{"id":78001,"date":"2020-04-15T13:42:19","date_gmt":"2020-04-15T11:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie"},"modified":"2020-04-15T13:42:19","modified_gmt":"2020-04-15T11:42:19","slug":"opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","title":{"rendered":"Sk\u00fasenosti s implement\u00e1ciou sie\u0165ov\u00fdch fabr\u00edk na b\u00e1ze EVPN VXLAN a Cisco ACI a mal\u00e9 porovnanie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Sk\u00fasenosti
\nPos\u00fa\u010fte v\u00e4zby v strednej \u010dasti sch\u00e9my. K nim sa \u010doskoro vr\u00e1time<\/i><\/p>\n

V ur\u010ditom okamihu sa m\u00f4\u017eete stretn\u00fa\u0165 s t\u00fdm, \u017ee ve\u013ek\u00e9 zlo\u017eit\u00e9 siete zalo\u017een\u00e9 na L2 s\u00fa nezvratne chor\u00e9. Predov\u0161etk\u00fdm probl\u00e9my s\u00favisiace so spracovan\u00edm BUM prev\u00e1dzky a so fungovan\u00edm protokolu STP. Druh\u00e1 skupina probl\u00e9mov spo\u010d\u00edva v celkovo mor\u00e1lne zastaranej architekt\u00fare. To sp\u00f4sobuje nepr\u00edjemn\u00e9 probl\u00e9my v podobe v\u00fdpadkov a \u0165a\u017ekost\u00ed s riaden\u00edm.<\/p>\n

Mali sme dva paraleln\u00e9 projekty, kde z\u00e1kazn\u00edci triezvo zhodnotili v\u0161etky klady a z\u00e1pory mo\u017enost\u00ed a vybrali si dve r\u00f4zne overlay rie\u0161enia, ktor\u00e9 sme implementovali. <\/p>\n

Bola mo\u017enos\u0165 porovna\u0165 pr\u00e1ve implement\u00e1ciu. Nie prev\u00e1dzku, o tej sa bude hovori\u0165 za dva-tri roky. <\/p>\n

Tak\u017ee, \u010do je to sie\u0165ov\u00e1 fabrika s prekryt\u00fdmi sie\u0165ami a SDN?
\n<\/a><\/noindex><\/p>\n

\u010co robi\u0165 s naliehav\u00fdmi probl\u00e9mami klasickej architekt\u00fary siete?<\/h3>\n

\nKa\u017ed\u00fd rok sa objavuj\u00fa nov\u00e9 technol\u00f3gie a n\u00e1pady. V praxi ve\u013emi dlho neexistovala hor\u00faca potreba prestavova\u0165 siete, preto\u017ee robi\u0165 v\u0161etko ru\u010dne pod\u013ea star\u00fdch dobr\u00fdch met\u00f3d sa dalo tie\u017e. A \u010do na tom, \u017ee je dvadsiaty prv\u00fd storo\u010die? Napokon, admin by mal pracova\u0165, nie sedie\u0165 vo svojej kancel\u00e1rii. <\/p>\n

Potom nastal boom v\u00fdstavby rozsiahlych d\u00e1tov\u00fdch centier. Vtedy sa uk\u00e1zalo, \u017ee bola dosiahnut\u00e1 hranica rozvoja klasickej architekt\u00fary nielen z h\u013eadiska funk\u010dnosti, spo\u013eahlivosti a \u0161k\u00e1lovate\u013enosti. A jednou z mo\u017enost\u00ed, ako vyrie\u0161i\u0165 tieto \u00falohy, bola my\u0161lienka vybudova\u0165 prekryt\u00e9 siete nad smerovate\u013en\u00fdm backboneom.<\/p>\n

Okrem toho, s rast\u00facimi ve\u013ekos\u0165ami siet\u00ed sa ostro objavila ot\u00e1zka spr\u00e1vy tak\u00fdchto fabr\u00edk, v d\u00f4sledku \u010doho sa za\u010dali objavova\u0165 rie\u0161enia softv\u00e9rom definovan\u00fdch siet\u00ed, ktor\u00e9 umo\u017e\u0148uj\u00fa spravova\u0165 cel\u00fa sie\u0165ov\u00fa infra\u0161trukt\u00faru ako jednotn\u00fd celok. A ke\u010f je sie\u0165 spravovan\u00e1 z jedn\u00e9ho bodu, ostatn\u00fdm komponentom IT infra\u0161trukt\u00fary je jednoduch\u0161ie s \u0148ou interagova\u0165 a tak\u00e9to procesy interakcie sa jednoduch\u0161ie automatizuj\u00fa.<\/p>\n

Prakticky ka\u017ed\u00fd ve\u013ek\u00fd v\u00fdrobca nielen sie\u0165ov\u00e9ho vybavenia, ale aj virtualiz\u00e1cie, m\u00e1 vo svojom portf\u00f3liu varianty tak\u00fdchto rie\u0161en\u00ed. <\/p>\n

Zost\u00e1va len zisti\u0165, \u010do vyhovuje ak\u00fdm potreb\u00e1m. Napr\u00edklad pre ve\u013emi ve\u013ek\u00e9 spolo\u010dnosti s dobrou v\u00fdvojovou a prev\u00e1dzkovou t\u00edmom nie v\u017edy krabicov\u00e9 rie\u0161enia od dod\u00e1vate\u013eov splnia v\u0161etky potreby, a tak sa uchy\u013euj\u00fa k v\u00fdvoju vlastn\u00fdch SD (software defined) rie\u0161en\u00ed. Napr\u00edklad to s\u00fa cloudov\u00ed poskytovatelia, ktor\u00ed neust\u00e1le roz\u0161iruj\u00fa sortiment slu\u017eieb, ktor\u00e9 poskytuj\u00fa svojim klientom, a krabicov\u00e9 rie\u0161enia jednoducho nie s\u00fa schopn\u00e9 sa prisp\u00f4sobi\u0165 ich potreb\u00e1m. <\/p>\n

Pre stredn\u00e9 spolo\u010dnosti funk\u010dnos\u0165, ktor\u00fa dod\u00e1vate\u013e pon\u00faka v podobe krabicov\u00e9ho rie\u0161enia, sta\u010d\u00ed v 99 percent\u00e1ch pr\u00edpadov. <\/p>\n

\u010co s\u00fa to overloyov\u00e9 siete<\/h3>\n

\nO \u010do ide v my\u0161lienke overloyov\u00fdch siet\u00ed. V podstate vezmete klasick\u00fa smerovate\u013en\u00fa sie\u0165 a postav\u00edte nad \u0148ou \u010fal\u0161iu sie\u0165, aby ste z\u00edskali viac funkci\u00ed. \u010castej\u0161ie ide o efekt\u00edvne rozdelenie za\u0165a\u017eenia na zariadenia a linky, v\u00fdrazn\u00e9 zv\u00fd\u0161enie limitu na \u0161k\u00e1lovate\u013enos\u0165, zlep\u0161enie spo\u013eahlivosti a mno\u017estvo v\u00fdhod v oblasti bezpe\u010dnosti (v\u010faka segment\u00e1cii). A SDN rie\u0161enia navy\u0161e poskytuj\u00fa ve\u013emi, ve\u013emi, ve\u013emi pohodln\u00e9 flexibiln\u00e9 spravovanie a robia sie\u0165 prieh\u013eadnej\u0161ou pre jej u\u017e\u00edvate\u013eov. <\/p>\n

V podstate, keby boli lok\u00e1lne siete vyn\u00e1jden\u00e9 v roku 2010, vyzerali by \u00faplne inak ako to, \u010do sme zdedili po vojakov z 70. rokov. <\/p>\n

Z poh\u013eadu technol\u00f3gi\u00ed v\u00fdstavby fabr\u00edk s vyu\u017eit\u00edm prekr\u00fdvaj\u00facich siet\u00ed v s\u00fa\u010dasnosti existuje mno\u017estvo realiz\u00e1ci\u00ed od v\u00fdrobcov a internetov\u00fdch projektov RFC (EVPN+VXLAN, EVPN+MPLS, EVPN+MPLSoGRE, EVPN+Geneve a \u010fal\u0161ie). \u00c1no, existuj\u00fa \u0161tandardy, ale realiz\u00e1cia t\u00fdchto \u0161tandardov r\u00f4znymi v\u00fdrobcami sa m\u00f4\u017ee l\u00ed\u0161i\u0165, preto pri vytv\u00e1ran\u00ed tak\u00fdchto fabr\u00edk je zatia\u013e mo\u017en\u00e9 na papieri \u00faplne sa vzda\u0165 \u00fa\u010delov\u00e9ho vybavenia.<\/p>\n

Rie\u0161enia SD s\u00fa e\u0161te zlo\u017eitej\u0161ie, ka\u017ed\u00fd dod\u00e1vate\u013e m\u00e1 svoju v\u00edziu. Existuj\u00fa \u00faplne otvoren\u00e9 rie\u0161enia, ktor\u00e9 si teoreticky m\u00f4\u017eete prisp\u00f4sobi\u0165 sami, existuj\u00fa aj \u00faplne uzavret\u00e9.<\/p>\n

Cisco pon\u00faka svoju variantu SDN pre d\u00e1tov\u00e9 centr\u00e1 \u2014 ACI. Samozrejme, ide o 100 % dod\u00e1vate\u013esky podmienen\u00e9 rie\u0161enie z h\u013eadiska v\u00fdberu sie\u0165ov\u00e9ho zariadenia, ale z\u00e1rove\u0148 sa \u00faplne integruje so syst\u00e9mami virtualiz\u00e1cie, kontajneriz\u00e1cie, bezpe\u010dnosti, orchestr\u00e1cie, vyva\u017eova\u010dmi z\u00e1\u0165a\u017ee a \u010fal\u0161\u00edmi. V podstate je to v\u0161ak st\u00e1le ak\u00e1si \u010dierna skrinka, bez mo\u017enosti pln\u00e9ho pr\u00edstupu ku v\u0161etk\u00fdm vn\u00fatorn\u00fdm procesom. Nie v\u0161etci objedn\u00e1vatelia s\u00fa ochotn\u00ed prija\u0165 tak\u00fato variantu, preto\u017ee \u00faplne z\u00e1vis\u00edte od kvality nap\u00edsan\u00e9ho k\u00f3du rie\u0161enia a jeho implement\u00e1cie, ale na druhej strane m\u00e1 v\u00fdrobca jednu z najlep\u0161\u00edch technick\u00fdch podpor na svete a m\u00e1 vyhraden\u00fd t\u00edm, ktor\u00fd sa zaober\u00e1 iba t\u00fdmto rie\u0161en\u00edm. Ako rie\u0161enie pre prv\u00fd projekt bola zvolen\u00e1 pr\u00e1ve Cisco ACI.<\/p>\n

Pre druh\u00fd projekt bolo vybran\u00e9 rie\u0161enie od Juniper. V\u00fdrobca m\u00e1 tie\u017e svoj SDN pre d\u00e1tov\u00e9 centr\u00e1, ale objedn\u00e1vate\u013e sa rozhodol vzda\u0165 sa implement\u00e1cie SDN. Ako technol\u00f3gia v\u00fdstavby siete bola zvolen\u00e1 EVPN VXLAN fabrika bez pou\u017eitia centralizovan\u00fdch kontrol\u00e9rov.<\/p>\n

Na \u010do je to potrebn\u00e9<\/h3>\n

\nVytvorenie fabriky umo\u017e\u0148uje postavi\u0165 \u013eahko \u0161k\u00e1lovate\u013en\u00fa, odoln\u00fa, spo\u013eahliv\u00fa sie\u0165. Architekt\u00fara (leaf-spine) zoh\u013ead\u0148uje zvl\u00e1\u0161tnosti d\u00e1tov\u00fdch centier<\/a> (cesty prechodu prev\u00e1dzky, minimaliz\u00e1ciu oneskoren\u00ed a \u00fazkych miest v sieti). SD rie\u0161enia v d\u00e1tov\u00fdch centr\u00e1ch umo\u017e\u0148uj\u00fa ve\u013emi pohodln\u00e9, r\u00fdchle a flexibiln\u00e9 riadenie takejto fabriky a jej integr\u00e1ciu do ekosyst\u00e9mu d\u00e1tov\u00e9ho centra. <\/p>\n

Obom objedn\u00e1vate\u013eom bolo potrebn\u00e9 vybudova\u0165 z\u00e1lo\u017en\u00e9 d\u00e1tov\u00e9 centr\u00e1 na zabezpe\u010denie odolnosti, okrem toho musel by\u0165 prev\u00e1dzkov\u00fd prenos medzi d\u00e1tov\u00fdmi centrami \u0161ifrovan\u00fd.<\/p>\n

Prv\u00fd objedn\u00e1vate\u013e u\u017e zva\u017eoval rie\u0161enia bez fabriky ako mo\u017en\u00fd \u0161tandard svojich siet\u00ed, ale pri testoch mali probl\u00e9my s kompatibilitou STP medzi r\u00f4znymi dod\u00e1vate\u013emi hardv\u00e9ru. Vyskytovali sa v\u00fdpadky, ktor\u00e9 sp\u00f4sobovali zlyhanie slu\u017eieb. A pre objedn\u00e1vate\u013ea to bolo kritick\u00e9. <\/p>\n

Cisco u\u017e bola firemn\u00fdm \u0161tandardom klienta, pozreli sa na ACI a \u010fal\u0161ie mo\u017enosti a rozhodli sa, \u017ee zober\u00fa pr\u00e1ve toto rie\u0161enie. P\u00e1\u010dila sa im automatiz\u00e1cia spr\u00e1vy jedn\u00fdm kliknut\u00edm pomocou jedn\u00e9ho kontrol\u00e9ra. Slu\u017eby sa nastavia r\u00fdchlej\u0161ie, spravuj\u00fa sa r\u00fdchlej\u0161ie. Rozhodli sa zabezpe\u010di\u0165 \u0161ifrovanie prev\u00e1dzky prostredn\u00edctvom technol\u00f3gie MACSec medzi prep\u00edna\u010dmi IPN a SPINE. Takto sa im podarilo vyhn\u00fa\u0165 \u00fazkemu miestu vo forme kryptografick\u00e9ho br\u00e1ny, u\u0161etri\u0165 na nich a maxim\u00e1lne vyu\u017ei\u0165 \u0161\u00edrku p\u00e1sma.<\/p>\n

Druh\u00fd klient si zvolil rie\u0161enie bez kontrol\u00e9ra od Junipera, preto\u017ee v ich existuj\u00facom DC u\u017e bola mal\u00e1 in\u0161tal\u00e1cia s realiz\u00e1ciou fabriky EVPN VXLAN. Ale tam nebola vysoko dostupn\u00e1 (pou\u017e\u00edval sa jeden prep\u00edna\u010d). Rozhodli sa roz\u0161\u00edri\u0165 infra\u0161trukt\u00faru hlavn\u00e9ho DC a postavi\u0165 fabriku v z\u00e1lo\u017enom DC. Existuj\u00face EVPN nebolo plne vyu\u017eit\u00e9: enkapsul\u00e1cia VXLAN sa vlastne nepou\u017e\u00edvala, preto\u017ee v\u0161etky hostite\u013esk\u00e9 zariadenia boli pripojen\u00e9 k jedn\u00e9mu prep\u00edna\u010du a v\u0161etky MAC adresy a \/32 adresy hostite\u013eov boli lok\u00e1lne, br\u00e1nou pre ne bol tento prep\u00edna\u010d, neexistovali in\u00e9 zariadenia, na ktor\u00e9 by bolo potrebn\u00e9 budova\u0165 VXLAN tunely. Rozhodli sa zabezpe\u010di\u0165 \u0161ifrovanie prev\u00e1dzky s pou\u017eit\u00edm technol\u00f3gie IPSEC medzi firewallmi (v\u00fdkon MSR bol dostato\u010dn\u00fd).<\/p>\n

Tie\u017e sa pozreli na ACI, ale rozhodli sa, \u017ee kv\u00f4li vendor lock bud\u00fa musie\u0165 k\u00fapi\u0165 pr\u00edli\u0161 ve\u013ea zariaden\u00ed, vr\u00e1tane n\u00e1hrady ned\u00e1vno zak\u00fapen\u00e9ho nov\u00e9ho hardv\u00e9ru, a to jednoducho ned\u00e1va ekonomick\u00fd zmysel. \u00c1no, Cisco fabrika sa integruje so v\u0161etk\u00fdm, ale vo vn\u00fatri samotnej fabriky s\u00fa mo\u017en\u00e9 len jej zariadenia. <\/p>\n

Na druhej strane, ako sa povedalo sk\u00f4r, EVPN VXLAN fabrika s ak\u00fdmko\u013evek susedn\u00fdm dod\u00e1vate\u013eom sa jednoducho nespoj\u00ed, preto\u017ee implement\u00e1cie protokolu sa l\u00ed\u0161ia. Je to ako kr\u00ed\u017eenie Cisco a Huawei v jednej sieti \u2014 zdanlivo s\u00fa \u0161tandardy spolo\u010dn\u00e9, len s t\u00fdm bude treba tancova\u0165. Ke\u010f\u017ee ide o banku a testy kompatibility by boli ve\u013emi dlh\u00e9, rozhodli sa, \u017ee bude lep\u0161ie nak\u00fapi\u0165 od toho ist\u00e9ho dod\u00e1vate\u013ea teraz a pr\u00edli\u0161 sa nezap\u00e1ja\u0165 do funkci\u00ed za hranicami z\u00e1kladn\u00e9ho bal\u00edka. <\/p>\n

Pl\u00e1n migr\u00e1cie<\/h3>\n

\nDva DC na b\u00e1ze ACI:<\/p>\n

\"Sk\u00fasenosti
\n
\nOrganiz\u00e1cia interakcie medzi DC. Vybrat\u00e9 rie\u0161enie Multi-Pod \u2014 ka\u017ed\u00fd DC je pod. Zoh\u013eadnen\u00e9 po\u017eiadavky na \u0161k\u00e1lovate\u013enos\u0165 z poh\u013eadu po\u010dtu prep\u00edna\u010dov a na oneskorenia medzi podmi (RTT menej ako 50 ms). Bolo rozhodnut\u00e9 nestava\u0165 rie\u0161enie Multi-Site kv\u00f4li pohodlnosti spr\u00e1vy (pre rie\u0161enie Multi-Pod sa pou\u017e\u00edva jednotn\u00e9 rozhranie spr\u00e1vy, pre Multi-Site by bolo potrebn\u00e9 dve rozhrania, alebo by bol potrebn\u00fd Multi-Site Orchestrator), a preto\u017ee nebolo potrebn\u00e9 geografick\u00e9 z\u00e1lohovanie lokal\u00edt.<\/p>\n

\"Sk\u00fasenosti
\n
\nZ h\u013eadiska migr\u00e1cie slu\u017eieb z Legacy siete bol vybran\u00fd najprieh\u013eadnej\u0161\u00ed variant, postupne prenies\u0165 VLAN, ktor\u00e9 s\u00fa priraden\u00e9 konkr\u00e9tnym slu\u017eb\u00e1m.
\nPre migr\u00e1ciu bol ka\u017ed\u00e9mu VLAN vytvoren\u00fd zodpovedaj\u00faci EPG (End-point-group) na fabrike. Najprv sa sie\u0165 roz\u0165ahovala medzi starou sie\u0165ou a fabrikou cez L2, potom po migr\u00e1cii v\u0161etk\u00fdch hostite\u013eov bol br\u00e1na presunut\u00e1 na fabriku a interakcia EPG so s\u00fa\u010dasnou sie\u0165ou prebiehala cez L3OUT, pri\u010dom interakcia medzi L3OUT a EPG bola pop\u00edsan\u00e1 s pou\u017eit\u00edm zml\u00fav. Pribli\u017en\u00fd diagram:<\/p>\n

\"Sk\u00fasenosti
\n
\nPribli\u017en\u00e1 \u0161trukt\u00fara v\u00e4\u010d\u0161iny polit\u00edk fabriky ACI na obr\u00e1zku ni\u017e\u0161ie. Cel\u00e9 nastavenie je postaven\u00e9 na politik\u00e1ch, vnoren\u00fdch do in\u00fdch polit\u00edk a tak \u010falej. Na za\u010diatku je ve\u013emi zlo\u017eit\u00e9 sa zorientova\u0165, ale postupne, ako ukazuje prax, administr\u00e1tori siet\u00ed si zvykaj\u00fa na tak\u00fato \u0161trukt\u00faru pribli\u017ene za mesiac, a potom prich\u00e1dza pochopenie, ak\u00e9 je to pohodln\u00e9.<\/p>\n

\"Sk\u00fasenosti
\n <\/p>\n

Porovnanie<\/h3>\n

\nV rie\u0161en\u00ed Cisco ACI je potrebn\u00e9 k\u00fapi\u0165 viac vybavenia (samostatn\u00e9 prep\u00edna\u010de pre Inter-Pod interakcie a APIC kontrol\u00e9ry), \u010do sp\u00f4sobilo, \u017ee to bolo drah\u0161ie. Rie\u0161enie Juniper nevy\u017eadovalo n\u00e1kup kontrol\u00e9rov ani doplnkov\u00e9ho vybavenia; \u010diasto\u010dne sa podarilo pou\u017ei\u0165 u\u017e existuj\u00face vybavenie z\u00e1kazn\u00edka. <\/p>\n

Tu je architekt\u00fara EVPN VXLAN fabriky pre dva DC druh\u00e9ho projektu:<\/p>\n

\"Sk\u00fasenosti
\n\"Sk\u00fasenosti
\n
\nV ACI dost\u00e1va\u0161 hotov\u00e9 rie\u0161enie \u2014 nie je potrebn\u00e9 sa hra\u0165, nie je potrebn\u00e9 optimalizova\u0165. Pri prvotnom zozn\u00e1men\u00ed z\u00e1kazn\u00edka s fabrikou nie s\u00fa potrebn\u00ed v\u00fdvoj\u00e1ri, nie s\u00fa potrebn\u00ed podporn\u00ed \u013eudia pre k\u00f3d a automatiz\u00e1ciu. Sta\u010d\u00ed len prev\u00e1dzka, mnoh\u00e9 nastavenia je mo\u017en\u00e9 vykona\u0165 \u00faplne cez sprievodcu, \u010do nie v\u017edy je v\u00fdhodou, najm\u00e4 pre \u013eud\u00ed zvyknut\u00fdch na pr\u00edkazov\u00fd riadok. V ka\u017edom pr\u00edpade je potrebn\u00fd \u010das na to, aby sa preorientoval myse\u013e na nov\u00e9 nastavenia, na \u0161pecifik\u00e1 nastaven\u00ed prostredn\u00edctvom polit\u00edk a manipul\u00e1ciu s mno\u017estvom vz\u00e1jomne prepojen\u00fdch polit\u00edk. Ve\u013emi \u017eiaduce je okrem toho ma\u0165 aj jasn\u00fa \u0161trukt\u00faru pomenovania polit\u00edk a objektov. Pri vzniku akejko\u013evek probl\u00e9my v logike fungovania kontrol\u00e9ra sa d\u00e1 vyrie\u0161i\u0165 iba prostredn\u00edctvom technickej podpory.<\/p>\n

V EVPN \u2014 konzola. Trp alebo sa raduj. Zvy\u010dajn\u00e9 rozhranie pre star\u00fa gardu. \u00c1no, existuje typov\u00e1 konfigur\u00e1cia a n\u00e1vody. Bude\u0161 musie\u0165 \u0161tudova\u0165 pr\u00edru\u010dky. R\u00f4zne kon\u0161trukcie, v\u0161etko je pochopite\u013en\u00e9 a detailn\u00e9.<\/p>\n

Samozrejme, v oboch pr\u00edpadoch je lep\u0161ie pri migrovan\u00ed najprv migrova\u0165 menej kritick\u00e9 slu\u017eby, napr\u00edklad testovacie prostredia, a a\u017e potom po zachyten\u00ed v\u0161etk\u00fdch ch\u00fdb prejs\u0165 na produkciu. A nenastavova\u0165 to v piatok ve\u010der. Nestoji za to veri\u0165 dod\u00e1vate\u013eovi, \u017ee v\u0161etko bude v poriadku, v\u017edy je lep\u0161ie sa pod\u0161koli\u0165.<\/p>\n

Na ACI plat\u00ed\u0161 viac, hoci v s\u00fa\u010dasnosti Cisco akt\u00edvne propaguje toto rie\u0161enie a \u010dasto poskytuje dobr\u00e9 z\u013eavy na\u0148, ale \u0161etr\u00ed\u0161 na \u00fadr\u017ebe \u2014 podpore. Spr\u00e1va a ak\u00e1ko\u013evek automatiz\u00e1cia EVPN fabriky bez kontrol\u00e9ra si vy\u017eaduje invest\u00edcie a pravideln\u00e9 n\u00e1klady \u2014 monitorovanie, automatiz\u00e1cia, implement\u00e1cia nov\u00fdch slu\u017eieb. S\u00fa\u010dasne je prv\u00fd spustenie ACI dlh\u0161ie o 30\u201340 percent. St\u00e1va sa to preto, \u017ee dlh\u0161ie sa vytv\u00e1ra cel\u00fd s\u00fabor potrebn\u00fdch profilov a polit\u00edk, ktor\u00e9 bud\u00fa n\u00e1sledne pou\u017eit\u00e9. Ale so zvy\u0161ovan\u00edm siete kles\u00e1 po\u010det potrebn\u00fdch konfigur\u00e1ci\u00ed. Pou\u017e\u00edva\u0161 u\u017e vopred vytvoren\u00e9 politiky, profily, objekty. M\u00f4\u017ee\u0161 flexibilne nastavova\u0165 segment\u00e1ciu a bezpe\u010dnos\u0165, centralizovane spravova\u0165 zmluvy, ktor\u00e9 zodpovedaj\u00fa za povolenie tak\u00fdch alebo onak\u00fdch interakci\u00ed medzi EPG, \u2014 objem pr\u00e1ce sa razantne zni\u017euje. <\/p>\n

V EVPN je potrebn\u00e9 konfigurova\u0165 ka\u017ed\u00e9 zariadenie vo fabrike, pravdepodobnos\u0165 chyby je vy\u0161\u0161ia.<\/p>\n

Ak je ACI pomal\u0161ie nasaden\u00fd, EVPN bol takmer dvakr\u00e1t dlh\u0161ie laden\u00fd. V pr\u00edpade Cisco sa m\u00f4\u017eete v\u017edy obr\u00e1ti\u0165 na technick\u00fa podporu a op\u00fdta\u0165 sa na sie\u0165 ako celok (preto\u017ee je pokryt\u00e1 ako rie\u0161enie), zatia\u013e \u010do pri Juniper Networks kupujete len hardv\u00e9r, ktor\u00fd je presne pokryt\u00fd. Odi\u0161li pakety z zariadenia? No, v poriadku, \u010falej s\u00fa to va\u0161e probl\u00e9my. Ale m\u00f4\u017eete otvori\u0165 ot\u00e1zku oh\u013eadom v\u00fdberu rie\u0161enia alebo dizajnu siete \u2014 a vtedy odporu\u010dia zak\u00fapi\u0165 profesion\u00e1lnu slu\u017ebu, za \u010fal\u0161\u00ed poplatok.<\/p>\n

Podpora ACI je ve\u013emi dobr\u00e1, preto\u017ee je samostatn\u00e1: samostatn\u00fd t\u00edm sa venuje iba tomuto. S\u00fa tam aj rusk\u00ed \u0161pecialisti. Sprievodca je podrobn\u00fd, rie\u0161enia s\u00fa preddefinovan\u00e9. Sledovanie a poradenstvo s\u00fa r\u00fdchle. R\u00fdchlo overuj\u00fa dizajn, \u010do je \u010dasto d\u00f4le\u017eit\u00e9. Juniper Networks rob\u00ed to ist\u00e9, ale ove\u013ea pomal\u0161ie (u n\u00e1s to tak bolo, teraz by to malo by\u0165 pod\u013ea spr\u00e1v lep\u0161ie), \u010do v\u00e1s n\u00fati robi\u0165 v\u0161etko sami tam, kde by mohol poradi\u0165 in\u017einier pre rie\u0161enia. <\/p>\n

Cisco ACI podporuje integr\u00e1ciu s virtualiza\u010dn\u00fdmi a kontajnerov\u00fdmi syst\u00e9mami (VMware, Kubernetes, Hyper-V) a centralizovan\u00e9 riadenie. Existuj\u00fa aj sie\u0165ov\u00e9 a bezpe\u010dnostn\u00e9 slu\u017eby \u2014 vyva\u017eovanie, firewall, WAF, IPS a \u010fal\u0161ie\u2026 Dobre funguj\u00faca mikrosegment\u00e1cia priamo z krabice. Pri druhom rie\u0161en\u00ed je integr\u00e1cia so sie\u0165ov\u00fdmi slu\u017ebami n\u00e1ro\u010dnej\u0161ia a je lep\u0161ie si najsk\u00f4r pre\u010d\u00edta\u0165 f\u00f3ra s t\u00fdmi, ktor\u00ed to u\u017e robili. <\/p>\n

Z\u00e1ver<\/h3>\n

\nPre ka\u017ed\u00fd konkr\u00e9tny pr\u00edpad je potrebn\u00e9 vybra\u0165 rie\u0161enie, nielen z poh\u013eadu n\u00e1kladov na vybavenie, ale je potrebn\u00e9 bra\u0165 do \u00favahy aj \u010fal\u0161ie v\u00fddavky na prev\u00e1dzku a hlavn\u00e9 probl\u00e9my, s ktor\u00fdmi sa z\u00e1kazn\u00edk v s\u00fa\u010dasnosti stret\u00e1va, a ak\u00e9 s\u00fa pl\u00e1ny na rozvoj IT infra\u0161trukt\u00fary. <\/p>\n

ACI sa s pomocou \u010fal\u0161ieho hardv\u00e9ru uk\u00e1zal ako drah\u0161\u00ed, ale m\u00e1 hotov\u00e9 rie\u0161enie bez potreby dodato\u010dn\u00e9ho v\u00fdvoja, druh\u00e9 rie\u0161enie je z poh\u013eadu prev\u00e1dzky zlo\u017eitej\u0161ie a n\u00e1kladnej\u0161ie, ale lacnej\u0161ie. <\/p>\n

Ak chcete diskutova\u0165 o tom, ko\u013eko m\u00f4\u017ee st\u00e1\u0165 implement\u00e1cia sie\u0165ovej fabriky u r\u00f4znych dod\u00e1vate\u013eov a ak\u00fa architekt\u00faru potrebujete, je mo\u017en\u00e9 sa stretn\u00fa\u0165 a porozpr\u00e1va\u0165. A\u017e po hrub\u00fd n\u00e1vrh architekt\u00fary (s ktor\u00fdm m\u00f4\u017eeme ur\u010di\u0165 rozpo\u010dty) poskytneme bezplatn\u00fa radu, podrobn\u00e1 pr\u00e1ca je u\u017e samozrejme spoplatnen\u00e1.<\/p>\n

Vladimir Klep\u010dev, podnikov\u00e9 siete.<\/p><\/blockquote>\n

Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0446\u0435\u043d\u0438\u0442\u0435 \u0441\u0432\u044f\u0437\u043a\u0438 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0445\u0435\u043c\u044b. \u041d\u0438\u0436\u0435 \u043a \u043d\u0438\u043c \u0432\u0435\u0440\u043d\u0451\u043c\u0441\u044f \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 L2 \u043d\u0435\u0438\u0437\u043b\u0435\u0447\u0438\u043c\u043e \u0431\u043e\u043b\u044c\u043d\u044b. \u0412 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 BUM \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u0441 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 STP. \u0412\u043e \u0432\u0442\u043e\u0440\u0443\u044e \u2014 \u0432 \u0446\u0435\u043b\u043e\u043c \u043c\u043e\u0440\u0430\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043e\u0439. \u042d\u0442\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0432\u0438\u0434\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78002,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78001","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sk\u00fasenosti s implement\u00e1ciou sie\u0165ov\u00fdch fabrick\u00fdch rie\u0161en\u00ed na b\u00e1ze EVPN VXLAN a Cisco ACI a mal\u00e9 porovnanie | ProHoster","description":"Ohodno\u0165te.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044b\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0444\u0430\u0431\u0440\u0438\u043a \u043d\u0430 \u0431\u0430\u0437\u0435 EVPN VXLAN \u0438 Cisco ACI \u0438 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 | ProHoster","og:description":"\u041e\u0446\u0435\u043d\u0438\u0442\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/opyt-realizaczii-setevyh-fabrik-na-baze-evpn-vxlan-i-cisco-aci-i-nebolshoe-sravnenie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-15T11:42:19+00:00","article:modified_time":"2020-04-15T11:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78001","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:07:26","updated":"2022-09-27 21:24:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/78001","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=78001"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/78001\/revisions"}],"predecessor-version":[{"id":164511,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/78001\/revisions\/164511"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/78002"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=78001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=78001"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=78001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}