The official definition of computer virtualization is the pooling and abstraction of resources and services in a way that masks the physical nature and boundaries of those resources and services. A VLAN is a great example of this definition because it masks the physical nature of resources. The concept of virtualization dates back to the 1970s, with IBM mainframes. These mainframes were separated into virtual machines so that different tasks could run separately and to prevent a process failure that could affect the entire system.
One of the issues IT departments face today is called “server sprawl.” This concept implies that each application is installed on its own server, and every time another server is added, issues such as power, space, and cooling must be addressed. With server sprawl, the infrastructure is not efficiently utilized so the concept of virtualization can enhance the utilization rate. This approach is similar to the bandwidth oversubscription method used instead of applying QoS techniques and properly optimizing the network traffic. This is not very efficient because the purchased links are not being properly utilized and this leads to increased costs.
Another issue with the scenario in which a server hosts a single application is that high availability implies high costs because all of the servers must be purchased in a redundant configuration. In addition, provisioning new applications is difficult and security is usually accomplished through physical isolation. All of these issues are not very cost effective. However, these IT challenges can be mitigated with server virtualization that allows the partitioning of a physical server to work with multiple operating systems and application instances. The most important advantages are as follows:
- Improved failover capabilities
- Better utilization of resources
- Smaller footprint
Virtualization is a concept that applies to many areas in modern IT infrastructures, including:
- Servers
- Networks
- Storage (Virtual SANs, Unified I/O)
- Applications
- Desktop (Virtual Desktop Infrastructure)
Network virtualization refers to one physical network supporting a wide array of logical topologies. This allows actions such as outsourcing by the IT department, where a logical topology can be created that can be accessed by an external IT professional. Another example is creating a dedicated logical topology for quality assurance or various tests. In the network security world, virtualization is present in firewall devices, under the form of virtual contexts. Network virtualization with Cisco products is typically classified into four different areas:
- Control plane virtualization: Implies making sure processes like routing are separate and distinct so any routing process failure will not affect the entire device.
- Data plane virtualization: This is done every time different streams of data traffic are multiplexed (i.e., different forms of traffic are placed into the same medium). The simplest example of data plane virtualization is a trunk link between two devices. This allows multiplexing the traffic of different VLANs on a single data link.
- Management plane virtualization: This implies the ability to make a software upgrade on a device without rebooting the device and without losing its capabilities to communicate on the network.
- Pooling and clustering: This is used in the Cisco Catalyst 6500 Virtual Switching System (VSS) and it works by creating pools of devices that act a single device. Another technology example is the Nexus vPC (Virtual Port Channel), which allows EtherChannels to be created that span across multiple devices.
A great example of data and control plane virtualization is the concept of Virtual Routing and Forwarding (VRF) instances. VRF allows an interface to have multiple routing tables associated with it and this is very useful, for example, in ISP Multiprotocol Label Switching (MPLS) environments where they must serve and isolate multiple customers. Virtualization has become a critical component in most Enterprise networks because of the modern demands in IT, including increasing efficiency while reducing capital and operational costs. Virtualization is a critical component of the Cisco Network Architecture for the Enterprise.
Virtualization can represent a variety of technologies but the general idea is to abstract the logical components from hardware or networks and implement them into a virtual environment. Some of advantages of virtualization include the following:
- Flexibility in managing system resources
- Better use of computing resources
- Consolidating low-performance devices into high-performance devices
- Providing flexible security policies
Some of the drivers behind implementing a virtualized environment include the following:
- The need to reduce the number of physical devices that perform individual tasks
- The need to reduce operational costs
- The need to increase productivity
- The need for flexible connectivity
- The need to eliminate underutilized hardware
Virtualization can be implemented at both the network and the device level. Network virtualization implies the creation of network partitions that run on the physical infrastructure, with each logical partition acting as an independent network. Network virtualization can include VLANs, VSANs, VPNs, or VRF. On the other hand, device virtualization allows logical devices to run independently of each other on a single physical machine. Virtual hardware devices are created in software and have the same functionality as real hardware devices. The possibility of combining multiple physical devices into a single logical unit also exists.
The Cisco Network Architecture for the Enterprise contains multiple forms of network and device virtualization:
- Virtual machines
- Virtual switches
- Virtual Local Area Networks
- Virtual Private Networks
- Virtual Storage Area Networks
- Virtual switching systems
- Virtual Routing and Forwarding
- Virtual port channels
- Virtual device contexts
Device contexts allow partitioning a single partition into multiple virtual devices called contexts. A context acts as an independent device with its own set of policies. The majority of features implemented on the real device are also functional on the virtual context. Some of the devices in the Cisco portfolio that support virtual contexts include the following:
- Cisco Adaptive Security Appliance (ASA)
- Cisco Application Control Engine (ACE)
- Cisco Intrusion Prevention System (IPS)
- Cisco Nexus series
Server virtualization allows servers’ resources to be abstracted to offer flexibility and usage optimization on the infrastructure. The result is that data center applications are no longer tied to specific hardware resources, making the application unaware of the underlying hardware. Server virtualization solutions are produced by companies such as VMware (ESX), Microsoft (Hyper-V), and Citrix (XenServer).
The network virtualization design process must take into consideration the preservation of high-availability, scalability, and security in the data center submodule. Access control issues must be considered to ensure legitimate user access and protection from external threats. Proper path isolation ensures that users and devices are mapped to the correct secure set of resources and implies the creation of independent logical traffic paths over a shared physical infrastructure.