi na r\u016fzn\u00fdch fyzick\u00fdch stroj\u00edch<\/li>\n<li>V\u00fdstup do vn\u011bj\u0161\u00edho sv\u011bta<\/li>\n<\/ul>\n<p>\n <\/li>\n<\/ul>\n<p>\n <\/li>\n<li><b>\u010casto kladen\u00e9 dotazy<\/b><\/li>\n<li><b>Z\u00e1v\u011br<\/b><\/li>\n<li><b>U\u017eite\u010dn\u00e9 odkazy<\/b><\/li>\n<\/ul>\n<p><\/p>\n<h1>D\u016fvody<\/h1>\n<p>\nA jeliko\u017e jsme o tom za\u010dali mluvit, stoj\u00ed za zm\u00ednku p\u0159edpoklady pro virtualizaci s\u00edt\u011b. Opravdu tento proces neza\u010dal v\u010dera. <\/p>\n<p>Pravd\u011bpodobn\u011b jste nes\u010detn\u011bkr\u00e1t sly\u0161eli, \u017ee s\u00ed\u0165 byla v\u017edy tou nejnepodajn\u011bj\u0161\u00ed \u010d\u00e1st\u00ed jak\u00e9hokoli syst\u00e9mu. A to je pravda ve v\u0161ech ohledech. S\u00ed\u0165 je z\u00e1kladem, na kter\u00e9m v\u0161echno stoj\u00ed, a prov\u00e1d\u011bt zm\u011bny na n\u00ed je docela slo\u017eit\u00e9 \u2014 slu\u017eby nesn\u00e1\u0161ej\u00ed, kdy\u017e s\u00ed\u0165 nefunguje. \u010casto v\u00fdpadek jednoho uzlu m\u016f\u017ee ovlivnit velkou \u010d\u00e1st aplikac\u00ed a mnoho klient\u016f. \u010c\u00e1ste\u010dn\u011b proto se s\u00ed\u0165ov\u00fd t\u00fdm m\u016f\u017ee br\u00e1nit jak\u00fdmkoli zm\u011bn\u00e1m \u2014 proto\u017ee to te\u010f n\u011bjak funguje (<i>mo\u017en\u00e1 ani nev\u00edme jak<\/i>), a te\u010f je pot\u0159eba n\u011bco nov\u00e9ho nastavit a nen\u00ed jasn\u00e9, jak to ovlivn\u00ed s\u00ed\u0165.<\/p>\n<p>Aby se lid\u00e9 nemuseli do\u017eadovat toho, kdy\u017e s\u00ed\u0165a\u0159i aktivuj\u00ed VLAN, a nemuseli zapisovat jak\u00e9koli slu\u017eby na ka\u017ed\u00fd uzel s\u00edt\u011b, vymysleli mo\u017enost pou\u017e\u00edvat overlaye \u2014 p\u0159ekryt\u00e9 s\u00edt\u011b \u2014 kter\u00fdch je mnoho r\u016fzn\u00fdch typ\u016f: GRE, IPinIP, MPLS, MPLS L2\/L3VPN, VXLAN, GENEVE, MPLSoverUDP, MPLSoverGRE atd.<\/p>\n<p>Jejich p\u0159ita\u017elivost spo\u010d\u00edv\u00e1 ve dvou jednoduch\u00fdch v\u011bcech:<\/p>\n<ul>\n<li>Konfiguruj\u00ed se pouze koncov\u00e9 uzly \u2014 transitn\u00ed se nemus\u00ed dot\u00fdkat. To v\u00fdrazn\u011b urychluje proces a n\u011bkdy dokonce umo\u017e\u0148uje zcela vylou\u010dit odd\u011blen\u00ed s\u00ed\u0165ov\u00e9 infrastruktury z procesu zav\u00e1d\u011bn\u00ed nov\u00fdch slu\u017eeb.<\/li>\n<li>Z\u00e1t\u011b\u017e je skryta hluboko uvnit\u0159 hlavi\u010dek \u2014 transitn\u00ed uzly o n\u00ed nemus\u00ed nic v\u011bd\u011bt, o adresov\u00e1n\u00ed na hostitel\u00edch, tras\u00e1ch p\u0159ekryt\u00e9 s\u00edt\u011b. To znamen\u00e1, \u017ee je t\u0159eba uchov\u00e1vat m\u00e9n\u011b informac\u00ed v tabulk\u00e1ch, co\u017e znamen\u00e1 pou\u017e\u00edt jednodu\u0161\u0161\u00ed\/levn\u011bj\u0161\u00ed za\u0159\u00edzen\u00ed.<\/li>\n<\/ul>\n<p>\nV tomto ne \u00fapln\u011b kompletn\u00edm vyd\u00e1n\u00ed nem\u00e1m v pl\u00e1nu rozeb\u00edrat v\u0161echny mo\u017en\u00e9 technologie, sp\u00ed\u0161e pop\u00ed\u0161u r\u00e1mec fungov\u00e1n\u00ed overlayov\u00fdch s\u00edt\u00ed v datov\u00e9m centru.<\/p>\n<p>Cel\u00e1 s\u00e9rie bude popisovat datov\u00e9 centrum slo\u017een\u00e9 z \u0159ad stejnorod\u00fdch sk\u0159\u00edn\u00ed, v nich\u017e je nainstalov\u00e1no stejn\u00e9 serverov\u00e9 vybaven\u00ed. <\/p>\n<p>Na tomto vybaven\u00ed b\u011b\u017e\u00ed virtu\u00e1ln\u00ed stroje\/kontejnery\/serverless, kter\u00e9 realizuj\u00ed slu\u017eby.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/a6863eb2804a298304d1e93daecf90d9.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h1>Terminologie<\/h1>\n<p>\nV cyklu <b>serverem<\/b> budu naz\u00fdvat program, kter\u00fd realizuje serverovou \u010d\u00e1st klient-server komunikace.<\/p>\n<p>Fyzick\u00e9 stroje v sk\u0159\u00edn\u00edch budeme naz\u00fdvat servery. <b>ne<\/b> Fyzick\u00e1 stroj<\/p>\n<p><b>je x86 po\u010d\u00edta\u010d um\u00edst\u011bn\u00fd v racku. Nej\u010dast\u011bji pou\u017e\u00edvan\u00fd term\u00edn je<\/b> . Tak ji budeme naz\u00fdvat \u201e <b>host<\/b>. Tak ji budeme naz\u00fdvat &#171;<b>\u201c nebo<\/b>&#187; nebo <b>host<\/b>.<\/p>\n<p><b>je aplikace b\u011b\u017e\u00edc\u00ed na fyzick\u00e9m stroji, kter\u00e1 emuluje fyzick\u00e9 zdroje, na nich\u017e b\u011b\u017e\u00ed virtu\u00e1ln\u00ed stroje. N\u011bkdy se v literatu\u0159e a na internetu slovo \u201ehypervisor\u201c pou\u017e\u00edv\u00e1 jako synonymum pro \u201ehost\u201c.<\/b> je opera\u010dn\u00ed syst\u00e9m b\u011b\u017e\u00edc\u00ed na fyzick\u00e9m stroji nad hypervisorem. Pro n\u00e1s v r\u00e1mci tohoto cyklu nen\u00ed a\u017e tak d\u016fle\u017eit\u00e9, zda jde skute\u010dn\u011b o virtu\u00e1ln\u00ed stroj nebo jen kontejner. Budeme to naz\u00fdvat \u201e<\/p>\n<p><b>Virtu\u00e1ln\u00ed stroj<\/b> \u2014 opera\u010dn\u00ed syst\u00e9m spu\u0161t\u011bn\u00fd na fyzick\u00e9m stroji nad hypervizorem. Pro n\u00e1s v r\u00e1mci tohoto cyklu nen\u00ed tak d\u016fle\u017eit\u00e9, zda se jedn\u00e1 skute\u010dn\u011b o virtu\u00e1ln\u00ed stroj nebo jen o kontejner. Budeme to naz\u00fdvat &#171;<b>Tenat<\/b>\u201e<\/p>\n<p><b>je \u0161irok\u00fd term\u00edn, kter\u00fd v tomto \u010dl\u00e1nku vydefinuji jako samostatnou slu\u017ebu nebo jednotliv\u00e9ho klienta.<\/b> Multitenantnost<\/p>\n<p><b>nebo multi-tenanting je vyu\u017e\u00edv\u00e1n\u00ed jedn\u00e9 a t\u00e9\u017ee aplikace r\u016fzn\u00fdmi klienty\/slu\u017ebami. P\u0159i\u010dem\u017e izolace klient\u016f navz\u00e1jem je dosa\u017eeno d\u00edky architektu\u0159e aplikace, a ne samostatn\u011b spu\u0161t\u011bn\u00fdm instanc\u00edm.<\/b> ToR \u2014 Top of the Rack switch<\/p>\n<p><b>ToR \u2014 swit\u010d na vrcholu sk\u0159\u00edn\u011b<\/b> \u2014 serverov\u00fd switch um\u00edst\u011bn\u00fd v racku, ke kter\u00e9mu jsou p\u0159ipojeny v\u0161echny fyzick\u00e9 stroje.<\/p>\n<blockquote><p> Krom\u011b topologie ToR r\u016fzn\u00ed poskytovatel\u00e9 praktikuj\u00ed End of Row (EoR) nebo Middle of Row (i kdy\u017e to posledn\u00ed je opom\u00edjen\u00e1 vz\u00e1cnost a zkratky MoR jsem nesly\u0161el).\n<\/p><\/blockquote>\n<p> <b>Podkladov\u00e1 s\u00ed\u0165<\/b> nebo podkladov\u00e1 s\u00ed\u0165 nebo underlay \u2014 fyzick\u00e1 s\u00ed\u0165ov\u00e1 infrastruktura: switche, routovacie za\u0159\u00edzen\u00ed, kabely.<\/p>\n<p><b>Nadlo\u017en\u00ed s\u00ed\u0165<\/b> nebo nadlo\u017en\u00ed s\u00ed\u0165 nebo overlay \u2014 virtu\u00e1ln\u00ed s\u00ed\u0165 tunel\u016f funguj\u00edc\u00edch nad fyzickou infrastrukturou.<\/p>\n<p><b>L3-fabrika nebo IP-fabrika<\/b> \u2014 ohromn\u00e9 vyn\u00e1lez lidstva, kter\u00e9 umo\u017e\u0148uje na pohovorech nezapom\u00ednat na STP a neu\u010dit se TRILL. Koncept, ve kter\u00e9m je cel\u00e1 s\u00ed\u0165 od \u00farovn\u011b p\u0159\u00edstupu v\u00fdhradn\u011b L3, bez VLAN a t\u00edm p\u00e1dem obrovsk\u00fdch rozlehl\u00fdch \u0161irok\u00fdch dom\u00e9n. Odkud se vzalo slovo \u201efabrika\u201c, to prozkoum\u00e1me v n\u00e1sleduj\u00edc\u00ed \u010d\u00e1sti.<\/p>\n<p><b>SDN<\/b> \u2014 Software Defined Network. Sotva pot\u0159ebuje p\u0159edstaven\u00ed. P\u0159\u00edstup k \u0159\u00edzen\u00ed s\u00edt\u011b, kdy zm\u011bny na s\u00edti prov\u00e1d\u00ed program, nikoli \u010dlov\u011bk. Obvykle znamen\u00e1 p\u0159esun Control Plane za hranice koncov\u00fdch s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed na kontrol\u00e9r.<\/p>\n<p><b>NFV<\/b> \u2014 Network Function Virtualization \u2014 virtualizace s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed, kter\u00e1 p\u0159edpokl\u00e1d\u00e1, \u017ee \u010d\u00e1st funkc\u00ed s\u00edt\u011b m\u016f\u017ee b\u00fdt spu\u0161t\u011bna jako virtu\u00e1ln\u00ed stroje nebo kontejnery za \u00fa\u010delem urychlen\u00ed zav\u00e1d\u011bn\u00ed nov\u00fdch slu\u017eeb, organizace Service Chaining a jednodu\u0161\u0161\u00ed horizont\u00e1ln\u00ed \u0161k\u00e1lovatelnosti.<\/p>\n<p><b>VNF<\/b> \u2014 Virtual Network Function. Konkr\u00e9tn\u00ed virtu\u00e1ln\u00ed za\u0159\u00edzen\u00ed: router, switch, firewall, NAT, IPS\/IDS atd.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/971b6a28a9caab5f3a7067ce4d25749c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<blockquote><p> Schv\u00e1ln\u011b nyn\u00ed zjednodu\u0161uji popis na konkr\u00e9tn\u00ed implementaci, aby \u010dten\u00e1\u0159e p\u0159\u00edli\u0161 nezm\u00e1tl. Pro d\u016fkladn\u011bj\u0161\u00ed \u010dten\u00ed ho odkazuji na sekci <noindex><a rel=\"nofollow\" href=\"#LINKS\">Odkazy<\/a><\/noindex>. Krom\u011b toho Roman Horge, kritizuj\u00edc\u00ed tento \u010dl\u00e1nek za nep\u0159esnosti, slibuje napsat samostatn\u00e9 \u010d\u00edslo o technologi\u00edch virtualizace server\u016f a s\u00edt\u00ed, kter\u00e9 bude podrobn\u011bj\u0161\u00ed a zam\u011b\u0159\u00ed se na detaily.<\/p><\/blockquote>\n<p>V\u011bt\u0161inu s\u00edt\u00ed dnes lze jasn\u011b rozd\u011blit na dv\u011b \u010d\u00e1sti: <\/p>\n<p><b>Podkladov\u00e1<\/b> \u2014 fyzick\u00e1 s\u00ed\u0165 se stabiln\u00ed konfigurac\u00ed.<br \/>\n<b>Nadlo\u017en\u00ed<\/b> \u2014 abstrakce nad podkladovou s\u00edt\u00ed pro izolaci tenant\u016f. <\/p>\n<p>To plat\u00ed jak pro p\u0159\u00edpad datov\u00fdch center (kter\u00fd se v tomto \u010dl\u00e1nku probereme), tak pro ISP (kter\u00fd nebudeme rozeb\u00edrat, proto\u017ee to ji\u017e bylo v <noindex><a rel=\"nofollow\" href=\"https:\/\/linkmeup.ru\/sdsm\">SDN<\/a><\/noindex>). Se s\u00edt\u00ed pro podniky je situace samoz\u0159ejm\u011b pon\u011bkud odli\u0161n\u00e1. <\/p>\n<p>Obr\u00e1zek se zam\u011b\u0159en\u00edm na s\u00ed\u0165:<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/7b7dabc6d9f3b87c598346bf9195d568.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h1>Podkladov\u00e1<\/h1>\n<p>\nUnderlay \u2014 je fyzick\u00e1 s\u00ed\u0165: hardwarov\u00e9 switche a kabely. Za\u0159\u00edzen\u00ed v underlay v\u011bd\u00ed, jak se dostat k fyzick\u00fdm stroj\u016fm.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/776a77a3821fe79a7323947e0bdf67e8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSpol\u00e9h\u00e1 na standardn\u00ed protokoly a technologie. Ne posledn\u00ed \u0159ad\u011b proto, \u017ee hardwarov\u00e1 za\u0159\u00edzen\u00ed pracuj\u00ed na propriet\u00e1rn\u00edm softwaru, kter\u00fd neumo\u017e\u0148uje programov\u00e1n\u00ed \u010dipu ani implementaci vlastn\u00edch protokol\u016f, a proto je pot\u0159eba kompatibilita s jin\u00fdmi dodavateli a standardizace.<\/p>\n<blockquote><p>Ale n\u011bkdo jako Google si m\u016f\u017ee dovolit vyvinout vlastn\u00ed switche a vzd\u00e1t se obecn\u011b uzn\u00e1van\u00fdch protokol\u016f. Ale LAN_DC nen\u00ed Google.\n<\/p><\/blockquote>\n<p> Underlay se pom\u011brn\u011b z\u0159\u00eddka m\u011bn\u00ed, proto\u017ee jeho \u00fakolem je z\u00e1kladn\u00ed IP konektivita mezi fyzick\u00fdmi stroji. Underlay nev\u00ed nic o slu\u017eb\u00e1ch, klientech, tenantech b\u011b\u017e\u00edc\u00edch nad n\u00edm \u2014 pot\u0159ebuje pouze doru\u010dit paket z jednoho stroje na druh\u00fd.<br \/>\nUnderlay m\u016f\u017ee b\u00fdt nap\u0159\u00edklad takov\u00fdto: <\/p>\n<ul>\n<li>IPv4+OSPF<\/li>\n<li>IPv6+ISIS+BGP+L3VPN<\/li>\n<li>L2+TRILL<\/li>\n<li>L2+STP<\/li>\n<\/ul>\n<p>\nUnderlay&#8217;ov\u00e1 s\u00ed\u0165 se nastavuje tradi\u010dn\u00edm zp\u016fsobem: CLI\/GUID\/NETCONF.<\/p>\n<p>Manu\u00e1ln\u011b, skripty, propriet\u00e1rn\u00edmi utilitami.<\/p>\n<p>Dal\u0161\u00ed podrobnosti o underlay budou p\u0159edm\u011btem dal\u0161\u00edho \u010dl\u00e1nku v t\u00e9to s\u00e9rii.<\/p>\n<p><\/p>\n<h1>Nadlo\u017en\u00ed<\/h1>\n<p>\nOverlay \u2014 virtu\u00e1ln\u00ed s\u00ed\u0165 tunel\u016f, nat\u00e1hnut\u00e1 nad Underlay, umo\u017e\u0148uje VM jednoho klienta komunikovat mezi sebou, p\u0159i\u010dem\u017e zaji\u0161\u0165uje izolaci od ostatn\u00edch klient\u016f.<\/p>\n<p>Data klienta jsou inkapsulov\u00e1na do n\u011bjak\u00fdch tunelovac\u00edch hlavi\u010dek pro p\u0159enos p\u0159es spole\u010dnou s\u00ed\u0165.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/3060bc4913c55c21b785083fbe0b603b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak VM jednoho klienta (jedn\u00e9 slu\u017eby) mohou komunikovat mezi sebou p\u0159es Overlay, ani\u017e by m\u011bly tu\u0161en\u00ed, jakou cestu paket ve skute\u010dnosti zab\u00edr\u00e1. <\/p>\n<p>Overlay m\u016f\u017ee b\u00fdt nap\u0159\u00edklad takov\u00fd, jak jsem ji\u017e zm\u00ednil v\u00fd\u0161e:<\/p>\n<ul>\n<li>GRE-tunel<\/li>\n<li>VXLAN<\/li>\n<li>EVPN<\/li>\n<li>L3VPN<\/li>\n<li>GENEVE<\/li>\n<\/ul>\n<p>\nOverlay&#8217;ov\u00e1 s\u00ed\u0165 se obvykle nastavuje a udr\u017euje prost\u0159ednictv\u00edm centr\u00e1ln\u00edho kontrol\u00e9ru. Odtud se konfigurace, Control Plane a Data Plane dod\u00e1vaj\u00ed na za\u0159\u00edzen\u00ed, kter\u00e1 se zab\u00fdvaj\u00ed routov\u00e1n\u00edm a zapouzd\u0159en\u00edm klientsk\u00e9ho provozu. Trochu <noindex><a rel=\"nofollow\" href=\"#TF\">n\u00ed\u017ee<\/a><\/noindex> to rozebereme na p\u0159\u00edkladech.<\/p>\n<p><b>Ano, toto je SDN v \u010dist\u00e9 podob\u011b. <\/b><\/p>\n<p>Existuj\u00ed dva z\u00e1sadn\u011b odli\u0161n\u00e9 p\u0159\u00edstupy k organizaci Overlay s\u00edt\u011b:<\/p>\n<ol>\n<li>Overlay na ToR&#8217;a<\/li>\n<li>Overlay z hostitele<\/li>\n<\/ol>\n<h2>Overlay na ToR&#8217;a<\/h2>\n<p>\nOverlay m\u016f\u017ee za\u010d\u00ednat na p\u0159\u00edstupov\u00e9m switchi (ToR) um\u00edst\u011bn\u00e9m v racku, jak tomu b\u00fdv\u00e1 nap\u0159\u00edklad v p\u0159\u00edpad\u011b VXLAN fabric. <\/p>\n<p>To je prov\u011b\u0159en\u00fd mechanismus v s\u00edt\u00edch ISP a v\u0161ichni dodavatel\u00e9 s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed ho podporuj\u00ed.<\/p>\n<p>V tomto p\u0159\u00edpad\u011b mus\u00ed ToR p\u0159ep\u00edna\u010d um\u011bt odd\u011blovat r\u016fzn\u00e9 slu\u017eby, p\u0159i\u010dem\u017e s\u00ed\u0165ov\u00fd administr\u00e1tor by m\u011bl do ur\u010dit\u00e9 m\u00edry spolupracovat s administr\u00e1tory virtu\u00e1ln\u00edch stroj\u016f a automaticky prov\u00e1d\u011bt zm\u011bny v konfiguraci za\u0159\u00edzen\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/9a5fe4d4a0cbb7e5c3bbac82527c6a6a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOdkazuji \u010dten\u00e1\u0159e na \u010dl\u00e1nek o <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/344326\/\">VxLAN na Habr<\/a><\/noindex> na\u0161eho star\u00e9ho p\u0159\u00edtele <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/bormoglotx\/\">@bormoglotx<\/a><\/noindex>.<br \/>\nV t\u00e9to <noindex><a rel=\"nofollow\" href=\"https:\/\/www.enog.org\/wp-content\/uploads\/presentations\/enog-16\/18-Scaleway-P14-fabric-ENOG16.pdf\">prezentace z ENOG<\/a><\/noindex> podrobn\u011b popisuje p\u0159\u00edstupy k v\u00fdstavb\u011b DC s EVPN VXLAN fabrikou. <\/p>\n<p>Pro podrobn\u011bj\u0161\u00ed pochopen\u00ed reality si m\u016f\u017eete p\u0159e\u010d\u00edst knihu od Cisco <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/td\/docs\/switches\/datacenter\/nexus9000\/sw\/vxlan_evpn\/VXLAN_EVPN.pdf\">A Modern, Open, and Scalable Fabric: VXLAN EVPN<\/a><\/noindex>.<\/p>\n<blockquote><p> Poznamen\u00e1v\u00e1m, \u017ee VXLAN \u2014 to je pouze metoda zapouzd\u0159en\u00ed a terminace tunel\u016f m\u016f\u017ee prob\u00edhat nejen na ToR&#8217;u, ale i na hostiteli, jak se tomu d\u011bje v p\u0159\u00edpad\u011b OpenStack&#8217;a, nap\u0159\u00edklad.<\/p>\n<p>Nicm\u00e9n\u011b, VXLAN-fabrika, kde overlay za\u010d\u00edn\u00e1 na ToR&#8217;u, je jedn\u00edm z ust\u00e1len\u00fdch design\u016f overlayov\u00e9 s\u00edt\u011b.\n<\/p><\/blockquote>\n<p><\/p>\n<h2>Overlay z hostitele<\/h2>\n<p>\nDruh\u00fd p\u0159\u00edstup je za\u010d\u00edt a ukon\u010dit tunely na koncov\u00fdch hostech.<br \/>\nV tomto p\u0159\u00edpad\u011b z\u016fst\u00e1v\u00e1 s\u00ed\u0165 (Underlay) co nejjednodu\u0161\u0161\u00ed a statick\u00e1.<br \/>\nHostitel pak prov\u00e1d\u00ed v\u0161echny pot\u0159ebn\u00e9 enkapsulace.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/c9c2971369d1b3e5f026d6844afeb67f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK tomu bude samoz\u0159ejm\u011b nutn\u00e9 spustit speci\u00e1ln\u00ed aplikaci na hostitel\u00edch, ale stoj\u00ed to za to. <\/p>\n<p>Za prv\u00e9, spu\u0161t\u011bn\u00ed klienta na linuxov\u00e9m stroji je jednodu\u0161\u0161\u00ed, nebo l\u00e9pe \u0159e\u010deno \u2014 v\u016fbec mo\u017en\u00e9 \u2014 zat\u00edmco na p\u0159ep\u00edna\u010di pravd\u011bpodobn\u011b bude nutn\u00e9 se zat\u00edm obr\u00e1tit na propriet\u00e1rn\u00ed SDN \u0159e\u0161en\u00ed, co\u017e zab\u00edj\u00ed my\u0161lenku multivendoru.<\/p>\n<p>Za druh\u00e9, ToR-switch v tomto p\u0159\u00edpad\u011b lze udr\u017eet co nejjednodu\u0161\u0161\u00ed, jak z pohledu Control Plane, tak i Data Plane. Skute\u010dn\u011b \u2014 s SDN-kontrol\u00e9rem se s n\u00edm pak nemus\u00ed komunikovat a uchov\u00e1vat s\u00edt\u011b\/ARP v\u0161ech p\u0159ipojen\u00fdch klient\u016f \u2014 sta\u010d\u00ed v\u011bd\u011bt IP adresu fyzick\u00e9ho stroje, co\u017e zna\u010dn\u011b usnad\u0148uje tabulky p\u0159ep\u00edn\u00e1n\u00ed\/routing.<\/p>\n<p>\nV s\u00e9rii ADSM vol\u00edm p\u0159\u00edstup overlay z hosta \u2014 d\u00e1le budeme mluvit pouze o n\u011bm a k VXLAN fabrice se ji\u017e nebudeme vracet.<\/p>\n<p>\nNejjednodu\u0161\u0161\u00ed je to ilustrovat na p\u0159\u00edkladech. A jako pokusn\u00fd objekt si vezmeme open-source SDN platformu OpenContrail, nyn\u00ed zn\u00e1mou jako <noindex><a rel=\"nofollow\" href=\"https:\/\/tungsten.io\">Tungsten Fabric<\/a><\/noindex>.<\/p>\n<blockquote><p> Na konci \u010dl\u00e1nku uvedu n\u011bkolik \u00favah o analogii s OpenFlow a OpenvSwitch.\n<\/p><\/blockquote>\n<p><\/p>\n<h2>Na p\u0159\u00edkladu Tungsten Fabric<\/h2>\n<p>\nNa ka\u017ed\u00e9m fyzick\u00e9m stroji je <b>vRouter<\/b> \u2014 virtu\u00e1ln\u00ed router, kter\u00fd zn\u00e1 p\u0159ipojen\u00e9 s\u00edt\u011b a kter\u00fdm klient\u016fm pat\u0159\u00ed \u2014 v z\u00e1sad\u011b \u2014 PE-router. Pro ka\u017ed\u00e9ho klienta udr\u017euje izolovanou tabulku routov\u00e1n\u00ed (\u010dti VRF). A samotn\u00fd vRouter prov\u00e1d\u00ed overlayov\u00e9 tunelov\u00e1n\u00ed.<\/p>\n<p>Trochu podrobn\u011bji o vRouteru \u2014 na konci \u010dl\u00e1nku.<\/p>\n<p>Ka\u017ed\u00e1 VM um\u00edst\u011bn\u00e1 na hypervizoru je spojena s vRouter&#8217;em tohoto stroje prost\u0159ednictv\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/TUN\/TAP\">TAP rozhran\u00ed<\/a><\/noindex>.<\/p>\n<p><b>TAP<\/b> \u2014 Terminal Access Point \u2014 virtu\u00e1ln\u00ed rozhran\u00ed v j\u00e1d\u0159e Linuxu, kter\u00e9 umo\u017e\u0148uje prov\u00e1d\u011bt s\u00ed\u0165ovou komunikaci.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/a6fa1b4370ba4e787303ae647a28f5ed.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPokud za vRouter&#8217;em existuje n\u011bkolik s\u00edt\u00ed, pro ka\u017edou z nich se vytv\u00e1\u0159\u00ed virtu\u00e1ln\u00ed rozhran\u00ed, na kter\u00e9 se p\u0159i\u0159azuje IP adresa \u2014 ta bude v\u00fdchoz\u00ed adresou br\u00e1ny.<br \/>\nV\u0161echny s\u00edt\u011b jednoho klienta jsou um\u00edst\u011bny v jednom <b>VRF<\/b> (jedn\u00e9 tabulce), r\u016fzn\u00e9 \u2014 v r\u016fzn\u00e9.<br \/>\n<i>Ud\u011bl\u00e1m zde pozn\u00e1mku, \u017ee to nen\u00ed tak jednoduch\u00e9, a po\u0161lu zv\u00eddav\u00e9ho \u010dten\u00e1\u0159e na konec \u010dl\u00e1nku.<\/i>.<\/p>\n<p>Aby si vRouter&#8217;y mohly vym\u011b\u0148ovat informace, a tedy tak\u00e9 VM, kter\u00e9 jsou za nimi, vym\u011b\u0148uj\u00ed si sm\u011brovac\u00ed informace prost\u0159ednictv\u00edm <b>SDN kontroler<\/b>.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/sdn-controller.png\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/8b133e10582dbde9c0670ad98c1840de.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Abychom se dostali do vn\u011bj\u0161\u00edho sv\u011bta, existuje v\u00fdstupn\u00ed bod z matice \u2014 br\u00e1na virtu\u00e1ln\u00ed s\u00edt\u011b <b>VNGW<\/b> \u2014 Virtual Network GateWay (<i>m\u016fj term\u00edn<\/i>).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/vngw.png\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/9ac4d084d9b58b7ed1bc2c0ed6d06059.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\nNyn\u00ed si probereme p\u0159\u00edklady komunikac\u00ed \u2014 a bude jasno.<\/p>\n<p><\/p>\n<h3>Komunikace uvnit\u0159 jednoho fyzick\u00e9ho stroje<\/h3>\n<p>\nVM0 chce poslat paket na VM2. P\u0159edpokl\u00e1dejme zat\u00edm, \u017ee se jedn\u00e1 o VM jednoho klienta.<\/p>\n<h4>Data Plane<\/h4>\n<p><\/p>\n<ol>\n<li>VM-0 m\u00e1 v\u00fdchoz\u00ed trasu na jeho rozhran\u00ed eth0. Paket je odesl\u00e1n tam.<br \/>\n Toto rozhran\u00ed eth0 je ve skute\u010dnosti virtu\u00e1ln\u011b spojeno s virtu\u00e1ln\u00edm routerem vRouter p\u0159es TAP rozhran\u00ed tap0.<\/li>\n<li>vRouter analyzuje, na kter\u00e9 rozhran\u00ed paket p\u0159i\u0161el, tj. ke kter\u00e9mu klientovi (VRF) pat\u0159\u00ed, srovn\u00e1v\u00e1 adresu p\u0159\u00edjemce s tabulkou sm\u011brov\u00e1n\u00ed tohoto klienta.<\/li>\n<li>Kdy\u017e zjist\u00ed, \u017ee p\u0159\u00edjemce je na stejn\u00e9m stroji za jin\u00fdm portem, vRouter jednodu\u0161e ode\u0161le paket k n\u011bmu bez jak\u00fdchkoliv dal\u0161\u00edch hlavi\u010dek \u2014 v tomto p\u0159\u00edpad\u011b m\u00e1 vRouter ji\u017e ARP z\u00e1znam. <\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/a42da3f48a3f538eb92c1908d9d66921.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPacket in this case does not fall into the physical network \u2014 it is routed internally within the vRouter.<\/p>\n<p><\/p>\n<h4>Control Plane<\/h4>\n<p>\nHypervizor p\u0159i spu\u0161t\u011bn\u00ed virtu\u00e1ln\u00edho stroje j\u00ed ozn\u00e1m\u00ed:<\/p>\n<ul>\n<li>Jej\u00ed vlastn\u00ed IP adresu.<\/li>\n<li>The default route is through the IP address of the vRouter in this network.<\/li>\n<\/ul>\n<p>\nThe vRouter informs the hypervisor via a special API that:<\/p>\n<ul>\n<li>\u017de je t\u0159eba vytvo\u0159it virtu\u00e1ln\u00ed rozhran\u00ed.<\/li>\n<li>Jakou pot\u0159ebuje (VM) vytvo\u0159it Virtu\u00e1ln\u00ed s\u00ed\u0165.<\/li>\n<li>K jak\u00e9mu VRF ji (VN) p\u0159ipojit.<\/li>\n<li>Statick\u00e1 ARP z\u00e1znam pro tuto VM \u2014 za kter\u00fdm rozhran\u00edm se nach\u00e1z\u00ed jej\u00ed IP adresa a ke kter\u00e9mu MAC adresa je p\u0159i\u0159azena.<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p> Znovu, skute\u010dn\u00fd postup interakce je zjednodu\u0161en ve prosp\u011bch pochopen\u00ed konceptu.\n<\/p><\/blockquote>\n<p> <img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/593d7ad41782e882a88732b475bf91cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak\u017ee v\u0161echny VM jednoho klienta na tomto stroji vRouter vid\u00ed jako p\u0159\u00edmo p\u0159ipojen\u00e9 s\u00edt\u011b a mohou mezi nimi samy sm\u011brovat.<\/p>\n<p>\nVM0 and VM1 belong to different clients, respectively, residing in different tables of the vRouter.<\/p>\n<p>Zda budou moci komunikovat p\u0159\u00edmo, z\u00e1vis\u00ed na nastaven\u00ed vRouteru a n\u00e1vrhu s\u00edt\u011b.<br \/>\nFor example, if both clients' VMs use public addresses, or NAT occurs on the vRouter itself, direct routing to the vRouter can be implemented.<\/p>\n<p>Naopak v jin\u00e9 situaci m\u016f\u017ee doj\u00edt ke kolizi adresov\u00fdch prostor\u016f \u2014 je nutn\u00e9 p\u0159ej\u00edt p\u0159es NAT server, aby se z\u00edskala ve\u0159ejn\u00e1 adresa \u2014 to vypad\u00e1 jako v\u00fdstup do extern\u00edch s\u00edt\u00ed, o kter\u00fdch bude podrobn\u011bji zm\u00edn\u011bno n\u00ed\u017ee.<\/p>\n<h3>Komunikace mezi VM um\u00edst\u011bn\u00fdmi na r\u016fzn\u00fdch fyzick\u00fdch stroj\u00edch<\/h3>\n<p><\/p>\n<h4>Data Plane<\/h4>\n<p><\/p>\n<ol>\n<li>Za\u010d\u00e1tek je p\u0159esn\u011b stejn\u00fd: VM-0 pos\u00edl\u00e1 paket adres\u00e1tovi VM-7 (172.17.3.2) podle sv\u00e9ho v\u00fdchoz\u00edmu nastaven\u00ed.<\/li>\n<li>vRouter jej p\u0159ij\u00edm\u00e1 a tentokr\u00e1t vid\u00ed, \u017ee adres\u00e1t je na jin\u00e9m stroji a je dostupn\u00fd p\u0159es tunel Tunnel0.<\/li>\n<li>Nejprve p\u0159id\u00e1v\u00e1 MPLS ozna\u010den\u00ed, kter\u00e9 identifikuje vzd\u00e1len\u00e9 rozhran\u00ed, aby na opa\u010dn\u00e9 stran\u011b vRouter mohl ur\u010dit, kam tento paket um\u00edstit, a to bez dodate\u010dn\u00fdch obchvat\u016f.\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/inter-hv-dp.png\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/1e159049376e2bf458b8c6cb5878cc17.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex>\n <\/li>\n<li>Tunnel0 m\u00e1 zdroj 10.0.0.2, p\u0159\u00edjemce: 10.0.1.2.<br \/>\n vRouter p\u0159id\u00e1v\u00e1 GRE (nebo UDP) hlavi\u010dky a novou IP k v\u00fdchoz\u00edmu paketu.<\/li>\n<li>V tabulce sm\u011brov\u00e1n\u00ed vRouteru je v\u00fdchoz\u00ed trasa p\u0159es adresu ToR1 10.0.0.1. Tam a pos\u00edl\u00e1.\n<p> <img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/8cb98a8ec43d202259acf6a1fcaeb3ee.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n \n <\/li>\n<li>ToR1 jako \u00fa\u010dastn\u00edk Underlay s\u00edt\u011b v\u00ed (nap\u0159\u00edklad z OSPF), jak se dostat k 10.0.1.2, a odes\u00edl\u00e1 paket podle trasy. V\u0161imn\u011bte si, \u017ee zde se zap\u00edn\u00e1 ECMP. Na ilustraci jsou dv\u011b next-hopy, a r\u016fzn\u00e9 toky se do nich rozlo\u017e\u00ed podle hash. V p\u0159\u00edpad\u011b skute\u010dn\u00e9 tov\u00e1rny by zde bylo sp\u00ed\u0161e 4 next-hopy.\n<p>P\u0159itom v\u011bd\u011bt, co se nach\u00e1z\u00ed pod vn\u011bj\u0161\u00edm IP z\u00e1hlav\u00edm, nen\u00ed t\u0159eba. Tedy fakticky pod IP m\u016f\u017ee b\u00fdt sendvi\u010d z IPv6 p\u0159es MPLS p\u0159es Ethernet p\u0159es MPLS p\u0159es GRE p\u0159es....<\/li>\n<li>Na p\u0159ij\u00edmac\u00ed stran\u011b tedy vRouter odejme GRE a podle MPLS ozna\u010den\u00ed ur\u010d\u00ed, do kter\u00e9ho rozhran\u00ed m\u00e1 tento paket poslat, odstran\u00ed ho a po\u0161le ho v p\u016fvodn\u00ed podob\u011b p\u0159\u00edjemci.<\/li>\n<\/ol>\n<h4>Control Plane<\/h4>\n<p>\nP\u0159i spu\u0161t\u011bn\u00ed stroje se d\u011bje to sam\u00e9, co bylo pops\u00e1no v\u00fd\u0161e.<\/p>\n<p>A nav\u00edc je\u0161t\u011b n\u00e1sleduj\u00edc\u00ed:<\/p>\n<ul>\n<li>Pro ka\u017ed\u00e9ho klienta vRouter p\u0159id\u011bluje MPLS zna\u010dku. To je servisn\u00ed zna\u010dka L3VPN, podle kter\u00e9 budou klienti rozd\u011bleni v r\u00e1mci jednoho fyzick\u00e9ho za\u0159\u00edzen\u00ed.<br \/>\n<blockquote><p> In fact, an MPLS label is allocated by the vRouter unconditionally all the time \u2014 as it is unknown in advance whether the machine will interact only with other machines behind the same vRouter, and this is most likely not the case. \n <\/p><\/blockquote>\n<\/li>\n<li>vRouter navazuje spojen\u00ed s SDN kontrol\u00e9rem p\u0159es protokol BGP (nebo podobn\u00fd \u2014 v p\u0159\u00edpad\u011b TF je to XMPP 0_o).<\/li>\n<li>Sestaven\u00edm t\u00e9to relace vRouter oznamuje SDN kontrol\u00e9ru sm\u011bry k p\u0159ipojen\u00fdm s\u00edt\u00edm:\n<ul>\n<li>Adresa s\u00edt\u011b<\/li>\n<li>Metoda enkapsulace (MPLSoGRE, MPLSoUDP, VXLAN)<\/li>\n<li>MPLS zna\u010dka klienta<\/li>\n<li>Jeho IP adresu jako nexthop<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>The SDN controller receives such routes from all connected vRouters and reflects them to others. Thus, it acts as a Route Reflector.<\/li>\n<\/ul>\n<p>\nTo sam\u00e9 se d\u011bje i na opa\u010dn\u00e9 stran\u011b.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/inter-hv-cp.png\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/feef9181133f3a50a5cb21aa7ba16dc0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Overlay se m\u016f\u017ee m\u011bnit i ka\u017edou minutu. P\u0159esn\u011b tak to funguje v ve\u0159ejn\u00fdch cloudech, kdy\u017e klienti pravideln\u011b spou\u0161t\u011bj\u00ed a vyp\u00ednaj\u00ed sv\u00e9 virtu\u00e1ln\u00ed stroje.<\/p>\n<p>Centr\u00e1ln\u00ed kontrol\u00e9r se uj\u00edm\u00e1 v\u0161ech slo\u017eitost\u00ed spojen\u00fdch s \u00fadr\u017ebou konfigurace a kontrolou tabulek p\u0159ep\u00edn\u00e1n\u00ed\/routingu na vRouter.<\/p>\n<p>Roughly speaking, the controller connects with all vRouters via BGP (or a similar protocol) and simply forwards routing information. BGP, for instance, already has an Address-Family for conveying encapsulation methods. <noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc4023\">MPLS-in-GRE<\/a><\/noindex> nebo <noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc7510\">MPLS-in-UDP<\/a><\/noindex>.<\/p>\n<p>P\u0159itom se nijak nem\u011bn\u00ed konfigurace Underlay s\u00edt\u011b, kterou je mimochodem mnohem slo\u017eit\u011bj\u0161\u00ed automatizovat, a je jednodu\u0161\u0161\u00ed ji rozb\u00edt ne\u0161ikovn\u00fdm pohybem.<\/p>\n<h3>V\u00fdstup do vn\u011bj\u0161\u00edho sv\u011bta<\/h3>\n<p>\nN\u011bkde mus\u00ed simulace skon\u010dit a z virtu\u00e1ln\u00edho sv\u011bta je t\u0159eba p\u0159ej\u00edt do re\u00e1ln\u00e9ho. A je pot\u0159eba telefonn\u00ed br\u00e1na.<\/p>\n<p>Existuj\u00ed dva p\u0159\u00edstupy:<\/p>\n<ol>\n<li>Instalace hardwarov\u00e9ho routeru.<\/li>\n<li>Spu\u0161t\u011bn\u00ed n\u011bjak\u00e9ho apace, kter\u00fd implementuje funkce routeru (ano, ano, po SDN jsme se setkali i s VNF). Pojmenujme to virtu\u00e1ln\u00ed br\u00e1na.<\/li>\n<\/ol>\n<p><\/p>\n<blockquote><p> V\u00fdhodou druh\u00e9ho p\u0159\u00edstupu je levn\u00e1 horizont\u00e1ln\u00ed \u0161k\u00e1lovatelnost \u2014 pokud chyb\u00ed v\u00fdkon, spust\u00edme dal\u0161\u00ed virtu\u00e1lku se br\u00e1nou. Na jak\u00e9mkoli fyzick\u00e9m za\u0159\u00edzen\u00ed, bez nutnosti hledat voln\u00e9 stojany, jednotky, nap\u00e1jen\u00ed, kupovat samotn\u00fd hardware, dov\u00e1\u017eet, instalovat, zapojovat, konfigurovat a pak je\u0161t\u011b m\u011bnit vadn\u00e9 komponenty.<\/p>\n<p>Nev\u00fdhody virtu\u00e1ln\u00edho br\u00e1ny spo\u010d\u00edvaj\u00ed v tom, \u017ee fyzick\u00fd sm\u011brova\u010d je mnohem v\u00fdkonn\u011bj\u0161\u00ed ne\u017e v\u00edcejadrov\u00fd virtu\u00e1ln\u00ed stroj, a jeho software, p\u0159izp\u016fsoben\u00fd jeho hardwarov\u00e9 z\u00e1kladn\u011b, pracuje v\u00fdrazn\u011b stabiln\u011bji (<i>ne<\/i>). Je t\u011b\u017ek\u00e9 pop\u0159\u00edt, \u017ee softwarov\u00fd a hardwarov\u00fd komplex jednodu\u0161e funguje a vy\u017eaduje pouze nastaven\u00ed, zat\u00edmco spu\u0161t\u011bn\u00ed a \u00fadr\u017eba virtu\u00e1ln\u00ed br\u00e1ny je z\u00e1le\u017eitost\u00ed siln\u00fdch in\u017een\u00fdr\u016f.\n<\/p><\/blockquote>\n<p> Jednou nohou br\u00e1na nahl\u00ed\u017e\u00ed do virtu\u00e1ln\u00ed s\u00edt\u011b Overlay, jako b\u011b\u017en\u00e1 virtu\u00e1ln\u00ed stroj, a m\u016f\u017ee interagovat se v\u0161emi ostatn\u00edmi VM. M\u016f\u017ee tak\u00e9 terminovat s\u00edt\u011b v\u0161ech klient\u016f a t\u00edm p\u00e1dem prov\u00e1d\u011bt sm\u011brov\u00e1n\u00ed mezi nimi.<\/p>\n<p>Druhou nohou br\u00e1na nahl\u00ed\u017e\u00ed ji\u017e do p\u00e1te\u0159n\u00ed s\u00edt\u011b a v\u00ed, jak se dostat na Internet.<\/p>\n<p><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/552fa0428ff8dd3aed76091a86a72109.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h4>Data Plane<\/h4>\n<p>\nTo znamen\u00e1, \u017ee proces vypad\u00e1 takto: <\/p>\n<ol>\n<li>VM-0, having default in the same vRouter, sends a packet with an external address (185.147.83.177) to the interface eth0.<\/li>\n<li>vRouter obdr\u017e\u00ed tento paket a provede lookup c\u00edlov\u00e9 adresy v tabulce sm\u011brov\u00e1n\u00ed \u2013 najde v\u00fdchoz\u00ed trasu p\u0159es br\u00e1nu VNGW1 prost\u0159ednictv\u00edm tunelu 1. <br \/>\n Tak\u00e9 vid\u00ed, \u017ee se jedn\u00e1 o tunel GRE se SIP 10.0.0.2 a DIP 10.0.255.2, a \u017ee je t\u0159eba nejprve p\u0159i\u0159adit MPLS zna\u010dku tohoto klienta, kterou VNGW1 o\u010dek\u00e1v\u00e1.\n <\/li>\n<li>vRouter zabal\u00ed p\u016fvodn\u00ed paket do hlavi\u010dek MPLS, GRE a nov\u00e9 IP a ode\u0161le na adresu ToR1 10.0.0.1 podle v\u00fdchoz\u00edho nastaven\u00ed.<\/li>\n<li>Podkladov\u00e1 s\u00ed\u0165 doru\u010d\u00ed paket k br\u00e1n\u011b VNGW1.<\/li>\n<li>Br\u00e1na VNGW1 odstran\u00ed tunelovac\u00ed hlavi\u010dky GRE a MPLS, pod\u00edv\u00e1 se na c\u00edlovou adresu, konzultuje svou tabulku sm\u011brov\u00e1n\u00ed a ch\u00e1pe, \u017ee je sm\u011brov\u00e1na na Internet \u2013 tedy prost\u0159ednictv\u00edm Full View nebo Default. V p\u0159\u00edpad\u011b pot\u0159eby provede NAT transformaci.<\/li>\n<li>Od VNGW k hranici m\u016f\u017ee b\u00fdt b\u011b\u017en\u00e1 IP s\u00ed\u0165, co\u017e je nepravd\u011bpodobn\u00e9.<br \/>\n M\u016f\u017ee to b\u00fdt klasick\u00e1 MPLS s\u00ed\u0165 (IGP+LDP\/RSVP TE), m\u016f\u017ee to b\u00fdt zp\u011btn\u00e1 fabrika s BGP LU nebo GRE tunel od VNGW k hranici p\u0159es IP s\u00ed\u0165.<br \/>\n A\u0165 je to jakkoli, VNGW1 provede pot\u0159ebn\u00e9 enkapsulace a ode\u0161le p\u016fvodn\u00ed paket sm\u011brem k hranici.<\/li>\n<\/ol>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/outside-dp.png\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/a66e490c75f8220349398af814d4ebf2.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Provoz zp\u011bt proch\u00e1z\u00ed stejn\u00fdmi kroky v opa\u010dn\u00e9m po\u0159ad\u00ed. <\/p>\n<ol>\n<li>Hranice doru\u010d\u00ed paket k VNGW1<\/li>\n<li>Ten jej rozlo\u017e\u00ed, pod\u00edv\u00e1 se na c\u00edlovou adresu a vid\u00ed, \u017ee je dostupn\u00e1 prost\u0159ednictv\u00edm tunelu Tunnel1 (MPLSoGRE nebo MPLSoUDP).<\/li>\n<li>Podle toho p\u0159i\u0159azuje zna\u010dku MPLS, hlavi\u010dku GRE\/UDP a novou IP a odes\u00edl\u00e1 na sv\u016fj ToR3 10.0.255.1.<br \/>\n The destination address of the tunnel is the IP address of the vRouter behind which the target VM resides \u2014 10.0.0.2.<\/li>\n<li>The underlay network delivers the packet to the appropriate vRouter. <\/li>\n<li>C\u00edlov\u00fd vRouter rozbal\u00ed GRE\/UDP, ur\u010d\u00ed rozhran\u00ed podle MPLS \u0161t\u00edtku a ode\u0161le hol\u00fd IP paket do sv\u00e9ho TAP rozhran\u00ed, kter\u00e9 je spojeno s eth0 VM.<\/li>\n<\/ol>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/outside-dp-reverse.png\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/ba6748694a822fc04f4e872658d1fbbb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><\/p>\n<h4>Control Plane<\/h4>\n<p>\nVNGW1 establishes BGP peering with the SDN controller from which it receives all routing information about clients: which client is behind which IP address (vRouter) and which MPLS label they are identified by.<\/p>\n<p>Similarly, it informs the SDN controller of the default route with the client's label, designating itself as the nexthop. Then, this default route is sent to the vRouters.<\/p>\n<p>Na VNGW se obvykle prov\u00e1d\u00ed agregace sm\u011brov\u00e1n\u00ed nebo NAT p\u0159eklad.<\/p>\n<p>And in the opposite direction, it passes the aggregated route in the session with the borders or Route Reflectors. From them, it receives the default route or Full-View, or something else.<\/p>\n<p>Z hlediska zapouzd\u0159en\u00ed a v\u00fdm\u011bny provozu se VNGW od vRouteru nijak neli\u0161\u00ed. <br \/>\nIf we slightly expand the scope, we can add other network devices, such as firewalls, cleaning or traffic enrichment farms, IPS, and so on, to VNGW and vRouters.<\/p>\n<p>And by sequentially creating VRFs and correctly announcing routes, you can make the traffic loop as you wish, which is called Service Chaining.<\/p>\n<p>That is, in this case, the SDN controller also serves as a Route Reflector between VNGW, vRouters, and other network devices.<\/p>\n<p>Ale ve skute\u010dnosti kontrol\u00e9r p\u0159en\u00e1\u0161\u00ed tak\u00e9 informace o ACL a PBR (Policy Based Routing), co\u017e donut\u00ed jednotliv\u00e9 toky provozu chovat se jinak, ne\u017e jak jim ur\u010duje trasa.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/fs.linkmeup.ru\/images\/adsm\/1\/outside-cp.png\"><img decoding=\"async\" alt=\"Automatizace pro nejmen\u0161\u00ed. \u010c\u00e1st prvn\u00ed (ta po nult\u00e9). Virtualizace s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/07\/dbba5a93d64edf56dc9c2b82311c5a11.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h1>\u010casto kladen\u00e9 dotazy<\/h1>\n<p><b>Pro\u010d st\u00e1le d\u011bl\u00e1\u0161 pozn\u00e1mku o GRE\/UDP?<\/b><\/p>\n<p>No, vlastn\u011b, to bych \u0159ekl, \u017ee je specifick\u00e9 pro Tungsten Fabric \u2013 v\u016fbec se to nemus\u00ed br\u00e1t v \u00favahu.<\/p>\n<p>Ale pokud vz\u00edt, samotn\u00fd TF, je\u0161t\u011b jako OpenContrail podporoval ob\u011b inkapsulace: MPLS v GRE a MPLS v UDP. <\/p>\n<p>UDP je dobr\u00fd t\u00edm, \u017ee v Source Portu v jeho z\u00e1hlav\u00ed lze snadno zak\u00f3dovat hash funkci z p\u016fvodn\u00edch IP+Proto+Port, co\u017e umo\u017e\u0148uje vyva\u017eov\u00e1n\u00ed. <\/p>\n<p>V p\u0159\u00edpad\u011b GRE, bohu\u017eel, existuj\u00ed pouze vn\u011bj\u0161\u00ed z\u00e1hlav\u00ed IP a GRE, kter\u00e9 jsou stejn\u00e9 pro cel\u00fd zapouzd\u0159en\u00fd provoz a o vyva\u017eov\u00e1n\u00ed nem\u016f\u017ee b\u00fdt \u0159e\u010d \u2013 m\u00e1lokdo se m\u016f\u017ee pono\u0159it tak hluboko dovnit\u0159 paketu.<\/p>\n<p>A\u017e doned\u00e1vna um\u011bly sm\u011brova\u010de, pokud m\u011bly dynamick\u00e9 tunely, pouze v MPLSoGRE, a teprve ned\u00e1vno se nau\u010dily i MPLSoUDP. Proto je v\u017edy nutn\u00e9 zm\u00ednit mo\u017enosti dvou r\u016fzn\u00fdch enkapsulac\u00ed.<\/p>\n<p>Z pohledu spravedlnosti stoj\u00ed za zm\u00ednku, \u017ee TF pln\u011b podporuje i L2 spojen\u00ed pomoc\u00ed VXLAN.<\/p>\n<p>\n<b>Sl\u00edbil jsi, \u017ee vysv\u011btl\u00ed\u0161 paralely s OpenFlow.<\/b><br \/>\nOni se skute\u010dn\u011b nab\u00edzej\u00ed. vSwitch ve stejn\u00e9m OpenStack d\u011bl\u00e1 velmi podobn\u00e9 v\u011bci, pou\u017e\u00edvaj\u00edc\u00ed VXLAN, kter\u00fd m\u00e1 mimochodem tak\u00e9 UDP hlavi\u010dku.<\/p>\n<p>V Data Plane pracuj\u00ed zhruba stejn\u011b, v\u00fdznamn\u011b se li\u0161\u00ed Control Plane. Tungsten Fabric pou\u017e\u00edv\u00e1 XMPP k doru\u010dov\u00e1n\u00ed informac\u00ed o tras\u00e1ch na vRouter, zat\u00edmco v OpenStack pracuje Openflow.<\/p>\n<p>\n<b>Mohl bys \u0159\u00edct n\u011bco v\u00edce o vRouteru?<\/b><br \/>\nD\u011bl\u00ed se na dv\u011b \u010d\u00e1sti: vRouter Agent a vRouter Forwarder.<\/p>\n<p>Prvn\u00ed b\u011b\u017e\u00ed v u\u017eivatelsk\u00e9m prostoru hostitelsk\u00e9ho opera\u010dn\u00edho syst\u00e9mu a komunikuje se SDN kontrolerem, vym\u011b\u0148uje si informace o sm\u011brech, VRF a ACL.<\/p>\n<p>Druh\u00fd realizuje Data Plane \u2013 obvykle v Kernel Space, ale m\u016f\u017ee b\u00fdt spu\u0161t\u011bn i na SmartNIC, co\u017e jsou s\u00ed\u0165ov\u00e9 karty s CPU a samostatn\u00fdm programovateln\u00fdm \u010dipem pro p\u0159ep\u00edn\u00e1n\u00ed, co\u017e umo\u017e\u0148uje odv\u00e9st z\u00e1t\u011b\u017e z CPU hostitelsk\u00e9 ma\u0161iny a u\u010dinit s\u00ed\u0165 rychlej\u0161\u00ed a p\u0159edv\u00eddateln\u011bj\u0161\u00ed. <\/p>\n<p>Tak\u00e9 je mo\u017en\u00fd sc\u00e9n\u00e1\u0159, kdy je vRouter aplikace DPDK v u\u017eivatelsk\u00e9m prostoru. <\/p>\n<p>vRouter Agent p\u0159ed\u00e1v\u00e1 nastaven\u00ed na vRouter Forwarder.<\/p>\n<p>\n<b>Co je to Virtual Network?<\/b><br \/>\nNa za\u010d\u00e1tku \u010dl\u00e1nku jsem zm\u00ednil VRF, \u017ee ka\u017ed\u00fd tenant je v\u00e1z\u00e1n na sv\u016fj VRF. A pokud pro povrchn\u00ed pochopen\u00ed fungov\u00e1n\u00ed overlay s\u00edt\u011b to bylo dostate\u010dn\u00e9, pak u\u017e v dal\u0161\u00ed iteraci je t\u0159eba prov\u00e9st up\u0159esn\u011bn\u00ed.<\/p>\n<p>Obvykle jsou v mechanismu virtualizace entity Virtual Network (m\u016f\u017eete to pova\u017eovat za vlastn\u00ed jm\u00e9no) zavedeny odd\u011blen\u011b od klient\u016f\/tenant\u016f\/virtu\u00e1ln\u00edch stroj\u016f \u2013 je to docela samostatn\u00e1 v\u011bc. A tuto Virtual Network lze p\u0159es rozhran\u00ed p\u0159ipojit k jednomu tenantovi, druh\u00e9mu, dv\u011bma, klidn\u011b kamkoli. Takto se nap\u0159\u00edklad realizuje Service Chaining, kdy\u017e je t\u0159eba p\u0159ev\u00e9st provoz p\u0159es ur\u010dit\u00e9 nody v po\u017eadovan\u00e9 posloupnosti, jednodu\u0161e vytv\u00e1\u0159en\u00edm a p\u0159i\u0159azov\u00e1n\u00edm Virtual Network v spr\u00e1vn\u00e9 posloupnosti.<\/p>\n<p>Proto neexistuje \u017e\u00e1dn\u00e9 p\u0159\u00edm\u00e9 odpov\u00eddaj\u00edc\u00ed spojen\u00ed mezi Virtual Network a tenantem.<\/p>\n<h1>Z\u00e1v\u011br<\/h1>\n<p>\nToto je velmi obecn\u00fd popis fungov\u00e1n\u00ed virtu\u00e1ln\u00ed s\u00edt\u011b s overlay s hostitele a SDN kontrol\u00e9rem. Ale a\u0165 u\u017e vezmete jakoukoli virtualiza\u010dn\u00ed platformu dnes, bude fungovat podobn\u00fdm zp\u016fsobem, a\u0165 u\u017e je to VMWare, ACI, OpenStack, CloudStack, Tungsten Fabric nebo Juniper Contrail. Li\u0161it se budou typy enkapsulac\u00ed a hlavi\u010dek, protokoly doru\u010dov\u00e1n\u00ed informac\u00ed k c\u00edlov\u00fdm s\u00ed\u0165ov\u00fdm za\u0159\u00edzen\u00edm, ale princip softwarov\u011b definovan\u00e9 overlay s\u00edt\u011b, kter\u00e1 funguje nad relativn\u011b jednoduchou a statickou underlay s\u00edt\u00ed, z\u016fstane stejn\u00fd.<br \/>\nLze \u0159\u00edci, \u017ee oblasti vytv\u00e1\u0159en\u00ed soukrom\u00e9ho cloudu dnes vyhr\u00e1ly SDN zalo\u017een\u00e9 na overlay s\u00edti. To v\u0161ak neznamen\u00e1, \u017ee OpenFlow nem\u00e1 m\u00edsto v modern\u00edm sv\u011bt\u011b \u2014 je pou\u017e\u00edv\u00e1n v OpenStacku a tak\u00e9 ve VMWare NSX, jak mi je zn\u00e1mo, pou\u017e\u00edv\u00e1 ho Google pro konfiguraci underlay s\u00edt\u011b.<\/p>\n<p>N\u00ed\u017ee uv\u00e1d\u00edm odkazy na podrobn\u011bj\u0161\u00ed materi\u00e1ly, pokud chcete studovat t\u00e9ma hloub\u011bji. <\/p>\n<p>A co n\u00e1\u0161 Underlay? <\/p>\n<p>A vlastn\u011b nic. Celou dobu se nem\u011bnil. V\u0161echno, co mus\u00ed d\u011blat v p\u0159\u00edpad\u011b overlaye z hostitele \u2013 je aktualizovat trasy a ARP, jak se objevuj\u00ed a miz\u00ed vRouter\/VNGW a pos\u00edlat pakety mezi nimi.<\/p>\n<p>Poj\u010fme formulovat seznam po\u017eadavk\u016f na Underlay s\u00ed\u0165.<\/p>\n<ol>\n<li>B\u00fdt schopen pou\u017e\u00edt n\u011bjak\u00fd sm\u011brovac\u00ed protokol, v na\u0161em p\u0159\u00edpad\u011b \u2014 BGP.<\/li>\n<li>M\u00edt \u0161irokou \u0161\u00ed\u0159ku p\u00e1sma, ide\u00e1ln\u011b bez p\u0159et\u00ed\u017een\u00ed, aby se zamezilo ztr\u00e1t\u00e1m paket\u016f v d\u016fsledku p\u0159et\u00ed\u017een\u00ed.<\/li>\n<li>Podporovat ECMP \u2014 ned\u00edln\u00e1 sou\u010d\u00e1st fabriky.<\/li>\n<li>B\u00fdt schopen zajistit QoS, v\u010detn\u011b slo\u017eit\u011bj\u0161\u00edch v\u011bc\u00ed, jako je ECN.<\/li>\n<li>Podporovat NETCONF \u2014 p\u0159\u00edprava na budoucnost.<\/li>\n<\/ol>\n<p>\nPr\u00e1ci samotn\u00e9 Underlay s\u00edt\u011b jsem zde v\u011bnoval velmi m\u00e1lo \u010dasu. To je proto, \u017ee se v dal\u0161\u00ed \u010d\u00e1sti s\u00e9rie budu pr\u00e1v\u011b na n\u00ed soust\u0159edit, zat\u00edmco Overlay budeme prob\u00edrat pouze okrajov\u011b.<\/p>\n<p>Je z\u0159ejm\u00e9, \u017ee se siln\u011b omezujeme, pou\u017e\u00edvaj\u00edc jako p\u0159\u00edklad s\u00ed\u0165 datacentra postavenou na fabriku Clos s \u010dist\u00fdm IP sm\u011brov\u00e1n\u00edm a overlay s hostitele.<\/p>\n<p>Jsem v\u0161ak p\u0159esv\u011bd\u010den, \u017ee jakoukoli s\u00ed\u0165 s designem lze popsat v form\u00e1ln\u00edch term\u00ednech a automatizovat. M\u00fdm c\u00edlem je tady zam\u011b\u0159it se na p\u0159\u00edstupy k automatizaci, nikoli zm\u00e1st v\u0161echny t\u00edm, \u017ee se pokus\u00edm \u0159e\u0161it obecn\u00fd probl\u00e9m.<\/p>\n<p>V r\u00e1mci ADSM pl\u00e1nujeme s Romanem Gorgem publikovat zvl\u00e1\u0161tn\u00ed vyd\u00e1n\u00ed o virtualizaci v\u00fdpo\u010detn\u00edch zdroj\u016f a jej\u00edm zapojen\u00ed do virtualizace s\u00edt\u011b. Z\u016fsta\u0148te v kontaktu.<\/p>\n<p><\/p>\n<h1>U\u017eite\u010dn\u00e9 odkazy<\/h1>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tungstenfabric.github.io\/website\/\">Architektura Tungsten Fabric<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/Kr6WIYPts8I?t=3157\">o:cloud<\/a><\/noindex>. 6 hodin o Yandex.Cloud, kde se tak\u00e9 hovo\u0159\u00ed o virtu\u00e1ln\u00ed s\u00edti na TF.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/docs.openvswitch.org\/en\/latest\/intro\/what-is-ovs\/\">Co je Open vSwitch?<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/344326\/\">\u00davod do VxLAN<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc7348\">RFC 7348. Virtu\u00e1ln\u00ed eXtensible Local Area Network (VXLAN): R\u00e1mec pro p\u0159ekr\u00fdv\u00e1n\u00ed virtualizovan\u00fdch s\u00edt\u00ed vrstvy 2 nad s\u00edt\u011bmi vrstvy 3.<br \/>\n <\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.enog.org\/wp-content\/uploads\/presentations\/enog-16\/18-Scaleway-P14-fabric-ENOG16.pdf\">P\u0159\u00edstup Scaleway k VXLAN EVPN Fabric<\/a><\/noindex>. Zde se hovo\u0159\u00ed o cel\u00e9 s\u00edti datov\u00e9ho centra, v\u010detn\u011b Underlay, Overlay, p\u0159\u00edstupech k multi-homing a spr\u00e1v\u011b.<\/li>\n<\/ul>\n<p><\/p>\n<h5>D\u011bkuji<\/h5>\n<p><\/p>\n<ul>\n<li><noindex>Roman Goreg<\/noindex> \u2014 b\u00fdval\u00fd moder\u00e1tor podcastu linkmeup, nyn\u00ed expert na cloudov\u00e9 platformy. Za koment\u00e1\u0159e a \u00fapravy. A t\u011b\u0161\u00edme se na jeho podrobn\u011bj\u0161\u00ed \u010dl\u00e1nek o virtualizaci v bl\u00edzk\u00e9 budoucnosti.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.alexander-shalimov.com\">Alexandra Shalimova<\/a><\/noindex> \u2014 m\u00e9mu kolegovi a expertovi na v\u00fdvoj virtu\u00e1ln\u00edch s\u00edt\u00ed. Za koment\u00e1\u0159e a \u00fapravy.<\/li>\n<li><noindex>Valentina Sinitsyna<\/noindex> \u2014 m\u00e9mu kolegovi a expertovi na Tungsten Fabric. Za koment\u00e1\u0159e a \u00fapravy.<\/li>\n<li><noindex>Artemu Chernobayu<\/noindex> \u2014 ilustr\u00e1torovi linkmeup. Za KDPV.<\/li>\n<li>Alexandru Limonovovi. Za meme \u201eautomato\u201c.<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/458622\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u044f \u043e\u043f\u0438\u0441\u0430\u043b \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u041f\u043e \u043e\u0442\u0437\u044b\u0432\u0430\u043c \u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043b\u044e\u0434\u0435\u0439 \u0434\u0430\u0436\u0435 \u044d\u0442\u043e\u0442 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0443\u0436\u0435 \u0440\u0430\u0437\u043b\u043e\u0436\u0438\u043b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043f\u043e \u043f\u043e\u043b\u043e\u0447\u043a\u0430\u043c. \u0418 \u044d\u0442\u043e \u043e\u0447\u0435\u043d\u044c \u043c\u0435\u043d\u044f \u0440\u0430\u0434\u0443\u0435\u0442, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043d\u0430\u0448\u0430 \u0446\u0435\u043b\u044c \u0432 \u0446\u0438\u043a\u043b\u0435 \u2014 \u043d\u0435 \u043e\u0431\u043c\u0430\u0437\u0430\u0442\u044c \u043f\u0438\u0442\u043e\u043d\u043e\u0432\u0441\u043a\u0438\u043c\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0430\u043d\u0437\u0438\u0431\u043b\u044c, \u0430 \u0432\u044b\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u042d\u0442\u043e\u0442 \u0436\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0437\u0430\u0434\u0430\u0451\u0442 \u043f\u043e\u0440\u044f\u0434\u043e\u043a, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26892,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35973","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u044f \u043e\u043f\u0438\u0441\u0430\u043b \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/avtomatizatsiya-dlya-samyh-malenkih-chast-pervaya-kotoraya-posle-nulevoj-virtualizatsiya-seti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0414\u043b\u044f \u0421\u0430\u043c\u044b\u0445 \u041c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0445. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f (\u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u043b\u0435 \u043d\u0443\u043b\u0435\u0432\u043e\u0439). \u0412\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u044f \u043e\u043f\u0438\u0441\u0430\u043b \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/avtomatizatsiya-dlya-samyh-malenkih-chast-pervaya-kotoraya-posle-nulevoj-virtualizatsiya-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:08:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:08:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Automatizace Pro Nejmen\u0161\u00ed. Prvn\u00ed \u010d\u00e1st (kter\u00e1 je po nulov\u00e9). Virtualizace s\u00edt\u011b | ProHoster","description":"V p\u0159edchoz\u00edm vyd\u00e1n\u00ed jsem popsal r\u00e1mec s\u00ed\u0165ov\u00e9 automatizace.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/avtomatizatsiya-dlya-samyh-malenkih-chast-pervaya-kotoraya-posle-nulevoj-virtualizatsiya-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0414\u043b\u044f \u0421\u0430\u043c\u044b\u0445 \u041c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0445. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f (\u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u043b\u0435 \u043d\u0443\u043b\u0435\u0432\u043e\u0439). \u0412\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u044f \u043e\u043f\u0438\u0441\u0430\u043b \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/avtomatizatsiya-dlya-samyh-malenkih-chast-pervaya-kotoraya-posle-nulevoj-virtualizatsiya-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:08:54+00:00","article:modified_time":"2019-10-31T19:08:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35973","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:28:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:53:30","updated":"2026-01-22 01:28:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35973"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35973\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/26892"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}