Part 1: Consolidate Network Appliances with Virtualization
Virtualization has transformed the economics of running data centers. Indeed one could say that without virtualization, data centers would have faced a serious power consumption dilemma. With virtualization, it is now possible to make more efficient use of physical resources and thereby space and power consumption, which lead to cost savings.
Cost, space and power will continue to dominate the agenda as Internet data traffic continues to grow between 50% and 60% per year. Indeed, for data centers, traffic could grow even quicker as cloud computing centralizes more computing resources and more devices are used to exchange data, such as mobile phones, tablets, TVs, etc.
As more computing resources are centralized, monitoring, analyzing and securing these resources becomes more important than ever. Yet, network appliances today are typically single server implementations with few implementations providing more than one application. It is not uncommon to find several network appliances accessing a single monitoring location. For example, a typical scenario could be three appliances monitoring the same connection with one monitoring specific flows, another providing performance analysis and a third providing intrusion detection functionality.
Since cost, space and power are major issues for data centers, reducing the footprint of network appliances also becomes a major consideration. Many network appliances require all the processing power they can get and thus cannot share processing resources with other applications. Examples are 10 GbE Intrusion Prevention Systems or Application Performance Monitoring systems.
But, there are also a large number of monitoring, analysis and security appliances that run at lower speeds or do not require as much processing resources. Here, there are opportunities to consolidate these appliances into a single server solution.
If all appliances are based on the same operating system, it is possible to consolidate them using intelligent network adapters that can distribute data and share data between multiple applications. Such solutions exist today.
However, if the appliances are based on different operating systems or environments or expect to have full control over available hardware resources, then an alternative solution is required. Virtualization can be used in such instances to consolidate these very different applications. A number of different solutions are possible depending on data sharing and distribution needs. The following describes various solutions based on VMware that can be used to consolidate multiple network appliances onto a single physical platform.
Using VMware direct path
VMware Direct Path allows a virtual machine to control a physical network adapter. This allows existing network appliance applications to be transferred to a virtual environment:
This is the first step in consolidation. To the network appliance application software, it still appears as if it is running on its own server with full control of the intelligent network adapter. The driver software has been updated to support VMware Direct Path, but otherwise, no changes need to be made.
With this solution, a consolidation can be performed for multiple network appliances:
As can be seen, each network appliance can be based on a different operating system and execution environment, but still be supported on the same physical server. The only restriction is that each virtual machine needs its own network adapter as only one virtual machine can control a given network adapter at one time.
Sharing network adapters
While the above implementation works, it still requires that a network adapter is dedicated to each virtual client. This limits the number of applications to the number of slots in the server. If all the virtual clients need to access the same point in the network, a separate load balancer would be required to distribute the data between the network adapters.
By distributing data within VMware, we can eliminate the load balancer and reduce the number of network adapters required.
By using a data distribution virtual machine as a server virtual machine based on VMware’s VMCI (Virtual Machine Communication Interface), it is possible to distribute and replicate data to multiple virtual machine clients. The data distribution virtual machine can thus distribute or replicate data captured by a single intelligent network adapter to multiple client virtual machines each supporting a separate network appliance.
RELATED ARTICLES