Subject: re: Active-active DC exits in the DCI solution

From: Xuxiaohu <[email-masked]>
Date: Fri, 26 Aug 2011 01:09:50 +0000

Hi all,

The attached is a concrete example explaining the following process.

Best regards,
Xiaohu

发件人: Xuxiaohu
发送时间: 2011年8月24日 10:59
收件人: 'Phil Bedard'; [email-masked]
主题: re: Active-active DC exits in the DCI solution

Hi Phil,

If I understand it correctly, the following approaches you mentioned are almost proprietary approaches which require DC exit routers in geographically dispersed locations are provided by a single vendor.

I found there was a very simple STANDARD approach to the same goal when host route based IP-only L2VPN service (e.g., Virtual Subnet http://tools.ietf.org/html/draft-xu-virtual-subnet-05) is used for DCI. For example, when incoming traffic from the Internet enters a DC, source IP addresses of the traffic will be NATed on the DC gateway. Notes that here DC exit gateways of geographically dispersed DCs are configured with different IP address pools without any overlapping. In addition, the corresponding routes for the above address pools are advertised by the DC gateways to their connected PE routers of the IP-only L2VPN respectively. Thus, when the outgoing traffic destined to the Internet arrives at its local PE router of the IP-only L2VPN, that PE router could forward the traffic according to the matching routes for the above address pools. In this way, active-active DC exits can be achieved easily in the case where path symmetry is required.

The attached is a concrete example explaining the above process.

Best regards,
Xiaohu

发件人: Phil Bedard [mailto:[email-masked]]
发送时间: 2011年8月23日 20:37
收件人: Xuxiaohu; [email-masked]
主题: Re: Active-active DC exits in the DCI solution

Most of the newer security devices including FW, IDS, IPS have the ability to deal with asymmetric traffic flows when deployed in pairs, either through clustering where traffic is shunted across a dedicated inter-chassis link or state table syncrhonization.    Active/Active gateways are being achieved these days through either virtual chassis or multi-chassis link aggregation.   Some vendors take one approach or the other while others support both approaches.    We have deployed equipment in a mutual (back to back) MC-LAG configuration which balances traffic in both directions.

The old way of active/active balancing at L3 would be use multiple VRRP groups with some hosts using one gateway and other hosts using the other gateway, but doesn't guarantee symmetry.  If you have multilayer devices supporting virtual L3 interfaces within a L2 domain MAC learning can take care of the asymmetry by sending traffic across a trunk between the two devices.  GLBP from Cisco is an enhanced version of VRRP/HSRP which hands out multiple virtual MAC addresses which allows outbound L3 load balancing, I can't remember it being written into an information RFC or a version of VRRP being proposed which does the same.

Phil
From: Xuxiaohu <[email-masked]<mailto:[email-masked]>>
Date: Tue, 23 Aug 2011 03:10:16 +0000
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Active-active DC exits in the DCI solution

Hi all,

There had been a lot of discussion about active-active multi-homing for a data center (DC) site in the layer2 DCI solution before. Now I’m considering whether we could further achieve active-active DC exits when considering route optimization for traffic routing to/from the outside of DCs (e.g., the Internet). In a normal case, each DC site will be connected to a default gateway (i.e., DC exit router) which is responsible for forwarding traffic routing to/from the outside. However, since these default gateways are within a single subnet due to the layer2 DCI usage, normally there is only one default gateway router (acting as VRRP master) is allowed to forward traffic routing to/from the outside. This is obviously not optimal from the perspective of WAN bandwidth utilization.

Active-active VRRP has been proposed in the above case so that the traffic destined for the outside could be forwarded by the local DC exit router. This is workable when path symmetry is not required. However, in most cases, firewall or NAT devices are deployed at the DC exits for the traffic to/from the outside. In such cases, path symmetry is a must, as a result, active-active VRRP is not available anymore.

Is there any better idea to achieve active-active DC exits while path symmetry is guaranteed?

Best regards,
Xiaohu