Data Center LAN Migration Guide - Juniper Networks

Data Center LAN Migration Guide
The most common case will be use of VPLS to provide “stretched” VLANs between areas of a large data center
network, or between multiple distant data centers using VPLS (over MPLS) to create a transparent extension of the
LAN to support nonstop application services (transparent failovers), transaction mirroring, data base backups, and
dynamic management of virtual server workloads across multiple data center sites.
In these cases, the core nodes will include VPLS instances matching the L2 topology and VLAN configurations required
by the applications, as well as the appropriate implementation of MPLS between the core nodes and the rest of the
organization’s routed IP/MPLS network. This design will include ensuring high availability and resilient access of the
L2 access tier into the “elastic” L2 infrastructure enabled by VPLS in the core; use of appropriate traffic engineering,
and HA features of MPLS to enable the proper QoS and degree of availability for the traffic being supported in the
transparent VLAN network. Details on these design points are included in the section of the Migration Guide on
incorporating multiple sites into the data center network design using MPLS in the Six Process Steps for Ensuring
MPLS Migration section.
Best Practices: Upgraded Security Services in the Core
Frequently a data center consolidation requires consolidating previously separate and siloed security appliances into
a more efficient security tier integrated into the L2 and L3 infrastructures at the core network layer. Here we describe
design considerations for accomplishing that integration of security services in the core.
• All security appliances should be consolidated and virtualized into a single pool of security services with a platform
such as the SRX Series Services Gateways.
• To connect to and protect all core data center network domains, the virtual appliance tier should optimally
participate in the interior gateway routing protocols within the data center network.
• Security zones should be defined to apply granular and logically precise protection for network partitions and
virtualized resources within the network wherever they reside, above and beyond the granularity of traditional
perimeter defenses.
• The security tier should support the performance required by the data center’s applications and be able to inspect
information up to L7 at line rate. A powerful application decoder is necessary on top of the forwarding, firewall
filtering, and IDP signature detection also applied to the designated traffic streams. Including this range of logic
modularly in a high-performance security architecture for the core helps reduce the number of devices in the network
and increase overall efficiency.
• Scalable, strong access controls for remote access devices and universal access control should be employed to
ensure that only those with an organizational need can access resources at the appropriate level. Integration of
secure access with unified policies and automation using coordinated threat control not only improves security
strength but also increases efficiency and productivity of applications within the data center.
• Finally, incorporation of virtual appliances such as virtual firewalls and endpoint verification servers into the data
center’s security design in a way that integrates protection for the virtual servers, desktops, and related network
transports provides an extension of the common security fabric into all of the resources the IT team needs to protect.
Aggregation/Core Insertion Point Installation Tasks
Preinstallation Tasks
The tasks described in this section pertain to a consolidation within an existing data center that has the required space
and power to support consolidation. Alternatively, a consolidation may take place in a new facility, sometimes referred
to as a “greenfield” installation. That scenario would follow the best practices outlined in Juniper’s Cloud-Ready Data
Center Reference Architecture: www.juniper.net/us/en/solutions/enterprise/data-center/simplify/#literature.
The steps outlined here also apply to a case in which the organization wants to stay with its existing three-tier design,
at least for the initial steps in the process. In such a case, deployment and provisioning should be done leaving
flexibility to move to a two-tier design at some future date.
Copyright © 2012, Juniper Networks, Inc. 41