Every time I talk about small (per-application) virtual appliances, someone inevitably cries “And who will manage thousands of appliances?” Guess what – I’ve heard similar cries from the mainframe engineers when we started introducing Windows and Unix servers. In the meantime, some sysadmins manage more than 10.000 servers, and we’re still discussing the “benefits” of humongous monolithic firewalls.
It won’t be easy
You’ll obviously have to change your processes and tools as you go from configuring uncountable firewall rules on a pair of gigantic pets to deploying a large herd of small appliances – here are a few tips that might help you.
Standardize. There might be thousands of applications in a typical large enterprise, but I’m positive they aren’t as unique as their developers think. Identify typical patterns (example: web application using external SQL Server) and standardize the network services needed by the application classes.
Simplify. Traditional firewall and load balancer rules/configurations are complex because we force a single box to manage hundreds or thousands of “unique” endpoints, each one identified by its IP address. In an appliance-per-application world the rules become much simpler, for example:
- Outside IP address is load balanced across all hosts in the web segment;
- Everyone can access port 80 on any host in the web segment;
- Every host in the web segment can access MySQL port on any host in the database segment and Memcached port on any host in the caching segment.
Simple, easy to understand, audit and manage.
Templatize. Once you have simple rules for standard application classes, generate configuration templates or golden images. Every time the requirements change, change the template, test it, and deploy hundreds of new VMs instead of manually changing firewall rules for every application/host.
Automate. Manual processes never scale, as craftsmen of all trades discovered throughout the history. If you want to roll out thousands of appliances, you have to automate their deployment, change management and monitoring.
The good news: all recent virtual appliances have an API that you can use to automate them. The bad news: someone will have to learn how to use that API and write scripts.
Delegate. Once you did your homework, identified typical application patterns, created simple rules, and prepared virtual appliance templates that can be automatically deployed from a central catalog, you have to let go. Application teams should take ownership of individual virtual appliance instances – these instances become just another VM in the application stack.
It’s impossible to get from the rigid environment of oversized physical appliances to the virtual appliance nirvana in a single giant leap, but there’s nothing preventing you from taking the first steps.
Don’t try to fix the existing nightmare – some of it can be migrated to the virtual appliances world once the new concepts have been proven, and some applications will simply have to die before you can get rid of the old world. Focus on the new applications that are in the design stage.
Don’t preach the new ideas to everyone you bump into. Identify the most flexible application development team in your organization and start working with them – once everyone else sees the benefits of the new approach, they just might decide to join you.
- Introduction to Virtual Networking will give you an overview;
- Cloud Computing Networking describes numerous technologies you can use to build virtual networks, and their scalability;
- Virtual Firewalls talks about appliance- and NIC-based virtual firewalls;
- VMware Networking Deep Dive covers the technical details of vSphere’s vSwitch, Nexus 1000V and virtual firewalls (including VSG, vShield App and vGW);
- Overlay Virtual Networking describes emerging technologies that you can use to implement large-scale virtualized environments;
- VXLAN Technical Deep Dive focuses on VXLAN-based virtual networks and VXLAN gateways.
All webinars are included with the yearly subscription.