Tweet

IT business leaders are seeking data center fabrics that scale to support increasing density of physical and virtual servers at cloud spec. In October of this year, Cisco delivered a monster data center fabric announcement aimed at increasing scale, security and new data center services. A few highlights are the second-generation Nexus 7000 capabilities, a new Nexus 7009 platform, plus FabricPath capabilities on the Nexus 5500 and expanded Nexus 1GbE and 40GbE form factors of the Nexus 3000. Shashi Kiran, Director of Market Management for Data Center/Virtualization and Enterprise Switching at Cisco Systems joins me to talk about what IT business leaders will gain from this new announcement from a business outcome and data center fabric design perspective.

Watch the Video

Tweet

The tech sector is at a crossroads. In just 18 short months, mobile and cloud computing has fundamentally changed business assumptions and technical underpinnings of IT delivery. And in the process IT business leaders are fundamentally changing their buying requirements and corporate IT investments challenging existing vendor relationships. The tech sector served up corporate IT along technical lines of computing, networking, storage and applications, but these lines are blurring as every major multi-billion dollar IT firm now seeks to deliver vertical offerings comprised of a single rack of compute, storage and networking to address scale and simplicity associated with the new mobile and cloud computing models. Cisco, IBM, HP, Dell and Oracle all are repositioning their data center offers to address the market opportunity and shift to assist IT leaders building iBusinesses. In this Lippis Report Research Note, we dive into Cisco’s Data Center Fabric as it’s the furthest along at integrating compute, networking and storage access for corporate advantage offering a glimpse of IT’s future.

What’s driving a new fabric or structure of data centers is rooted in the interplay between technology and business opportunity. The efficiency of server virtualization to reduce energy consumption and increase server utilization drove its massive deployment that was boosted by an economic cycle starving for efficiency. At nearly the same time, mobile computing, thanks in large part to Apple’s iPhone and iPad plus Google’s android- based devices, introduced a new tier of computing that unleashed increased corporate productivity, evident in today’s productivity boom. Equipped with a new IT delivery model that is both more flexible and centralized, IT business leaders have begun en masse to build private cloud facilities.

The iBusiness

The end result is the construction of iBusinesses that possess simultaneously lower IT cost and the ability to quickly address market dynamics, thanks to faster application deployments plus a nimbler and mobile workforce. While it’s too early to aggregate the benefits of iBusiness in terms of productivity improvements, market share gains, IT expense as a percentage of corporate revenue and other metrics, early adopters are experiencing improvements that span IT departments and most importantly, corporate operations.

In short, a Data Center Fabric of compute, networking and storage reduce IT operational cost, the largest budget component of IT Total Cost of Ownership (TCO) and provide the foundation for a faster responding business that is able to exploit the value of mobile and cloud computing to corporate advantage.

Data Center Fabric Requirements

A core set of data center fabric requirements is emerging, thanks to early adopter deployments that possess the following attributes fundamental to iBusinesses.

Scale: Computational density is increasing at a fast pace with the ability to support hundreds to hundreds of thousands of servers per data center. This increased density of computing is also driving higher virtualization ratios as the ratio of virtual to physical servers is increasing from 10:1 to soon 60:1, which taxes the logical network of MAC address, /32 IP host route table size and ARP entry size. The ability to support both east-west and north-south traffic flows over an increasingly 10GbE and 40GbE low latency, non-blocking, high performance network fabric has become paramount as small queries from mobile devices drive a tsunami of east-west plus north-south data center traffic flows, all of which must be combined and transmitted back to the mobile device at millisecond speeds.

Mobility: As virtual machines (VMs) are moved within and between racks of computing and between data centers plus between private and public cloud facilities, the ability of the Data Center Fabric to support such moves is fundamental. VM aware Data Center Fabrics support VM mobility, allowing IT business leaders to maximize efficiency while enabling a degree of freedom to move containers of IT workloads (data, applications, VMs) as business requirements demand.

Consolidated IO: A significant cost reduction strategy and performance enhancement is the deployment of a single physical 10GbE and soon 40GbE network that supports both storage and network traffic. Cost savings is found in reduced cabling requirements, storage and network switches as well as server network and storage interface cards.

Consolidated Management: As compute, storage and networking converge into a single virtualized Data Center Fabric, the ability to manage these resources across operational groups become increasingly important. Not only is the technology converging, but IT organizational design is under review to focus this human resource into a services organization rather than siloed technology departments. The ability to manage the Data Center Fabric as a centralized resource that is partitioned to unique IT departments is an aid to organization re-design. It’s very helpful that a common look and feel for all resources be available so as to hasten a learning curve and accelerate cross-discipline service delivery.

Cloud Enabled: The combination of the above attributes results in a Data Center Fabric that is cloud-enabled, meaning that containers of workload are movable not only within a data center but also between them and into private and public cloud facilities. The ability to move workloads provides IT leaders with the tools to expand and contract their IT resources and shop their IT needs from a wide range of cloud providers, assuring executive management that their IT cost is competitive.

iBusiness Outcomes

Those who have deployed a Data Center Fabric are rewarded with favorable business outcome results. Cisco’s Data Center Fabric unifies network services, networking and storage plus computing through its Unified Network Services (UNS), Unified Fabric (UF) and Unified Computing System (UCS), respectively. Early adopters have benefited by viewing and procuring their data center assets from this unified holistic perspective versus compute, network and storage separately. For example, Kindred Healthcare saved approximately $6.6M on just cabling cost for a 1,000-server data center, thanks to its deployment of a Data Center Fabric. Additional operational savings was gained by a reduction in the number of management points the operations group has to manage too. To Kindred’s surprise and delight they noticed that the Data Center Fabric enabled different groups—the virtualization team, the network team, and the storage team—to work together as one on a common platform versus in silos; a huge help to hasten deployments especially as Kindred has been growing through acquisitions.

Other early adopters are Almaviva wine producers that saw its revenue increase 2 to 3%, thanks to its data center fabric deployment that also reduced its cabling and power consumption cost by 70% and 60%, respectively. Tutor Perini Corporation was able to reduce its device count and power consumption by 60% and 38%, respectively. Coca Cola was able to consolidate 80 servers down to four, plus reduced cabling 30 to 60%. Terremark saw a 30% improvement in application performance and server density increased by a factor of four. The Apollo Group, owner of the University of Phoenix and other educational properties, doubled the size of its network without an increase in IT staff, lowered per-port switching cost while increasing port volume and freed up several rows of space in its data centers. Avago Technologies, a manufacturer, accelerated batch processing by 30 to 40%, increased business flexibility and decreased operational cost by 40% while adding a third data center. CareCore National, a health benefit management concern, increased business agility by being able to launch new lines of business in just two weeks, down from six months. These iBusinesses’ benefits were gained, in large part through the insight and leadership of IT executives and their deployment of Cisco’s Data Center Fabric architecture.

Cisco has been investing heavily in its Data Center Fabric portfolio. It owns some 80% of the data center switching market and in just two short years, possesses the number three-market share ranking for x86 blade servers worldwide, behind HP and IBM, according to an IDC report released in May. Over the past quarter, Cisco has added to its UF portfolio with the new Nexus 3000, 5548 and 5596 switches. It has expanded its Fabric Extender (FEX) offering to include the adapter and VM FEX, a key technology in converged IO plus virtualization aware networking. To increase mobility of workloads, it has added IP address location independence with its OTV (Overlay Transport Virtualization) and LISP (Location ID/Separation Protocol) features to its Nexus Operating System. Fiber Channel over Ethernet (FCoE) can traverse more devices, thanks to a new director-class multihop FCoE feature available on the Nexus 7000 and MDS 9500. Data Center LANs, SANs and virtualization infrastructure can now be managed via a single pane of glass, thanks to the Cisco Data Center Network Manager. On the computing side, Cisco has expanded the UCS server portfolio with multiple form factors, including Blade and Rack-Mounted, and in the process, has broke three world performance records. Cisco has followed up that with a new set of I/O components for UCS, which was just announced on July 13th.

At the crossroads of the tech industry are two paths; one is a legacy approach of building data centers by acquiring compute, storage and networking gear separately with IT professionals integrating these components. The other road is one of vertically-integrated offerings of compute, storage and networking where IT professionals focus on automating business processes turning their corporation into an agile iBusiness. I advise choosing the latter.

Tweet

Cisco’s Nexus Operating System that runs on the Nexus switches and evolved from Cisco’s MDS SAN-OS is a fundamental building block of its Data Center Fabric. Berna Devrim, Senior Manager of Data Center and Virtualization Marketing at Cisco Systems, discusses the next generation of Nexus OS designed to address the biggest data center issues. These issues are virtualization scale and mobility, cloud spec scale, LAN and SAN convergence plus operational efficiency. This is one of the best audio podcast we’ve produced, so sit back listen, learn and enjoy.

Listen to the Podcast

Tweet

By Nick Lippis, the Lippis Report

A number of independent trends are driving a new age of massively scalable data centers. One of these trends include a new IT delivery model based upon cloud computing, where large hosting facilities provide a range of IT services to corporations and governments. Further, high performance computing (HPC) facilities built via server clusters on the order of thousands to tens of thousands of servers and more has ushered in new favorable economics, thanks to its use of x86 commodity hardware. The growth of public hosting and HPC facilities will only continue as efficient data center economics point to a fewer number of highly dense sites. It is this data center market segment, where the number of servers per facility is greater than 5,000, that we focus this white paper from a perspective of fabric, connecting servers and storage to internet/intranet via high performance Ethernet networking. For IT architects and designers of high-end data centers, this is the most important network design paper you will read this year.

Download this white paper now

Get the White Paper

Tweet

By Cisco Systems

Virtualization is rapidly becoming an essential tool for more fully harnessing and managing the power of today’s data center servers. In only a few years, standard x86 server technology has increased in performance and density so that today, multisocket, quad-core systems with 32 or more gigabytes of memory, are the norm. The combination of multicore computing and virtualization software such as VMware Virtual Infrastructure has enabled IT departments to bring server sprawl under control by running multiple independent workloads on a smaller number of servers. Today, fewer servers are required to do the same work, and their utilization levels have increased — both factors that contribute to greater energy efficiency and lower power and cooling costs.

As IT departments have discovered the benefits of server consolidation, they have also found that virtualization solves an even broader set of problems. Business continuity plans based on virtualization can make disaster-recovery solutions simple, reliable, and more cost effective. Virtual desktop environments can use centralized servers and thin clients to support large numbers of users with standard PC configurations that help to lower both capital and operating costs. Virtualization allows development, test, and production environments to coexist on the same servers, and it helps decouple application deployment from server purchasing decisions. New applications can be deployed in virtual environments and scaled on demand to accommodate the evolving needs of
the business.

Get the White Paper

Tweet

Many IT leaders are striving to understand who is on their network and what they are doing. These are two simple questions and yet, in many cases, IT business leaders do not have a good way to answer them. And once IT leaders are able to obtain this information the question then becomes what else I can do with the data: obtain a history report, perform statistics for analysis and planning, generate compliance reports and much more. To tightly link business processes with networked applications, IT leaders need to wrap policy, identity and security around users and IT assets.

This is the essence of Cisco’s TrustSec; that TrustSec provides security services as its primary value proposition but the data and insight it generates assist IT business leaders with network design to meet future growth. Cisco’s TrustSec organizes and simplifies existing authentication and policy schema allowing administrators to configure and maintain identity-based access to IT resources while identifying and applying policy based on a user’s role in the organization. TrustSec also provides encrypted links between end-points and servers. TrustSec is an architecture which builds upon existing network services embedded into network infrastructure, addressing not only security issues but delivering certain business services too.

A key pillar of strength for TrustSec is its ability to create a consistent and unified set of policies across the entire network. Its second pillar is the ability to identify users; from the moment a user accesses the network, everything about this user is known and it follows them wherever they go. TrustSec identity is embedded in the traffic that the user generates, which goes well beyond initial Network Access Control (NAC) and offers unique design capabilities that we’ll discuss below. The third pillar is security, which is reflected in a number of areas such as NAC, encryption, etc.

TrustSec is an architecture delivering network access control, policy, identity and encryption. Policy is the glue that ties business processes to network behavior and thus TrustSec has expanded its role in policy creation. TrustSec policy is segmented into three areas:

Authentication: The foundation of the technologies is authentication as it defines user identity. Authentication is how TrustSec understands users; who they are, what roles they have in the organization and what type of credentials they possess as well as confirmation of these attributes. TrustSec provides multiple authentication approaches, such as 802.1x, web authentication and MAC authentication bypass (MAB). All three approaches are implemented and supported on Cisco Catalyst or Cisco Nexus switches. Cisco uses the term “Flexible Authentication” to represent these three methods. What’s unique about Cisco’s TrustSec authentication approach is that it is providing all three methods together and they are completely adjustable. What this means is that IT administrators can configure these authenticating methods in any sequence of their choice, in one place, to host all authentication configurations, greatly simplifying the process of configuration and change management. There is yet another TrustSec authentication method, namely appliance-based network authentication provided by the Cisco NAC Appliance. This method expands beyond LAN switches to include wireless and remote access as well.

A powerful feature is that once authentication is configured on a centralized policy server all switches receive this data, easing deployment while providing consistency and scale. No more authentication configuration on a per switch basis but rather a consistent policy is realized. For IT leaders not ready to implement Catalyst or Nexus switch policy enforcement but who would rather use an appliance there is an in- and out-of-band NAC appliance approach to policy enforcement.

Authorization: Once a user has been authenticated and their organizational role confirmed then services could be designed specifically for them, implemented via control mechanisms. It’s common in the industry to typically assign a VLAN or ACL for the user depending upon a layer 2 or 3 construct. TrustSec supports both VLAN and ACL implementations. What’s unique about TrustSec is that it allows IT administrators to create a security group tag or SGT. SGT essentially allows every single packet to be tracked throughout the entire infrastructure so user control is not relegated to the initial network entry point that VLAN and ACLs dictate. SGT enables user control and support deep down in the interior of the network. For example, to strictly control access to a critical file server, an IT administrator can enable SGT to filter network egress to that server for only those allowed access. The control point is on the switch so that when traffic leaves the switch trying to reach the file server, authorized users via SGT are able to egress.

Value-Added Services: With user authentication and authorization configured along with control, IT administrators can now design specified user services that are linked to business processes. Services such as IP telephony integration and IP phone end-points that need to be authenticated and authorized but are non-user devices, meaning that they don’t possess an 802.1x supplicant and there is no human behind the device. TrustSec utilizes aspects of 802.1x to authenticate and authorize the IP phone’s user taking into account various scenarios such as when the IP phone is powered down or its behind a PC, etc. Other services are guest access, device profiling, device posture and link encryption via MACSec, an IEEE standard that specifies how encryption may be used to secure links within local area networks.

TrustSec’s MACSec implementation is supported on the Nexus switches and on the new Cisco Catalyst 3560-X and 3750-X series switches that connect desktops, WLAN access points and laptops. In short, with MACSec supported on Nexus 7000 and Catalyst 3560-X and 3750-X switches Cisco is working towards full native layer 2 encryption as the Nexus switches are located in the data center while the Catalyst 3000s are closet switches connecting desktops. This is a welcome development for high security environments such as government agencies, certain research and development laboratories and other environments that require a higher level of security.

TrustSec Innovations
Cisco is announcing a set of new TrustSec features and innovations such as Security Group Access Control List that allows IT administrators to control group access based upon MACSec key technology. Security group Tag Exchange Protocol (SXP) is useful for Catalyst switches that do not have the processing power to support SGT today. So Cisco developed SXP to insure Cisco customers can use their existing Catalyst switches to participate in the overall SGT implementation. Flexible Authentication is another innovation for scenarios when end-points do not have an 802.1x supplicant and require access to an 802.1x network. Flexible Authentication offers web authentication which is useful for printers, guest access, etc.

Open Mode offers additional options or modes to being simply denied network access, a dramatic event when it occurs. Cisco TrustSec designed multiple modes to ease this transition. For example, monitor mode is like an audit mode. IT is able to monitor all users and their traffic thus allowing IT to view network dynamics before turning on 802.1x.

In addition to monitor mode there is ‘low impact’ mode. In this case 802.1x authentication is engaged but allows certain types of traffic to pass onto the network even if authentication denies access. This is useful for DNS or maintenance related network traffic; for example, allowing this specific traffic to pass even if it didn’t pass authentication. There are configurable options for “low impact” mode. There is also a “high security” mode where only authenticated users/devices are granted access.

Value-Added Services:

There are tools to automate the process of adding value-added services such as device profiling which recognizes defined end-points such as a printer which is very handy when the printer is moved, replaced or a new one is added, thus saving IT operations configuration time. Automated device profiling tracks devices by monitoring these end-points as they boot up on the network. TrustSec identifies that the new device is a printer, and then loads the printer policy placing the printer in the right VLAN, ACL or SGT; then it updates the device database, saving IT a lot of effort.

Guest services are now integrated with the Cisco NAC appliance guest server, streamlining guest account creation and user notification. The integration of guest services into the NAC Appliance allows report creation; for example, history tracking. Guest services now works in both 802.1x and NAC environments offering IT choice, convenience and simplified operations, an industry first. Thus any worker with authorization can create a guest account, reducing dependence on IT or the helpdesk which often fielded guest access requests.

Posture assessment provides device compliance status, such as which version of Anti-Virus, spyware scan, network configuration assessment, etc., which is added to authentication services.

Cisco has enhanced end-to-end troubleshooting and monitoring capabilities into TrustSec for 802.1x environments. When an 802.1x end-point attempts to access the network a string of exchanges occur between that end-point and the network. There is a protocol exchange to obtain user information while the authenticator or network switch transfers the information to the authentication policy server. During this protocol exchange between the three entities there could be a number of reasons why things do not work. Typically when things went wrong there was limited information available to IT administrators to troubleshoot and resolve the issue. To fix this problem TrustSec collects user supplicant information from the network, the policy server and switch as a log message, which is passed through certain algorithms or scripts to isolate the problem. This increased visibility enables quick problem identification and resolution, pin pointing the trouble to the switch configuration, supplicant issue or determining whether it’s simply a wrong password. These scripts are not only useful with troubleshooting, but also compliance as collected information can generate reports. These scripts are available in Cisco’s ACS 5.1 policy server.

Implementing TrustSec

There are currently two TrustSec deployment scenarios: 1) 802.1x and 2) Appliance based. In 802.1x environments ACS server is the policy server with Catalyst and Nexus switches providing enforcement with Radius as the control plane. In the appliance-based approach Catalyst switches provide enforcement, NAC Manager is the policy server while SNMP is the control plane. The appliance-based approach does not support SGT but it provides posture assessment which 802.1x does not.

TrustSec features and attributes are implemented across many Cisco products such as the Cisco Catalyst and Nexus switches providing policy enforcement and encryption services. Policy is defined in the Cisco ACS (Access Control System) while its key authentication and authorization are implemented in the NAC Manager, Server, Profiler and Guest Server. There are two TrustSec end-point clients, those being Cisco’s or any 802.1x supplicant and its NAC client. It’s not a stretch to see that Cisco will consolidate the end-point clients and policy components over time to minimize the number of appliances needed to fully utilize TrustSec. ACS already works with the NAC Profiler and Guest Server plus directory services such as active directory or LDAP. Knowing Cisco the NAC manager may also hold all this functionality for those who choose to deploy TrustSec in an appliance form factor. Over time these two TrustSec approaches will consolidate to one, allowing 802.1x and NAC users and devices connect to the network with one policy server, and either switch or appliance enforcement method leaving choice to IT departments. The end-point clients would fit nicely into Cisco’s AnyConnect client offering both LAN and remote security services in one client.

TrustSec has expanded to include 802.1x and NAC environments offering customer choice to either proceed with one approach or a combination of the two. TrustSec’s attributes are based on policy, identity and security. Over time we expect that many of the TrustSec attributes will be integrated into the network allowing its services to be ubiquitous throughout the corporate network fabric, significantly adding to corporate security architecture.

To make TrustSec truly successful Cisco should add more support for mobile and remote access end-points in addition to LAN-based end-points to the architecture. In addition video end-points will require TrustSec services too and will have to be supported. There are slight tradeoffs between 802.1x and NAC clients such as posture assessment and SGT support. These two client features should blend over time and converge into one to simplify TrustSec client software.

Tweet

By Cisco Systems

The traditional network and physical perimeter is no longer the only borderline to defend information security. Collaboration, IT consumerization, mobility, and new computing technologies are driving productivity gains while presenting renewed security requirements. There is greater pressure on IT to meet the demands of a dynamic workforce, both in terms of service delivery and security challenges. New solutions are needed to protect borderless networks and to help further improve business efficiencies in the mean time. Cisco® TrustSec is such a solution.

To find out how to protect your network with TrustSec download this white paper now

Get the White Paper

Tweet

Cisco’s TrustSec is architecture with its implementation spread across client software, infrastructure (Catalyst & Nexus) and policy (Access Control System and NAC appliance). Cisco has expanded TrustSec to incorporate 802.1x clients allowing IT leaders to mix and match NAC and 802.1x endpoints. TrustSec organizes and simplifies authentication and policy schema allowing administrators to configure and maintain identity-based access to IT resources while identifying and applying policy based on a user roles in the organization. TrustSec also provides encrypted links at the switch port level. Steven Song Security Business Manager in the Network Systems & Security group at Cisco Systems joins me to discuss TrustSec and how Cisco is expanding its services and importance for IT business leaders.

Listen to the Podcast