{"id":87676,"date":"2020-07-09T13:42:19","date_gmt":"2020-07-09T11:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/huawei-dcn-pyat-sczenariev-postroeniya-seti-czod"},"modified":"2020-07-09T13:42:19","modified_gmt":"2020-07-09T11:42:19","slug":"huawei-dcn-pyat-sczenariev-postroeniya-seti-czod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/huawei-dcn-pyat-sczenariev-postroeniya-seti-czod","title":{"rendered":"Huawei DCN: p\u011bt sc\u00e9n\u00e1\u0159\u016f pro vytvo\u0159en\u00ed datov\u00e9ho centra","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dnes se zam\u011b\u0159\u00edme nejen na produktovou \u0159adu Huawei pro vytv\u00e1\u0159en\u00ed datov\u00fdch center, ale tak\u00e9 na to, jak na jej\u00edm z\u00e1klad\u011b sestavit pokro\u010dil\u00e1 komplexn\u00ed \u0159e\u0161en\u00ed. Za\u010dneme sc\u00e9n\u00e1\u0159i, p\u0159ejdeme ke konkr\u00e9tn\u00edm funkc\u00edm, podporovan\u00e9mu vybaven\u00ed, a nakonec se pod\u00edv\u00e1me na konkr\u00e9tn\u00ed za\u0159\u00edzen\u00ed, kter\u00e1 mohou b\u00fdt z\u00e1kladem modern\u00edch datov\u00fdch center s nejvy\u0161\u0161\u00ed \u00farovn\u00ed automatizace s\u00ed\u0165ov\u00fdch proces\u016f.<\/p>\n

\"Huawei
\n<\/a><\/noindex>
\nA\u0165 u\u017e jsou vlastnosti s\u00ed\u0165ov\u00e9ho vybaven\u00ed jakkoli p\u016fsobiv\u00e9, mo\u017enosti aplika\u010dn\u00edch architektonick\u00fdch \u0159e\u0161en\u00ed na jeho z\u00e1klad\u011b jsou ur\u010dov\u00e1ny t\u00edm, jak efektivn\u00ed m\u016f\u017ee b\u00fdt vz\u00e1jemn\u00e1 integrace souvisej\u00edc\u00edch hardwarov\u00fdch, softwarov\u00fdch, virtu\u00e1ln\u00edch a dal\u0161\u00edch technologi\u00ed. Sna\u017e\u00edme se dr\u017eet krok s dobou a rychle nab\u00edz\u00edme na\u0161im klient\u016fm modern\u00ed a perspektivn\u00ed mo\u017enosti, kter\u00e9 mnohdy p\u0159ed\u010d\u00ed i ty nejodv\u00e1\u017en\u011bj\u0161\u00ed pl\u00e1ny jin\u00fdch dodavatel\u016f.<\/p>\n

\"Huawei
\n
\n\u0158e\u0161en\u00ed zalo\u017een\u00e1 na Cloud Fabric zahrnuj\u00ed s\u00ed\u0165 datov\u00e9ho centra, SDN \u0159adi\u010d a dal\u0161\u00ed pot\u0159ebn\u00e9 komponenty konkr\u00e9tn\u00edho projektu, v\u010detn\u011b d\u00edl\u016f od jin\u00fdch v\u00fdrobc\u016f.<\/p>\n

Prvn\u00ed a nejjednodu\u0161\u0161\u00ed sc\u00e9n\u00e1\u0159 zahrnuje pou\u017eit\u00ed minim\u00e1ln\u00edho po\u010dtu komponent: s\u00ed\u0165 je postavena na hardwarov\u00e9 z\u00e1kladn\u011b Huawei a extern\u00edch prost\u0159edc\u00edch pro automatizaci proces\u016f spr\u00e1vy s\u00edt\u011b a jej\u00edho monitorov\u00e1n\u00ed. Nap\u0159\u00edklad takov\u00fdch, jako je Ansible nebo Microsoft Azure.<\/p>\n

Druh\u00fd sc\u00e9n\u00e1\u0159 p\u0159edpokl\u00e1d\u00e1, \u017ee z\u00e1kazn\u00edk ji\u017e pou\u017e\u00edv\u00e1 syst\u00e9m virtualizace a SDN pro datov\u00e1 centra, nap\u0159\u00edklad NSX, a chce vyu\u017e\u00edt vybaven\u00ed Huawei jako hardwarov\u00fd VTEP (Virtual Tunnel End Point) v r\u00e1mci st\u00e1vaj\u00edc\u00edho \u0159e\u0161en\u00ed VMware. Na webov\u00fdch str\u00e1nk\u00e1ch t\u00e9to spole\u010dnosti je uveden seznam<\/a><\/noindex> vybaven\u00ed Huawei, kter\u00e9 bylo otestov\u00e1no a m\u016f\u017ee b\u00fdt pou\u017eito jako VTEP. V\u017edy\u0165 nen\u00ed \u017e\u00e1dn\u00fdm tajemstv\u00edm, \u017ee a\u0165 u\u017e jsou softwarov\u00e1 \u0159e\u0161en\u00ed VXLAN (Virtual Extensible LAN) na virtu\u00e1ln\u00edch p\u0159ep\u00edna\u010d\u00edch jakkoli \u00fasp\u011b\u0161n\u00e1, hardwarov\u00e9 implementace jsou z pohledu v\u00fdkonu efektivn\u011bj\u0161\u00ed.<\/p>\n

T\u0159et\u00ed sc\u00e9n\u00e1\u0159 se zam\u011b\u0159uje na v\u00fdstavbu syst\u00e9m\u016f t\u0159\u00eddy hosting & computing, kter\u00e9 obsahuj\u00ed \u0159\u00eddic\u00ed prvek, ale postr\u00e1daj\u00ed jakoukoli nad\u0159azenou platformu, se kterou by bylo nutn\u00e9 integrovat. Jednou z mo\u017enost\u00ed realizace tohoto sc\u00e9n\u00e1\u0159e je samostatn\u00fd SDN \u0159\u00eddic\u00ed prvek Agile Controller-DCN. Tuto architekturu mohou syst\u00e9mov\u00ed administr\u00e1to\u0159i vyu\u017e\u00edvat k prov\u00e1d\u011bn\u00ed ka\u017edodenn\u00edch operac\u00ed spr\u00e1vy s\u00edt\u011b. Vy\u0161\u0161\u00ed varianta t\u0159et\u00edho sc\u00e9n\u00e1\u0159e se op\u00edr\u00e1 o interakci Agile Controller-DCN s VMware vCenter, spojeny ur\u010dit\u00fdm obchodn\u00edm procesem, av\u0161ak op\u011bt bez nad\u0159azen\u00e9ho syst\u00e9mu spr\u00e1vy.<\/p>\n

\u010ctvrt\u00fd sc\u00e9n\u00e1\u0159 je zaj\u00edmav\u00fd \u2014 integrace s nad\u0159azenou platformou na b\u00e1zi OpenStack nebo na\u0161eho produktu virtualizace FusionSphere. Registrujeme mnoho \u017e\u00e1dost\u00ed o podobn\u00e1 architektonick\u00e1 \u0159e\u0161en\u00ed, z nich\u017e nejv\u011bt\u0161\u00ed popularitu m\u00e1 OpenStack (CentOS, Red Hat atd.). Z\u00e1le\u017e\u00ed na tom, jak\u00e1 platforma orchestrace a spr\u00e1vy v\u00fdpo\u010detn\u00edch prost\u0159edk\u016f se pou\u017e\u00edv\u00e1 v datov\u00e9m centru.<\/p>\n

P\u00e1t\u00fd sc\u00e9n\u00e1\u0159 je zcela nov\u00fd. Krom\u011b \u0161iroce zn\u00e1m\u00fdch hardwarov\u00fdch switch\u016f zahrnuje distribuovan\u00fd virtu\u00e1ln\u00ed switch CloudEngine 1800V (CE1800V), kter\u00fd lze pou\u017e\u00edvat pouze s KVM (Kernel-based Virtual Machine). Tato architektura p\u0159edpokl\u00e1d\u00e1 spojen\u00ed Agile Controller-DCN s platformou pro kontejnerizaci Kubernetes pomoc\u00ed pluginu CNI. Takto Huawei spolu se sv\u011btem sm\u011b\u0159uje od virtualizace hostitel\u016f k virtualizaci opera\u010dn\u00edch syst\u00e9m\u016f<\/b>.<\/p>\n

\"Huawei
\n<\/p>\n

V\u00edce o kontejnerizaci<\/h2>\n

\nD\u0159\u00edve jsme ji\u017e zm\u00ednili virtu\u00e1ln\u00ed switch CE1800V, nasazovan\u00fd pomoc\u00ed Agile Controller-DCN. V kombinaci s hardwarov\u00fdmi switchemi Huawei tvo\u0159\u00ed jak\u00fdsi \u201ehybridn\u00ed overlay\u201c. V bl\u00edzk\u00e9 budoucnosti z\u00edskaj\u00ed kontejnerov\u00e9 sc\u00e9n\u00e1\u0159e od Huawei podporu funkc\u00ed NAT a vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee. <\/p>\n

Omezen\u00edm architektury je nemo\u017enost pou\u017e\u00edvat CE1800V samostatn\u011b od Agile Controller-DCN. Je tak\u00e9 t\u0159eba m\u00edt na pam\u011bti, \u017ee jeden PoD platformy Kubernetes m\u016f\u017ee obsahovat maxim\u00e1ln\u011b 4 miliony kontejner\u016f.<\/p>\n

P\u0159ipojen\u00ed k s\u00edti VXLAN datov\u00e9ho centra se uskute\u010d\u0148uje prost\u0159ednictv\u00edm VLAN (Virtual Local Area Network), existuje v\u0161ak i varianta, kdy CE1800V funguje jako VTEP s procesem BGP (Border Gateway Protocol). To umo\u017e\u0148uje v\u00fdm\u011bnu BGP sm\u011brov\u00e1n\u00ed s p\u00e1te\u0159n\u00ed s\u00edt\u00ed bez zapojen\u00ed samostatn\u00fdch hardwarov\u00fdch switch\u016f.<\/p>\n

\"Huawei
\n<\/p>\n

S\u00edt\u011b \u0159\u00edzen\u00e9 z\u00e1m\u011bry: s\u00edt\u011b analyzuj\u00edc\u00ed z\u00e1m\u011bry<\/h2>\n

\nKoncept s\u00edt\u011b \u0159\u00edzen\u00e9 z\u00e1m\u011bry (IDN) od Huawei p\u0159edstavila<\/a><\/noindex> byl p\u0159edstaven ji\u017e v roce 2018. Od t\u00e9 doby spole\u010dnost nep\u0159etr\u017eit\u011b pracuje na s\u00edt\u00edch, kter\u00e9 pomoc\u00ed technologie cloud computingu, velk\u00fdch dat a um\u011bl\u00e9 inteligence analyzuj\u00ed c\u00edle a z\u00e1m\u011bry u\u017eivatel\u016f.<\/p>\n

V podstat\u011b mluv\u00edme o p\u0159echodu od automatizace k autonomii. Vyj\u00e1d\u0159en\u00fd z\u00e1m\u011br u\u017eivatele se vrac\u00ed ve form\u011b doporu\u010den\u00ed s\u00ed\u0165ov\u00fdch produkt\u016f, jak tento z\u00e1m\u011br realizovat. Z\u00e1kladem t\u00e9to funk\u010dnosti jsou schopnosti Agile Controller-DCN, kter\u00e9 budou p\u0159id\u00e1ny do produktu, aby zajistily realizaci ideologie IDN.<\/p>\n

V budoucnu s implementac\u00ed IDN bude mo\u017en\u00e9 nasazovat s\u00ed\u0165ov\u00e9 slu\u017eby jedn\u00edm kliknut\u00edm, co\u017e znamen\u00e1 nejvy\u0161\u0161\u00ed \u00farove\u0148 automatizace. Modul\u00e1rn\u00ed architektura funkc\u00ed s\u00edt\u011b a mo\u017enost kombinovat tyto funkce umo\u017en\u00ed administr\u00e1torovi jednodu\u0161e uv\u00e9st, jak\u00e9 slu\u017eby je t\u0159eba zp\u0159\u00edstupnit v konkr\u00e9tn\u00ed s\u00ed\u0165ov\u00e9 segmentaci.<\/p>\n

K dosa\u017een\u00ed takov\u00e9 \u00farovn\u011b spr\u00e1vy je velmi d\u016fle\u017eit\u00fd proces ZTP (Zero Touch Provisioning). Huawei dos\u00e1hl v t\u00e9to oblasti v\u00fdznamn\u00e9ho pokroku, d\u00edky \u010demu\u017e nab\u00edz\u00ed mo\u017enost pln\u00e9ho nasazen\u00ed s\u00edt\u011b \"z krabice\".<\/p>\n

N\u00e1sleduj\u00edc\u00ed proces instalace a nasazen\u00ed nezbytn\u011b zahrnuje postup kontroly konektivity mezi zdroji (network connectivity) a hodnocen\u00ed zm\u011bn v v\u00fdkonu s\u00edt\u011b v z\u00e1vislosti na re\u017eimech jej\u00edho provozu. Tento krok zahrnuje proveden\u00ed simulace p\u0159ed zah\u00e1jen\u00edm re\u00e1ln\u00e9ho provozu.<\/p>\n

Dal\u0161\u00edm krokem je nastaven\u00ed slu\u017eeb podle pot\u0159eb klienta (service provisioning) a jejich verifikace, kter\u00e1 se prov\u00e1d\u00ed vestav\u011bn\u00fdmi n\u00e1stroji od Huawei. Pot\u00e9 zb\u00fdv\u00e1 pouze zkontrolovat v\u00fdsledek. <\/p>\n

Celou popsanou cestu nyn\u00ed lze absolvovat pomoc\u00ed jednoho komplexn\u00edho mechanismu zalo\u017een\u00e9ho na platform\u011b iMaster NCE, obsahuj\u00edc\u00ed Agile Controller-DCN a syst\u00e9m spr\u00e1vy s\u00ed\u0165ov\u00fdch prvk\u016f (EMS) eSight.<\/p>\n

\"Huawei
\n
\nV sou\u010dasn\u00e9 dob\u011b Agile Controller-DCN dok\u00e1\u017ee kontrolovat dostupnost zdroj\u016f a existenci spojen\u00ed, a tak\u00e9 proaktivn\u011b (po schv\u00e1len\u00ed administr\u00e1tora) reagovat na vznikl\u00e9 probl\u00e9my v s\u00edti. P\u0159id\u00e1n\u00ed pot\u0159ebn\u00fdch slu\u017eeb se nyn\u00ed prov\u00e1d\u00ed ru\u010dn\u011b, ale do budoucna m\u00e1 Huawei v pl\u00e1nu tuto a dal\u0161\u00ed operace, jako je nasazen\u00ed server\u016f a konfigurace s\u00edt\u00ed pro \u00falo\u017ei\u0161t\u011b dat, automatizovat. <\/p>\n

\"Huawei
\n<\/p>\n

Servisn\u00ed \u0159et\u011bzce a mikrosegmentace<\/h2>\n

\nAgile Controller-DCN je schopen zpracov\u00e1vat servisn\u00ed hlavi\u010dky (Net Service Headers, nebo NSH), kter\u00e9 jsou obsa\u017eeny v paketech VXLAN. To se pou\u017e\u00edv\u00e1 k vytv\u00e1\u0159en\u00ed servisn\u00edch \u0159et\u011bzc\u016f (service chains). Nap\u0159\u00edklad, pokud chcete zaslat ur\u010dit\u00e9 typy paket\u016f po trase, kter\u00e1 je odli\u0161n\u00e1 od t\u00e9, kterou nab\u00edz\u00ed standardn\u00ed protokol sm\u011brov\u00e1n\u00ed. P\u0159ed opu\u0161t\u011bn\u00edm s\u00edt\u011b mus\u00ed proj\u00edt n\u011bjak\u00fdm za\u0159\u00edzen\u00edm (firewall atd.). K tomu sta\u010d\u00ed nakonfigurovat servisn\u00ed \u0159et\u011bzec s po\u017eadovan\u00fdmi pravidly. D\u00edky tomuto mechanismu lze nap\u0159\u00edklad konfigurovat bezpe\u010dnostn\u00ed politiky, ale jsou mo\u017en\u00e9 i jin\u00e9 oblasti pou\u017eit\u00ed.<\/p>\n

\"Huawei
\n
\nNa sch\u00e9matu je n\u00e1zorn\u011b zn\u00e1zorn\u011bna \u010dinnost RFC-kompatibiln\u00edch servisn\u00edch \u0159et\u011bzc\u016f, zalo\u017een\u00fdch na NSH, a je uveden seznam podporuj\u00edc\u00edch hardwarov\u00fdch p\u0159ep\u00edna\u010d\u016f.<\/p>\n

\"Huawei
\n
\nMo\u017enosti \u0159e\u0161en\u00ed Huawei v oblasti vytv\u00e1\u0159en\u00ed servisn\u00edch \u0159et\u011bzc\u016f jsou dopln\u011bny n\u00e1stroji mikrosegmentace \u2013 metodou s\u00ed\u0165ov\u00e9 bezpe\u010dnosti, kter\u00e1 zahrnuje izolaci bezpe\u010dnostn\u00edch segment\u016f a\u017e po jednotliv\u00e9 prvky pracovn\u00edho zat\u00ed\u017een\u00ed. P\u0159ekonat \"\u00fazk\u00e9 hrdlo\" seznam\u016f \u0159\u00edzen\u00ed p\u0159\u00edstupu (Access Control List nebo ACL) pom\u00e1h\u00e1 absence pot\u0159eby manu\u00e1ln\u011b konfigurovat ohromn\u00e9 mno\u017estv\u00ed ACL.<\/p>\n

\"Huawei
\n<\/p>\n

Inteligentn\u00ed provoz<\/h2>\n

\nP\u0159i p\u0159echodu k ot\u00e1zk\u00e1m provozu s\u00edt\u011b nelze nezm\u00ednit dal\u0161\u00ed komponentu onkologick\u00e9ho brandu iMaster NCE \u2014 inteligentn\u00ed analyz\u00e1tor s\u00edt\u011b FabricInsight. Ten poskytuje \u0161irok\u00e9 mo\u017enosti pro sb\u011br telemetrie a informac\u00ed o tok\u016f dat v s\u00edti. Telemetrie se shroma\u017e\u010fuje pomoc\u00ed gRPC a akumuluje \u00fadaje o \u00fasp\u011b\u0161n\u00fdch, zpo\u017ed\u011bn\u00fdch v bufferu a ztracen\u00fdch paketech. Druh\u00e1 velk\u00e1 \u010d\u00e1st informac\u00ed se agreguje prost\u0159ednictv\u00edm ERSPAN (Encapsulated Remote Switch Port Analyzer) a poskytuje p\u0159ehled o toku dat v datov\u00e9m centru. V podstat\u011b jde o sb\u011br TCP z\u00e1hlav\u00ed a objem\u016f informac\u00ed, p\u0159ed\u00e1van\u00fdch b\u011bhem ka\u017ed\u00e9 TCP session. To je mo\u017en\u00e9 prov\u00e1d\u011bt s pou\u017eit\u00edm r\u016fzn\u00fdch za\u0159\u00edzen\u00ed Huawei \u2014 jejich seznam je uveden na sch\u00e9matu.<\/p>\n

Nezapomn\u011blo se ani na SNMP a NetStream, tak\u017ee Huawei vyu\u017e\u00edv\u00e1 jak star\u00e9, tak nov\u00e9 mechanismy, aby p\u0159e\u0161el od s\u00edt\u011b jako \"\u010dern\u00e9 sk\u0159\u00ed\u0148ky\" k s\u00edti, o kter\u00e9 v\u00edme doslova v\u0161echno.<\/p>\n

\"Huawei
\n<\/p>\n

AI Fabric: chytr\u00e9 s\u00edt\u011b bez ztr\u00e1t<\/h2>\n

\nFunkce AI Fabric, podporovan\u00e9 na\u0161\u00edm vybaven\u00edm, maj\u00ed za c\u00edl prom\u011bnit Ethernet na vysokov\u00fdkonnou s\u00ed\u0165 s n\u00edzk\u00fdmi latencemi a bez ztr\u00e1t paket\u016f. To je nutn\u00e9 pro realizaci z\u00e1kladn\u00edch sc\u00e9n\u00e1\u0159\u016f implementace aplikac\u00ed v datov\u00e9m centru.<\/p>\n

\"Huawei
\n
\nNa v\u00fd\u0161e uveden\u00e9m sch\u00e9matu vid\u00edme probl\u00e9my, se kter\u00fdmi se m\u016f\u017eeme p\u0159i provozu s\u00edt\u011b setkat:<\/p>\n