diff --git a/virtual.rst b/virtual.rst index 0ac9d0f..132ee26 100644 --- a/virtual.rst +++ b/virtual.rst @@ -65,3 +65,4 @@ computing systems. .. include:: virtual/vlan.rst .. include:: virtual/vpn.rst .. include:: virtual/datacenter.rst +.. include:: virtual/microseg.rst diff --git a/virtual/datacenter.rst b/virtual/datacenter.rst index 827a5ef..de67afe 100644 --- a/virtual/datacenter.rst +++ b/virtual/datacenter.rst @@ -622,83 +622,6 @@ build virtual networks for the containers they are hosting. In this case, the "cloud management system" that OVN integrates with is likely to be a container management system, such as Kubernetes. -.. TODO -- It might make sense to end the datacenter section here - (with the capstone example) and then elevate Microsegmentation to - top-level section 9.5. The lead paragraph would need to be modified - a bit, but this seems like a "stand-alone" nugget worth highlighting. - Perhaps a nod to use cases outside the datacenter could be added. - -|Virt|.4.4 Microsegmentation -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Network virtualization has certainly had an impact on networking, -particularly in the datacenter, in the years since VL2. The technology -is now widespread in Telcos and large enterprise datacenters. It is -also ubiquitous in the datacenters of large cloud companies, as an -essential component of delivering infrastructure as a service. - -.. TODO -- We are talking about firewalls for the first time in this - chapter. Do they need to appear elsewhere in the book? Is it - sufficient to add a bit more on firewalls at their first appearance - here? - -One of the interesting side-effects of network virtualization is that -it enabled a change in the way security is implemented in the -datacenter. As noted above, network virtualization enables security -features to be implemented in a distributed manner, in software. It -also makes it relatively straightforward to create a large number of -isolated networks, compared to the traditional approach of configuring -VLANs by hand. These two factors combined to lead to the idea of -*microsegmentation*. - -Microsegmentation stands in contrast to traditional approaches to -segmenting networks, in which relatively large sets of machines would -connect to a "zone" and then firewalls would be used to filter traffic -passing between zones. While this made for relatively simple network -configuration, it meant that lots of machines would be in the same -zone even if there was no need for them to communicate. Furthermore, -the complexity of firewall rules would grow over time as more and more -rules would need to be added to describe the traffic allowed to pass -from one zone to another. - -By contrast, network virtualization allows for the creation of -microsegments, which are narrowly defined virtual networks that -determine both which machines can communicate with each other and how -they can do so. For example, a three-tier application can have -its own microsegmentation policy which says that the machines in the -web-facing tier of the application can talk to the machines in the -application tier on some set of specified ports, but that web-facing -machines may not talk to each other. This is a policy that was -difficult to implement in the past, because all the web-facing -machines would sit on the same network segment. - -Prior to microsegmentation, the complexity of configuring segments was -such that machines from many applications would likely sit on the same -segment, creating opportunities for an attack to spread from one -application to another. The lateral movement of attacks within -datacenters has been well documented as a key strategy of successful -cyberattacks over many years. - -Consider the arrangement of VMs and the firewall in :numref:`Figure %s -`. Suppose that, without network -virtualization, we wanted to put VM A and VM B in different segments -and apply a firewall rule for traffic going from VM A to VM B. We -would have to configure two VLANs in the physical network, connect A -to one of them, and B to the other, and then configure the routing -such that the path from the first VLAN to the second passed through -the firewall. If at some point VM A was moved to another server, we'd -have to make sure the appropriate VLAN reached that server, connect VM -A to it, and ensure that the routing configuration was still forcing -traffic through the firewall. This situation is admittedly a little -contrived, but it demonstrates why microsegmentation was effectively -impossible before the arrival of network virtualization. - - -Microsegmentation has become an accepted best practice for datacenter -networking, providing a starting point for "zero-trust" -networking. This illustrates the far-reaching impact of network -virtualization. - .. sidebar:: Is Network Virtualization SDN? *There is a case to be made that Network Virtualization didn't change diff --git a/virtual/figures/f08-20-9780123850591.png b/virtual/figures/f08-20-9780123850591.png new file mode 100644 index 0000000..89df5df Binary files /dev/null and b/virtual/figures/f08-20-9780123850591.png differ diff --git a/virtual/microseg.rst b/virtual/microseg.rst new file mode 100644 index 0000000..e94b1f2 --- /dev/null +++ b/virtual/microseg.rst @@ -0,0 +1,111 @@ +|Virt|.5 Microsegmentation +--------------------------------- + +Network virtualization has certainly had an impact on networking, +particularly in the datacenter, in the years since VL2. The technology +is now widespread in telcos and large enterprise datacenters. It is +also ubiquitous in the datacenters of large cloud companies, as an +essential component of delivering infrastructure as a service. + +.. TODO -- We are talking about firewalls for the first time in this + chapter. Do they need to appear elsewhere in the book? Is it + sufficient to add a bit more on firewalls at their first appearance + here? + +One of the interesting side-effects of network virtualization is that +it enabled a change in the way security is implemented in the +datacenter. As noted above, network virtualization enables security +features such as firewalling to be implemented in a distributed manner, in software. It +also makes it relatively straightforward to create a large number of +isolated networks, compared to the traditional approach of configuring +VLANs by hand. These two factors combined to lead to the idea of +*microsegmentation*. + +Microsegmentation stands in contrast to traditional approaches to +segmenting networks, in which large sets of machines +connect to a "zone" with firewalls placed between zones. Firewalls are +a type of security appliance that is configured to selectively block +some subset of the traffic passing through it. + +A firewall typically sits between two regions +of a network, as illustrated in :numref:`Figure %s `, +protecting the flow of traffic from one region to another. A common +location would be a strategic point such as the ingress/egress point +to an enterprise network or data center. Of course, unlike a physical +firewall that blocks everything in its path, a network firewall is +really a sort of packet filter that makes decisions about exactly what +traffic is allowed to pass through it. + +.. _fig-firewall: +.. figure:: virtual/figures/f08-20-9780123850591.png + :width: 600px + :align: center + + A firewall filters packets flowing between a site and the rest of the + Internet. + +Historically, a firewall has been implemented as an “appliance”: a +dedicated system with one job, filtering packets. Firewalls have also +been provided as a set of features available on a router, and a +“personal firewall” may be implemented on an end-user +machine. Firewalls are usually configured to allow or disallow traffic +based on IP addresses, port numbers, and sometimes other information +such as the URL of an HTTP request. + +Firewalls are used not just at the perimeter of a network as in +:numref:`Figure %s ` but are also placed between zones +or regions within an enterprise or a datacenter. With firewalls being +physical appliances that need to be configured, it is common to have +just a few of them and to divide the network into large zones. This +makes for simple network configuration, but it also means that lots of +machines end up in the same zone even when there is no need for them +to communicate. Furthermore, the complexity of firewall rules tends to +grow over time as more and more rules would need to be added to +describe the traffic allowed to pass from one zone to another. + +By contrast, network virtualization allows for the creation of +microsegments, which are narrowly defined virtual networks that +determine both which machines can communicate with each other and how +they can do so. The key idea is that a microsegment is a lightweight +construct created in software. An operator can define the precise +communication policy to be applied to a small number of virtual +machines or containers, and the SDN system implements that policy. + +For example, a three-tier application is a common structure in which +one tier of VMs face the Internet, a second tier implements some +application logic, and a third tier stores data for the application. A +single three-tier application can have +its own microsegmentation policy which says that the machines in the +Internet-facing tier of the application can talk to the machines in the +application tier on some set of specified ports, but that Internet-facing +machines may not talk to each other. This is a policy that was +difficult to implement in the past, because all the Internet-facing +machines would sit on the same network segment. + +Prior to microsegmentation, the complexity of configuring segments was +such that machines from many applications would likely sit on the same +segment, creating opportunities for an attack to spread from one +application to another. The lateral movement of attacks within +datacenters has been well documented as a key strategy of successful +cyberattacks over many years. + +Consider the arrangement of VMs and the conventional firewall in +:numref:`Figure %s `. Suppose that, without +network virtualization, we wanted to put VM A and VM B in different +segments and apply a firewall rule for traffic going from VM A to +VM B. We would have to configure two VLANs in the physical network, +connect A to one of them, and B to the other (so A and B can't +directly communicate), and then configure the routing such that the +path from the first VLAN to the second passes through the firewall. If +at some point VM A was moved to another server, we'd have to make sure +the appropriate VLAN reached that server, connect VM A to it, and +ensure that the routing configuration was still forcing traffic +through the firewall. This situation is admittedly a little contrived, +but it demonstrates why microsegmentation was effectively impossible +before the arrival of network virtualization. + + +Microsegmentation has become an accepted best practice for datacenter +networking, providing a starting point for "zero-trust" +networking. This illustrates the far-reaching impact of network +virtualization, one of the key use cases of SDN.