How To Segregate & Load Balance 10Gbps Traffic To 1Gbps... // White Paper

How To Segregate & Load Balance 10Gbps Traffic To 1Gbps Tools
// White Paper
The Smart Route To Visibility™
The latest Internet phenomenon, Web 2.0, is transforming the
World Wide Web from a collection of static portals to a dynamic
interactive medium ideally suited for commerce, advertising, grassroot content creation, and on-demand multimedia consumption.
Technical Challenges
A major issue faced when deploying 10GbE core networks is
to provide a cost-effective, comprehensive solution to monitor
mission-critical traffic at full line-rate. Ensuring network integrity
including performance, security and compliance is paramount.
Critical mass in broadband and wireless accessibility, an important
enabling factor for Web 2.0, has made high-speed networking
technology a commodity. In the year 2000, service providers struggled
Unfortunately, 10 Gigabit monitoring tools while available, are either
prohibitively expensive or simply incapable of handling full linerate except in short bursts.
with deploying expensive 100Mbps Fast Ethernet switching
Recently, a new class of Traffic Visibility Switch, designed specifically
technology, today they have almost completely transitioned to
for out-of-band network monitoring has been introduced and can
Gigabit Ethernet to stay competitive. As this trend continues, the
accommodate multiple bit-mask filtering rules at each ingress
second decade of the 21st century will emerge as the decade of
port (both 1GbE and 10GbE).
10 Gigabit expansion. Few customers are willing to be left behind
and most are already moving to transition their core network to 10
Gigabit in order to realize additional cost savings and substantial
Using these multi-rule sequential pre-filters, 10 Gigabit traffic
performance gains.
can be “mapped” to multiple load-sharing 1 Gigabit analyzers.
With each tool analyzing a specific VLAN range, port number
or IP subnet according to the specific filter rule, comprehensive
Port mirroring has its limitations and since managed switches are
monitoring at 10Gbps without oversubscribing any single Gigabit
an integral part of the infrastructure, it is important to be careful
tool is achieved. Since mapping filters are hardware based,
not to establish a point-of-failure. Understanding what can be
latency is negligible and full line-rate performance is guaranteed.
monitored is important for success. SPAN ports are often over
used leading to dropped frames. LAN switches are designed to
groom traffic (change timing or add delay), extract bad frames
and ignore all layer 1 & 2 information. Furthermore, typical
implementations of SPAN ports cannot handle FDX monitoring,
and analyzing VLANs is also problematic.
Copyright © 2012 Gigamon, LLC. All rights reserved. Gigamon, GigaVUE®, GigaSMART, G-TAP, Flow Mapping are registered trademarks of Gigamon, LLC and/or affiliates in the
United States and certain other countries. Visibility Fabric, Traffic Visibility Fabric (TVF), Citrus, and The Smart Route To Visibility are trademarks of Gigamon. All other trademarks
are the property of their respective owners.
Gigamon | 598 Gibraltar Drive Milpitas, CA 95035 | PH 408.263.2022 | www.gigamon.com
1
How To Segregate & Load Balance 10Gbps Traffic To 1Gbps Tools
// White Paper
The Smart Route To Visibility™
Computers/End
User Devices
Access
Switches
Storage
Distribution
Switches
Core
Switches
Servers
Gigamon
10GigaPORT-6X
1G/10G PORTS (SFP+)
SERIAL TIME CODE
SLOT 2
Alm
IntelligentDAN TM
PORTS
Rdy
GPS Lock
Pwr
GPS ANT (TNC-RG213)
GigaVUE-2404MB
G1
G2
G3
9
1G/10G PORTS (SFP+)
G4
G1 G2 G3 G4
1
2
1
16
RS232
10/100/1000 PORTS (SFP)
M/S
Rdy
3
4
2
3
5
4
6
5
7
6
SLOT 1
8
7
8
PORTS G1-G4
PORTS 1-8
Pwr
Mgmt
Console
10GigaPORT-8X
SLOT 3
1G/10G PORTS (SFP+)
PORTS
17
24
Pwr
VoIP Phones
UP WHEN
INSTALLED IN
REAR SLOT
VoIP
Security Protocol Forensic Application
Analyzers
IDS Analyzers Recorders Monitors
Network Monitoring with a Single Core Switch
Network Monitoring with Multiple Core Switches
10G Network Ports
1
10G Network Ports
1
Core
Switch
Filter Rule 1
1G Tool Ports
Post-Filter
Filter Rule 2
Filter Rule 3
Filter Rule 4
5
Core
Switch
Post-Filter
Post-Filter
5
Filter Rule 3
Post-Filter
6
Filter Rule 4
M onitor Tool 1
M onitor Tool 2
Post-Filter
7
Post Filter
8
Filter Rule 1
6
7
Monitor Tool 3
Post Filter
Post-Filter
Filter Rule 2
Monitor Tool 1
Monitor Tool 2
Legend
10G
1G
Filter Rule 1
1G Tool Ports
8
Monitor Tool 4
2
Core
Switch
Filter Rule 2
Filter Rule 3
M onitor Tool 3
Filter Rule 4
M onitor Tool 4
Legend
10G
1G
Whether it is Gigabit or 10 Gigabit, mission critical core networks
Shown here is a typical web-centric customer data center running
are almost always tiered, meshed and fully redundant. High
a 10Gbps core. In order to support the tremendous amount of
availability network architecture dictates that multiple 10Gbps
web traffic (on the order of tens of millions of page views per
links are deployed between parallel switches to improve reliability.
week), it is not uncommon to have up to ten 1Gbps links to the
Therefore, packets do not travel on a unique path and in order
Internet (to ISP’s and peering sites). Furthermore, it is estimated
to provide thorough monitoring, multiple 10Gbps traffic streams
that total traffic is also increasing at 30% per quarter. Therefore a
would have to be mapped simultaneously and aggregated so that
scalable monitoring solution is needed to match growth.
each tool gets a logical slice of the total traffic.
In the core of the network, servers are organized in clusters,
each serving specific business functions. These functions range
from online shopping, credit verification, merchandise delivery,
Copyright © 2012 Gigamon, LLC. All rights reserved. Gigamon, GigaVUE®, GigaSMART, G-TAP, Flow Mapping are registered trademarks of Gigamon, LLC and/or affiliates in the
United States and certain other countries. Visibility Fabric, Traffic Visibility Fabric (TVF), Citrus, and The Smart Route To Visibility are trademarks of Gigamon. All other trademarks
are the property of their respective owners.
Gigamon | 598 Gibraltar Drive Milpitas, CA 95035 | PH 408.263.2022 | www.gigamon.com
2
How To Segregate & Load Balance 10Gbps Traffic To 1Gbps Tools
// White Paper
The Smart Route To Visibility™
product support, uploading and downloading of music, pictures,
podcasts, video, and various online activities including search,
chat, email, blogging, etc. Each server switch is connected to
the core switches using two 10Gbps redundant links, which are
connected to the Internet through multiple 1Gbps redundant links.
A large number of best-of-breed monitoring tools from multiple
vendors are deployed including performance tools to track realtime user experience and to enable internal charge-back
About Gigamon
to various business functions, database security tools to prevent
Gigamon provides intelligent Traffic Visibility Networking solutions
leakage of confidential information and forensic data storage
for enterprises, data centers and service providers around the globe.
to proactively and retroactively examine attacks and abuses.
Our technology empowers infrastructure architects, managers and
All of these monitoring appliances compete for out-of-band
operators with unmatched visibility into the traffic traversing both
traffic access.
physical and virtual networks without affecting the performance or
stability of the production environment. Through patented technologies,
With the Traffic Visibility Switch, the 10Gbps traffic streams
the Gigamon GigaVUE portfolio of high availability and high density
mirrored from the core switches are captured and aggregated.
products intelligently delivers the appropriate network traffic to security,
Mapping filters based on IP address range corresponding
monitoring or management systems. With over seven years’ experience
to the server switches are used to segregate the total traffic
designing and building intelligent traffic visibility products in the US,
into different logical groupings such that each appliance is
Gigamon serves the vertical market leaders of the Fortune 1000
responsible for monitoring traffic belonging to one or several
and has an install base spanning 40 countries.
specific business functions.
For more information about our Gigamon products visit:
Using a Traffic Visibility Switch with multi-rule mapping features
www.gigamon.com
to share the load among multiple parallel processing Gigabit
tools is the most effective way to cost-effectively monitor
your 10Gbps network.
Moreover, the Traffic Visibility Switch acts as the virtualization
layer between the network and monitoring tools. It is the building
block for a flexible Traffic Visibility Network that enables IT
engineers to deploy monitoring tools at will. Adds, changes
and moves can be performed without requiring any physical
changes or exerting load to the production network. Speed
change (1Gbps to 10Gbps or 10Gbps to 1Gbps) and media
conversion (copper to optical, multimode to single mode)
can also be easily accommodated.
Copyright © 2012 Gigamon, LLC. All rights reserved. Gigamon, GigaVUE®, GigaSMART, G-TAP, Flow Mapping are registered trademarks of Gigamon, LLC and/or affiliates in the
United States and certain other countries. Visibility Fabric, Traffic Visibility Fabric (TVF), Citrus, and The Smart Route To Visibility are trademarks of Gigamon. All other trademarks
are the property of their respective owners.
Gigamon | 598 Gibraltar Drive Milpitas, CA 95035 | PH 408.263.2022 | www.gigamon.com
3