H3C AD-DC Solution

Underlay network automation

· Underlay network automation with up to four layers: Spine, Aggregation, Leaf, and Access layers.

· Automated underlay network provisioning with DRNI (MLAG) groups: Automated underlay network provisioning process. When the DRNI (MLAG) option is enabled in the fabric template and the intra-portal link (IPL) exists between two same layer devices, the DRNI (MLAG) device group is automatically configured with the two devices.

· Automatic link-aggregation group (LAG) creation: The link-aggregation group can be manually or automatically configured on the switches of the DRNI (MLAG) group when a server connects to the DRNI (MLAG) group with multiple links.

· IPv4 or IPv6 underlay network.

· BGP peer configuration of the DRNI (MLAG) network with Calico.

· Manages devices with the certificate.

· Device replacement wizard including device replacement impact analysis and assessment.

· Auto discovered links and manual added links in the topology.

· Send CLI commands to a specific device.

· Bulk configuration of commands to multiple devices.

Overlay network automation

· Bulk deployment of tenant, virtual network, virtual router, virtual subnet, virtual port, gateway, external network, floating IP and VLAN-VXLAN mapping with templates.

· VLAN-VXLAN mapping: Map VLAN ID to overlay logical network’s VXLAN segment ID for access control. Each mapping is applied to specific interfaces or devices.

· VXLAN service pre-configuration for server master and backup network interface failover.

· Virtual Port QoS rate limit: Each virtual port represents one endpoint (VM, K8s pod, bare metal server, etc.).

· Traffic behavior for specified tenant services: DSCP remark, rate limit, etc. for certain traffic that matches the classifier.

· Configure the routing table and bind the routes to a vRouter: Static route and default route configuration for the external network and inter-VPN traffic.

EVPN VXLAN

VXLAN with BGP EVPN control plane and distributed gateways.

Multicast

· Layer 3 multicast service in the same VPN and to the external network.

· Layer 3 multicast service across VPNs.

· Layer 2 multicast service across different data centers.

· Layer 3 multicast service across different data centers.

Container network

· Interoperate with K8s to automatically provide network connectivity for K8s pods: Layer 2 and Layer 3 connectivity in the same VPN.

· Interoperate with K8s to provide security policies for K8s pods.

· Interoperate with K8s to provide QoS for K8s pods: Rate limit, DSCP remark, etc.

· Access the service in a pod using the pod’s IP and port number e.g. Access the HTTP service in a pod using port 8080

· K8s cluster IP.

· Interconnectivity with Calico.

· K8s Pod IP and Node IP interconnectivity.

· K8s pod fixed IP address.

· H3C AD-DC interoperates with K8s via the H3C CNI plug-in.

IPv6

· IPv4 and IPv6 dual-stack overlay network: IPv4/IPv6 endpoints can access the network.

· IPv6 endpoints can access the IPv6 external network without NAT.

Easy provisioning and expansion

· Network provisioning wizard for the underlay network.

· Network expansion wizard for the underlay network.

Security function

· Security policy for the endpoint: Applies to the virtual port. Each virtual port represents one endpoint (VM, K8s pod, bare meter, etc.).

· Floating IP: H3C AD-DC can configure the Destination NAT (DNAT) service (floating IP service) on the H3C firewall to allow external users to use the public IP address and port number to access the internal virtual port’s IP address and port number.

· Firewall as a Service (FWaaS): Manages H3C firewalls including virtual firewall instances and the firewall policies.

· Antivirus as a Service (AVaaS): Configure Antivirus policies on the H3C firewall and provide antivirus services.

· IPS as a Service (IPSaaS): Configure IPS policies on the H3C firewall and provide IPS services.

· Load balance as a Service (LBaaS): Configure H3C load balancer’s policies and provide LB services.

· Manages F5 load balancer’s policies and provide LB services.

IP service chain

· The policy based IP service chain redirects traffic between two contexts through one or multiple firewalls, load balancers or third-party value-added service (VAS) instances Each context matches certain private subnets (VXLAN segments) or external network subnets.

· Service chain drag-and-drop style configuration.

· East-west IP service chain in a VPN: Each virtual router in H3C AD-DC represents a VPN.

· East-west IP service chain across two VPNs.

· East-west IP service chain across two fabrics: Each fabric contains a group of border, spine, leaf physical devices to form a network. Two fabrics are in the same data center.

· East-west IP service chain with multiple hops: Each hop is a firewall, load balancer or third-party VAS instance.

· North-south IP service chain.

· North-south IP service chain with multiple hops.

· North-south IP service chain for all external traffic or traffic to specific external subnets.

· North-south IP service chain with excluded external subnets.

· Service chain firewall bypass: Each firewall has the optional bypass mode.

· Reuse a firewall instance in multiple IP service chains.

· IP service chain priority: If the traffic matches multiple service chains, it will use the service chain with the highest priority.

· IP service chain through a third-party value-added service (VAS) instance.

· North-south IP service chain through a third-party firewall device for SNAT/DNAT.

· North-south IP service chain through a third-party load balancer device with its virtual IP.

Microsegmentation

· The microsegmentation application policy for a vRouter (VPN) performs certain action including deny, permit, redirect (service chain), etc. for traffic between two EPGs.

· Whitelist and blacklist: An application policy can be applied to a VPN (vRouter) with a default action (deny all or permit all) and exception rules. Exception rules can be created for traffic between certain two EPGs as whitelist or blacklist.

· Microsegmentation service chain matching Layer 4 protocol and port .

· The microsegmentation service chain applies to traffic between two endpoint groups (EPGs) and can match Layer 4 protocol and port. The IP service chain (which is discussed on the previous page) applies to traffic between two contexts. The context can only specify the private or external subnet. The EPG can specify many more attributes including subnet, VM, host, and more.

· Microsegmentation service chain with EPGs matching host name, VM name and VM MAC address: The match schemes include “exact match”, “include”, “start with” and “end with”.

· Microsegmentation service chain through the firewall.

· Microsegmentation service chain through the load balancer.

· Microsegmentation service chain through the third-party value-added service (VAS).

· Microsegmentation service chain with multi hops.

· Microsegmentation service chain priority: If the traffic matches multiple microsegmentation service chains rules, it will use the rule with the highest priority.

· Source side matching: The network matches traffic and applies the traffic policy on the source side leaf switch for maximum security.

· IPv4/IPv6 microsegmentation north-south service chain.

· Microsegmentation north-south service chain with multiple external networks.

· Microsegmentation north-south service chain with multiple external networks distributed in two fabrics for redundancy.

2-in-1 deployment

Service leaf and server leaf in one.

Service leaf and border in one.

Basic operation and maintenance (O&M)

· Logs, alarms and dashboard.

· Physical network topology, logical network topology, and application topology interactive display.

· Loop detection and automatic removal.

· Underlay network check:Connectivity check, black hole route check, routing loop check, and configuration check.

· Overlay configuration consistency check between the controller and the device: Inconsistent configuration can be synchronized from AD-DC to the network device.

· Configuration consistency check whitelist: Configuration in the whitelist won’t be displayed in the configuration differences between the controller and the network device.

· VM IP search.

· Radar Detection: Displays the path from a specified source to a specified destination in the topology. The source/destination can be a vPort’s IP address (IP address of a VM, K8s pod or bare metal server) or an external IP address.

Health assessment and insight

· Topology overview.

· Network health overview.

· Device health.

· Chip health.

· Interface health.

· Queue health.

· Transceiver modules health.

· Daily, weekly and monthly health report.

Key performance indicators assessment and insight

· Link statistics analysis.

· Transient Capture Buffer (TCB) packet loss statistics: Monitors packet loss in buffer. Displays packet loss of each traffic flow.

· Mirror on Drop (MOD) packet loss statistics .

· Monitors packet loss in the forwarding process on each device. Displays packet loss of each traffic flow.

· Configuration change analysis and visualization.

· Hardware resources change analysis and visualization: Including ARP, MAC, IPv4 routing, IPv6 routing, LLDP neighbor, VRF, VSI, L2VPN MAC tables and more.

· Software version change.

TCP flow analysis

· Fabric TCP flow overview.

· Host-dimension TCP flow analysis.

· Application-dimension TCP flow analysis.

· TCP flow session statistics.

· Illegal flow analysis with configured compliance rules.

· Illegal flow analysis of SYN flood attack.

INT flow analysis

In-band Network Telemetry (INT) analyzes latency caused by each device.

Topology interactive display based intelligent analysis

· Physical network topology, logical network topology, and application topology interactive display.

· Inter-application topology.

Issue analysis

· Network Issues: Grouped into multiple types and sub-types.

· Application Issues: Grouped into multiple types and sub-types.

Intelligent troubleshooting

· Device type problems.

· Network type problems.

· Protocol type problems.

· Overlay type problems.

· Problem discovery, identification and remediation in minutes (Closed-loop troubleshooting): Based on AI and big data technologies, H3C AD-DC helps IT team troubleshoot and remediate the problem in minutes with recommended remediation action for problems.

Intelligent prediction

Device KPI trend and prediction.

Intent simulation

· Device replacement impact analysis and assessment.

· Service and configuration change simulation and assessment

Intent verification

· Reachability verification.

· Consistency verification.

· Isolation verification.

· Black hole route and routing loop existence verification.

Emergency recovery

· Contingency plan with plan templates.

· Tenant snapshot rollback.

· Entire network restore point rollback.

AD-DC anywhere

· Connectivity across multiple fabrics: VMs in the same VPN can access each other across fabrics.

· Remote Leaf: The remote leaf switch across WAN.

AD-DC lite

· All-in-one device: Server leaf, service leaf, border, spine, edge device roles in one device.

· Single-node mode or three-node mode controller cluster.

· Manages security devices (H3C firewalls) in the controller.

Multiple external network gateways

· Multiple gateways for a VPN in a single fabric.

· Multiple VPNs, each with multiple gateways in a single fabric.

· Multiple fabrics are managed by the same H3C AD-DC: Each fabric includes multiple physical Spine/Leaf/gateway/external network devices to form a full functional network.

· Two gateways (deployed in two separate fabrics) for multiple fabrics. For each VPN, one gateway acts as the active gateway for VMs in all specified fabrics to access the external network while the other one acts as the standby gateway.

· Active-standby gateways in two fabrics with H3C firewalls or third-party firewalls.

· Active-standby gateways failover.

· Active-active gateways with redundancy for fast traffic failover.

· Back-to-back connection between multiple fabrics.

Active-standby ISPs

The firewall can have static routes to multiple ISPs with different priorities for redundancy.

Data center interconnect (DCI)

· Each data center has its own H3C SeerEngine-DC controller.

· Layer 2 connectivity between VMs across two data centers.

· Layer 3 connectivity between VMs across two data centers with firewalls.

· Layer 3 connectivity between VMs across two data centers without firewall.

· Boarder and Edge Device (ED) 2-in-1 on the same device: Edge Device is used for DCI.

· Individual Edge Device: The device only acts as an Edge Device.

· The H3C Super Controller can manage multiple SeerEngine-DC controllers in multiple data centers and orchestrate the DCI.

Cross-technology deployment

· H3C SeerEngine-DC and the H3C SeerAnalyzer can be installed on the same K8s nodes in a cluster as containers.

· The controller features and analyzer features are integrated in the same Web console.

Cross-domain deployment

· The H3C AD-DC data center network solution, AD-Campus campus network solution, and AD-WAN SD-WAN solution’s components can be installed on the same K8s nodes in a cluster as containers.

· The features in the H3C AD-DC solution, AD-Campus solution and AD-WAN solution are integrated in the same Web console.

Interoperability with OpenStack

· Interoperate with OpenStack to automatically provide network connectivity for OpenStack VMs.

· support VM creation, VM deletion, and VM Migration.

· Synchronize the OpenStack security group to be the security policy on the H3C vPort for Bare Metal servers.

· Display the synchronization status between H3C AD-DC and the OpenStack platform.

· Northbound configuration check.

· Configuration difference check between the OpenStack platform and H3C AD-DC (in case any configuration has been removed or modified by administrators accidentally on the controller).

· Northbound configuration synchronization.

· Synchronize the different configuration on the OpenStack platform to H3C AD-DC.

VMware

Interoperability with VMware vCenter to automatically provide network connectivity for VMs.

Microsoft system center

Interoperability with Microsoft System Center to automatically provide network connectivity for VMs.

Red Hat

Interoperability with Red Hat to automatically provide network connectivity for VMs.

Ansible

Interoperates with Ansible.

After installing H3C’s plugin in Ansible, administrators can use Ansible to automatically configure the network for H3C AD-DC.

Controller high availability

· Node-level controller failover: There is no traffic disruption when one controller node fails. The northbound service can recover rapidly when the leader controller node fails, and without service break when the backup node fails.

· 2+1+1 controller cluster disaster tolerance (2 nodes in one datacenter, 1 node + 1 backup node in anther datacenter) .

· In a 2+1+1 controller disaster tolerance mode deployment, when the datacenter with 2 nodes failed, administrators can quick start the backup node to restore the controller cluster and take over the whole network.

· 3+3+1 controller cluster disaster tolerance (three-node active controller cluster + three-node backup controller cluster + one-node arbitrator): One three-node controller deployment locally as the active controller. One three-node controller deployment in a remote disaster tolerance site with real-time data synchronization to the active controller. When the active controller is down, the remote controller can switchover to be the active controller and maintain the network service.

· Container-level controller failover: H3C AD-DC is installed on each K8s node as a container in the pod. In a typical three-node controller deployment, when one controller container fails, the system reload the container and recover the controller services automatically. There is no packet loss for existing services.

Configuration consistency audit

· Southbound configuration and data consistency audit: Audit the configuration difference between the controller and the switches. Synchronize the selected differences to the switches.

· Northbound configuration and data consistency audit: Audit the configuration difference between the OpenStack cloud platform and H3C AD-DC. Synchronize the selected difference to the controller.

· Configuration and data consistency audit between controller cluster nodes.

Business availability when the controller is offline

· No impact on existing services when the controller is offline.

· New VMs can be created to have network access when the controller is offline: If the service has been created on the controller before and the “VXLAN Service Preconfiguration” option is enabled.

MLAG GIR

Graceful Insertion and Removal (GIR) for DRNI (MLAG) devices .

Put one device into maintenance mode to migrate all traffic on it to the other DRNI (MLAG) member. Then upgrade the device with 0 packet loss..