Network-Based Virtualization - Cisco

Cisco on Cisco: Inside Cisco ITVirtualization Featured Content – December 2007Network-Based VirtualizationVirtualizing network-based services and resources yields Cisco IT greaterapplications availability, agility, resiliency, and broad cost savings.The inherent constraints of any physical component in terms of failure, provisioning, and limited utilizationhave always constituted an obstacle to optimizing the application hosting environment. Now, with networkbased virtualization, this obstacle can be practically eliminated for both network resources and applicationservices—with impressive results. Network-based virtualization yields greater availability because theuptime no longer depends on an individual physical component. As virtualization turns a hard resourceinto a soft one, most of the operations associated with its lifecycle are transformed from manual tasks toconfiguration changes, enabling automation and fostering increased agility and resiliency. And theincreased flexibility to deal with limited capacity leads to better“Increased utilization, availability,resilience, operability, and agility simplyoutweigh all the overhead associatedwith adoption of the new technology.”—Koen Denecker, IT Architect, Network and DataCenter Services, Ciscoutilization, which is a core enabler for consolidation,rationalization, and pervasive cost savings in the data center.Cisco IT defines virtualization as the decoupling of logical andphysical entities, and categorizes virtualization on two levels:resource (or infrastructure) virtualization and service (orapplication) virtualization. In resource virtualization, physicalresources such as network, compute, and storage resourcesare segmented or pooled as logical resources. An example of resource virtualization: Sharing a loadbalancing device (hardware) between multiple applications virtualizes the infrastructure. In servicevirtualization, on the other hand, multiple physical service instances are grouped to act as one logicalinstance. Service virtualization includes application services (fully functional application instances) andnetwork services (application component instances that are used to build fully functional applications).An example of service virtualization: Load balancing an application (service) between two serversvirtualizes the application and enables high availability. With virtualization, the role of the network istwofold: the network resources themselves are virtualized, and the network also acts as an enabler forservice virtualization.Since 2000, Cisco IT has virtualized five network-based resources and services: Server load balancing Firewalling Secure Sockets Layer (SSL) encryption and decryption Web services gateway Global site selectionFor Cisco IT, virtualizing load balancing alone has increased utilization of the hardware involved from 5to 75 percent. Simultaneously, the physical footprint for the load balancers decreased by 50 percentwhile the total number of virtualized applications increased sixfold. Load balancing was, in fact, the firstshared network service Cisco IT offered across the network that severed the one-to-one link betweenapplication and device.All contents are Copyright 1992–2006 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.Page 1 of 5

Cisco on Cisco: Inside Cisco ITVirtualization Featured Content – December 2007“Before 2000, everything was siloed,” says Wilson Ng,Each partition can be defined by application,network engineer in the IT Networking Design andcustomer, or business organization, and resourceEngineering group at Cisco. “If a client wanted loadallocations such as bandwidth or number ofbalancing, IT would procure the system, go through aconnections can be defined for each partition. Inlearning curve on how to use it for the particularaddition, role-based access control (RBAC) in theapplication, and finally deploy it. The whole processACE Module allows each virtual partition to bewould take two to three months.”managed by the appropriate IT team.Multiple load balancing systems were increasinglyWith the ACE Module, even large applications,becoming harder for IT to manage and maintain andsuch as enterprise resource planning (ERP)produced low average utilization. Moreover, thecan be served by up to 250 virtual loadnumber of application environments that required loadbalancers, with a percentage of the module’sbalancing was doubling each year. By 2003 the groupload balancing resources dedicated to ERPwas operating 14 pairs of load balancers. “Wewhen needed.concluded that this was not the way we shouldprovide the network service,” Ng says.Next, Cisco IT initiated the virtualization offirewalling, deployed on a Cisco Catalyst 6500So in 2003 Cisco IT introduced a virtualized,Series Firewall Services Module (FWSM). Likehorizontal load balancing service using the Ciscothe ACE Module, the FWSM can be partitionedCatalyst 6500 Series Switch Content Switchinginto multiple logical firewalls assigned toModule (CSM) and partitioning techniques to createspecific applications. It, too, runs horizontallylogical, individual load balancers. The first applicationacross the data center.to use a virtualized load balancer was the Ciscoemployee intranet; the CSM was located in a datacenter at the company’s headquarters in San Jose,California. With the success of that application, CiscoIT migrated other applications to the virtualized loadbalancing service.Eliminating various siloed load balancingappliances has given Cisco IT consistentconfiguration, deployment, and monitoringcapabilities, and has also significantly increasedservice availability and load balancinginfrastructure utilization. What’s more, requestsToday one pair of CSM modules has been configuredfor load balancing can be satisfied in hours,to handle the entire production load balancingrather than months.required across the Cisco data center at ResearchTriangle Park, North Carolina. Where only 5 percentof capacity was being used on average with the 14pairs of load balancers, now up to 75 percent of theCSM (paired for redundancy) capacity is used.Into the IT InfrastructureThe virtualized load balancing service was the firstThe CSM and ACE Module are also the keyenabling technologies for application servicevirtualization. Cisco’s primary Internet presence,Cisco.com or www.cisco.com, consists ofmultiple server farms, each with multiple physicalservers, which have been optimized for specificapplication functionality.instance of bringing a service into the IT infrastructureFor example, one server farm serves staticrather than having it reside on dedicated systems paidcontent, a second serves dynamic content, and afor by application owners. It became the model andthird provides a supporting authentication role. Tomotivation for Cisco IT to virtualize other services.the outside world, however, the Internet presenceNow Cisco IT is migrating from the CSM to the CiscoApplication Content Engine (ACE) Module, which candivide resources into 250 different virtual partitions.appears as one giant server. In addition, physicalserver failures and server maintenance can behidden from end users.All contents are Copyright 1992–2006 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.Page 2 of 5

Cisco on Cisco: Inside Cisco ITVirtualization Featured Content – December 2007This deployment of application virtualization enableshosts the bulk of the internal and external HTTP-greater availability, agility, and operability.based applications. Because thesecommunications include queries about personnelSome Complexity of Integrationmatters, the entire payload, including incomingThe next two services that Cisco IT sought toURLs, is encrypted and must be decryptedvirtualize require more involvement from applicationbefore the application can go to the appropriateowners: SSL encryption and decryption and an XMLapplication server selected by the content switch.Gateway. SSL encryption and decryption, using theThe SSLSM performs the first task; the CSMCisco Catalyst 6500 ACE Module or the earlier SSLperforms the second. Today, both functions canService Module (SSLSM), was first used in 2004 tobe performed within a single pair of ACEenable content switching of encrypted HTTP traffic inModules.the Java 2 Enterprise Edition environment. Thisenvironment hosts more than 40 percent of Cisco’sinternal and external applications and is missioncritical to Cisco’s business.The Cisco ACE XML Gateway is anotherexample of network-based service virtualization.It provides a virtual web services gateway to theInternet for a broad range of users whoseLater, in 2006, it was adopted to support employeesapplications need XML links to other software, towho use a non-Windows-based operating system,databases, or other systems to do their jobs.such as UNIX, and who need access to Windowsbased e-mail. The SSLSM offloads the encryption anddecryption required from the e-mail server, resulting inmuch faster access for the employees. Thisfunctionality is being transitioned to the newer, morescalable ACE Module, which integrates it better intothe load balancing and content switching function.“The ACE XML Gateway can act as a virtualfront door for B2B [business to business]interactions within Cisco,” says Sandeep Puri,IT architect in the Platform Services and Supportgroup at Cisco. “This gives us one interfacepoint through which our partners may talk to us.The XML Gateway can transform different dataThe application owner’s involvement with this serviceformats involved in B2B interactions on the flymust increase because there is more integrationto what we use at Cisco. The appliance gives uswork, according to Koen Denecker, IT architect in thea central point to enforce different serviceNetwork and Data Center Services group at Cisco.policies that we may have for services that Cisco“There is the benefit to the owner of not paying for thehosts. In addition, the gateway can be positionedhardware, but the owner must sit down with IT toto add an additional layer of security by usingdiscuss the application’s specific needs.”the appliance’s XML level firewall policies,”The SSLSM has been installed in all major Cisco ITproduction centers, and Cisco IT is using it to supportother services in a virtual way. Additionally, Deneckersays, IT now uses the SSLSM to support applicationenvironments, not just individual applications, forexample, the Java-to-enterprise environment. “Weuse the SSLSM to encrypt and decrypt for hundredsof applications by putting it on that singleenvironment,” he says.Cisco IT is also using the SSLSM with the CSM toenable back-end migration and vendor transition inthe Java 2 Enterprise Edition environment, whichhe explains.An Enabler of VirtualizationThe latest service to be virtualized is as much anenabler of the technology as a use of it. TheCisco ACE GSS 4400 Series Global Site Selector(GSS) performs global server load balancing. Itdistributes client requests for applications todifferent geographic instances of thoseapplications.“Users anywhere in the world can reach thenearest instance of an application for fasteraccess and response times—it’s a form ofAll contents are Copyright 1992–2006 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.Page 3 of 5