Since Cisco produces a lot of nifty new features, the title might suggest this is going to be a LONG blog. Far from it! As I write, it’s Summer, and I suspect most readers have better things to do than read long blogs. Brevity for the win!
My goal here is to briefly cover one nifty feature that most people I’ve talked to are not aware of, and another that I’d somehow missed hearing about. I’ll let you guess which one of the following is which.
ITD
Intelligent Traffic Director (ITD) provides multi-terabit L4 load balancing and traffic steering via Nexus switches. Clustering and symmetric flows are supported. VPC is also supported. ITD reportedly has much less TCAM use than WCCP.
ITD is not a L7 SLB with URL rewrite rules, cookie visibility, SSL offload, etc. However, I’ve seen most sites using their NetScaler, F5, or A10 SLB in only basic VIP ways, so that may fit your needs, or not. In addition, if you need terabit SLB behavior, streamlining how your webpages are accessed to leverage existing Nexus switches might be extremely attractive compared to a pile of top end F5’s or other SLB’s. Not taking a position here, just trying to explain how and where ITD might or might not be useful.
ITD is supported on the Nexus 5000, 6000, 7000 series, and 9000 (broadly speaking), with the right code and license level (see the At A Glance link below for details and double-check pre-requisites and device support for the specific Nexus model you have in mind).
Apparently ITD auto-configures PBR to enforce symmetry of flows (where relevant), presumably with failure triggering re-allocation (hopefully just failed flows, but I’m not seeing that detail in the documentation).
Summary of Modes of Use:
- Direct Server Return (DSR) mode: the SLB (ITD) forwards to server (usually at L2 by MAC, ITD is configured with IP of interface), VIP is configured on loopback on servers in pool
- Flow Symmetry preserving One-Arm mode
- Flow Symmetry preserving Nexus / ITD “sandwich” mode
References:
- ITD At A Glance
- Configuring ITD (N9K)
- Deployment Guide for Direct Server Return (DSR)
- Deployment Guide for ASA (dated, there’s also one for FirePower)
Dynamic FCoE
J. Metz explained this capability quite well back in 2014 (love the diagrams!), so I’ll refer you to his blog for details and the diagrams.
The basic idea is automatic FCoE over a FabricPath fabric, unifying the LAN and SAN infrastructures. No extra licensing costs.
The cool part is that the automation kicks in when FCoE is configured on the leaf switch. The word “dynamic” refers to:
- NX-OS automatically creates a full mesh of virtual links between leaf switches
- NX-OS automatically creates the virtual Fibre Channel (vFC) ports
- NX-OS automatically creates the VE_Port type and the ISL
I should probably note, this is “new” technology (as of 3-4 years ago) and might really disturb your SAN group if you propose using it. In that case, be prepared for words like “unproven”, “risky”, etc. Don’t most SAN people generally think Networking people are wild and crazy risk takers?
My only question: When can we have this for VXLAN? Yeah, ok, the Nexus 9K’s need full FCF functionality too, and that probably comes first.
References:
Comments
I haven’t used ITD in the field yet, nor Dynamic FCoE, so if you have, and have something you’d care to pass along (good, bad, ugly), please do so via a Comment!
Comments are welcome, both in agreement or constructive disagreement about the above. I enjoy hearing from readers and carrying on deeper discussion via comments. Thanks in advance!
—————-
Hashtags: #CiscoChampion #CiscoNexus
Twitter: @pjwelcher
NetCraftsmen Services
Did you know that NetCraftsmen does network /datacenter / security / collaboration design / design review? Or that we have deep UC&C experts on staff, including @ucguerilla? For more information, contact us at info@ncm2020.ainsleystaging.com.