WEBVTT

1
00:00.210 --> 00:01.080
So starting off,

2
00:01.080 --> 00:02.250
I'd like to make sure that you and I

3
00:02.250 --> 00:03.810
are on the same sheet of music

4
00:03.810 --> 00:05.820
regarding the basic infrastructure

5
00:05.820 --> 00:08.250
for the software-defined data center,

6
00:08.250 --> 00:10.680
or SDDC for short from VMware.

7
00:10.680 --> 00:12.180
And one of the core components

8
00:12.180 --> 00:17.180
of that infrastructure is the hypervisor called ESXi.

9
00:17.250 --> 00:20.130
So ESXi runs on top of hardware,

10
00:20.130 --> 00:21.780
usually, it's a pretty hefty server

11
00:21.780 --> 00:24.000
that has lots of CPU, and memory,

12
00:24.000 --> 00:26.970
and network access through network interface cards.

13
00:26.970 --> 00:28.860
These days, a lot of those network interface cards

14
00:28.860 --> 00:30.300
are 10 gigs each.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.860 --> 00:30.300
are 10 gigs each.

15
00:30.300 --> 00:32.370
And that ESXi host also has some storage,

16
00:32.370 --> 00:33.810
and that storage could be local

17
00:33.810 --> 00:35.760
or the ESXi host may have access

18
00:35.760 --> 00:37.410
to network-based storage as well.

19
00:37.410 --> 00:38.340
So the hypervisor,

20
00:38.340 --> 00:39.720
think of it like an operating system

21
00:39.720 --> 00:41.910
that's running on top of the hardware,

22
00:41.910 --> 00:43.410
in the case of ESXi,

23
00:43.410 --> 00:45.690
it's a specialized, dedicated operating system

24
00:45.690 --> 00:46.950
for host hardware,

25
00:46.950 --> 00:50.430
that could then provide a home for one or more VMs.

26
00:50.430 --> 00:51.870
And also with the right licensing,

27
00:51.870 --> 00:53.250
some containers as well.

28
00:53.250 --> 00:56.070
So the hypervisor's responsible for doling out

29
00:56.070 --> 00:57.570
and providing the resources

30
00:57.570 --> 00:59.310
regarding CPU, and memory,

31
00:59.310 --> 01:01.050
and network access, and storage,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
00:59.310 --> 01:01.050
and network access, and storage,

32
01:01.050 --> 01:03.810
for each of the VMs or containers

33
01:03.810 --> 01:05.730
that are running on that hypervisor.

34
01:05.730 --> 01:06.960
So an individual virtual machine

35
01:06.960 --> 01:09.240
believes it has access to storage,

36
01:09.240 --> 01:11.370
and RAM, and CPU, and everything else,

37
01:11.370 --> 01:12.203
but behind the scenes,

38
01:12.203 --> 01:13.860
it's all being provided logically

39
01:13.860 --> 01:15.210
via the hypervisor.

40
01:15.210 --> 01:16.920
And most environments that are running ESXi

41
01:16.920 --> 01:19.110
are gonna have more than just one ESXi host.

42
01:19.110 --> 01:22.020
So here's an example of three ESXi hosts,

43
01:22.020 --> 01:24.000
each of them with network access,

44
01:24.000 --> 01:25.440
and with CPU, and RAM,

45
01:25.440 --> 01:27.990
and either storage or network-attached storage,

46
01:27.990 --> 01:29.910
and each of them supporting several VMs

47
01:29.910 --> 01:32.520
that are running on those respective ESXi hosts.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:29.910 --> 01:32.520
that are running on those respective ESXi hosts.

48
01:32.520 --> 01:34.230
And to manage multiple ESXi hosts,

49
01:34.230 --> 01:36.660
we're often gonna use a vCenter server,

50
01:36.660 --> 01:39.240
which is implemented as a virtual machine.

51
01:39.240 --> 01:41.880
And then vCenter is interacting with

52
01:41.880 --> 01:43.500
and managing all the ESXi hosts,

53
01:43.500 --> 01:44.333
then you and I,

54
01:44.333 --> 01:46.440
we interact with vCenter to get information

55
01:46.440 --> 01:47.273
regarding what's going on,

56
01:47.273 --> 01:49.650
so this is us right here at our management PC.

57
01:49.650 --> 01:50.483
So we interact with vCenter

58
01:50.483 --> 01:53.580
and vCenter interacts with each of the ESXi hosts.

59
01:53.580 --> 01:55.530
And when working with multiple ESXi hosts,

60
01:55.530 --> 01:58.320
generally, we'll put two or more into a cluster,

61
01:58.320 --> 02:00.390
and then leverage some really cool features
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
01:58.320 --> 02:00.390
and then leverage some really cool features

62
02:00.390 --> 02:02.313
that we can get from that cluster of ESXi hosts,

63
02:02.313 --> 02:04.260
that are being managed by vCenter,

64
02:04.260 --> 02:05.910
including cool things like DRS,

65
02:05.910 --> 02:07.440
distributed resource scheduler,

66
02:07.440 --> 02:08.880
or being able to move a virtual machine

67
02:08.880 --> 02:11.190
from this ESXi host to another one,

68
02:11.190 --> 02:13.080
whether it's powered on or off.

69
02:13.080 --> 02:14.490
And when implementing the switching

70
02:14.490 --> 02:15.960
on these ESXi hosts,

71
02:15.960 --> 02:17.820
it's often a pain to go into each one,

72
02:17.820 --> 02:19.920
and configure a virtual switch here,

73
02:19.920 --> 02:21.690
another one here, another one here,

74
02:21.690 --> 02:22.920
and then if we wanna do vMotion,

75
02:22.920 --> 02:25.080
or migrate VMs back and forth,

76
02:25.080 --> 02:26.700
we need to make sure we have the same port groups

77
02:26.700 --> 02:27.533
on each of the switches,

78
02:27.533 --> 02:31.110
so oftentimes, we'll use a virtual distributed switch,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:27.533 --> 02:31.110
so oftentimes, we'll use a virtual distributed switch,

79
02:31.110 --> 02:31.943
and that way, we can have

80
02:31.943 --> 02:33.630
a configuration for a virtual switch

81
02:33.630 --> 02:35.970
be replicated across multiple hosts.

82
02:35.970 --> 02:37.200
So that way if we want a port group

83
02:37.200 --> 02:38.340
called port group 10,

84
02:38.340 --> 02:39.960
and we want it on all three switches,

85
02:39.960 --> 02:41.700
we create a virtual distributed switch,

86
02:41.700 --> 02:44.220
we create a distributed port group called, "PG-10."

87
02:44.220 --> 02:45.300
And then, poof!

88
02:45.300 --> 02:46.200
Once these three hosts

89
02:46.200 --> 02:47.610
are all part of that distributed switch,

90
02:47.610 --> 02:49.350
they will all have that port group.

91
02:49.350 --> 02:50.183
And then behind the scenes,

92
02:50.183 --> 02:51.180
that port group will lead

93
02:51.180 --> 02:53.550
to one or more of the physical NICs,

94
02:53.550 --> 02:55.170
which are called VMNICs

95
02:55.170 --> 02:56.970
for access out to the physical world.

96
02:56.970 --> 02:58.770
So that's all well and good,

97
02:58.770 --> 03:01.770
However, I would like to point out a few challenges
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
02:58.770 --> 03:01.770
However, I would like to point out a few challenges

98
03:01.770 --> 03:04.650
that we are going to fix and address with NSX.

99
03:04.650 --> 03:05.940
Let me label some VMs,

100
03:05.940 --> 03:10.290
I'm gonna go ahead and let's name them VM A here,

101
03:10.290 --> 03:12.780
and then VM B right here,

102
03:12.780 --> 03:14.220
and VM C.

103
03:14.220 --> 03:16.620
So VM A is being hosted on ESXi-one,

104
03:16.620 --> 03:19.800
and ESXi-two is hosting VM B and VM C.

105
03:19.800 --> 03:21.930
Let's also imagine that each of those VMs

106
03:21.930 --> 03:24.510
are connected logically to a port group,

107
03:24.510 --> 03:25.830
and I'll go ahead and put that port group

108
03:25.830 --> 03:26.910
in the same color here,

109
03:26.910 --> 03:29.040
that's part of a distributed switch.

110
03:29.040 --> 03:30.360
And let's imagine each of those port groups
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:29.040 --> 03:30.360
And let's imagine each of those port groups

111
03:30.360 --> 03:32.010
are associated with VLAN 10.

112
03:32.010 --> 03:34.920
And let's also imagine that this VMNIC right here

113
03:34.920 --> 03:36.180
with the green cable,

114
03:36.180 --> 03:38.190
is associated with this switch,

115
03:38.190 --> 03:41.130
and that this port group is using that uplink.

116
03:41.130 --> 03:43.200
So this represents VLAN 10.

117
03:43.200 --> 03:44.160
Now under the covers,

118
03:44.160 --> 03:46.080
all of this connectivity right here

119
03:46.080 --> 03:48.180
is gonna be provided by our physical network.

120
03:48.180 --> 03:50.160
So we may have some top-of-rack switches

121
03:50.160 --> 03:51.960
and we have VLAN 10 that's accessible

122
03:51.960 --> 03:54.510
by both ESXi-one and ESXi-two.

123
03:54.510 --> 03:56.070
And if that's the case, no problem.

124
03:56.070 --> 03:57.390
So as far as the IP addresses,

125
03:57.390 --> 04:01.380
VM A could be 10.10.0.11,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
03:57.390 --> 04:01.380
VM A could be 10.10.0.11,

126
04:01.380 --> 04:05.160
and VM B could be 10.10.0.12,

127
04:05.160 --> 04:08.970
and VM C could be 10.10.0.13.

128
04:08.970 --> 04:10.350
And they could all communicate with each other

129
04:10.350 --> 04:11.970
because they're on the same port group,

130
04:11.970 --> 04:14.261
And that port group is associated with VLAN 10,

131
04:14.261 --> 04:16.830
and VLAN 10 is accessible on the physical network

132
04:16.830 --> 04:18.503
between ESXi-one and ESXi-two.

133
04:18.503 --> 04:19.680
So with that in mind,

134
04:19.680 --> 04:21.120
let me ask a couple of questions

135
04:21.120 --> 04:23.310
and these are gonna lead to a couple problems as well.

136
04:23.310 --> 04:25.440
And one of those is security.

137
04:25.440 --> 04:26.790
How do we implement controls

138
04:26.790 --> 04:28.620
between what can be done between VM A,

139
04:28.620 --> 04:29.790
for example, and VM B?

140
04:29.790 --> 04:31.140
Back and forth between each other,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
04:29.790 --> 04:31.140
Back and forth between each other,

141
04:31.140 --> 04:33.060
or VM A to VM C?

142
04:33.060 --> 04:35.280
Now all three of those VMs are in the same VLAN,

143
04:35.280 --> 04:36.270
so in the physical world,

144
04:36.270 --> 04:38.880
we could perhaps do some layer two security

145
04:38.880 --> 04:41.040
if we knew what the MAC addresses were,

146
04:41.040 --> 04:41.940
and so forth.

147
04:41.940 --> 04:43.350
And also if we had the expertise

148
04:43.350 --> 04:45.930
and time to do that in the physical world.

149
04:45.930 --> 04:46.950
However, it's a hassle,

150
04:46.950 --> 04:48.360
because we're bringing up and down

151
04:48.360 --> 04:49.380
various VMs all the time,

152
04:49.380 --> 04:50.940
and if we want security involved,

153
04:50.940 --> 04:52.110
it'd be a pain to have to go

154
04:52.110 --> 04:53.280
to the physical environment

155
04:53.280 --> 04:55.290
and identify what the MAC addresses are,

156
04:55.290 --> 04:57.360
and then try to implement some layer two security

157
04:57.360 --> 04:58.830
for traffic going back and forth

158
04:58.830 --> 05:00.150
to control what's allowed.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
04:58.830 --> 05:00.150
to control what's allowed.

159
05:00.150 --> 05:01.020
And it even gets worse

160
05:01.020 --> 05:02.040
if we wanna start controlling

161
05:02.040 --> 05:03.060
what services are allowed.

162
05:03.060 --> 05:05.070
For example, if we wanna allow SSH

163
05:05.070 --> 05:06.990
between VM A and VM B,

164
05:06.990 --> 05:11.010
and HTTPS between VM A and VM C,

165
05:11.010 --> 05:14.580
and maybe ICMP between VM B and VM C,

166
05:14.580 --> 05:15.840
once again, this can be very tough

167
05:15.840 --> 05:18.240
to implement it here at the physical network

168
05:18.240 --> 05:20.250
to control the traffic between those VMs.

169
05:20.250 --> 05:21.510
So I'll leave a question mark there,

170
05:21.510 --> 05:22.710
saying there should be a better way

171
05:22.710 --> 05:25.410
of implementing security between our VMs

172
05:25.410 --> 05:26.490
in the infrastructure.

173
05:26.490 --> 05:27.750
Another challenge could be this,

174
05:27.750 --> 05:30.870
let's imagine that ESXi-one and ESXi-two,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

174
05:27.750 --> 05:30.870
let's imagine that ESXi-one and ESXi-two,

175
05:30.870 --> 05:32.820
behind the scenes on the physical network,

176
05:32.820 --> 05:36.000
do not have connectivity to that same VLAN 10.

177
05:36.000 --> 05:36.900
So let's imagine down here,

178
05:36.900 --> 05:39.330
instead of just having trunking with layer two,

179
05:39.330 --> 05:41.070
we have a router.

180
05:41.070 --> 05:42.540
And if that's the case,

181
05:42.540 --> 05:44.370
ESXi-one and ESXi-two

182
05:44.370 --> 05:46.560
no longer have access to that same

183
05:46.560 --> 05:48.180
layer two broadcast domain.

184
05:48.180 --> 05:49.530
So even though the clients

185
05:49.530 --> 05:51.780
are using the 10.10.0 address space,

186
05:51.780 --> 05:53.640
assuming a 24-bit mask up here,

187
05:53.640 --> 05:55.230
if we don't have a contiguous VLAN

188
05:55.230 --> 05:57.120
between ESXi-one and two,

189
05:57.120 --> 05:59.760
VM A cannot be on the same broadcast domain here

190
05:59.760 --> 06:01.710
as VM B and VM C.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
05:59.760 --> 06:01.710
as VM B and VM C.

191
06:01.710 --> 06:03.990
So over here, if we have a VLAN 10,

192
06:03.990 --> 06:06.000
and maybe over here, it's VLAN 20,

193
06:06.000 --> 06:08.010
or even if the numbers are the same on both sides,

194
06:08.010 --> 06:08.843
VLAN 10 over here,

195
06:08.843 --> 06:10.320
and VLAN 10 over here on another switch,

196
06:10.320 --> 06:12.330
because we have a logical layer three router

197
06:12.330 --> 06:13.470
in the middle of that,

198
06:13.470 --> 06:15.150
we're gonna have two different broadcast domains,

199
06:15.150 --> 06:15.983
and as a result,

200
06:15.983 --> 06:17.640
we cannot have VM A

201
06:17.640 --> 06:19.800
on the same layer two broadcast domain

202
06:19.800 --> 06:21.930
with a traditional distributed switch

203
06:21.930 --> 06:24.030
as VM B and VM C.

204
06:24.030 --> 06:25.320
And that's because the infrastructure

205
06:25.320 --> 06:27.360
behind the scenes has a router

206
06:27.360 --> 06:29.880
between ESXi-one and ESXi-two.

207
06:29.880 --> 06:30.780
So our next challenge
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

207
06:29.880 --> 06:30.780
So our next challenge

208
06:30.780 --> 06:34.110
is an extended layer two broadcast domain

209
06:34.110 --> 06:37.710
when we have a router between the two ESXi hosts.

210
06:37.710 --> 06:38.940
Because if this is our topology

211
06:38.940 --> 06:39.773
of the physical world

212
06:39.773 --> 06:41.970
of the router between ESXi-one and ESXi-two,

213
06:41.970 --> 06:44.130
we are not going to have an extended

214
06:44.130 --> 06:45.630
layer two broadcast domain

215
06:45.630 --> 06:47.610
across these two ESXi hosts.

216
06:47.610 --> 06:49.890
Another challenge that comes up is routing.

217
06:49.890 --> 06:53.130
So for example, let's take VM B and VM C,

218
06:53.130 --> 06:54.770
and let's put VM B in the 20 subnet,

219
06:54.770 --> 06:57.510
10.20.0, dot, let's use 20,

220
06:57.510 --> 06:59.979
and let's put VM C in the 30 subnet,

221
06:59.979 --> 07:03.270
10.30, with a host address of 30 also.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

221
06:59.979 --> 07:03.270
10.30, with a host address of 30 also.

222
07:03.270 --> 07:05.790
And so if these devices are in different subnets,

223
07:05.790 --> 07:07.260
how can we route between them?

224
07:07.260 --> 07:08.093
So one way of doing that,

225
07:08.093 --> 07:11.100
we could go ahead and put VM A on one port group,

226
07:11.100 --> 07:13.710
and put VM B on a different port group here,

227
07:13.710 --> 07:16.320
and VM C on yet a different port group.

228
07:16.320 --> 07:17.970
Maybe this is VLAN 40,

229
07:17.970 --> 07:20.460
and VLAN 50, and VLAN 60.

230
07:20.460 --> 07:23.010
And let me remove my router down here.

231
07:23.010 --> 07:24.330
So if these three VMs

232
07:24.330 --> 07:25.890
are now on three different port groups,

233
07:25.890 --> 07:27.960
and effectively on three different VLANs,

234
07:27.960 --> 07:28.920
in the physical world,

235
07:28.920 --> 07:30.540
we could set up our routing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

235
07:28.920 --> 07:30.540
we could set up our routing

236
07:30.540 --> 07:32.779
between the subnets

237
07:32.779 --> 07:35.190
10.10.0, 10.20.0, and 10.30.0,

238
07:35.190 --> 07:36.930
but once again, that is gonna require us

239
07:36.930 --> 07:38.850
to do that in the physical environment

240
07:38.850 --> 07:40.650
with logical layer three interfaces

241
07:40.650 --> 07:41.880
on whatever gear we're using,

242
07:41.880 --> 07:44.190
from Cisco, or HP,

243
07:44.190 --> 07:45.540
or Juniper, et cetera.

244
07:45.540 --> 07:46.830
And although that can be done

245
07:46.830 --> 07:47.760
in the physical environment,

246
07:47.760 --> 07:49.020
it'd be much more convenient

247
07:49.020 --> 07:51.480
if we could set up that routing logically

248
07:51.480 --> 07:54.030
inside of the virtualized environment.

249
07:54.030 --> 07:54.863
And while we're talking about

250
07:54.863 --> 07:56.220
traditional network services,

251
07:56.220 --> 07:57.360
let's also put a question mark

252
07:57.360 --> 07:59.160
regarding how do we implement features

253
07:59.160 --> 08:00.960
like network address translation,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

253
07:59.160 --> 08:00.960
like network address translation,

254
08:00.960 --> 08:04.710
and DHCP services, and VPNs,

255
08:04.710 --> 08:07.410
and load balancing, and the list goes on.

256
08:07.410 --> 08:08.580
And once again, the answer to that

257
08:08.580 --> 08:09.630
in the physical environment

258
08:09.630 --> 08:11.070
would be to use the tools that we have.

259
08:11.070 --> 08:12.270
Either from Cisco,

260
08:12.270 --> 08:14.130
or Juniper, or HP, et cetera,

261
08:14.130 --> 08:15.720
and we'd set up those features.

262
08:15.720 --> 08:17.580
However, it would be a lot more convenient

263
08:17.580 --> 08:19.140
if we could set up those features

264
08:19.140 --> 08:22.620
virtually inside of our vSphere environment.

265
08:22.620 --> 08:24.420
And now is time for the great news.

266
08:24.420 --> 08:25.350
All these features,

267
08:25.350 --> 08:29.100
which, with traditional vSphere might be a problem,

268
08:29.100 --> 08:32.160
can now be solved and done with software
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

268
08:29.100 --> 08:32.160
can now be solved and done with software

269
08:32.160 --> 08:34.710
once we implement NSX,

270
08:34.710 --> 08:37.353
and add that to our vSphere environment.