{"id":78001,"date":"2020-04-15T13:42:19","date_gmt":"2020-04-15T11:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie"},"modified":"2020-04-15T13:42:19","modified_gmt":"2020-04-15T11:42:19","slug":"opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","title":{"rendered":"Zku\u0161enosti s implementac\u00ed s\u00ed\u0165ov\u00fdch fabrik na b\u00e1zi EVPN VXLAN a Cisco ACI a mal\u00fd p\u0159ehled","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Zku\u0161enosti
\nOhodno\u0165te spojen\u00ed ve st\u0159edn\u00ed \u010d\u00e1sti sch\u00e9matu. K nim se vr\u00e1t\u00edme n\u00ed\u017ee.<\/i><\/p>\n

V ur\u010dit\u00e9m okam\u017eiku se m\u016f\u017eete setkat s t\u00edm, \u017ee velk\u00e9 slo\u017eit\u00e9 s\u00edt\u011b zalo\u017een\u00e9 na L2 jsou nevratn\u011b posti\u017een\u00e9. P\u0159edev\u0161\u00edm probl\u00e9my spojen\u00e9 se zpracov\u00e1n\u00edm BUM provozu a s fungov\u00e1n\u00edm protokolu STP. A pak tak\u00e9 s celkov\u011b mor\u00e1ln\u011b zastaralou architekturou. To zp\u016fsobuje nep\u0159\u00edjemn\u00e9 probl\u00e9my v podob\u011b v\u00fdpadk\u016f a nepohodl\u00ed p\u0159i spr\u00e1v\u011b.<\/p>\n

M\u011bli jsme dva paraleln\u00ed projekty, kde si klienti realisticky vyhodnotili v\u0161echny v\u00fdhody a nev\u00fdhody a zvolili dv\u011b r\u016fzn\u00e1 overlay \u0159e\u0161en\u00ed, kter\u00e1 jsme implementovali. <\/p>\n

M\u011bli jsme mo\u017enost porovnat pr\u00e1v\u011b realizaci. Ne provoz, o tom bychom m\u011bli mluvit za dva a\u017e t\u0159i roky. <\/p>\n

Tak\u017ee, co je to s\u00ed\u0165ov\u00e1 fabrika s overlay s\u00edt\u011bmi a SDN?
\n<\/a><\/noindex><\/p>\n

Co d\u011blat s pal\u010div\u00fdmi probl\u00e9my klasick\u00e9 architektury s\u00edt\u011b?<\/h3>\n

\nKa\u017ed\u00fd rok se objevuj\u00ed nov\u00e9 technologie a my\u0161lenky. V praxi se dlouho neobjevila nal\u00e9hav\u00e1 pot\u0159eba p\u0159estav\u011bt s\u00edt\u011b, proto\u017ee se st\u00e1le dalo v\u0161echno d\u011blat manu\u00e1ln\u011b star\u00fdmi dobr\u00fdmi metodami. No a co, \u017ee je dvac\u00e1t\u00e9 prvn\u00ed stolet\u00ed? Koneckonc\u016f, administr\u00e1tor by m\u011bl pracovat, a ne sed\u011bt v kancel\u00e1\u0159i. <\/p>\n

Pak p\u0159i\u0161el boom stavby rozs\u00e1hl\u00fdch datov\u00fdch center. Tehdy se uk\u00e1zalo, \u017ee byl dosa\u017een limit rozvoje klasick\u00e9 architektury nejen z hlediska funk\u010dnosti, odolnosti a \u0161k\u00e1lovatelnosti. A jedn\u00edm z mo\u017en\u00fdch \u0159e\u0161en\u00ed t\u011bchto \u00fakol\u016f se stala my\u0161lenka budov\u00e1n\u00ed overlay s\u00edt\u00ed nad sm\u011brovateln\u00fdm backbone.<\/p>\n

Krom\u011b toho, s rostouc\u00edmi rozm\u011bry s\u00edt\u00ed, se akutn\u011b objevila problematika spr\u00e1vy t\u011bchto tov\u00e1ren, v d\u016fsledku \u010deho\u017e za\u010dala vznikat \u0159e\u0161en\u00ed softwarov\u011b definovan\u00fdch s\u00edt\u00ed, kter\u00e9 umo\u017e\u0148uj\u00ed spravovat celou s\u00ed\u0165ovou infrastrukturu jako celek. A kdy\u017e je s\u00ed\u0165 spravov\u00e1na z jednoho bodu, ostatn\u00edm komponent\u016fm IT infrastruktury se snadn\u011bji spolupracuje a takov\u00e9 procesy interakce se snadn\u011bji automatizuj\u00ed.<\/p>\n

T\u00e9m\u011b\u0159 ka\u017ed\u00fd velk\u00fd v\u00fdrobce nejen s\u00ed\u0165ov\u00e9ho za\u0159\u00edzen\u00ed, ale tak\u00e9 virtualizace, m\u00e1 ve sv\u00e9m portfoliu varianty takov\u00fdch \u0159e\u0161en\u00ed. <\/p>\n

Z\u016fst\u00e1v\u00e1 jen pochopit, co se hod\u00ed pro jak\u00e9 pot\u0159eby. Nap\u0159\u00edklad pro velmi velk\u00e9 spole\u010dnosti s dobrou v\u00fdvojovou a provozn\u00ed skupinou nemus\u00ed krabicov\u00e1 \u0159e\u0161en\u00ed od dodavatel\u016f sta\u010dit v\u0161em pot\u0159eb\u00e1m, a proto p\u0159istupuj\u00ed k v\u00fdvoji vlastn\u00edch \u0159e\u0161en\u00ed definovan\u00fdch softwarem (SD). Nap\u0159\u00edklad to jsou cloudov\u00ed poskytovatel\u00e9, kte\u0159\u00ed neust\u00e1le roz\u0161i\u0159uj\u00ed nab\u00eddku slu\u017eeb poskytovan\u00fdch sv\u00fdm klient\u016fm, a krabicov\u00e1 \u0159e\u0161en\u00ed zkr\u00e1tka nesta\u010d\u00ed na jejich pot\u0159eby. <\/p>\n

Pro st\u0159edn\u00ed spole\u010dnosti v 99 procentech p\u0159\u00edpad\u016f posta\u010duje funkcionalita, kterou dodavatel nab\u00edz\u00ed ve form\u011b krabicov\u00e9ho \u0159e\u0161en\u00ed. <\/p>\n

Co jsou to overlayov\u00e9 s\u00edt\u011b<\/h3>\n

\nJak\u00e1 je my\u0161lenka overlayov\u00fdch s\u00edt\u00ed? V podstat\u011b vezmete klasickou sm\u011brovatelnou s\u00ed\u0165 a nad ni postav\u00edte dal\u0161\u00ed s\u00ed\u0165, abyste z\u00edskali v\u00edce funkc\u00ed. Nej\u010dast\u011bji jde o efektivn\u00ed rozlo\u017een\u00ed z\u00e1t\u011b\u017ee na za\u0159\u00edzen\u00ed a spojov\u00e9 linky, v\u00fdznamn\u00e9 zv\u00fd\u0161en\u00ed limitu pro \u0161k\u00e1lovatelnost, zlep\u0161en\u00ed spolehlivosti a celou \u0159adu vylep\u0161en\u00ed v oblasti bezpe\u010dnosti (d\u00edky segmentaci). A SDN \u0159e\u0161en\u00ed nav\u00edc umo\u017e\u0148uj\u00ed velmi, velmi, velmi pohodln\u00e9 flexibiln\u00ed administraci a \u010din\u00ed s\u00ed\u0165 jasn\u011bj\u0161\u00ed pro u\u017eivatele. <\/p>\n

Obecn\u011b, pokud by lok\u00e1ln\u00ed s\u00edt\u011b byly vynalezeny n\u011bkdy v 2010. letech, vypadaly by velmi odli\u0161n\u011b od toho, co jsme zd\u011bdili od vojensk\u00fdch s\u00edt\u00ed ze 70. let. <\/p>\n

Z pohledu technologi\u00ed pro budov\u00e1n\u00ed tov\u00e1ren s vyu\u017eit\u00edm overlayov\u00fdch s\u00edt\u00ed existuje v sou\u010dasn\u00e9 dob\u011b mnoho realizac\u00ed od v\u00fdrobc\u016f a internetov\u00fdch projekt\u016f RFC (EVPN+VXLAN, EVPN+MPLS, EVPN+MPLSoGRE, EVPN+Geneve a dal\u0161\u00ed). Ano, existuj\u00ed normy, ale implementace t\u011bchto norem r\u016fzn\u00fdmi v\u00fdrobci se m\u016f\u017ee li\u0161it, tak\u017ee p\u0159i vytv\u00e1\u0159en\u00ed takov\u00fdch tov\u00e1ren je teoreticky mo\u017en\u00e9 se zcela vzd\u00e1t vendor lock pouze na pap\u00ed\u0159e.<\/p>\n

S SD \u0159e\u0161en\u00edmi je to je\u0161t\u011b slo\u017eit\u011bj\u0161\u00ed, ka\u017ed\u00fd dodavatel m\u00e1 sv\u016fj vlastn\u00ed pohled. Existuj\u00ed zcela otev\u0159en\u00e1 \u0159e\u0161en\u00ed, kter\u00e1 si teoreticky m\u016f\u017eete upravit sami, a existuj\u00ed zcela uzav\u0159en\u00e1.<\/p>\n

Cisco nab\u00edz\u00ed sv\u016fj vlastn\u00ed variant SDN pro datov\u00e9 centrum - ACI. Samoz\u0159ejm\u011b se jedn\u00e1 o 100% \u0159e\u0161en\u00ed zam\u011b\u0159en\u00e9 na dodavatele z hlediska v\u00fdb\u011bru s\u00ed\u0165ov\u00e9ho vybaven\u00ed, ale z\u00e1rove\u0148 se pln\u011b integruje se syst\u00e9my virtualizace, kontejnerizace, zabezpe\u010den\u00ed, orchestrace, vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee a dal\u0161\u00edmi. V podstat\u011b se ale jedn\u00e1 o \u010dernou sk\u0159\u00ed\u0148ku, bez mo\u017enosti pln\u00e9ho p\u0159\u00edstupu ke v\u0161em vnit\u0159n\u00edm proces\u016fm. Ne v\u0161ichni z\u00e1kazn\u00edci souhlas\u00ed s takovou variantou, proto\u017ee jste pln\u011b z\u00e1visl\u00ed na kvalit\u011b napsan\u00e9ho k\u00f3du \u0159e\u0161en\u00ed a jeho implementaci, ale na druhou stranu v\u00fdrobce m\u00e1 jednu z nejlep\u0161\u00edch technick\u00fdch podpor na sv\u011bt\u011b a m\u00e1 vy\u010dlen\u011bn\u00fd t\u00fdm, kter\u00fd se zab\u00fdv\u00e1 pouze t\u00edmto \u0159e\u0161en\u00edm. Jako \u0159e\u0161en\u00ed pro prvn\u00ed projekt byl vybr\u00e1n pr\u00e1v\u011b Cisco ACI.<\/p>\n

Pro druh\u00fd projekt bylo zvoleno \u0159e\u0161en\u00ed od Juniper. V\u00fdrobce m\u00e1 tak\u00e9 sv\u016fj SDN pro datov\u00e9 centrum, ale z\u00e1kazn\u00edk se rozhodl vzd\u00e1t se zav\u00e1d\u011bn\u00ed SDN. Jako technologie pro budov\u00e1n\u00ed s\u00edt\u011b byla vybr\u00e1na EVPN VXLAN fabrika bez pou\u017eit\u00ed centralizovan\u00fdch kontrol\u00e9r\u016f.<\/p>\n

K \u010demu je to pot\u0159eba<\/h3>\n

\nVytvo\u0159en\u00ed fabric umo\u017e\u0148uje vybudovat snadno \u0161k\u00e1lovatelnou, odolnou, spolehlivou s\u00ed\u0165. Architektura (leaf-spine) zohled\u0148uje specifika datov\u00fdch center<\/a> (cesty pro\u0161en\u00ed provozu, minimalizaci zpo\u017ed\u011bn\u00ed a \u00fazk\u00fdch m\u00edst v s\u00edti). SD \u0159e\u0161en\u00ed v datov\u00fdch centrech umo\u017e\u0148uj\u00ed velmi pohodln\u011b, rychle a flexibiln\u011b spravovat takovou fabric, integrovat ji do ekosyst\u00e9mu datov\u00e9ho centra. <\/p>\n

Ob\u011bma z\u00e1kazn\u00edk\u016fm bylo nezbytn\u00e9 vybudovat z\u00e1lo\u017en\u00ed datov\u00e1 centra pro zaji\u0161t\u011bn\u00ed odolnosti, nav\u00edc by m\u011bl b\u00fdt provoz mezi datov\u00fdmi centry \u0161ifrov\u00e1n.<\/p>\n

Prvn\u00ed z\u00e1kazn\u00edk ji\u017e zva\u017eoval \u0159e\u0161en\u00ed bez fabric jako mo\u017en\u00fd standard sv\u00fdch s\u00edt\u00ed, ale p\u0159i testech se pot\u00fdkali s probl\u00e9my s kompatibilitou STP mezi n\u011bkolika dodavateli hardwaru. Vznikaly v\u00fdpadky, kter\u00e9 zp\u016fsobovaly p\u00e1dy slu\u017eeb. A pro z\u00e1kazn\u00edka to bylo kritick\u00e9. <\/p>\n

Cisco u\u017e byla firemn\u00edm standardem z\u00e1kazn\u00edka, pod\u00edvali se na ACI a dal\u0161\u00ed mo\u017enosti a rozhodli se, \u017ee stoj\u00ed za to zvolit pr\u00e1v\u011b toto \u0159e\u0161en\u00ed. L\u00edbila se jim automatizace spr\u00e1vy jedn\u00edm tla\u010d\u00edtkem pomoc\u00ed jednoho ovlada\u010de. Slu\u017eby se nastavuj\u00ed rychleji, l\u00e9pe se spravuj\u00ed. \u0160ifrov\u00e1n\u00ed provozu se rozhodli zajistit spu\u0161t\u011bn\u00edm MACSec mezi p\u0159ep\u00edna\u010di IPN a SPINE. T\u00edmto zp\u016fsobem se poda\u0159ilo vyhnout u\u017e\u0161\u00edmu m\u00edstu v podob\u011b kryptografick\u00e9 br\u00e1ny, u\u0161et\u0159it na n\u00ed a maxim\u00e1ln\u011b vyu\u017e\u00edt \u0161\u00ed\u0159ku p\u00e1sma.<\/p>\n

Druh\u00fd z\u00e1kazn\u00edk zvolil \u0159e\u0161en\u00ed bez ovlada\u010de od Juniper, proto\u017ee v jejich st\u00e1vaj\u00edc\u00edm datov\u00e9m centru ji\u017e byla mal\u00e1 instalace s realizac\u00ed tov\u00e1rny EVPN VXLAN. Ale tam nebyla odoln\u00e1 proti v\u00fdpadk\u016fm (pou\u017e\u00edval se jeden p\u0159ep\u00edna\u010d). Rozhodli se roz\u0161\u00ed\u0159it infrastrukturu hlavn\u00edho datov\u00e9ho centra a postavit tov\u00e1rnu v z\u00e1lo\u017en\u00edm datov\u00e9m centru. St\u00e1vaj\u00edc\u00ed EVPN nebyl pln\u011b vyu\u017eit: enkapsulace VXLAN se prakticky nepou\u017e\u00edvala, proto\u017ee v\u0161echny hosty byly p\u0159ipojeny k jednomu p\u0159ep\u00edna\u010di a v\u0161echny MAC adresy a \/32 adresy host\u016f byly lok\u00e1ln\u00ed, br\u00e1nou pro n\u011b byl tento stejn\u00fd p\u0159ep\u00edna\u010d, nebyla jin\u00e1 za\u0159\u00edzen\u00ed, kam by bylo t\u0159eba stav\u011bt VXLAN tunely. \u0160ifrov\u00e1n\u00ed provozu se rozhodli zajistit pomoc\u00ed technologie IPSEC mezi firewally (v\u00fdkon MSCE byl dostate\u010dn\u00fd).<\/p>\n

Tak\u00e9 si osahali ACI, ale rozhodli se, \u017ee kv\u016fli vendor-locku budou muset zakoupit p\u0159\u00edli\u0161 mnoho za\u0159\u00edzen\u00ed, v\u010detn\u011b v\u00fdm\u011bny ned\u00e1vno zakoupen\u00e9ho nov\u00e9ho vybaven\u00ed, a to prost\u011b nem\u00e1 ekonomick\u00fd smysl. Ano, tov\u00e1rna Cisco se integruje se v\u0161\u00edm, ale uvnit\u0159 samotn\u00e9 tov\u00e1rny jsou mo\u017en\u00e9 pouze jej\u00ed za\u0159\u00edzen\u00ed. <\/p>\n

Na druhou stranu, jak bylo \u0159e\u010deno d\u0159\u00edve, tov\u00e1rnu EVPN VXLAN s jak\u00fdmkoli sousedn\u00edm dodavatelem jen tak nesmixujete, proto\u017ee realizace protokolu se li\u0161\u00ed. Je to jako k\u0159\u00ed\u017een\u00ed Cisco a Huawei v jedn\u00e9 s\u00edti \u2014 zd\u00e1nliv\u011b, standardy jsou spole\u010dn\u00e9, jen s bubnem si \u010dlov\u011bk bude muset zatan\u010dit. Vzhledem k tomu, \u017ee se jedn\u00e1 o banku, a testy na kompatibilitu by byly velmi dlouh\u00e9, rozhodli se, \u017ee bude lep\u0161\u00ed nyn\u00ed nakoupit od stejn\u00e9ho dodavatele a neodch\u00e1zet p\u0159\u00edli\u0161 od z\u00e1kladn\u00edch funkc\u00ed. <\/p>\n

Pl\u00e1n migrace<\/h3>\n

\nDva datov\u00e9 centra na b\u00e1zi ACI:<\/p>\n

\"Zku\u0161enosti
\n
\nOrganizace interakce mezi datov\u00fdmi centry. Bylo vybr\u00e1no \u0159e\u0161en\u00ed Multi-Pod \u2014 ka\u017ed\u00e9 datov\u00e9 centrum je pod. Byly zohledn\u011bny po\u017eadavky na \u0161k\u00e1lovatelnost po\u010dtu p\u0159ep\u00edna\u010d\u016f a na latenci mezi podmi (RTT m\u00e9n\u011b ne\u017e 50 ms). Bylo rozhodnuto nebudovat Multi-Site \u0159e\u0161en\u00ed kv\u016fli snadnosti spr\u00e1vy (pro \u0159e\u0161en\u00ed Multi-Pod se pou\u017e\u00edv\u00e1 jednotn\u00e9 \u0159\u00edd\u00edc\u00ed rozhran\u00ed, pro Multi-Site by byly pot\u0159eba dv\u011b rozhran\u00ed, nebo by byl pot\u0159ebn\u00fd Multi-Site Orchestrator), a proto\u017ee nebylo po\u017eadov\u00e1no geografick\u00e9 z\u00e1lohov\u00e1n\u00ed lokalit.<\/p>\n

\"Zku\u0161enosti
\n
\nZ pohledu migrace slu\u017eeb ze star\u00e9 s\u00edt\u011b byl vybr\u00e1n nejtransparentn\u011bj\u0161\u00ed variant, postupn\u011b p\u0159en\u00e1\u0161et VLAN odpov\u00eddaj\u00edc\u00ed ur\u010dit\u00fdm slu\u017eb\u00e1m.
\nPro migraci byl ka\u017ed\u00e9mu VLAN vytvo\u0159en odpov\u00eddaj\u00edc\u00ed EPG (End-point-group) na fabric. Nejprve byla s\u00ed\u0165 rozta\u017eena mezi starou s\u00edt\u00ed a fabric za L2, pot\u00e9 po migraci v\u0161ech hostitel\u016f byl br\u00e1na p\u0159enesena na fabric a interakce EPG se st\u00e1vaj\u00edc\u00ed s\u00edt\u00ed prob\u00edhala p\u0159es L3OUT, p\u0159i\u010dem\u017e interakce mezi L3OUT a EPG byla pops\u00e1na pomoc\u00ed kontrakt\u016f. P\u0159\u00edkladn\u00e1 sch\u00e9ma:<\/p>\n

\"Zku\u0161enosti
\n
\nP\u0159\u00edkladn\u00e1 struktura v\u011bt\u0161iny politik fabric ACI na obr\u00e1zku n\u00ed\u017ee. Ve\u0161ker\u00e9 nastaven\u00ed je zalo\u017eeno na politik\u00e1ch, vno\u0159en\u00fdch do jin\u00fdch politik atd. Zpo\u010d\u00e1tku je velmi obt\u00ed\u017en\u00e9 se v tom zorientovat, ale postupem \u010dasu, jak ukazuje praxe, administr\u00e1to\u0159i s\u00edt\u00ed si na tuto strukturu zvyknou p\u0159ibli\u017en\u011b za m\u011bs\u00edc, a pot\u00e9 p\u0159ich\u00e1z\u00ed pochopen\u00ed, jak je pohodln\u00e1.<\/p>\n

\"Zku\u0161enosti
\n <\/p>\n

Porovn\u00e1n\u00ed<\/h3>\n

\nV \u0159e\u0161en\u00ed Cisco ACI je t\u0159eba zakoupit v\u00edce vybaven\u00ed (samostatn\u00e9 p\u0159ep\u00edna\u010de pro Inter-Pod interakci a APIC kontrol\u00e9ry), co\u017e zp\u016fsobilo, \u017ee je dra\u017e\u0161\u00ed. \u0158e\u0161en\u00ed Juniper nevy\u017eadovalo n\u00e1kup kontrol\u00e9r\u016f a pomocn\u00e9ho vybaven\u00ed; poda\u0159ilo se \u010d\u00e1ste\u010dn\u011b vyu\u017e\u00edt ji\u017e existuj\u00edc\u00ed vybaven\u00ed z\u00e1kazn\u00edka. <\/p>\n

Toto je architektura EVPN VXLAN fabric pro dv\u011b datov\u00e1 centra druh\u00e9ho projektu:<\/p>\n

\"Zku\u0161enosti
\n\"Zku\u0161enosti
\n
\nV ACI dost\u00e1v\u00e1\u0161 hotov\u00e9 \u0159e\u0161en\u00ed \u2013 nen\u00ed pot\u0159eba zasahovat, nen\u00ed pot\u0159eba optimalizovat. P\u0159i prvn\u00edm sezn\u00e1men\u00ed z\u00e1kazn\u00edka s tov\u00e1rnou nejsou pot\u0159eba v\u00fdvoj\u00e1\u0159i ani podp\u016frn\u00fd person\u00e1l pro k\u00f3d a automatizaci. Sta\u010d\u00ed pouze provoz, mnoho nastaven\u00ed lze prov\u00e1d\u011bt p\u0159\u00edmo pomoc\u00ed pr\u016fvodce, co\u017e nen\u00ed v\u017edy v\u00fdhodn\u00e9, zejm\u00e9na pro lidi zvykl\u00e9 na p\u0159\u00edkazov\u00fd \u0159\u00e1dek. V ka\u017ed\u00e9m p\u0159\u00edpad\u011b je pot\u0159eba \u010das na to, abychom si p\u0159estavili my\u0161len\u00ed na nov\u00e9 koleje, na specifika nastaven\u00ed prost\u0159ednictv\u00edm politik a manipulaci s mnoha vz\u00e1jemn\u011b se prol\u00ednaj\u00edc\u00edmi politikami. Je velmi \u017e\u00e1douc\u00ed m\u00edt tak\u00e9 jasnou strukturu pojmenov\u00e1n\u00ed politik a objekt\u016f. P\u0159i jak\u00e9mkoli probl\u00e9mu v logice pr\u00e1ce kontroleru lze probl\u00e9m vy\u0159e\u0161it pouze prost\u0159ednictv\u00edm technick\u00e9 podpory.<\/p>\n

V EVPN \u2013 konzole. Trp nebo se raduj. Zn\u00e1m\u00e9 rozhran\u00ed pro starou gardu. Ano, existuje standardn\u00ed konfigurace a p\u0159\u00edru\u010dky. Bude\u0161 muset studovat manu\u00e1ly. R\u016fzn\u00e9 konstrukce, v\u0161e jasn\u00e9 a detailn\u00ed.<\/p>\n

Samoz\u0159ejm\u011b, v obou p\u0159\u00edpadech je lep\u0161\u00ed p\u0159i migraci nejd\u0159\u00edve migrovat m\u00e9n\u011b kritick\u00e9 slu\u017eby, nap\u0159\u00edklad testovac\u00ed prost\u0159ed\u00ed, a a\u017e pot\u00e9, po odhalen\u00ed v\u0161ech chyb, p\u0159istoupit k produkci. A nenastavovat to v p\u00e1tek ve\u010der. Nen\u00ed dobr\u00e9 v\u011b\u0159it dodavateli, \u017ee v\u0161e bude v po\u0159\u00e1dku, v\u017edy je lep\u0161\u00ed se zabezpe\u010dit.<\/p>\n

Na ACI plat\u00ed\u0161 v\u00edce, a\u010dkoli v sou\u010dasnosti Cisco aktivn\u011b propaguje toto \u0159e\u0161en\u00ed a \u010dasto poskytuje dobr\u00e9 slevy, ale \u0161et\u0159\u00ed\u0161 na \u00fadr\u017eb\u011b \u2013 podpo\u0159e. Spr\u00e1va a jak\u00e1koli automatizace tov\u00e1rny EVPN bez kontrol\u00e9ru vy\u017eaduje investice a pravideln\u00e9 v\u00fddaje \u2013 monitoring, automatizaci, zav\u00e1d\u011bn\u00ed nov\u00fdch slu\u017eeb. P\u0159itom po\u010d\u00e1te\u010dn\u00ed spu\u0161t\u011bn\u00ed ACI trv\u00e1 o 30\u201340 procent d\u00e9le. D\u011bje se to proto, \u017ee d\u00e9le trv\u00e1 vytvo\u0159en\u00ed cel\u00e9ho pot\u0159ebn\u00e9ho souboru profil\u016f a politik, kter\u00e9 budou n\u00e1sledn\u011b pou\u017eity. Ale s r\u016fstem s\u00edt\u011b se mno\u017estv\u00ed pot\u0159ebn\u00fdch konfigurac\u00ed sni\u017euje. Pou\u017e\u00edv\u00e1\u0161 ji\u017e p\u0159edem vytvo\u0159en\u00e9 politiky, profily, objekty. M\u016f\u017ee\u0161 flexibiln\u011b nastavovat segmentaci a bezpe\u010dnost, centr\u00e1ln\u011b spravovat kontrakty, kter\u00e9 odpov\u00eddaj\u00ed za povolen\u00ed r\u016fzn\u00fdch interakc\u00ed mezi EPG, \u2013 objem pr\u00e1ce se n\u00e1hle zmen\u0161uje. <\/p>\n

V EVPN je pot\u0159eba konfigurovat ka\u017ed\u00e9 za\u0159\u00edzen\u00ed v tov\u00e1rn\u011b, pravd\u011bpodobnost chyby je vy\u0161\u0161\u00ed.<\/p>\n

Pokud se ACI zav\u00e1d\u00ed pomaleji, EVPN se ladil t\u00e9m\u011b\u0159 dvakr\u00e1t d\u00e9le. Zat\u00edmco v p\u0159\u00edpad\u011b Cisco m\u016f\u017eete v\u017edy zavolat technickou podporu a zeptat se na s\u00ed\u0165 jako celek (proto\u017ee je to pokryt\u00e9 jako \u0159e\u0161en\u00ed), u Juniper Networks kupujete pouze hardware, a to je v\u0161e, co je pokryto. Odeslaly se pakety z za\u0159\u00edzen\u00ed? No dob\u0159e, d\u00e1l jsou to va\u0161e probl\u00e9my. M\u016f\u017eete v\u0161ak otev\u0159\u00edt ot\u00e1zku ohledn\u011b v\u00fdb\u011bru \u0159e\u0161en\u00ed nebo n\u00e1vrhu s\u00edt\u011b \u2014 a pak doporu\u010d\u00ed zakoupit profesion\u00e1ln\u00ed slu\u017ebu za p\u0159\u00edplatek.<\/p>\n

Podpora ACI je velmi kvalitn\u00ed, proto\u017ee je odd\u011blen\u00e1: samostatn\u00fd t\u00fdm se zam\u011b\u0159uje pouze na to. Jsou zde tak\u00e9 specialist\u00e9, kte\u0159\u00ed mluv\u00ed rusky. P\u0159\u00edru\u010dka je podrobn\u00e1, \u0159e\u0161en\u00ed jsou p\u0159edem definov\u00e1na. Sleduj\u00ed a rad\u00ed. Rychle validuj\u00ed n\u00e1vrh, co\u017e je \u010dasto d\u016fle\u017eit\u00e9. Juniper Networks d\u011bl\u00e1 to sam\u00e9, ale mnohem pomaleji (my jsme to m\u011bli tak, nyn\u00ed by to m\u011blo b\u00fdt podle drb\u016f lep\u0161\u00ed), co\u017e v\u00e1s nut\u00ed d\u011blat v\u0161e sami tam, kde by v\u00e1s mohl poradit \u0159e\u0161en\u00ed-in\u017een\u00fdr. <\/p>\n

Cisco ACI podporuje integraci se syst\u00e9mem virtualizace a kontejnerizace (VMware, Kubernetes, Hyper-V) a centralizovan\u00e9 \u0159\u00edzen\u00ed. Existuj\u00ed s\u00ed\u0165ov\u00e9 slu\u017eby a bezpe\u010dnostn\u00ed slu\u017eby \u2014 vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee, firewally, WAF, IPS a dal\u0161\u00ed\u2026 Dobr\u00e1 mikrosegmentace hned z krabice. U druh\u00e9ho \u0159e\u0161en\u00ed je integrace se s\u00ed\u0165ov\u00fdmi slu\u017ebami slo\u017eit\u011bj\u0161\u00ed a je lep\u0161\u00ed se p\u0159edem pod\u00edvat na f\u00f3ra s t\u011bmi, kdo to tak d\u011blali. <\/p>\n

V\u00fdsledek<\/h3>\n

\nPro ka\u017ed\u00fd konkr\u00e9tn\u00ed p\u0159\u00edpad je t\u0159eba vybrat \u0159e\u0161en\u00ed, nejen na z\u00e1klad\u011b ceny vybaven\u00ed, ale tak\u00e9 je t\u0159eba zohlednit dal\u0161\u00ed n\u00e1klady na provoz a hlavn\u00ed probl\u00e9my, s nimi\u017e se z\u00e1kazn\u00edk aktu\u00e1ln\u011b pot\u00fdk\u00e1, a jak\u00e9 m\u00e1 pl\u00e1ny na rozvoj IT infrastruktury. <\/p>\n

ACI se d\u00edky dal\u0161\u00edmu vybaven\u00ed uk\u00e1zalo jako dra\u017e\u0161\u00ed, ale je to hotov\u00e9 \u0159e\u0161en\u00ed bez pot\u0159eby dodate\u010dn\u00fdch \u00faprav, druh\u00e9 \u0159e\u0161en\u00ed je slo\u017eit\u011bj\u0161\u00ed a n\u00e1kladn\u011bj\u0161\u00ed z hlediska provozu, ale levn\u011bj\u0161\u00ed. <\/p>\n

Pokud chcete probrat, kolik by mohla st\u00e1t implementace s\u00ed\u0165ov\u00e9 fabriky u r\u016fzn\u00fdch dodavatel\u016f a jak\u00e1 architektura je pot\u0159eba, r\u00e1di se setk\u00e1me a promluv\u00edme si o tom. P\u0159ed n\u00e1vrhem hrub\u00e9 architektury (se kter\u00fdm lze po\u010d\u00edtat rozpo\u010dty) porad\u00edme zdarma, podrobn\u00e9 zpracov\u00e1n\u00ed je samoz\u0159ejm\u011b ji\u017e zpoplatn\u011bn\u00e9.<\/p>\n

Vladimir Klep\u010de, firemn\u00ed s\u00edt\u011b.<\/p><\/blockquote>\n

Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0446\u0435\u043d\u0438\u0442\u0435 \u0441\u0432\u044f\u0437\u043a\u0438 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0445\u0435\u043c\u044b. \u041d\u0438\u0436\u0435 \u043a \u043d\u0438\u043c \u0432\u0435\u0440\u043d\u0451\u043c\u0441\u044f \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 L2 \u043d\u0435\u0438\u0437\u043b\u0435\u0447\u0438\u043c\u043e \u0431\u043e\u043b\u044c\u043d\u044b. \u0412 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 BUM \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u0441 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 STP. \u0412\u043e \u0432\u0442\u043e\u0440\u0443\u044e \u2014 \u0432 \u0446\u0435\u043b\u043e\u043c \u043c\u043e\u0440\u0430\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043e\u0439. \u042d\u0442\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0432\u0438\u0434\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78002,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78001","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zku\u0161enosti s implementac\u00ed s\u00ed\u0165ov\u00fdch fabrik zalo\u017een\u00fdch na EVPN VXLAN a Cisco ACI a mal\u00e9 srovn\u00e1n\u00ed | ProHoster","description":"Ohodno\u0165te.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044b\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0444\u0430\u0431\u0440\u0438\u043a \u043d\u0430 \u0431\u0430\u0437\u0435 EVPN VXLAN \u0438 Cisco ACI \u0438 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 | ProHoster","og:description":"\u041e\u0446\u0435\u043d\u0438\u0442\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-15T11:42:19+00:00","article:modified_time":"2020-04-15T11:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78001","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:07:26","updated":"2022-09-27 21:24:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78001","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=78001"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78001\/revisions"}],"predecessor-version":[{"id":164511,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78001\/revisions\/164511"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/78002"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=78001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=78001"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=78001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}