TEC37 E13 Cisco ACI, VMware NSX, or both

many organizations are looking to software-defined networking or sdn for their data center network now there are two different leaders in this space and they both have their champions in every enterprise what's best for your situation cisco's aci or maybe vmware's nsx or perhaps some combination of the two assuming that's even possible well i recently had a chance to dig into this topic with a couple of data center experts because you've got questions and today we are going to get some answers so welcome to tech 37 your podcast for technology education and collaboration from our friends at worldwide technology today's episode is sponsored by cisco well two technical solutions architects from worldwide technology join us to weigh in on these questions and draw upon their experience please welcome matt and eric guys i'll have you introduce matt let's have you uh start tell us a little bit about what you do and uh and what brings you today on our guest panel yeah matt hillicker i'm a technical solutions architect with worldwide like you said i'm on our global engineering team at wwt and i focus on data center networking so anything software defined networking as it pertains to the data center aci nsx and also traditional networking things like that excellent excellent eric how about you eric fairfield uh part of our global engineering team pure of mats focusing on all things data center networking as he said everything from your classical design to software defined with all things aci and nsx or both well i wanted those are two big subjects um but that's just probably just touching the surface in terms of what you guys have experienced in terms of all kinds of things that would come up in the data center you guys are both global you're both as i understand assisting customers around the world for worldwide technology uh in various situations so i'm not going to force either one of you to pick a side as it would be more fun from a challenging perspective but uh eric i'll just start with you since you were speaking last um let me ask you let's start with a setup tell us what it how would you describe to someone that may not be completely familiar what is cisco's aci key points cisco's aci the primary factors of aci is it's a simple automated fabric to start with that's one of the premise points of aci again is the simple networking it's a foundation that you can automate and then on top of that we get into the security aspect of aci we're able to secure the applications and and within the data center much more effectively in the past with both macro and micro segmentation is it fair to also characterize just as we look to draw upon some just fundamental differences is that aci is is a combination of both overlay and underlay perhaps more tightly integrated um or certainly designed to be tightly integrated i should say that uh is that fair statement absolutely i i look at aci as kind of a hybrid software-defined network right where it owns the underlay the traditional network underneath it and the overlay and also extends into the cloud and remote sites as well all right we'll dig into those details more in just a moment so let's go over you matt for nsx how do you describe it to someone that may not be completely familiar with it yeah so nsx is vmware's software-defined networking solution a little bit different from aci and that there isn't really any hardware component that you purchase from vmware as part of the solution it all runs on either the vsphere or kbm hypervisor so nsx does aim to be hypervisor agnostic if you will support it on both vsphere and kvm but they sort of take a different approach but ultimately still trying to bring networking and security policy to your workloads your applications wherever they may live well just to get this done right off the top can i get either one of you to just go ahead and give me the answer on which one i should deploy no nothing wow that's a loaded that's a little question no i know there's no right answer it's nothing better than asking an engineer to to make a this is always the right answer kind of decision um well no so how do we begin breaking these down so i think they're both very worthy providers in the software defined space they both have a lot of champions and people that are familiar with them uh but what are the kind of things how do we how do you begin breaking this down because i assume you've worked with a lot of customers in these deployments you've deployed both so what kind of things are important to understand perhaps use cases or something in terms of how people would look at these things differently i would say you know the first thing that i look at is why are we having the discussion what's what's driving the change in your data center network is it simply a refresh is there something about how you want to deliver your applications differently right stepping back and ultimately looking at what's keeping you up at night how can we resolve that and where do you want to be in the next three to five years in terms of delivering your applications to the business um well let me are there specific things that a customer watching this let's just say it that way if a customer is considering these things what are the big elements maybe that someone uh would be telling you in your consultative capacity that says oh that begins to tell me these are the things that where you start to orient in one direction versus another what are the what are the ones that tend to sway you how about you eric i would say uh the things that tend to sway me is what are we looking for in terms of environments right are we looking at containers cloud multiple data centers right our our amount of physical workload versus virtualized workload though those are the things that uh we we want to start looking at is what what's that workload going to look like and where is it going to be and what's the connectivity requirements for it you know from a dr pers perspective active standby versus active active etc matt what about what do you think i would honestly completely agree with eric i mean it's really it goes back to being use case dependent and similar to what eric said i like to take a step back and really try to understand what are the initiatives of the business what are the technical initiatives as well and then where can a solution meet those initiatives in the middle and so when you start to do that you you tend to tease out a few more details from the customer as to what they're ultimately trying to accomplish may uncover a much larger opportunity than just software-defined networking it could be a much larger data center play overall but you tend to really get to the root of what kind of requirements do they have of their data center from a networking and security standpoint is it possible to get you guys to weigh in on what you think is better about certain solutions and you can caveat it however you want but i'm just kind of curious i mean obviously i think everybody's going to be good at some things and it's not to say someone else is bad at it but what kind of things would you hold up as one being ideal for yeah so i mean i think it's fair to say you know that for a long time a lot of people have considered cisco as like the king of networking certainly there's other vendors out there but a lot of us you know in the networking space at worldwide especially we built our career on cisco and so i think one area where eric and i definitely agree that aci is a solution is very good at is providing a very easy to provision underlay and overlay architecture but then what aci is also very good at is the multi-location capabilities and this is all encompassed under cisco's aci anywhere uh marketing term if you will so you have capabilities like multi-site multi-pod you have cloud extension and with the click cloud apic and things like this so cisco has done a very good job in that area i would say and is that an important element that a lot of people when they're moving to sdn either they've already been doing something different in a more traditional fashion for multiple data centers and for security and things like this you know when they're going to sdn what do you think is the big driver why now what would be a catalyst that may also help kind of open up the discussion yeah i think you know it teams are constantly being asked to do more with less network architectures aren't becoming simplified they're becoming more complex even if some of that complexity is being abstracted away but the size of the teams seem to be shrinking over time so the needs of the business are increasing but the sizes of the teams are going down and so there's this been this push to try to abstract away some of these more manual tasks and things like this you know tasks that don't really add a lot of value to the underlying you know business right it doesn't really do anything for your apps and services so if we can abstract that away through some type of software-defined networking solution then the engineers architects etc they can spend their time on tasks that actually do have a qualitative and quantitative impact on the business that's always the dream as busy as we are all are it's amazing how often the discussion comes up around you know moving towards automation and we're worried about not having a job and i'm like who's been getting off early each day um and somehow finishing their to-do list because i have yet to ever encounter that um i want to make sure i'm going to get i want to hear some more positives from a from a vmware um nsx direction eric what what would you hold up as saying these are the things you love about uh what nsx is capable of doing well you know as matt said you know one of the big things cisco's been doing this a long time so nsx is having to to catch up but one of the things that i'll say is they've been catching up really fast i mean they've they've been uh changing things adding new features uh very consistently heck they even uh completely changed architectures from nsxv which only worked on vsphere right to nsxt which has multi-hypervisor support um it's got bare metal support it's got container support right and cloud extension much like aci does and in fact with nsx3 federation support team so they're starting to get into the multi-data center support game much more effectively than than in the past so really they've been stepping up their game just as much as cisco has and as matt said you know it's there's a lot of things that they both do really well and it's it's a matter of step stepping back and looking at what are we trying to accomplish what one's going to check the most boxes and are there going to be more boxes checked if we do both okay yeah i'm going to ask you about both in just a second but as a setup into that let me ask you just stick with you for a second eric on uh layer eight um so i feel like there's a lot of times there's a network team that probably has a lot of experience with cisco and an understanding of exactly where things begin and end perhaps even if they're not that familiar with aci yet uh in this scenario but then they're the exact same thing could be said about your vmware fans that may be in a different part of the organization and so i can imagine you guys have to reorient your conversation depending on who actually starts talking to you first in terms of what angle they may be coming from but could you highlight a little bit about the reality of of how organizations are kind of structured and how that has an effect on because we've seen this in other technologies but how is it having effect on these type of decisions oh absolutely it's crucial to get both groups in the room together working together this reminds me of the old days in the early 2000s when i started doing voice over ip right same problem having to get both the server and virtualization teams in the same room as the network people as the security folks and again getting back getting away from you you'll see a lot of times where the network team brings cisco because that's what they know the vmware team and the oems target as such where again it's getting them in the room and saying let's talk about what the end game is not about what this one does that one does what's the end game and figure out the best option yeah does that often require you know because as i think back to even working in security and then you brought up voice and i've seen it happen in storage as well where sometimes you're like wait it this can't be something that's going to be accomplished at a at the um maybe the hands-on level you need senior management support saying this is what we need to do and and they're the ones saying these people have to be present um in the room when it comes to that so let's talk about both now so go back over to you matt is it possible to do both it is absolutely possible to do both whether it's a good or idea or not again is entirely dependent on what you're trying to accomplish like eric was alluding to there well let's get into more details on that does it differentiate between um i don't think we've talked a lot about security differences perhaps micro segmentation and kind of where these things happen what what type of differences are important from that perspective because i imagine you get all the same people in the room and you talk about being able to understand the long-term goals so that you can provide accurate device of how to get from where you are now to where you want to be because it requires input and buy-in from both but um i guess from the security difference going back to the earlier question of which not which one's better but what kind of things uh become important in terms of how these are implemented if you're looking at doing both are you hobbling one versus the other or blinding one on the other when you're looking at those type of implementations you absolutely could if you're not careful so that's why we we definitely encourage our teams to have a discussion with us and their customer when they start asking about bringing aci and nsx together they can absolutely work well together but you ultimately need to understand like what are you trying to accomplish and then with what solution does it make sense to have that particular uh task or you know the piece that you're looking for so like you mentioned security for example does it make sense for you to build the majority of your security constructs in aci with its capabilities or does it maybe make more sense to spend more time on that aspect in nsx it ultimately just depends on what you're trying to accomplish going back to what you were asking eric about earlier with you know what is nsx good app you know one particular area that they're very well known for is this distributed firewall feature that has drawn a lot of customers to nsx over the years so we'll talk more about that exactly and define firewall just to make sure that we're all speaking from the same hymnbook what is what is your definition of firewall in this situation and how is it what is it that they're doing um that's not easy to do or possible to do elsewhere yeah so in the context of this discussion when i say firewall i'm really talking about a staple service if you will that can potentially look all the way up into the layer seven part of an ip packet right so um that is something that you cannot do with aci natively you can do something like service insertion where you can intelligently redirect traffic to a firewall of some kind with regardless of what the vendor of that firewall is but the neat thing with the distributed firewall which is a a truly distributed service within nsxt from vmware is that firewall lives at the workload level on every single nsx host and so that's really really cool because you're able to enforce security policy on a per workload basis in fact that you're enforcing that security before that packet even hits the virtual switch and so if you talk about having a segmentation strategy or some kind of segmentation initiative with a customer that tends to raise a lot of eyebrows because being able to segment east west is tends to be very important to them yeah and one of the things i'll add to that too is you know it when you compare that function to aci a lot of customers look for having a solution that looks from a rule set perspective like a firewall yeah and that's a big difference between aci is it doesn't have that firewall rule set look that a lot of security teams do look for so that's why a lot of people tend to gravitate towards the distributed firewall is that capability as well it's it it's to them it's a more natural approach and look and feel well i feel like acid granted i'm not aware of its ability and it makes sense that it wouldn't have the ability without a service insertion to be able to even see things at that level and so i'm always a big fan of of keeping security both close to the workload or close to the user or both um in those situations and having some defined boundaries but what is so could but what is aci doing from this perspective because from a security perspective one of the things i've always liked is the notion of of being able to you know contract-based policy um grouping things together to be able to simplify policy is that stuff go out the door if you're doing more security oriented stuff on the on the vmware side or does it still have a play no it it still has a play it really comes down to how we're trying to do what the service that you're trying to deploy right if people are re requiring stateful firewall inspection aci in itself the fabric is a stateless firewall that's based upon five tuple type value um for the contracts right so it's it's really good at doing that you just have to know how to build out your contracts and have that application dependency mapping if you want to get that that much detail to your application security right and again that's a great i i don't necessarily call that micro segmentation but it's a great macro segmentation start not to mention it it has the macro segmentation capabilities of of multi-tenancy and uh multiple vrfs and that is something that just started with nsx in 3.0 right so uh nsx just recently caught up to that whereas aci has had that since 1.0 yeah so that's something that could really work well together too because if you're bringing both aci and nsx together you know we like to think of security as like an onion you wouldn't want to just have a firewall out at the perimeter of your network and that's all you have because then if that device goes down or something like that and that's all your security well you're going to be fairly well exposed there and so what you could do like eric was saying is use the contracts within aci to have a little bit more macro approach you know kind of pick off the uh the low hanging fruit if you will from a threat standpoint and then get into more of your micro segmentation type stuff down at the nsx layer if you'd like if i'm thinking of kind of the and i'm just saying this loosely but whatever you'd call the team that probably more in favor of vmware what would you refer to people from that side of things are the virtualization team um people that are more information computing okay virtualization compute side versus network in terms of layer 8 issues that we kind of talked about earlier is it a plus or a minus it's out because it sounds like if you were doing both together is there a layer 3 kind of boundary here that now keeps those divisions completely separated so that you always know this is your set of stuff to worry about this is my set of stuff to worry about and do you see customers if that's indeed the case are customers jumping on this to preserve the easier path of not solving any organizational issues with a deployment and simply kind of preserving status quo by doing both is that a reason that anyone would ever do that i i've seen both approaches in in how that's dealt with and operated where um there might be a an ownership line in the sand let's say where the compute and virtualization team own nsx from a deploying the segments and all that and the network team owns the bgp peering on the nsx edge and the rest of the network the underlay etc and again they hand off the the compute team where they're going to run with everything that's not unusual like in a vcloud foundation environment right because at that point you're handing off hopefully in a range of ip addresses that really you're going to let that team dole out and swizzle however that they want to and you're worried more about that layer 3 handoff and and they can operate really in a in a cloud-like fashion so you're not having to worry about all the networking of nsx anything additional on that one matt i would just re-emphasize the fact that you know it's important regardless of what path the customer goes down that the network team and the server teams they need to start communicating with each other and if you start talking about bringing both nsx and aci together i would list it as a critical component if they have like a hard silo between them or if they don't have a good relationship there's politics going on to whatever to where they just do not get along for whatever reason in my opinion it's going to be doomed to failure because you need mutual cooperation and so i assume then we're still seeing that in the customer base these days are you seeing examples of where those subdivisions are still persevering and those differences are still something that has to be addressed i guess you wouldn't bring it up it wasn't still the reality um but there's one reality to it here and there there is um i've seen both sides of it obviously you know eric and i we split the customer opportunities you know it just depends on how uh what person it goes to but um i've been encouraged by a few organizations that i've spoken to and that they have begun developing uh what they tend to call a tiger team so it's not necessarily a a network team or a server team or a storage team it's one team but they've got representation from network from security maybe even from the application side all working together very cohesively and i i'm sure to tell those customers like that is very forward thinking and that is the way forward because that's going to remove any of those real or perceived roadblocks to making these solutions work well together how does we when we were talking earlier you i can't remember which one you brought this up i think it was eric but you were talking about the ways in which nsx and don't mean this in a negative way but network oriented folks may need to be on the lookout for ways in which nsx may sneak into an organization um assuming i'm characterizing that correctly can you restate it correctly and expand on sure sure you know so a good example is you might have an environment that a customer has aci in place today and all of a sudden pivotal container system comes into the fold right that's going to be running nsx now the question is how do we integrate this and that's why it's always important when we do an aci design workshop that we have that discussion of what if and how do we plan for that what if that a sidecar like environment like this comes in where it's really not it's an environment that's going to connect to the aci fabric and how are we going to accommodate for that and if it works well you just have to know how to plan for it and operationalize that right who's going to own that peering who's how far can that network team own nsx how far are they willing to right and if there's pushback on that right getting that tiger team mentality that matt referred to in place to avoid the layer eight and nine issues okay is there any way that you would see that happening is there anything that gets triggered is there any failure scenario that you need to be aware of or is it just something that kind of comes up and it would come up in conversation and thus you need to then dig in further just trying to think of it as a major you know sometimes you get something on the network suddenly that's just handing out addresses or something and it becomes obvious that something bad is happening but i don't think you're talking about that type of intrusion on the network no you usually it's the oh by the way in the next six months we're putting in pks okay right and the network team goes and how are we doing that right and and or what's good yes yeah what is it right but no doubt but it it's you know having those discussions when we do these design workshops or these briefings giving people you know a little forward thinking about how do we address this if it needs to happen and don't be scared about it there's nothing technical that says you cannot and will not integrate these two environments it's educating them on how it can be done the different options because there's multiple ways to do nsx on aci it's just a matter of what's the right way for what we're putting in and it's not one way or the other both ways can integrate at the same time so it's just getting people to step back and not worry about you know is it is it even going to work it's how do we make it work how do we deliver what the business needs talk a little bit about um i don't think we've kind of gotten into this but single overlay versus double overlay um whoever wants to take that what's how does it seems like that that's the potential also that you get into and and i remember back from my cisco experience it felt like vmware was is always willing to say we don't care what's underneath in reality i think we all do and so it's not something you're going to leave to chance but is there is there an issue with with single or double overlays and a choice to be made there in terms of when you're when you're looking at these deployments it's definitely something you have to consider especially when you know you always want to just understand how the technology is working underneath you're absolutely right and with an nsx only design vmware being software only they have the luxury of saying oh we don't care about what the uh the physical network infrastructure looks like in reality that's that's not quite true you know it does not absolve you from good network design but when you bring aci and nsx together you've got a really strong resilient and robust underlay right there waiting for you now as far as single overlay or double overlay is concerned aci is both an underlay and an overlay solution that's the way it's always going to work you cannot choose to just not use the overlay if you don't want so it's always going to be there but with nsx it's not exactly the same thing so you can deploy nsx in a couple of different ways but you have the option of whether or not you want to use the software overlay capabilities and so that's where this whole single underlay or a single overlay excuse me versus double overlay debate comes into play is the real question is you know are we going to use the overlay capabilities of nsx or not and so if you're not you just have to make some considerations for how that's going to be deployed on the uh the aci side you're also going to be foregoing certain features and capabilities that nsx has because there are some capabilities within nsx that relies on that overlay capability here's one i just thought of that i don't think we talked about in advance as we were planning in this conversation so i'm just curious take this what is it you know you always worry about the old um i always have this thing on my walls it's not the network's fault um you know but this notion of of uh when it comes to troubleshooting and something like this if you're in a dual environment like this how high is the chance that it's more difficult to discern exactly where your issues are coming from and and does your vendor support suddenly get different because they feel like that's well you didn't deploy nsx in the way in which we recommend and you're doing it in this situation is there any finger pointing issues or something to worry about there in your uh you know in your day two beyond scenarios uh thankfully that doesn't seem to be a problem at least not one that i've heard of both vmware and cisco have come to the realization that customers are going to do this and with or without their help and that's really a uh a great position for a corporation like worldwide to be in because we sit in the middle and we're able to explain the facts to the customer of how exactly they need to do it what they need to look out for but both vmware and cisco have design guides for bringing the two solutions together that doesn't mean they necessarily see eye to eye but um to my knowledge there hasn't been any like supportability issues or anything like that to aci the encapsulated packets is just another service writing on top of the fabric so it shouldn't really interfere yeah so some of that will come down to you know single overlay versus double overlay where do you start looking then right and usually if it's a single overlay people start looking in aci in its tool set versus nsx where when double overlay they'll start looking in the nsx toolset okay let me ask you about this another potentially i don't see a dangerous question i'm going to talk a learning curve so i know going from traditional data center understanding of how things work to aci was kind of a big turn for me and i've never had to deploy it so i can't imagine what someone going through that from a deployment perspective is looking at so i know there's a learning curve you know and a different head space to be in with terminology and kind of equating things on the cisco aci side my assumption is is that the same is there some similar thing on the vmware side or if i'm a vsphere expert and i've worked in this for years am i going to get nsx like that or what's the what's the what's the learning curve to be aware of in either of these both sides have learning curves there's simply no way around it aci got its nuances and nsx has it uh its own set of nuances how nsx routes between different layers tier zero and tier one is very different than what a traditional uh cisco networking person is used to right so regardless of which technology or both you're going to you're going to have new skills and and learning those skills is going to be incredibly important and then on top of that they both do automation so you're going to be getting new skills there anyhow because if you're sitting in the cli or the gui all the time you're probably not spending the time best there right versus learning some of the good basics of automation yeah it is either direction that you choose to go in do you feel like either side has any limitations in terms of where people are going next whether it be cloud adoption but automation and devops tool sets anything like that does are they both kind of working in that direction and seem none of these decisions are necessarily going to affect that negatively or anything to be aware of there i mean cisco has definitely done an outstanding job of embracing the idea of automation and orchestration most people are probably familiar with cisco devnet there's an enormous community there and an entire line of professional certification so um both both cisco and vmware as far as like aci and nsx are concerned both have a very robust and well-documented api so you'd be able to interact with that api directly if you'd like or consume a tool like ansible or terraform things like that you're going to feel like when we get into the ansible terraform and especially apis now we're starting to get a language that's potentially working across more than even just cisco and vmware and so maybe that goes to your point of saying if you're spending too much time in the ui of any one of those things then you're probably not doing your job correctly because you need to because a lot of that stuff is happening at that level is going to be more of the grunt work that you really want automation to take over i would assume and that's generally the goal of moving to stn right to make things easier and get to a point where we're doing less of the mistake prone manual intervention oh absolutely because you know it when you're deploying vms you're going to be doing api calls to vcenter you're going to be doing api calls to nsx or aci right you're going to be hitting multiple environments from let's say an ansible playbook or or something like that right or or within terraform you're going to be hitting multiple environments anyhow so interesting all right well guys as we wrap up here tell you what tell me a little bit about what resources you might have available because this is i know you guys are always good at this and you've already been hammering on me that education never stops and a lot of this sounds like it sounds like anyone watching this if this is truly a question someone in our audience has a mind you know trying to figure out which direction to go i think the only real way you could probably help them i would assume is know something a little bit more about their architecture and it feels like it's a more personal interactive discussion um what kind of things have you guys started doing or have you been doing i should say worldwide to um to offer more assistance in this area yeah so worldwide we're very proud of our what we call our platform the wwt platform you can go out to wwt.com to check it out but we have a variety of resources divided up by a solution area there and so the area that eric and i obviously focus on is data center networking so we have a variety of workshops that we could give for a customer and also both schedulable and on-demand labs so lots of different resources to get a customer up and running there yeah absolutely uh you know in this particular area we have briefings that are available that talk about aci and nsx nsx on aci uh really just talking about the technology digging into what you're trying to do and then we have workshops that can be anywhere from four four hours to maybe a day two days depending on size and complexity on those same topics and really getting into being design workshops around those three topics right one you know aci nsx or both and then i assume that's where and those are and that indeed when you talk about getting into design workshops this is where you're going to get into let me understand a little bit about you mentioned at the top and throughout what are you trying to accomplish because so it's not enough for them to say i want to do sdn whatever that means you want to know both where they want to go long term a little bit more about their organization if you don't already understand them because you guys have a lot of good relationships and then also i would assume kind of uh where they are in terms of what's been deployed what's been attempted perhaps um and things of that nature to account for the recommendations that would then follow from there so i assume because this is not a decision no one cuts over to this kind of thing overnight this is something that requires kind of a strategic rollout or extension as you slowly retire old ways of doing things adopt new ways or perhaps bring up new sites and such as you do this i would assume absolutely we everyone kind of chuckles at my mantra is sdn is not a project it's a journey it's a crawl walk run type of engagement right it there you're always bringing in new apps it doesn't stop yeah it's funny how fast can can we still kind of remember the point where we were arguing about whether sdn in terms of granted every vendor and i'm guilty of this has over hyped the latest hot acronym but obviously the the fundamentals of what we mean you know when we're talking about centralized control in these type of situations that's obviously taken root i don't think there's any question about that being the way to go long term uh in terms of efficient scaling and efficient operations so i assume there's no argument to be made there and i think that's fine let's move on forward so it sounds like this question still gets resolved we got either or or both um and it sounds like the best way to address this obviously is to engage with you guys and then as much as i enjoyed visiting you in st louis um neither of which are you guys in st louis uh but you both travel a lot or at least you used to um and but this is all stuff that can be online as well so someone doesn't necessarily have to come out there it doesn't matter where they're located in the world uh this is still something that you guys can provide assistance and support for correct correct yeah absolutely excellent well guys thank you so much i appreciate you weighing in i do hope we get to get on planes again and get back in front of customers physically face to face as soon as possible but let's all stay safe until then thank you to our audience appreciate you watching my name is rob boyd thank you so much we'll see you on the next one

Channel: World Wide Technology Inc.

Views: 1,055

Rating: 5 out of 5

Keywords:

Id: -RAFe0EjJ4M

Length: 40min 18sec (2418 seconds)

Published: Tue Sep 15 2020