But hopefully this makes sense.
Let's talk about overlay underlay and fabrics.
So overlay networks go back a long way in time.
So the example I use when I spoke about the exam and I like that example is in the old days we had a
traditional telephone network.
The intelligence was in the telephone network so the public switched telephone network that AT&T would
have built or British Telecom would have built here in the U.K. The phones were done.
They didn't even have dial tone without the network giving dial tone to the phone.
So the phones were essentially stupid but then that God revolutionized with voice over IP.
Then suddenly we were using the Internet as a dumb call.
And I shouldn't say it's totally dumb.
But from a telephone switching point of view it was done.
We were basically setting up calls across the Internet and the devices in the core Internet didn't understand
what the calls were doing.
They were just routing IP packets.
So I phoned you using Skype or WhatsApp today.
I phone you.
The Internet doesn't understand what we're doing.
I mean WhatsApp calls are encrypted so we setting up a tunnel across the damn central Internet.
So the intelligence is now in the endpoints rather than in the core network.
So notice the difference in the old days intelligence was in the network in devices were done that switch
round now core network is just high speed forwarding that's what the Internet should be doing.
High speed switching routing of traffic intelligence is in the edge not in the core.
So that was a whole industry that got revolutionized the PSTN public switch telephone network was intelligent
endpoints were dumb intelligence was moved to the edge to the endpoints core became done all it was
doing is high speed forwarding of traffic from a to b.
So I made a call from the UK to the US the core Internet routers are just trying to move the traffic
as quickly as possible from the UK to the US.
They don't understand the call setup process.
I mean WhatsApp again is setting up encrypted calls the telephone system in WhatsApp or in Skype is
out of the control of the core Internet.
OK.
So that's great.
But in networking for many years enterprise networking it didn't work that way.
We would have say Cisco IP phones on a network and they would mark their traffic as important but then
the network had the intelligence of saying okay this traffic is more important that traffic and then
we try to implement all kinds of clever stuff on the network.
So the applications were still done but the network was intelligent.
Notice where I'm going with us.
Network was intelligent.
Applications were done from the point of view that a P.C. just sent traffic to its default gateway and
then the network took care of things.
Intelligence and the network endpoints were done a VM where and others changed this entirely.
So VM where purchased a company called the sera sera almost got bought by Cisco but in a datacenter
when we using ASX sign as an example from VM where they said OK we don't need an intelligent network
we will put the intelligence in the ASX ie servers in the service because the servers have visibility
of the applications running on them.
The server ASX AI server has visibility of the victims and the applications running on the server.
The network can't see the victims like the ASX ie server can.
So rather than having an intelligent network we make the network dumb just like the Internet.
It doesn't have visibility of the applications and the VMs on the ASX ie server and what we do is we
set up tunnels across the core network so you could have and it doesn't matter could be Cisco writers
could be HP switches.
It doesn't matter your core network is simply there to rot as quickly as possible from one ASX ie server
to another E6 I server and we build what they call here an overlay network.
So we have our IP network traditional say IP version 4 and then we build a whole new network on top
of that called an overlay network.
This underlying network the physical network doesn't understand what's going on because all it sees
is tunnels.
Think of WhatsApp.
Think of IP SEC tunnels that you use across the Internet you can have the Internet and you build encrypted
tunnels across the Internet that connect to various sites.
Two of your company so your company may have sites in the US and the UK in Canada in Japan whatever
you set up these VPN ends across the internet you would be very upset if the Internet writers could
actually see inside your IP SAC tunnel.
The whole idea of encryption is to hide the internal network information from the core Internet network.
Same principle here.
Now we're not using typically encryption in a data datacenter they use rather than IP SEC tunnels or
geo re tunnels they use Vieques or land tunnels.
The whole idea of a vehicle land is think of a restriction in traditional switching we have a two to
one Q it's restricted to just over 4000 villains you can only have 4000 villains in a network now if
you running big ASX AI servers and you have lots of customers and then you have lots of departments
for lots of customers and they want a whole bunch of villains you run out of 4000 villains very very
quickly so vehicles land supports 16 million villains.
And I say villains because that concept no longer exists.
Sixteen million subnets rather than 4000 subnets in order to have one key.
So in a traditional switching network we would create up to 4000 villains.
That's how we would implement security let's say by restricting who can talk to who based on villains
or subnets but in a traditional switched environment we kind of limited that doesn't scale to a data
center.
So in a data center they want to use this whole concept and let me go over it again just to make sure
that it's clear we have a core network could be Cisco routers Cisco switches.
Notice the politics here because VMware and the Sierra basically changed the game.
The core network now doesn't have to be fancy because it's going to be like the internet.
I just need the core routers to route traffic from one year six I service a one VM with server to another
VM with server and just assume we got a whole bunch of them with servers these VM where servers will
set up tunnels to each other automatically they're not encrypted but it's the same concept.
They will set up a tunnel from one year six ice over to another year six ice server and they will use
a totally different subnet totally different network just like you if you setting up a VPN across the
Internet we'll use a different subnet different IP addressing to the core Internet.
You can rot or if C 1918 addresses across the Internet.
Agreed.
If you use a tunnel so the outside IP address would be a public IP address when you're riding from one
rider to another using an IP cell tunnel across the Internet.
But the inside IP addresses could be already 1918 addresses the core Internet doesn't see that data
because it's encrypted so the whole idea in a data center is the core network could be very simple basic
subletting.
We don't need villains.
We can run routing everywhere.
So this solved another problem because let's say we want to have a VM on one ASX ice server and another
VM on another year yes expensive but we want them in the same villain same deal and same broadcast domain.
They must be layer 2 connection between these two VMs that own different servers.
Now you might say why would you want to do that now.
Think about V motion the V motion is something that allows you to move a VM automatically if you want
from one physical ASX AI server to another ASX AI server.
So when the load on the server gets too high it can automatically migrate to the VM to another 6 ISO
over to use resources on this ASX AI server.
But the problem is you've now moved the VM from one server to another server but you want to keep them
in the same VLAN so what happens if I move it to that server over there using the motion across a network.
Now traditionally we would have to run Layer 2 across this because that VM and this VM on the same subnet.
So we need to have a layer 2 connection across but with this overlay network and this concept of doing
away with a clever core the core network can run writing protocols so we don't need spanning tree we
just run away SPF everywhere.
As an example.
So it's a layer 3 network.
But this VM running on this year's x5 server and this VM running on this year's X ie server can be in
the same subnet because they are connected across a tunnel.
So this piece could have an IP address of 10 1 1 2 this piece.
You could have an IP address of 10 1 1 1 24 let's say when a broadcast is sent by this P.C. it goes
into the tunnel centre across the tunnel to that P.C. on the other side.
It gets complicated with broadcasts and multicast but just think of the concept that these two devices
on the same VLAN when in actual fact they're not same villain because this infrastructure is routed.
So we are basically pulling a cable logically from that VM on that E6 I server to this VM on this is
X I said so logically you to Ethan a cable from one side to the other but it's just a tunnel created
using Vieques land.
I went into a lot of detail here.
Let me just summarize overlay network is a network that's both on top of an underlying network under
a network of physical devices which could be Cisco rather than switches.
Yes it's high from the hardware will bold and it's actually NSX.
It's not yes excites NSX is the product that does this NSX will build a whole new network and overlay
network across the underlying network this underlying network doesn't understand what's going on with
an overlay network.
As an analogy again think of this underlay as the Internet and the overlay network as your VPN tunnels
going across the Internet.
The core routers don't have visibility of the traffic that you encrypting through your IP SEC tunnels
that call Cisco routers and switches in a data center don't have visibility of the VM traffic going
through a vehicle and tunnel.
All they see is this.
Yes excised server wants to talk to this iOS 6 AI server or this is X I server wants to talk to that
yes X I said they don't understand that it's actually a VM running within this year's X I server that's
talking to VM within that iOS 6 AI server.
So we basically tunneling traffic across.
Now I'm gonna add some videos from my NSX and overlays course there are other vendors that also do this.
Again it's optional.
So if you want to watch that stuff then feel free to see the small practically.
I've been dealing with this stuff for a long time but it's now great to see that it's coming to the
CCN CCMA.