Welcome back to part 3 of the VxLAN series! It’s been great to have you along for the
first two parts of this series, and I’m glad to see you coming back for more!
So far, we’ve covered the basics of VxLAN, including encapsulation, tunnels, and VNI’s.
In the last video, we looked at how the VxLAN headers work.
This video is focused on the spine-leaf topology, often called a fabric.
This is an architecture that is often associated with VxLAN. It’s not exclusive to VxLAN
though; FabricPath and ACI are other technologies that use may also spine-leaf.
But before we do that, let’s get started by looking back at the traditional network architecture
You may already be familiar with the traditional hierarchical architecture. It uses core, distribution,
and access layers. The access layer is where hosts and devices
connect. The distribution layer controls traffic in an area, perhaps a floor in a building.
And the core layer provides fast transport between areas.
This model is often used in the campus, and sometimes in the data centre. It creates network
‘pods’, and focuses on a ‘north-south’ traffic pattern, where the majority of traffic
needs to leave the local area. Traffic moves up through the layers, and travels
back down to reach its destination. This model can be used in different ways.
One way is to route all the way to the access layer.
There are many benefits to this, but it can restrict mobility. If a device like a smartphone
moves from one area to another, it needs to get a new IP address through DHCP.
The other option is to span VLANs across the access layer. This increases mobility, but
also increases the broadcast and failure domain size. This will also only work within a distribution
block, as the core is a routed network. This is a good topology for a campus, where
a DHCP server can easily hand out new IP addresses. In the data centre, we typically have hosts
with static addresses. Using this model here can really limit mobility.
Imagine you have different subnets in each rack, and you want to migrate a VM. It would
need to change IP address. This is where the spine-leaf architecture,
along with VxLAN, comes in.
Spine-leaf is not new. It is also called a Clos or ‘Cloh’ network, as it was originally
designed by Charles Clos in the 1950’s, as a better way to switch telephone calls.
I sincerely hope I’ve pronounced Charles’ name correctly. If I’m wrong, please let
me know in the comments section. This architecture has only two layers; the
spine layer, and the leaf layer. The leaf layer is where hosts and other devices
connect. The leaf switches connect to the spine switches.
No other devices connect to the spine, as they exist only for passing traffic.
Every leaf switch has a link to every spine switch. Each of these links are routed, making
them all layer-3. Every link needs an IP address at each end,
and will use a /30 or /31 subnet. A routing protocol like OSPF or EIGRP is used to manage
routing. What all of this means, is that every path
is equal, and every destination is always two hops away. If a link or switch fails,
ECMP is used to recover nearly instantly. You may notice that there are no links between
spine switches, and no links between leaves. This keeps the topology consistent, and avoids
unnecessary paths. The exception to this is if you are using
vPC. In this case, a pair of switches can have a layer-2 peer-link, and a layer-3 keepalive
link added. These extra links are used for vPC traffic only.
Spine/leaf is well suited to the data centre. It is a routed network, which limits the layer-2
failure domain. Adding VxLAN over the top allows devices to move without changing IP
addresses. This also focuses on an east-west traffic
pattern. This suits the data centre, as a lot of the traffic is between servers.
Another major advantage is scalability. Need to add more hosts? Just add more leaf switches.
Need more bandwidth? Add a spine switch or two.
The critical point here, is that the design doesn’t change. You just need more switches,
links, and IP addresses. The routing protocol will take care of the rest.
In part 1 of the series, we discussed how VxLAN is an overlay technology, running on
top of an IP network, or underlay. The spine-leaf fabric becomes the underlay
for VxLAN. The VTEPs are on the leaf switches. This means
that VxLAN tunnels are created between leaf switches.
The spine switches are used mainly for transport. They may also be used as multicast rendezvous
points If you use BGP, the spine switches can become
route reflectors. But more on that in part 4...
So now we have a nice fabric for our hosts. How do we add internet and WAN connectivity?
What about firewalls, load balancers, and routers?
This functionality is added to the leaf layer. Leaf switches with routers and firewalls attached
are called Border Leaves. The border leaf switches represents connectivity
to and from the fabric. This is also where routes from the overlay are redistributed
into the core routing protocol. In practice, these switches are not particularly
special. Hosts can still be connected to border leaves.
What happens if your fabric is growing out of control? One options is to break it into
smaller fabrics. These can be connected with a super-spine.
This behaves just like a normal spine layer. Of course, you’d need to have a very large
fabric to use the super spine topology.
In the fourth part of this series, we’ll look at how host addresses are learned, how
VTEPs are discovered, and the difference between data-plane and control-plane learning.
Please hit the subscribe and notifications buttons
I'd also really like to get your feedback on this video. Please leave me a comment, so I know what you thought
I’ll see you in Part 4