Network Virtualization Flashcards
Hypervisors
The host OS runs natively on x86 hardware or bare metal
Type 1: Server virtualization. Examples are VMware ESXi, Microsoft Hyper-V
Type 2: Running VMs on a typical personal pc. Examples are VMware Fusion, VMware Workstation, Oracle Virtualbox
vSwitch
May connect to the host physical NIC to allow VMs to get layer 2 access. Can provide 801.Q VLAN tagging to separate layer 2 traffic
Network Function Virtualization
Takes features and functionality of proprietary network equipment and implements them into VMs. These VMs are called virtual network functions (VNFs). An example is the Cisco CSR1000v. VNFs can run on type 1 or type 2 hypervisors
Single-Root I/O Virtualization (SR-IOV)
SR-IOV allows multiple VNFs to share the same physical NIC on a VM host
Edge Virtual Bridging (EVB)
Using a physical switch to pass layer 2 traffic between VMs running on the same host. There are 2 approaches:
Internal EVB: The physical NIC includes an internal switch that bridges traffic between separate VFs. Called virtual Ethernet bridge (VEB) mode
External EVB: Traffic from one VNF goes out of the physical NIC to a physical switch, then comes back into the same NIC. This is called hairpinning or reflective relay. Configure VEPA to use reflective relay
To enable reflective relay on a Nexus switch:
switchport mode virtual-ethernet-bridge
GRE
It allows you to tunnel almost any layer 3 protocol over another. Uses IP protocol number 47
IPv4 over IPv4
Ipv6 over IPv4
Recursive Routing
Occurs when a route to a tunnel endpoint uses the tunnel interface itself as the next hop
IPsec
Encrypt traffic between 2 endpoints.
Internet Key Exchange (IKE)
Exchange the encryption keys that they’ll use to encrypt IPsec traffic. IKE uses UDP port 500
Encapsulating Security Payload (ESP)
IPsec uses ESP to provide encryption and authentication. 2 modes are transport and tunnel
Transport mode
Only the IP payload is encrypted. IP protocol number is changed to 50
Tunnel mode
The entire inner IP packet is encrypted.
Tunnel Protection Command
Causes IOS to automatically encrypt and decrypt GRE packets using IPsec
R1(ipsec-profile)#int tunnel12
tunnel protection ipsec profile myprofile
Location/ID Separation Protocol (LISP)
Designed to reduce the growth of routing tables. Advertises prefixes-called EIDs to a map resolver/map server (MR/MS) that is reachable by both sites usually over the internet. Request and replies sent over UDP port 4342.
VXLANs
Lets you create layer 2 tunnels across layer 3 networks. It tunnels ethernet frames over IP/UDP
VXLAN tunnel endpoint (VTEP)
A switch configured as a VTEP. VTEP use multicast to initially flood unknown unicast and broadcasts
VXLAN Control Planes
2 options are LISP and EVPN with BGP.
VRF-Lite Route Targets
Control the import and export of routes into the customer routing table
LISP
LISP map resolver: Accepts LISP encapsulated map requests
LISP proxy ETR: Receives traffic from LISP sites and sends it to non-LISP sites
LISP ITR: Received packets from site-facing interfaces
LISP map server: Learns of EID prefix mapping entries from an ETR
SD- WAN
vSmart controller - Manages the control plane. Distributes security information for tunnel establishment between vEdge routers
vBond - Handles the orchestration plane
