Ch 27: Virtualization Flashcards
- What is a virtual machine?
- A software emulation of a virtual server with an operating system
- A software emulation of a physical server with an operating system
- A software emulation of a physical server without an operating system
- A software emulation of a virtual server with or without an operating system
2.
A virtual machine is a software emulation of a virtual server with an operating system.
What is a container?
- A lightweight virtual machine
- A software emulation of a physical server without an operating system
- An application with its dependencies packaged inside a tarball
- An isolated environment where containerized applications run.
4.
A container is an isolated environment where containerized applications run. It contains the application, along with the dependencies that the application needs to run. It is created by a container engine running a container image.
Which of the following are container engines? (Choose all that apply.)
- Rkt
- Docker
- vSphere hypervisor
- LXD
1, 2, and 4.
Rkt, Docker, and LXD are container engines. The vSphere hypervisor is a hypervisor that enables the creation of VMs.
What is a virtual switch (vSwitch)?
- A software version of a physical multilayer switch
- A software version of a physical Layer 2 switch
- A software version of a physical switch with advanced routing capabilities
- A cluster of switches forming a virtual switching system (VSS)
2.
A virtual switch (vSwitch) is a software-based Layer 2 switch that operates like a physical Ethernet switch and enables VMs to communicate with each other within a virtualized server and with external physical networks through the physical network interface cards (pNICs).
T/F: Only a single vSwitch is supported within a virtualized server.
False.
Multiple vSwitches can be created under a virtualized server, but network traffic cannot flow directly from one vSwitch to another vSwitch within the same host, and they cannot share the same pNIC.
T/F: Containers do not need vSwitches to communicate with each other or with the outside world.
False.
Containers, just like VMs, rely on vSwitches (also known as virtual bridges) for communication within a node (server) or the outside world.
Which of the following is the virtual or software version of a network function and typically runs on a hypervisor as a VM?
a. VNF
b. NFV
c. NFVI
d. NFVIS
1.
A virtual network function (VNF) is the virtual or software version of a physical network function (NF) such as a firewall, and it typically runs on a hypervisor as a VM.
For reference:
- NFV: Network Function Virtualization
- NFVI: Network Function Virtualization Infrastructure
- NFVIS: Network Function Virtualization Infrastructure Software
Which of the following is an architectural framework created by ETSI that defines standards to decouple network functions from proprietary hardware-based appliances and have them run in software on standard x86 servers?
a. VNF
b. NFV
c. NFVI
d. NFVIS
2.
Network functions virtualization (NFV) is an architectural framework created by the European Telecommunications Standards Institute (ETSI) that defines standards to decouple network functions from proprietary hardware-based appliances and have them run in software on standard x86 servers. It also defines how to manage and orchestrate the network functions.
Connecting VNFs together to provide an NFV service or solution is known as ______.
- daisy chaining
- bridging
- switching
- service chaining
- linking
4.
Service chaining refers to chaining VNFs together to provide an NFV service or solution.
Which of the following is the I/O technology that uses VFs and PFs?
- OVS
- OVS-DPDK
- SR-IOV
- PCI passthrough
c.
In SR-IOV, the emulated PCIe devices are called virtual functions (VFs), and the physical PCIe devices are called physical functions (PFs).
For reference:
OVS: Open vSwitch, sometimes abbreviated as OVS, is an open-source implementation of a distributed virtual multilayer switch. The main purpose of Open vSwitch is to provide a switching stack for hardware virtualization environments, while supporting multiple protocols and standards used in computer networks.[3]
OVS-DPDK: DPDK stands for Data Plane Development Kit, is a set of libraries that improves data plane performance.
SR-IOV: Single Root I/O Virtualization (SR-IOV) allows multiple VMs running a variety of guest operating systems to share a single PCIe network adapter within a host server. SR-IOV allows a VM to move data directly to and from the network adapter, bypassing the hypervisor for increased network throughput and lower server CPU burden. Recent x86 server processors include chipset enhancements, such as Intel VT-x technology, that facilitate direct memory transfers and other operations required by SR-IOV.
The SR-IOV specification defines two device types:
Physical Function (PF)—Essentially a static vNIC, a PF is a full PCIe device that includes SR-IOV capabilities. PFs are discovered, managed, and configured as normal PCIe devices. A single PF can provide management and configuration for a set of virtual functions (VFs).
Virtual Function (VF)—Similar to a dynamic vNIC, a VF is a full or lightweight virtual PCIe device that provides at least the necessary resources for data movements. A VF is not managed directly but is derived from and managed through a PF. One or more VFs can be assigned to a VM.
Which platform plays the role of the orchestrator in Cisco’s Enterprise NFV solution?
- APIC-EM
- Cisco DNA Center
- Cisco Enterprise Service Automation (ESA)
- APIC Controller
2.
Cisco DNA Center provides the VNF management and NFV orchestration capabilities. It allows for easy automation of the deployment of virtualized network services, consisting of multiple VNFs. APIC-EM and ESA are no longer part of the Enterprise NFV solution.
T/F: NFVIS is based on a standard version of Linux packaged with additional functions for virtualization, VNF lifecycle management, monitoring, device programmability, and hardware acceleration.
True.
NFVIS is based on standard Linux packaged with additional functions for virtualization, VNF lifecycle management, monitoring, device programmability, and hardware acceleration.
What is NFV?
Server virtualization is the process of using software to create multiple independent virtual servers (virtual machines) or multiple independent containerized operating systems (containers) on a physical x86 server.
Network functions virtualization (NFV) is the process of virtualizing specific network functions, such as a firewall function, into a virtual machine (VM) so that they can be run in common x86 hardware instead of a dedicated appliance. This chapter describes server virtualization and NFV and the benefits they bring to an enterprise network.
What is a hypervisor? What are some examples of these?
The virtualization software that creates VMs and performs the hardware abstraction that allows multiple VMs to run concurrently is known as a hypervisor.
VMware vSphere, Microsoft Hyper-V, Citrix XenServer, and Red Hat Kernel-based Virtual Machine (KVM) are the most popular hypervisors in the server virtualization market. Figure 27-1 provides a side-by-side comparison of a bare-metal server and a server running virtualization software.
What is a container?
A container is an isolated environment where containerized applications run. It contains the application, along with the dependencies that the application needs to run. Even though they have these and many other similarities to VMs, containers are not the same as VMs, and they should not be referred to as “lightweight VMs.”
Containers share the underlying resources of the host operating system and do not include a guest OS, as VMs do; containers are therefore lightweight (small in size). The application, along with the specific dependencies (binary files and libraries) that it needs to run, are included within the container.
Containers originate from container images. A container image is a file created by a container engine that includes the application code along with its dependencies. Container images become containers when they are run by the container engine. Because a container image contains everything the application code within it needs to run, it is extremally portable (easy to move/migrate). Container images elimi- nate some typical problems, such as applications working on one machine but not another and applications failing to run because the necessary libraries are not part of the operating system and need to be downloaded to make it run.
Figure 27-4 shows a side-by-side comparison of VMs and containers. Notice that each VM requires an OS and that containers all share the same OS while remaining isolated from each other.
See the attached diagram.
Can the traffic from VM1 reach the internet via VM0, which has the connection to the outside world?
Yes, provide the NGFW permits it.
Since network traffic cannot flow from one vSwitch to another, network traffic from VM1 destined to the external network, or VM0, needs to flow through the virtual next-generation firewall (NGFWv).
Figure 27-5 illustrates a virtualized server with three vSwitches connected to the virtual network interface cards (vNICs) of the VMs as well as the pNICs. vSwitch1 and vSwitch3 are linked to pNIC 1 and pNIC 3, respectively, to access the physical network, whereas vSwitch2 is not linked to any pNICs.
What is service-chaining?
Service chaining refers to chaining VNFs together to provide an NFV service or solution, as illustrated in Figure 27-8.
What is OVS-DPDK?
OVS Data Plane Development Kit (OVS-DPDK):
To overcome the performance impact on throughput due to interrupts, OVS was enhanced with the Data Plane Development Kit (DPDK) libraries. OVS with DPDK operates entirely in user space. The DPDK Poll Mode Driver (PMD) in OVS polls for data that comes into the pNIC and processes it, bypassing the network stack and the need to send an interrupt to the CPU when a packet is received—in other words, bypassing the kernel entirely.
To be able to do this, DPDK PMD requires one or more CPU cores dedicated to polling and handling the incoming data. Once the packet is in OVS, it’s already in user space, and it can then be switched directly to the appropriate VNF, resulting in huge performance benefits.
Figure 27-11 illustrates an x86 host with a standard OVS compared to an x86 host with an OVS with DPDK.
What is the downside to PCI passthrough?
The downside to PCI passthrough is that the entire pNIC is dedicated to a single VNF and cannot be used by other VNFs. Therefore, the number of VNFs that can use this technology is limited by the number of pNICs available in the system.
Figure 27-12 illustrates an x86 host with a standard OVS and an x86 host with PCI passthrough.
What is SR-IOV?
SR-IOV, Single-Root I/O Virtualization, is an enhancement to PCI passthrough that allows multiple VNFs to share the same pNIC.
SR-IOV emulates multiple PCIe devices on a single PCIe device (such as a pNIC). In SR-IOV, the emulated PCIe devices are called virtual functions (VFs), and the physical PCIe devices are called physical functions (PFs). The VNFs have direct access to the VFs, using PCI passthrough technology.
An SR-IOV-enabled pNIC supports two different modes for switching traffic between VNFs:
- Virtual Ethernet Bridge (VEB): Traffic between VNFs attached to the same pNIC is hardware switched directly by the pNIC.
- Virtual Ethernet Port Aggregator (VEPA): Traffic between VNFs attached to the same pNIC is switched by an external switch.
Figure 27-13 illustrates an x86 host with a standard OVS compared to an x86 host with SR-IOV.
