Ch 27: Virtualization Flashcards

Question

What is a VNF?

Answer 1

**A virtual network function (VNF)**, as its name implies, is the virtual or software version of an NF, and it typically runs on a hypervisor as a VM. VNFs are commonly used for Layer 4 through Layer 7 functions, such as those provided by **load balancers (LBs)** and **application delivery controllers (ADCs)**, firewalls, intrusion detection systems (IDSs), and WAN optimization appliances. However, they are not limited to Layer 4 through Layer 7 functions; they can also perform lower-level Layer 2 and Layer 3 functions, such as those provided by routers and switches. Some examples of Cisco VNFs include the following: * Cisco Cloud Services Router 1000V (CSR 1000V) * Cisco Cloud Services Platform 2100 (CSP 2100) * Cisco Integrated Services Virtual Router (ISRv) * Cisco NextGen Firewall Virtual Appliance (NGFWv) * Cisco Adaptive Security Virtual Appliance (ASAv)

Answer 2

Service chaining refers to chaining VNFs together to provide an NFV service or solution, as illustrated in Figure 27-8.

Answer 3

**Element managers (EMs)**, also known as element management systems (EMSs), are responsible for the functional management of VNFs; in other words, they perform fault, configuration, accounting, performance, and security (FCAPS) functions for VNFs. A single EM can manage one or multiple VNFs, and an EM can also be a VNF.

Answer 4

In NFV solutions, the data traffic has two different patterns: north–south and east–west. **North–south** traffic comes into the hosting server through a physical NIC (pNIC) and is sent to a VNF; then it is sent from the VNF back out to the physical wire through the pNIC. **East–west** traffic comes into the hosting server through a pNIC and is sent to a VNF. From there, it could be sent to another VNF (service chained) and possibly service chained to more VNFs and then sent back out to the physical wire through a pNIC. There can also be combinations of the two, where a VNF uses a north–south traffic pattern for user data and an east–west traffic pattern to send traffic to a VNF that is just collecting statistics or that is just being used for logs or storage. These patterns and the purpose of the VNFs are important to understand when deciding which technology to use to switch traffic between VNFs as well as to the outside world. Picking the right technologies will ensure that the VNFs achieve optimal throughput and performance.

Answer 5

**They all address how to avoid continual interruptions of the CPU which is very inefficient and leads to degredation in perfomance.** Every packet received needs to go through the same process, which requires the CPU to be continuously interrupted. The number of interrupts increases when using high-speed NICs (for example, 40 Gbps) and the packet size is small because more packets need to be processed per second. Interrupts add a lot of overhead because any activity the CPU is doing must be stopped, the state must be saved, the interrupt must be processed, and the original process must be restored so that it can resume what it was doing before the interrupt. **To avoid all the overhead and increase packet throughput,** multiple I/O technologies have been developed. The most prevalent of these technologies are the following: OVS Data Plane Development Kit (OVS-DPDK) PCI passthrough Single-root I/O virtualization (SR-IOV)

Answer 6

**OVS Data Plane Development Kit (OVS-DPDK):** To overcome the performance impact on throughput due to interrupts, OVS was enhanced with the Data Plane Development Kit (DPDK) libraries. OVS with DPDK operates entirely in user space. The DPDK Poll Mode Driver (PMD) in OVS polls for data that comes into the pNIC and processes it, bypassing the network stack and the need to send an interrupt to the CPU when a packet is received—in other words, bypassing the kernel entirely. To be able to do this, DPDK PMD requires one or more CPU cores dedicated to polling and handling the incoming data. Once the packet is in OVS, it’s already in user space, and it can then be switched directly to the appropriate VNF, resulting in huge performance benefits. Figure 27-11 illustrates an x86 host with a standard OVS compared to an x86 host with an OVS with DPDK.

Answer 7

PCI passthrough allows VNFs to have direct access to physical PCI devices, which appear and behave as if they were physically attached to the VNF. This technology can be used to map a pNIC to a single VNF, and from the VNF’s perspective, it appears as if it is directly connected to the pNIC. PCI passthrough offers many performance advantages: * Exclusive one-to-one mapping * Bypassed hypervisor * Direct access to I/O resources * Reduced CPU utilization * Reduced system latency * Increased I/O throughput

Answer 8

The downside to PCI passthrough is that **the entire pNIC is dedicated to a single VNF and cannot be used by other VNFs.** Therefore, the number of VNFs that can use this technology is limited by the number of pNICs available in the system. Figure 27-12 illustrates an x86 host with a standard OVS and an x86 host with PCI passthrough.

Answer 9

**SR-IOV, Single-Root I/O Virtualization**, **is an enhancement to PCI passthrough** **that allows multiple VNFs to share the same pNIC.** SR-IOV emulates multiple PCIe devices on a single PCIe device (such as a pNIC). In SR-IOV, the emulated PCIe devices are called virtual functions (VFs), and the physical PCIe devices are called physical functions (PFs). The VNFs have direct access to the VFs, using PCI passthrough technology. An SR-IOV-enabled pNIC supports two different modes for switching traffic between VNFs: 1. Virtual Ethernet Bridge (VEB): Traffic between VNFs attached to the same pNIC is hardware switched directly by the pNIC. 2. Virtual Ethernet Port Aggregator (VEPA): Traffic between VNFs attached to the same pNIC is switched by an external switch. Figure 27-13 illustrates an x86 host with a standard OVS compared to an x86 host with SR-IOV.

Answer 10

**The Cisco ENFV solution,** Cisco Enterprise Network Functions Virtualization, is a Cisco solution based on the ETSI NFV architectural framework. It reduces the operational complexity of enterprise branch environments by running the required networking functions as virtual networking functions (VNFs) on standard x86-based hosts. In other words, it replaces physical firewalls, routers, WLC, load balancers, and so on with virtual devices running in a single x86 platform. The Cisco ENFV solution provides the following benefits: * Reduces the number of physical devices to be managed at the branch, resulting in efficiencies in space, power, maintenance, and cooling * Reduces the need for truck rolls and technician site visits to perform hardware installations or upgrades * Offers operational simplicity that allows it to roll out new services, critical updates, VNFs, and branch locations in minutes * Centralizes management through Cisco DNA Center, which greatly simplifies designing, provisioning, updating, managing, and troubleshooting network services and VNFs * Enhances network operations flexibility by taking full advantage of virtualization techniques such as virtual machine moves, snapshots, and upgrades * Supports Cisco SD-WAN cEdge and vEdge virtual router onboarding * Supports third-party VNFs