Tech Bytes

On today’s Tech Bytes, sponsored by HPE and Intel, we talk with Garth Reid about HPE’s Composable Fabric.

Composable Fabric, which came from HPE’s Plexxi acquisition, combines top-of-rack switches and automation software to pool networking resources and help your data center scale.

We also talk about how Composable Fabric integrates with HPE’s Simplivity hyperconverged infrastructure portfolio, and how it can complement other network overlays.

Garth Reid is Senior Strategist – Enterprise Portfolio at HPE.

Show Links:

Composable Fabric

Simplivity

HPE Discover

The following is a transcript of the audio report you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary. I’m Ethan Banks, it’s December 7, 2018. Automation and sources of truth are on my mind.

Sources Of Truth

In Weekly Show 402, Ken Celenza from NetworkToCode came on to discuss network automation frameworks. In that conversation, he shared the idea of sources of truth, where automation tools need to go to a single source of truth for any aspect of the infrastructure we needed to know about. You might have several truth sources, one for each kind of information, but for a given kind of information, there’s only going to be one truth source.

BlueCat Networks, DDI, And Automation

In the last month, I’ve chatted with BlueCat Networks a couple of times. You can see some of those sessions by searching for BlueCat and Tech Field Day on YouTube. They are a DDI company. That is, DNS, DHCP, and IPAM services combined into a unified platform. DDI by itself isn’t exciting, but BlueCat grabbed my interest because of the capabilities they wrap around their DDI information. The platform is automation-friendly, making BlueCat a great candidate to be one of the sources of truth that automation tooling needs.

BlueCat is an API-capable product. That is, there’s a full API that developers can leverage to get information in and out of BlueCat. That’s good and even necessary for a modern IT shop, but BlueCat has gone ever further.

BlueCat Gateway For Customized Business APIs

BlueCat offers a free add-on product to their DDI platform called Gateway. Gateway is a platform customers can use to create their own custom APIs that make sense for their business. Put another way, Gateway provides a REST API endpoint for other applications within the business to talk to.

The full BlueCat API is heavy and capable–lots of features and parameters, requiring a decent understanding of how DNS, DHCP, and so on actually work. Gateway enables a business-centric interaction with BlueCat DDI data, streamlining the process.

Figure out how your company executes a process, and use Gateway to build an API that exposes just the parameters required to get the BlueCat-related part of that process done. For example, you might create an API called “MoveServer” that might do a bunch of different things within BlueCat like free up the old IP, assign a new IP, and update the DNS hostname. The custom Gateway API shares just the minimum number of parameters required to kick off a process that will get those steps done.

You might think of Gateway as an abstraction between business intent and specific execution. I wouldn’t call it intent based networking, but there are comparisons we could make.

Building Business Workflows

Upon the foundation of customized, business logic driven APIs, Gateway builds workflows. That is, as information flows into and out of BlueCat via the Gateway APIs, Gateway can also populate other systems. For instance, it’s possible to integrate with ServiceNow so that steps of the process can be reviewed and approved if needed.

That workflow can also include validation–querying the infrastructure to be certain that the request was fulfilled as intended. BlueCat mentioned that auditing is a use case frequently cited by customer–sanity checking that deployments are compliant to a set of business rules.

Enabling Automation Adoption

For many engineers, APIs & business logic sounds intimidating. BlueCat recognizes this and offers several resources to help folks get started with Gateway.

The following is a transcript of the audio recording you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary. I’m Ethan Banks, it’s December 6, 2018, and cloud visibility is on my mind.

Application Architecture Complexity

Imagine a complex application. There are multiple parts to it. A web farm behind a load balancer on the front end. A firewall or two. Probably some database calls. And then the stuff we tend to forget about like authentication and domain name services. Okay, you’re with me so far.

Now let’s make this more complex by splitting the web app into elastic microservices living in the public cloud. At least, part of the app lives in the public cloud, because an AWS bill shows up every month. Part of the app also lives on-premises. You think. Which is the problem. It’s actually getting hard to tell what is going on with this app, as the developers aren’t always in lock step with the operations team about what they’ve deployed where, and the architecture team just points you to a reference document…that is full of lies.

You shake your head that no one seems to know what’s going on. Business as usual. And then on a fateful day, the help desk tickets start piling up. The app performance has gone down the toilet, much like your hopes for a lunch outside the office, and no one seems to know why. Must be the network. Or the cloud. Or that Kubernetes thing. Or something.

Data Visualization With Kentik

What’s an infrastructure engineer to do? You need visibility. A few weeks ago, I had a briefing with Kentik. Their mission in life is to collect infrastructure data and help you gain meaningful insights from it. I’m not talking about stacks of RRD graphs that look cool while communicating almost nothing. Rather, Kentik shows how data relates to other data in an intuitive way that helps you make decisions or solve problems.

Let me give you an example. One of their core use cases has been helping service providers and Internet exchange points understand how data is flowing through their network. Who sent them this data? Where is this data going next? Oh, AS 12345 is sending us data for AS 54321, but it’s costing us a ton of money because it’s traversing our link to AS 31416. Maybe we should create a peering relationship with AS 54321 directly and stop running up our bill to AS 31416.

That’s just one example. In the latest demo I’ve seen, Kentik has applied their visualization and analysis to cloud traffic, helping IT teams understand the flows that are happening between services that make up an application.

Kentik Cloud Visibility

Kentik works by ingesting data. Massive amounts of netflow and other sorts of records from your network and endpoints. For cloud visibility use cases, Kentik is able to absorb AWS & GCP flow logs, with Azure support coming soon. Kubernetes for container orchestration and Istio for service mesh control are also data providers to Kentik, among many other data providers. These are added to the host level instrumentation and network device data Kentik has been able to gather since it came on the scene a few years back.

In the briefing I attended, Crystal Li, Senior Product Marketing Manager with Kentik pointed out, “We consume the tag and label information which contains the information about your infrastructure, your service mapping, and your user information.”

Which is quite granular indeed. When Kentik has ingested & analyzed the information, results, alarms and actions can be handed off to third party providers as complex as ServiceNow or PagerDuty, and as simple as JSON you bring into a tool of your choosing.

Let’s bring this back to our opening hypothetical situ…

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary.

Ethan Banks and Drew Conry-Murray discuss the new Tofino 2 ASIC from Barefoot Networks. This ASIC boasts 12.8Tbps total throughput, which puts it on par with silicon from providers such as Broadcom and Innovium.

Barefoot’s compelling differentiator is that Tofino offers a fully programmable packet-processing pipeline. Using the open-source P4 language, Tofino customers can customize how the ASIC processes packets, add or remove features, and create their own programs to run on the switch.

Small Is Beautiful

The Tofino 2 is made with the 7nm process, giving it more transistors in the same die area and greater power efficiency compared to Tofino 1, which uses the 16nm process. Barefoot says the new chip offers a 50% improvement in packets per second per watt.

Port options include 32X400GbE, 128x100GE, or 256×10/25/50GE on a single chip.

Barefoot Tofino is available through ODMs. Version 1 of the ASIC is also available from Cisco (the Nexus 34180YC) and Arista (the 7170).

Barefoot says the Tofino 2 will sample to customers in the first half of 2019.

Learn More

Tofino 2 – Barefoot Networks

BiB 017: Barefoot Networks Introduces Deep Insight – Packet Pushers

Barefoot Releases P4 Studio To Streamline Tofino ASIC Programming – Packet Pushers

Barefoot Networks At Network Field Day (videos and blogs) – Tech Field Day

Increase Flexibility with Cisco’s Programmable Cloud Infrastructure – Cisco

Tech Bytes are short, sponsored conversations on the latest technologies and products. Today’s episode is sponsored by VIAVI.

Our guest is Charles Thompson, Sr. Director of Product Line Management at VIAVI. We talk about performance management and the essential role that end user experience metrics play in turning piles of data into actionable insights.

We also discuss how VIAVI gathers end user performance metrics through synthetic transactions, and how it ties those metrics into problem isolation to help troubleshoot and resolve problems faster.

To learn more about VIVAI, check out viavisolutions.com/packetpushers to access a 14 day free trial of its ObserverLIVE platform, and receive a complementary copy of VIAVI’s enterprise protocol poster based on the OSI model.

Show Links:

The Users’ Experience is Always Right – VIAVI

IT teams are drowning in data – throw them a lifetime – Network World

Big Data Vs. Big Insight – Packet Pushers Human Infrastructure

VIAVI on Twitter

The following is a transcript of the audio you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary.

I’m Ethan Banks, it’s December 1, 2018, and here’s what’s on my mind.

I’ve had a few briefings with Riverbed in the last month or two. You can watch some of those on YouTube by searching for Riverbed SD-WAN and Tech Field Day. You probably know Riverbed as that WAN optimization company that bought CACE Technologies a few years back bringing WireShark under Riverbed’s care.

SD-WAN Is Crucial To Riverbed

The most critical thing happening at Riverbed these days is SD-WAN. Here’s why. The SD-WAN market is exploding with products. Consolidation is beginning to happen as major players Cisco and VMware have made SD-WAN acquisitions and begun preaching about the glory of SD-WAN to their customers…and that’s a lot of customers.

Many of those WAN customers might well be Riverbed customers, too–Riverbed’s install base of WAN optimization appliances is huge. But the need for WAN optimization, by itself, isn’t a strong enough play anymore. People might or might not need WAN op, but as applications increasingly transition to encrypted HTTP, WAN op isn’t providing the gain it once did. That’s not to say it doesn’t matter, but organizations have to evaluate WAN optimization’s usefulness to them based on their individual application mix.

So when Cisco comes knocking on my door telling me I can install IOSXE-SDWAN on my ISR routers and get the Viptela product, that’s pretty interesting. Sure, there’s no WAN optimization there, but maybe I make the switch and have one less supplier to deal with. Why keep Riverbed around?

Then again, maybe I don’t make the switch. Riverbed has been a little slow with their SD-WAN strategy, but it’s far from too late. SD-WAN adoption in the enterprises where Riverbed has been making their money for so many years has been slow, too. And I think that’s going to work out well for Riverbed. Because now, I think their SD-WAN story has shaped up reasonably. This could keep Riverbed customers in the fold.

Two New Riverbed SD-WAN Products

If I’m interested in SD-WAN and I am running Riverbed SteelHeads, I now have an in-place upgrade option, plus some lower cost device options for sites where maybe I hadn’t deployed SteelHeads before. There are 2 appliances Riverbed has announced, adding to the SteelConnect products they launched a couple of years ago.

SteelHead SD

The first new appliance is the SteelHead SD. Riverbed bills SteelHead SD as a full-featured SD-WAN product, with VPN, cloud connectivity, OSPF and BGP routing, active/active high availability pairs managed as a single unit, path steering, and a business intent driven policy engine, as well as retaining the WAN optimization capabilities that Riverbed customers are likely familiar with.

Again, just because WAN optimization isn’t as important as it once was doesn’t mean it’s no longer important at all. For example, Silver Peak claims that a pretty large percentage of their SD-WAN customers will license Boost, their WAN optimization module, for some or all of their SD-WAN fabrics. I’m sure that will be true with Riverbed SD-WAN customers as well.

SteelHead SD is available as a software upgrade for many existing Riverbed appliances, so a lot of folks can get these features with a minimum of operational disturbance. And in fact, Riverbed has that exact scenario in mind with SteelHead SD. They are aiming this product at brownfield deployments where the routing requirements might be complex and the WAN circuits might be a hybrid of private MPLS and public Internet. Riverbed knows from their work with customers that bolting SD-WAN on…

The following is a transcript of the audio you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary.

I’m Ethan Banks, it’s December 1, 2018, and here’s what’s on my mind.

I’ve had a few briefings with Riverbed in the last month or two. You can watch some of those on YouTube by searching for Riverbed SD-WAN and Tech Field Day. You probably know Riverbed as that WAN optimization company that bought CACE Technologies a few years back bringing WireShark under Riverbed’s care.

SD-WAN Is Crucial To Riverbed

The most critical thing happening at Riverbed these days is SD-WAN. Here’s why. The SD-WAN market is exploding with products. Consolidation is beginning to happen as major players Cisco and VMware have made SD-WAN acquisitions and begun preaching about the glory of SD-WAN to their customers…and that’s a lot of customers.

Many of those WAN customers might well be Riverbed customers, too–Riverbed’s install base of WAN optimization appliances is huge. But the need for WAN optimization, by itself, isn’t a strong enough play anymore. People might or might not need WAN op, but as applications increasingly transition to encrypted HTTP, WAN op isn’t providing the gain it once did. That’s not to say it doesn’t matter, but organizations have to evaluate WAN optimization’s usefulness to them based on their individual application mix.

So when Cisco comes knocking on my door telling me I can install IOSXE-SDWAN on my ISR routers and get the Viptela product, that’s pretty interesting. Sure, there’s no WAN optimization there, but maybe I make the switch and have one less supplier to deal with. Why keep Riverbed around?

Then again, maybe I don’t make the switch. Riverbed has been a little slow with their SD-WAN strategy, but it’s far from too late. SD-WAN adoption in the enterprises where Riverbed has been making their money for so many years has been slow, too. And I think that’s going to work out well for Riverbed. Because now, I think their SD-WAN story has shaped up reasonably. This could keep Riverbed customers in the fold.

Two New Riverbed SD-WAN Products

If I’m interested in SD-WAN and I am running Riverbed SteelHeads, I now have an in-place upgrade option, plus some lower cost device options for sites where maybe I hadn’t deployed SteelHeads before. There are 2 appliances Riverbed has announced, adding to the SteelConnect products they launched a couple of years ago.

SteelHead SD

The first new appliance is the SteelHead SD. Riverbed bills SteelHead SD as a full-featured SD-WAN product, with VPN, cloud connectivity, OSPF and BGP routing, active/active high availability pairs managed as a single unit, path steering, and a business intent driven policy engine, as well as retaining the WAN optimization capabilities that Riverbed customers are likely familiar with.

Again, just because WAN optimization isn’t as important as it once was doesn’t mean it’s no longer important at all. For example, Silver Peak claims that a pretty large percentage of their SD-WAN customers will license Boost, their WAN optimization module, for some or all of their SD-WAN fabrics. I’m sure that will be true with Riverbed SD-WAN customers as well.

SteelHead SD is available as a software upgrade for many existing Riverbed appliances, so a lot of folks can get these features with a minimum of operational disturbance. And in fact, Riverbed has that exact scenario in mind with SteelHead SD. They are aiming this product at brownfield deployments where the routing requirements might be complex and the WAN circuits might be a hybrid of private MPLS and public Internet. Riverbed knows from their work with customers that bolting SD-WAN on…

The following is a transcript of the audio you can hear in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary. (And today we’re going to do a lot of commentary.)

I’m Ethan Banks, it’s November 30, 2018 and here’s what’s going on. I had a briefing with Silver Peak earlier this month. Silver Peak is a software defined WAN company. They make devices and controllers that allow you to manage your wide area network fabric centrally, leveraging a mix of different circuit types, as they take care of security and traffic optimization for you.

In this briefing, Silver Peak offered a current status of their company and a series of deeply technical demos which you can find on YouTube by searching for Silver Peak and Tech Field Day. All of this was in the context of using Silver Peak devices as WAN router replacements. Silver Peak is invested in a marketing campaign to displace Cisco WAN routers. Yep, they called Cisco out specifically.

The campaign is a series of tongue-in-cheek videos built around the character Wayne McFarkus. Wayne is a mullet-wearing 80’s stereotype bearing the not-so-subtle message that routers are old and outdated. Modern networks wouldn’t use something so antiquated as a router. Instead, they’d use a modern solution from, oh I don’t know, Silver Peak.

Replace A WAN Router With An SD-WAN Device?

Let’s examine this assertion from Silver Peak. Is an SD-WAN device able to be a drop-in replacement for a WAN router from Cisco or whomever?

First, we have to back away from the FUD claiming that routers are ancient technology that should be banished along with parachute pants and the mullet. WAN routers are, of course, an integral part of most networks of any size. They tend to have complex configurations for several reasons.

* They connect TDM circuits, such as T1s or T3s. These circuit types are still present in many markets particularly in the US, and it takes special cards to support them.

* They often sit at the edge of a routing domain, so they might have complicated routing policies.

* They tend to represent a chokepoint between high-bandwidth LANs and low-bandwidth WANs, so there’s usually a QoS policy for traffic prioritization and congestion management.

* If they are sitting at the Internet edge they might be handling public Internet routing tables and/or announcing routes themselves via BGP.

* They are often candidates to be endpoints for tunnels like GRE or IPSEC.

* They are frequently used as stateful firewalls, or at least for traffic filtering with access-lists, as they might be governing traffic flows between two or more different organizations.

* For organizations requiring multicast, the WAN router needs to be a proper multicast router to avoid dropped traffic or traffic being flooded across WAN links where bandwidth is precious.

* For those companies that are rolling out IPv6, the WAN router needs to support data-plane and ideally control-plane v6 functionality. V6 is 20 years old, so you wouldn’t think this is an issue. It’s a huge issue, especially as more organizations are getting serious about bringing the v6 running around their network already under control.

* And finally, WAN routers are often asked to participate in network segmentation, using schemes such as VRFs, or in larger organizations, L3VPN over MPLS.

I say all that to raise the point that routers are, for the most part, anything but mullet-wearing 80’s throwbacks. Assuming the appropriate network operating system and licensing, plenty of modern WAN routers can do all of these things. Often,

The following is a transcript of the audio you can hear in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary. (And today we’re going to do a lot of commentary.)

I’m Ethan Banks, it’s November 30, 2018 and here’s what’s going on. I had a briefing with Silver Peak earlier this month. Silver Peak is a software defined WAN company. They make devices and controllers that allow you to manage your wide area network fabric centrally, leveraging a mix of different circuit types, as they take care of security and traffic optimization for you.

In this briefing, Silver Peak offered a current status of their company and a series of deeply technical demos which you can find on YouTube by searching for Silver Peak and Tech Field Day. All of this was in the context of using Silver Peak devices as WAN router replacements. Silver Peak is invested in a marketing campaign to displace Cisco WAN routers. Yep, they called Cisco out specifically.

The campaign is a series of tongue-in-cheek videos built around the character Wayne McFarkus. Wayne is a mullet-wearing 80’s stereotype bearing the not-so-subtle message that routers are old and outdated. Modern networks wouldn’t use something so antiquated as a router. Instead, they’d use a modern solution from, oh I don’t know, Silver Peak.

Replace A WAN Router With An SD-WAN Device?

Let’s examine this assertion from Silver Peak. Is an SD-WAN device able to be a drop-in replacement for a WAN router from Cisco or whomever?

First, we have to back away from the FUD claiming that routers are ancient technology that should be banished along with parachute pants and the mullet. WAN routers are, of course, an integral part of most networks of any size. They tend to have complex configurations for several reasons.

* They connect TDM circuits, such as T1s or T3s. These circuit types are still present in many markets particularly in the US, and it takes special cards to support them.

* They often sit at the edge of a routing domain, so they might have complicated routing policies.

* They tend to represent a chokepoint between high-bandwidth LANs and low-bandwidth WANs, so there’s usually a QoS policy for traffic prioritization and congestion management.

* If they are sitting at the Internet edge they might be handling public Internet routing tables and/or announcing routes themselves via BGP.

* They are often candidates to be endpoints for tunnels like GRE or IPSEC.

* They are frequently used as stateful firewalls, or at least for traffic filtering with access-lists, as they might be governing traffic flows between two or more different organizations.

* For organizations requiring multicast, the WAN router needs to be a proper multicast router to avoid dropped traffic or traffic being flooded across WAN links where bandwidth is precious.

* For those companies that are rolling out IPv6, the WAN router needs to support data-plane and ideally control-plane v6 functionality. V6 is 20 years old, so you wouldn’t think this is an issue. It’s a huge issue, especially as more organizations are getting serious about bringing the v6 running around their network already under control.

* And finally, WAN routers are often asked to participate in network segmentation, using schemes such as VRFs, or in larger organizations, L3VPN over MPLS.

I say all that to raise the point that routers are, for the most part, anything but mullet-wearing 80’s throwbacks. Assuming the appropriate network operating system and licensing, plenty of modern WAN routers can do all of these things. Often,

The following is a transcript of the audio you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary. I’m Ethan Banks, it’s November 29, 2018, and here’s what’s happening. I had a briefing with Illumio earlier this month.

Who Is Illumio?

Illumio is a security company focused on preventing breaches from spreading through an organization using microsegmentation. The system works with a combination of agents and a central controller they call the Policy Compute Engine. The PCE determines, based on policy, what each endpoint in the network should be allowed to communicate with and tells the installed agents. Each agent programs the local operating system firewall service such as iptables or Windows Firewall.

And in that way, you’ve got a centrally managed security policy with granular controls you can keep up with. The Policy Compute Engine is doing the heavy lifting of figuring out exactly what rules are needed in each endpoint’s firewall. There’s more to the Illumio story, but that sets the background for the announcement I’m bringing to your attention today.

Illumio’s PCE Supercluster & Use Cases

In this briefing, Illumio discussed their Policy Compute Engine Supercluster. The PCE Supercluster is, as the name implies, a cluster of Policy Compute Engines that spans regions or even the globe. Illumio cited several scenarios driving this available architecture of their central controller.

Massive scale was one of those, and Illumio didn’t just throw a number up on the wall and expect people to believe it. In a live demo with a total of around 225K actual workloads spun up in three AWS regions around the world, they showed the Supercluster in action.

The point? Supercluster distributed controller architecture works when a single, centralized controller is likely to hit scaling limits. You can grow your microsegmentation domain as big as it needs to with this product.

A second scenario Illumio matched up with the PCE Supercluster architecture was that of large, globally distributed organizations. Why does this scenario matter to Illumio? Global companies like this often have complex applications that are communicating across the globe. For instance, a workload in one region might need to hit an authentication server in another, or perform a replication task. You get the idea.

To manage these communications well, you need a way to coordinate policy for flow between regions, and the Supercluster offers this. The alternative is manual firewall coordination at region edges, and that’s not terribly practical in an automated world. Controller federation really matters in some organizations.

Federation has a parallel benefit of offering consistent policy everywhere that an app is deployed, for example in multiple regions. Why reinvent the policy for each region? Create the policy once, then leverage that same policy in any region the PCE Supercluster lives and the app has been deployed.

For More Information

Illumio went into a lot more detail with some of the best live demos I’ve ever seen covering how the Policy Compute Engine Supercluster functions, recovers from failure scenarios, and so on.

If you’re one of those companies with tens or even hundreds of thousands of workloads distributed globally either on-premises, in the public cloud, or both, Illumio is bringing you maximally scalable microsegmentation.

For more information, see the recordings of the live demos I mentioned earlier by searching YouTube for Tech Field Day and Supercluster, visit illumio.com, or stay tuned into the Packet Pushers, as we’re going to publish an episode with Illumio in the coming weeks.