Chapter 8 : Network Virtualization
Interactions of control plane and Data plane
What is network virtualization?
Network Virtualization (NV) refers to abstracting network resources that
were traditionally delivered in hardware to software. NV can combine
multiple physical networks to one virtual, software-based network, or it
can divide one physical network into separate, independent virtual
networks.
Network virtualization software allows network administrators to move
virtual machines across different domains without reconfiguring the
network. The software creates a network overlay that can run separate
virtual network layers on top of the same physical network fabric.
Network virtualization is rewriting the rules for the way services are
delivered, from the software-defined data center (SDDC), to the cloud, to
the edge. This approach moves networks from static, inflexible, and
inefficient to dynamic, agile, and optimized. Modern networks must keep
up with the demands for cloud-hosted, distributed apps, and the
increasing threats of cybercriminals while delivering the speed and agility
you need for faster time to market for your applications.
How does network virtualization work?
Network virtualization decouples network services from the underlying
hardware and allows virtual provisioning of an entire network. It makes it
possible to programmatically create, provision, and manage networks all
in software, while continuing to leverage the underlying physical network
as the packet-forwarding backplane. Physical network resources, such as
switching, routing, firewalling, load balancing, virtual private networks
(VPNs), and more, are pooled, delivered in software, and require only
Internet Protocol (IP) packet forwarding from the underlying physical
network.
Network and security services in software are distributed to a virtual layer
(hypervisors, in the data center) and “attached” to individual workloads,
such as your virtual machines (VMs) or containers, in accordance with
1
networking and security policies defined for each connected application.
When a workload is moved to another host, network services and security
policies move with it. And when new workloads are created to scale an
application, necessary policies are dynamically applied to these new
workloads, providing greater policy consistency and network agility.
Benefits of network virtualization
Network virtualization helps organizations achieve major advances in
speed, agility, and security by automating and simplifying many of the
processes that go into running a data center network and managing
networking and security in the cloud. Here are some of the key benefits of
network virtualization:
Reduce network provisioning time from weeks to minutes
Achieve greater operational efficiency by automating manual
processes
Place and move workloads independently of physical topology
Improve network security within the data center
Network Virtualization Example
One example of network virtualization is virtual LAN (VLAN). A VLAN is a
subsection of a local area network (LAN) created with software that
combines network devices into one group, regardless of physical location.
VLANs can improve the speed and performance of busy networks and
simplify changes or additions to the network.
Another example is network overlays. There are various overlay
technologies. One industry-standard technology is called virtual extensible
local area network (VXLAN). VXLAN provides a framework for overlaying
virtualized layer 2 networks over layer 3 networks, defining both an
encapsulation mechanism and a control plane. Another is generic network
virtualization encapsulation (GENEVE), which takes the same concepts but
makes them more extensible by being flexible to multiple control plane
mechanisms.
VMware NSX Data Center – Network Virtualization Platform
VMware NSX Data Center is a network virtualization platform that delivers
networking and security components like firewalling, switching, and
2
routing that are defined and consumed in software. NSX takes an
architectural approach built on scale-out network virtualization that
delivers consistent, pervasive connectivity and security for apps and data
wherever they reside, independent of underlying physical infrastructure.
The Data, Control, and Management Planes
Stop and think about what networking devices do. What does a router do?
What does a switch do?
Many ideas should come to mind. For instance, routers and switches
physically connect to each other with cables, and with wireless, to create
networks. They forward messages: switches forward Ethernet frames, and
routers forward packets. They use many different protocols to learn useful
information such as routing protocols for learning network layer routes.
Everything that networking devices do can be categorized as being in a
particular plane. This section takes those familiar facts about how
networking devices work and describes the three planes most often used
to describe how network programmability works: the data plane, the
control plane, and the management plane.
The Data Plane
The term data plane refers to the tasks that a networking device does to
forward a message. In other words, anything to do with receiving data,
processing it, and forwarding that same data—whether you call the data a
frame, a packet, or, more generically, a message—is part of the data
plane.
The Control Plane
Next, take a moment to ponder the kinds of information that the data
plane needs to know beforehand so that it can work properly. For
instance, routers need IP routes in a routing table before the data plane
can forward packets. Layer 2 switches need entries in a MAC address
table before they can forward Ethernet frames out the one best port to
reach the destination. Switches must use Spanning Tree Protocol (STP) to
limit which interfaces can be used for forwarding so that the data plane
works well and does not loop frames forever.
From one perspective, the information supplied to the data plane controls
what the data plane does. For instance, a router needs a route that
3
matches a packet’s destination address for the router to know how to
route (forward) the packet. When a router’s data plane tries to match the
routing table and finds no matching route, the router discards the packet.
And what controls the contents of the routing table? Various control plane
processes.
The term control plane refers to any action that controls the data plane.
Most of these actions have to do with creating the tables used by the data
plane, tables like the IP routing table, an IP Address Resolution Protocol
(ARP) table, a switch MAC address table, and so on.
Traditional networks use both a distributed data plane and a distributed
control plane. In other words, each device has a data plane and a control
plane, and the network distributes those functions into each individual
device, as shown in the example in Figure 16-2.
In the figure, Open Shortest Path First (OSPF), the control plane protocol,
runs on each router (that is, it is distributed among all the routers). OSPF
on each router then adds to, removes from, and changes the IP routing
table on each router. Once populated with useful routes, the data plane’s
IP routing table on each router can forward incoming packets, as shown
from left to right across the bottom of the figure. The following list
includes many of the more common control plane protocols:
Routing protocols (OSPF, Enhanced Interior Gateway Routing
Protocol [EIGRP], Routing Information Protocol [RIP], Border
Gateway Protocol [BGP])
IPv4 ARP
IPv6 Neighbor Discovery Protocol (NDP)
Switch MAC learning
STP
Without the protocols and activities of the control plane, the data plane of
traditional networking devices would not function well. Routers would be
mostly useless without routes learned by a routing protocol. Without
4
learning MAC table entries, a switch could still forward unicasts by
flooding them, but doing that for all frames would create much more load
on the local-area network (LAN) compared to normal switch operations. So
the data plane must rely on the control plane to provide useful
information.