WEBVTT 00:00:00.000 --> 00:00:08.840 Alright, let's have a quick discussion on virtual servers and switches in order to get 00:00:08.840 --> 00:00:11.520 ready for the certification exam. 00:00:11.520 --> 00:00:20.640 So virtual servers are a really important part of our network because it allows us to 00:00:20.640 --> 00:00:29.680 reduce our physical footprint when it comes to the number of servers that we need. 00:00:29.680 --> 00:00:41.440 So if I was to follow security best practices, I would build a server with a single operating 00:00:41.440 --> 00:00:45.360 system on it and a single application. 00:00:45.360 --> 00:00:49.840 So for every application and service I need to provide on my network, I would have an 00:00:49.840 --> 00:00:51.760 isolated server doing that. 00:00:51.760 --> 00:01:04.120 So that way there is no way that a breach of one server service could affect another 00:01:04.120 --> 00:01:05.120 service. 00:01:05.120 --> 00:01:06.120 Why? 00:01:06.120 --> 00:01:07.120 Because they're on different systems. 00:01:07.120 --> 00:01:11.520 So if I have them on different systems, it's better from a security standpoint. 00:01:11.520 --> 00:01:14.920 So let's say you're running DHCP and DNS, well you wouldn't want to run them on the 00:01:14.920 --> 00:01:17.840 same servers because a breach of one affects the other, you would have them on different 00:01:17.840 --> 00:01:18.840 servers. 00:01:18.920 --> 00:01:27.640 So with that in mind though, that is very wasteful from a physical resource standpoint, 00:01:27.640 --> 00:01:35.480 from an economical standpoint, from a mother nature standpoint, right, the environment 00:01:35.480 --> 00:01:41.320 as we consume a lot of electricity and to run the devices but also cool the devices 00:01:41.320 --> 00:01:43.040 in our environment. 00:01:43.040 --> 00:01:51.640 So we have virtual machines, virtual servers, giving us the opportunity to get the same 00:01:51.640 --> 00:01:58.200 level of security that we would have, that's right, same level of security, not increased 00:01:58.200 --> 00:02:02.040 security, same level of security we would have if we would have had different physical 00:02:02.040 --> 00:02:03.440 systems. 00:02:03.440 --> 00:02:10.280 So with our virtual machines, we have our physical server now running a hypervisor which 00:02:10.320 --> 00:02:15.640 is a lightweight operating system that allows us to then create these different virtual 00:02:15.640 --> 00:02:20.600 machines, isolated environments where we can set up an operating system and an application 00:02:20.600 --> 00:02:21.600 or service. 00:02:21.600 --> 00:02:24.400 So I'm still going to have a different operating system for every virtual machine. 00:02:24.400 --> 00:02:28.000 When I say different, I don't mean like a different type of operating system. 00:02:28.000 --> 00:02:31.680 It could be Windows 11 on all of them, Windows Server on all of them, whatever it is that 00:02:31.680 --> 00:02:37.120 we're installing on, right, and have the applications we need running on each and every single one 00:02:37.120 --> 00:02:41.480 of those. 00:02:41.480 --> 00:02:46.040 So now I get a reduction in space requirements, a reduction in power requirements, a reduction 00:02:46.040 --> 00:02:54.640 in cooling requirements, and I get increased deployment speeds. 00:02:54.640 --> 00:03:06.600 A Type 1 hypervisor is going to be a, Cisco likes to call, a production level solution. 00:03:06.600 --> 00:03:11.640 The hypervisor itself, this operating system that allows us to do this virtualization, 00:03:11.640 --> 00:03:18.760 runs directly on top of the physical hardware of the host machine. 00:03:18.760 --> 00:03:22.720 It doesn't rely on some type of underlying operating itself. 00:03:22.720 --> 00:03:28.920 It is an operating system, so it doesn't need another operating system to run, and it has 00:03:28.920 --> 00:03:34.680 the ability to provide direct access to the CPU, memory, storage, and networking resources 00:03:34.760 --> 00:03:42.240 for all of those different virtual machines that we build on top of it. 00:03:42.240 --> 00:03:48.280 So Hyper-V, ESXi, examples of Type 1 hypervisors. 00:03:48.280 --> 00:03:56.720 Type 2 hypervisors, according to Cisco, not production level solutions, fair enough, right, 00:03:56.720 --> 00:04:04.000 more for developers, let's say, who want to run another system on their own system or 00:04:04.000 --> 00:04:10.320 their own – a system on maybe a server or a testing machine they have. 00:04:10.320 --> 00:04:16.120 Using a Type 2 hypervisor there might be a good solution. 00:04:16.120 --> 00:04:19.960 In this case, you can see the hypervisor runs on top of an already existing operating system. 00:04:19.960 --> 00:04:24.240 So we already have maybe Windows running or Linux running or Mac running on top of the 00:04:24.240 --> 00:04:27.080 actual hardware, and then we put the hypervisor. 00:04:27.080 --> 00:04:32.640 So VMware Workstation or Fusion or Solaris Zones or Oracle VirtualBox is installed on, 00:04:32.640 --> 00:04:37.080 let's say, Windows as an example, and then we build virtual machines inside of that that 00:04:37.080 --> 00:04:40.560 we can then access. 00:04:40.560 --> 00:04:43.080 More overhead, why? 00:04:43.080 --> 00:04:44.720 Because of that operating system here. 00:04:44.720 --> 00:04:49.440 That operating system is consuming a lot of these resources, and so there's less resources 00:04:49.440 --> 00:04:54.000 available for our virtual machines, and this hypervisor is not necessarily as efficient, 00:04:54.000 --> 00:05:01.600 as effective as ESXi would be as a Type 1 hypervisor. 00:05:01.600 --> 00:05:05.960 So a lot more efficient, a lot more effective. 00:05:05.960 --> 00:05:12.280 That's why Type 1, more of a production-level server, farm solution than a Type 2 hypervisor. 00:05:12.280 --> 00:05:15.640 And I agree with that, absolutely, and you should too. 00:05:15.640 --> 00:05:20.300 So the hypervisor, though, regardless of whether it is a Type 1 or Type 2 hypervisor, it really 00:05:20.300 --> 00:05:23.360 is our resource traffic cop, folks. 00:05:23.360 --> 00:05:25.160 That's one way to think about it. 00:05:25.160 --> 00:05:30.680 What we have here is the hypervisor controlling access to those hardware resources. 00:05:30.760 --> 00:05:38.640 It is divvying up, virtualizing the CPU, virtualizing the RAM, virtualizing the storage, virtualizing 00:05:38.640 --> 00:05:44.120 the network interface card, and then divvying up those virtualized resources to each and 00:05:44.120 --> 00:05:51.640 every single one of our virtual machines. 00:05:51.640 --> 00:06:00.200 So since we have our virtual servers connected to our physical box, that physical box needs 00:06:00.200 --> 00:06:01.200 to be connected to what? 00:06:01.200 --> 00:06:03.800 Our network. 00:06:03.800 --> 00:06:08.760 So we have, for example, our switch here, and let's say this physical NIC is connected 00:06:08.760 --> 00:06:12.880 to this particular port right here. 00:06:12.880 --> 00:06:18.760 Based on this scenario here, what I want you to realize is that every single one of these 00:06:18.760 --> 00:06:27.080 virtual machines now, notice how their VNICs are connected to the physical NIC, and then 00:06:27.080 --> 00:06:29.560 the physical NIC goes out to the switch. 00:06:29.920 --> 00:06:31.240 What does this mean? 00:06:31.240 --> 00:06:39.320 In this particular scenario, it means that every single one of those virtual machines 00:06:39.320 --> 00:06:47.880 are in the same subnet, same VLAN, same broadcast domain as the physical server, which is based 00:06:47.880 --> 00:06:50.400 on what? 00:06:50.400 --> 00:06:54.480 Based on our configuration of that port right there. 00:06:54.480 --> 00:06:58.440 So if I put that port in VLAN 10, that means the physical server is in VLAN 10 and all 00:06:58.440 --> 00:07:02.760 those VNICs are in VLAN 10 as well, because there's no other way to separate that out 00:07:02.760 --> 00:07:13.040 right now based on the way I have this design. 00:07:13.040 --> 00:07:15.360 So where are all the MAC addresses? 00:07:15.360 --> 00:07:23.600 Well, every single one of the VNICs has its own MAC and own IP. 00:07:23.600 --> 00:07:25.900 This has its own MAC and own IP. 00:07:25.900 --> 00:07:30.060 So this right here, this switch, is going to know about each and every single one of 00:07:30.060 --> 00:07:33.820 those MAC addresses on that port. 00:07:33.820 --> 00:07:39.540 So the switch MAC address table says, let's say VLAN 10, we are going to find those four 00:07:39.540 --> 00:07:51.340 MAC addresses out that port, but there's not a lot of flexibility in this. 00:07:51.340 --> 00:07:55.220 That means every single virtual machine we put on this server is going to be stuck in 00:07:55.220 --> 00:08:00.700 that same VLAN, same subnet as how we configure that port. 00:08:00.700 --> 00:08:04.860 I want to move now the switch inside. 00:08:04.860 --> 00:08:05.860 How can I do that? 00:08:05.860 --> 00:08:11.660 That's where V switches come in, virtual switches come into play, folks. 00:08:11.660 --> 00:08:18.280 Virtual switches allow me to extend my network inside of the server itself. 00:08:18.280 --> 00:08:19.320 So now what can we do? 00:08:19.320 --> 00:08:21.180 We can actually trunk. 00:08:21.180 --> 00:08:23.780 We could trunk from here to here. 00:08:23.780 --> 00:08:25.220 That's what we can do. 00:08:25.220 --> 00:08:26.460 And by trunking, what does that mean? 00:08:26.460 --> 00:08:30.220 We could pass traffic from multiple VLANs. 00:08:30.220 --> 00:08:36.260 So since we could pass traffic from multiple VLANs now, it means that we could have different 00:08:36.260 --> 00:08:42.460 VNICs in different VLANs based on how we configure our virtual switch. 00:08:42.460 --> 00:08:49.180 So it doesn't matter whether we're using the VMware V switch or the Cisco AVS application 00:08:49.180 --> 00:08:50.980 virtual switch. 00:08:50.980 --> 00:08:56.260 We have the opportunity to essentially do everything we did out here on the physical 00:08:56.260 --> 00:08:57.260 switch. 00:08:57.260 --> 00:09:03.140 Now we can actually do it inside on that virtual switch, and that is highly recommended. 00:09:03.140 --> 00:09:09.140 And don't give up, for all you network admins out there, don't give up the control of that 00:09:09.140 --> 00:09:10.460 V switch. 00:09:10.460 --> 00:09:11.860 To who? 00:09:11.860 --> 00:09:13.420 To the server admins. 00:09:13.420 --> 00:09:15.900 That is your responsibility. 00:09:15.900 --> 00:09:20.180 The V switch is an extension of your network. 00:09:20.180 --> 00:09:24.020 That should be under your control, not the server admins' control. 00:09:24.020 --> 00:09:25.020 Why? 00:09:25.020 --> 00:09:30.620 Because you still need to think about your network security controls and policies that 00:09:30.620 --> 00:09:37.820 you want to maintain in there, because we obviously don't want to have traffic from 00:09:37.820 --> 00:09:40.340 VLAN 10 accidentally go to 20. 00:09:40.340 --> 00:09:41.980 That should never happen, right? 00:09:41.980 --> 00:09:43.020 And last, what? 00:09:43.020 --> 00:09:46.020 We do routing. 00:09:46.020 --> 00:09:48.940 So things to keep in mind about that. 00:09:48.940 --> 00:09:54.180 So for the certification exam, what do you want to know from this particular discussion? 00:09:54.180 --> 00:09:59.060 What we talked about in regards to V switches and VNICs, right, and the difference between 00:09:59.060 --> 00:10:02.420 having a V switch and not having a V switch. 00:10:02.420 --> 00:10:07.500 I want you to know type one and type two hypervisors, yes, I do. 00:10:07.500 --> 00:10:11.380 Type one and type two hypervisors, or else I would have never had that conversation with 00:10:11.380 --> 00:10:12.660 you folks. 00:10:13.300 --> 00:10:18.340 So make sure you know what I said about type one hypervisors, type two hypervisors. 00:10:18.340 --> 00:10:23.180 Make sure you have a visual representation of the pictures I provided you in your head 00:10:23.180 --> 00:10:28.500 to give you the ability to answer questions more efficiently and effectively on the exam. 00:10:28.500 --> 00:10:34.820 Make sure you're aware of why we want those V switches set up. 00:10:34.820 --> 00:10:39.900 More control, more flexibility, number one. 00:10:39.900 --> 00:10:40.900 Number two, right? 00:10:41.140 --> 00:10:43.420 More control, more flexibility. 00:10:43.420 --> 00:10:49.700 We have the ability now to extend our network security policies in that virtual switch when 00:10:49.700 --> 00:10:50.420 it's all said and done.