Micro-segmentation Recommendations for Multi-Datacenter Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network management systems are limited to managing single datacenter environments and face challenges in scaling to manage multiple tenant networks distributed across various datacenters, including on-premises and virtual datacenters in the public cloud, requiring a more comprehensive and cloud-based solution for unified network management.
Innovation Solution
A cloud-based network management and monitoring system is deployed, utilizing a container cluster like Kubernetes, with service instances for policy management, network flow monitoring, and threat monitoring, featuring microservices, local managers at each datacenter, and multi-tenant services. This system allows tenants to select services, deploys them across datacenters, and ensures isolation and communication through namespaces and firewall rules, with persistent connections for efficient data exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a cloud-based network management system is deployed to manage multiple tenant networks across diverse datacenters, then the system's scalability and multi-tenancy capability are improved, but the system complexity increases
Solution Approach 1:
The system is divided into separate service instances, each dedicated to managing specific datacenter groups. Each service instance contains isolated microservices that operate independently, allowing the system to handle multiple tenants without requiring a monolithic complex architecture. This segmentation enables scalable addition of new tenants and datacenter groups while maintaining manageable complexity within each service instance.
Solution Approach 2:
The cloud-based platform provides universal service instances that can be deployed to manage various types of datacenters (on-premises, cloud, hybrid) and support multiple tenant networks simultaneously. The multi-tenant services layer enables a single platform to serve diverse networking needs across different organizations, achieving versatility without requiring separate specialized systems for each tenant type.
2Productivity
If service instances are deployed in the cloud for each datacenter group, then the network management system's scalability is improved, but the data communication overhead increases
Solution Approach 1:
Connection servers act as intermediaries between service instances and datacenter groups, managing persistent connections and routing data traffic efficiently. These intermediaries reduce the need for complex inter-service communication by establishing dedicated connection channels, thereby lowering data communication overhead while maintaining the scalability benefits of distributed service deployment.
Solution Approach 2:
The system establishes persistent connections between service instances and datacenter groups that remain active throughout operation. This continuity eliminates repeated connection establishment and handshaking overhead, reducing data communication costs while enabling scalable horizontal deployment of service instances across the cloud platform.
3Adaptability or versatility
If multiple instances of services are deployed in the public cloud for different datacenter groups, then the system's multi-tenancy capability is improved, but the resource consumption increases
Solution Approach 1:
Multiple service instances share common infrastructure resources in the cloud environment, including connection servers, load balancers, and underlying cloud infrastructure. This merging approach enables the system to support multiple tenants and datacenter groups while consolidating resource consumption rather than duplicating all components, thereby reducing overall resource usage compared to isolated standalone systems.
Solution Approach 2:
The system dynamically adjusts resource allocation parameters for service instances based on actual workload demands. By monitoring and adapting resource consumption parameters (CPU, memory, storage) according to real-time needs, the system optimizes resource utilization across multiple tenant environments, reducing waste while maintaining the scalability required for multi-tenancy.
Data Source
AI summary
Some embodiments provide a method for generating microsegmentation recommendations, performed by a network monitoring service implemented in a public cloud to monitor data flows for a group of datacenters. The method receives a selection of a set of logical network compute nodes (LNCNs) located at a particular datacenter for which to generate recommended rules. The method analyzes flows collected by the network monitoring service in order to generate a set of recommended rules relating to the set of LNCNs. The method provides the set of rules to a local manager at the particular datacenter for the local manager to configure network elements at the particular datacenter to enforce the set of rules. The rules use compute node identifiers for LNCNs located at the particular datacenter and network addresses for LNCNs located at other datacenters as the local manager does not store data regarding compute nodes located at the other datacenters.