Introduction |
|
xviii | |
Part I A Network Architecture for the Virtual Enterprise |
|
3 | (120) |
|
Chapter 1 Business Drivers Behind Enterprise Network Virtualization |
|
|
5 | (12) |
|
|
5 | (9) |
|
Visitors, Partners, Contractors, and Quarantine Areas |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
Virtual Project Environment: Next-Generation Business Processes |
|
|
12 | (2) |
|
Business Requirements Drive Technical Requirements |
|
|
14 | (1) |
|
|
15 | (2) |
|
Chapter 2 Designing Scalable Enterprise Networks |
|
|
17 | (18) |
|
Hierarchical Campus Design |
|
|
17 | (5) |
|
|
22 | (1) |
|
|
22 | (11) |
|
WAN Provider Service Offerings |
|
|
23 | (2) |
|
|
25 | (2) |
|
|
27 | (2) |
|
WAN Routing Considerations |
|
|
29 | (2) |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
33 | (2) |
|
Chapter 3 Basic Virtualized Enterprise |
|
|
35 | (20) |
|
|
37 | (3) |
|
Transport Virtualization—VNs |
|
|
40 | (9) |
|
|
42 | (1) |
|
Virtualizing the Routed Core |
|
|
43 | (4) |
|
Policy-Based Segmentation |
|
|
43 | (2) |
|
Control-Plane-Based Virtualization |
|
|
45 | (2) |
|
The LAN Edge: Authentication and Authorization |
|
|
47 | (2) |
|
Central Services Access: Virtual Network Perimeter |
|
|
49 | (3) |
|
|
51 | (1) |
|
|
52 | (3) |
|
Chapter 4 A Virtualization Technologies Primer: Theory |
|
|
55 | (34) |
|
Network Device Virtualization |
|
|
55 | (11) |
|
|
56 | (1) |
|
|
57 | (6) |
|
|
58 | (3) |
|
Virtual and Logical Routers |
|
|
61 | (1) |
|
|
62 | (1) |
|
|
63 | (1) |
|
Virtual Firewall Contexts |
|
|
64 | (1) |
|
Network Device Virtualization Summary |
|
|
65 | (1) |
|
|
66 | (17) |
|
|
66 | (1) |
|
Generic Routing Encapsulation |
|
|
66 | (3) |
|
|
68 | (1) |
|
|
69 | (3) |
|
Cisco IOS IPsec Configuration |
|
|
71 | (1) |
|
|
72 | (3) |
|
|
73 | (2) |
|
|
75 | (8) |
|
|
79 | (1) |
|
|
80 | (3) |
|
Data-Path Virtualization Summary |
|
|
83 | (1) |
|
Control-Plane Virtualization—Routing Protocols |
|
|
83 | (4) |
|
|
83 | (2) |
|
|
84 | (1) |
|
VRF Address Families: EIGRP, RIP, and BGP |
|
|
84 | (1) |
|
|
85 | (1) |
|
Control-Plane Virtualization Summary |
|
|
86 | (1) |
|
|
87 | (2) |
|
Chapter 5 Infrastructure Segmentation Architectures: Theory |
|
|
89 | (34) |
|
|
90 | (5) |
|
|
92 | (1) |
|
Single Address Space Alternatives |
|
|
93 | (2) |
|
|
95 | (1) |
|
|
95 | (7) |
|
L3VPN Using GRE and IPsec Overlay |
|
|
96 | (2) |
|
Putting It All Together: DMVPN |
|
|
98 | (3) |
|
|
101 | (1) |
|
Tunnel Overlay for Layer 2 VPNs |
|
|
102 | (6) |
|
Layer 2 P2P Overlay Using L2TPv3 |
|
|
102 | (2) |
|
Layer 2 P2P Overlay Using MPLS |
|
|
104 | (2) |
|
Layer 2 VPN MP2MP Using MPLS (VPLS) |
|
|
106 | (1) |
|
|
107 | (1) |
|
Peer-Based Model for Layer 3 VPNs |
|
|
108 | (8) |
|
|
112 | (2) |
|
RFC 2547bis Forwarding-Plane Alternatives |
|
|
114 | (2) |
|
|
114 | (1) |
|
|
115 | (1) |
|
Inter-Autonomous System Connectivity: Another Application of Tunnels |
|
|
116 | (5) |
|
Carrier Supporting Carrier |
|
|
116 | (3) |
|
Inter-Autonomous System Routing |
|
|
119 | (1) |
|
Inter-Autonomous System Connectivity Summary |
|
|
120 | (1) |
|
|
121 | (2) |
Part II Enterprise Virtualization Techniques and Best Practices |
|
123 | (198) |
|
Chapter 6 Infrastructure Segmentation Architectures: Practice |
|
|
125 | (48) |
|
|
125 | (13) |
|
|
129 | (9) |
|
Single Address Space Solutions |
|
|
138 | (3) |
|
Tunnel Overlay for Layer 3 VPNs |
|
|
141 | (14) |
|
|
141 | (3) |
|
|
144 | (3) |
|
|
145 | (1) |
|
|
146 | (1) |
|
Mapping Traffic to Tunnels |
|
|
147 | (2) |
|
|
148 | (1) |
|
|
148 | (1) |
|
Resiliency and Routing Considerations |
|
|
149 | (6) |
|
Encryption Considerations |
|
|
155 | (1) |
|
|
155 | (10) |
|
|
155 | (4) |
|
Campus Network/MAN Deployment |
|
|
155 | (4) |
|
|
159 | (1) |
|
|
160 | (1) |
|
|
160 | (1) |
|
BGP Best Practices: Route Reflectors |
|
|
160 | (1) |
|
BGP Best Practices: Route Distinguishers and ECMP Routing |
|
|
161 | (3) |
|
Migration Recommendations |
|
|
164 | (1) |
|
|
165 | (6) |
|
|
166 | (4) |
|
Providing Point-to-Point Connectivity |
|
|
166 | (1) |
|
Providing Multipoint Connectivity |
|
|
167 | (1) |
|
Resilient Pseudowire Topologies |
|
|
168 | (2) |
|
|
170 | (1) |
|
|
171 | (2) |
|
Chapter 7 Extending the Virtualized Enterprise over the WAN |
|
|
173 | (34) |
|
|
173 | (5) |
|
|
173 | (2) |
|
|
175 | (1) |
|
|
176 | (1) |
|
|
177 | (1) |
|
|
178 | (1) |
|
Extending Segmentation over the WAN |
|
|
178 | (2) |
|
MPLS over Layer 2 Circuits |
|
|
180 | (5) |
|
VRF-to-VRF Connections at the Autonomous System Border Routers |
|
|
182 | (1) |
|
MP-eBGP Exchange of Labeled VPN-IPv4 Routes Between Adjacent ASBRs |
|
|
182 | (1) |
|
Multihop MP-eBGP Between Remote Autonomous Systems |
|
|
182 | (1) |
|
Using MPLS over Layer 2 Circuits for Segmented Branch Aggregation |
|
|
182 | (2) |
|
|
184 | (1) |
|
Contracting Multiple IP VPNs |
|
|
185 | (2) |
|
|
187 | (1) |
|
Carrier Supporting Carrier (CsC) |
|
|
187 | (5) |
|
Using CsC for Segmented Branch Aggregation |
|
|
191 | (1) |
|
|
192 | (1) |
|
|
192 | (3) |
|
|
195 | (1) |
|
RFC 2547 VPNs over L2TPv3 Tunnels |
|
|
195 | (5) |
|
|
199 | (1) |
|
VRFs Interconnected by a GRE or DMVPN Overlay |
|
|
200 | (2) |
|
|
202 | (1) |
|
|
202 | (3) |
|
|
205 | (1) |
|
|
205 | (2) |
|
Chapter 8 Traffic Steering and Service Centralization |
|
|
207 | (34) |
|
Shared Services: Protected vs. Unprotected |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
Unprotected Services Access |
|
|
208 | (10) |
|
Basic Import/Export Mechanism |
|
|
210 | (2) |
|
|
210 | (1) |
|
Single-Platform Deployment |
|
|
211 | (1) |
|
Any-to-Any and Hub-and-Spoke VPNs |
|
|
212 | (1) |
|
|
213 | (1) |
|
Localized Inter-VPN Communication |
|
|
214 | (3) |
|
Leaking Traffic with the Global Table |
|
|
217 | (1) |
|
Protected Services Access |
|
|
218 | (18) |
|
Firewalling for Common Services |
|
|
220 | (2) |
|
Routed Firewalls and Transparent Firewalls |
|
|
222 | (1) |
|
Routed Firewall Deployments |
|
|
222 | (12) |
|
Single Common Services/Internet Edge Site |
|
|
222 | (2) |
|
Multiple Common Services/Internet Edge Sites |
|
|
224 | (6) |
|
|
230 | (1) |
|
Network Address Translation (NAT) |
|
|
231 | (3) |
|
Transparent Firewall Deployments |
|
|
234 | (2) |
|
|
236 | (2) |
|
|
236 | (2) |
|
Dedicated DHCP Services per VN |
|
|
236 | (1) |
|
|
237 | (1) |
|
Domain Name System (DNS) Services |
|
|
238 | (1) |
|
|
238 | (3) |
|
Chapter 9 Multicast in a Virtualized Environment |
|
|
241 | (32) |
|
|
241 | (8) |
|
Internet Group Management Protocol (IGMP) |
|
|
243 | (2) |
|
|
245 | (2) |
|
|
246 | (1) |
|
|
247 | (1) |
|
Protocol Independent Multicast (PIM) |
|
|
247 | (2) |
|
|
249 | (5) |
|
Multicast Sourced from an External IP Network |
|
|
250 | (3) |
|
Multicast Across VRFs (mVPN Extranet) |
|
|
253 | (1) |
|
|
254 | (14) |
|
|
254 | (4) |
|
|
258 | (3) |
|
|
261 | (7) |
|
|
268 | (3) |
|
|
271 | (2) |
|
Chapter 10 Quality of Service in a Virtualized Environment |
|
|
273 | (16) |
|
QoS Models and Mechanisms: A Review |
|
|
273 | (4) |
|
|
274 | (3) |
|
|
277 | (1) |
|
|
277 | (1) |
|
MPLS Traffic Engineering and Guaranteed Bandwidth |
|
|
278 | (2) |
|
DS-TE and Guaranteed Bandwidth |
|
|
279 | (1) |
|
Do I Really Need This in an Enterprise Network? |
|
|
280 | (1) |
|
QoS Models for Virtualized Networks |
|
|
280 | (6) |
|
|
280 | (13) |
|
Multiple Policies per Group—Hierarchical QoS |
|
|
283 | (3) |
|
|
286 | (3) |
|
Chapter 11 The Virtualized Access Layer |
|
|
289 | (32) |
|
|
289 | (4) |
|
Implementing Dynamic Authentication and Authorization |
|
|
293 | (18) |
|
Clientless Authentication |
|
|
295 | (6) |
|
Static Clientless Implementation—Port Security |
|
|
296 | (1) |
|
Centralized Dynamic Clientless Authentication—VMPS |
|
|
297 | (2) |
|
Layer 3 Clientless Authentication—Web Clients |
|
|
299 | (2) |
|
|
301 | (10) |
|
|
303 | (3) |
|
|
306 | (5) |
|
Virtualizing the Access Layer |
|
|
311 | (7) |
|
|
317 | (1) |
|
|
318 | (3) |
Part III Appendixes |
|
321 | (28) |
|
Appendix A L2TPv3 Expanded Coverage |
|
|
323 | (6) |
|
|
324 | (3) |
|
|
327 | (2) |
|
Appendix B MPLS QoS, Traffic Engineering, and Guaranteed Bandwidth |
|
|
329 | (10) |
|
MPLS QoS—Uniform Tunnel and Pipe Modes |
|
|
329 | (2) |
|
|
331 | (2) |
|
|
333 | (2) |
|
|
335 | (4) |
|
Appendix C Recommended Reading |
|
|
339 | (6) |
|
Appendix D RFCs and Internet Drafts |
|
|
345 | (4) |
Index |
|
349 | |