De-Risking New Service Provider Technology Deployments – Introduction to the UVFA: Features & Apps

Gigamon has pioneered the Unified Visibility Fabric solution. The Unified Visibility Fabric sits between the production network and the monitoring or management tools. It acts as a centralized fabric that delivers the relevant data from various networks under an administrative domain (including campus networks, branch/remote office networks, private cloud, or SDN islands that an enterprise or service provider may have), to a centralized set of tools that are connected to the Unified Visibility Fabric. In the process of delivering data from the production network to the tools, the Visibility Fabric provides a variety of functions such as filtering, replication, etc. to ensure that only the relevant data gets delivered to the tools. Traffic delivered to each tool can be individually tuned within the fabric, independent of the traffic profile of other tools in order to optimize the functioning of each tool. In other words, non-relevant traffic to a tool can be filtered out/dropped from the set of traffic delivered to that tool without affecting the traffic delivered to other tools. This can be done independently for each tool. The Unified Visibility Fabric takes care of replicating, filtering, and forwarding traffic based on each individual tool’s traffic profile. In addition to filtering and replication, the Visibility Fabric performs several other key functions in order to offload the tools. For example, some of these functions may include:

• Packet Masking: Masking out certain sections of the packet data (social security numbers, for example) in order to ensure confidentiality of data.
• Packet Slicing:Many tools do not need to see the entire data packet. They operate on say the first 128 or 256 bytes of the packet. In these cases, sending an entire 1500 byte Ethernet packet or a 9k byte Ethernet packet to a tool only serves to increase the burden on the tools. The Visibility Fabric can slice the packet down to only the size relevant to the tool before delivering it to the tools so as to optimize tool usage.
• De-Duplication:In many cases, the network is tapped at multiple tiers (such as access, aggregation, and core.) As a consequence, the same packet may be delivered to a tool multiple times, once for each point where the network is tapped. In some cases, this leads to significantly higher processing overhead for tools which do not need to see the multiple copies of the same packet. In this case, de-duplicating the traffic and sending only a single copy of the packet to the tools is highly desirable and this function too can be performed within the Visibility Fabric

Other functions that the Visibility Fabric may enable include time stamping, deterministic sampling and delivery of data, among others.

Figure 1: An example of a network with tool proliferation

Figure 2: An example of a network with the Gigamon Visibility Fabric architecture deployed

Unified Visibility Fabric Architecture

The Unified Visibility Fabric consists of multiple components that taken together constitute the Unified Visibility Fabric architecture (UVFA).

Services

The Services layer consists of Visibility Fabric nodes that connect into the data/production network on one side and a set of tools on the other side. On the network side, the Visibility Fabric nodes provide a variety of options to connect into the network and collect data. These include TAP modules, inline bypass modules, as well options for connecting to the mirror/SPAN ports on network devices. A variety of speeds and connectivity options are available from 1Gb all the way to 100Gb as well as short reach and long haul options. On the tool side a variety of interface speeds and options are supported. The Visibility Fabric nodes provide a set of key services for delivery of data to the tools. These services include packet filtering, packet replication, packet time-stamping, as well as packet transformation such as packet slicing and packet masking. At the heart of the Visibility Fabric nodes is a key patented technology developed by Gigamon called Flow Mapping® which allows users to specify individual traffic delivery profiles based on the tools connected to the Visibility Fabric nodes. Where visibility is desired into virtualized environments, Visibility Fabric nodes are available as virtual machines that can be fired up on a hypervisor and tunnel VM traffic back to the Visibility Fabric and to the tools connected to the Visibility Fabric. Filtering and Flow Mapping are done within the VM-based Visibility Fabric nodes, thereby only tunneling relevant traffic back to the Visibility Fabric. Nodes are also available for remote/branch offices to provide local filtering and Flow Mapping capability within the branch/remote office and tunneling just the relevant traffic to the centralized tools.

Figure 3: The Gigamon Unified Visibility Fabric architecture

Management

The Management layer provides two key functions. It provides an intuitive GUI driven approach to manageability along with a centralized approach to bringing multiple Visibility Fabric nodes under one management umbrella. This can greatly simplify the deployment and management of Visibility Fabric nodes across islands of topologies such as campus networks, remote/branch offices, virtualized environments, and in the future SDN deployments as well. The other key function that the management layer enables is the servicing of multiple IT departments (such as security, applications, networking, etc.) which effectively function as multiple tenants to the Unified Visibility Fabric. Each tenant can specify what traffic they would like the Visibility Fabric to send to their tools along with which operations they would like the fabric to perform on their data before delivery to the tools. In effect, the management layer provides the ability to virtualize the Visibility Fabric.

Orchestration

The Orchestration layer will consist of a set of APIs* and programmatic interfaces* that will ultimately enable the Visibility Fabric to integrate with tools, applications, and orchestration solutions. In this sense the orchestration layer will become an enabler to orchestration of the Visibility Fabric. The APIs will be used for a variety of purposes, For example, to allow tools to integrate more tightly with the Visibility Fabric and provide just in time tuning of the Visibility Fabric. The APIs* may also be used to enable a set of application developers to develop visibility applications that take advantage of the Visibility Fabric.

Applications

The Applications layer consists of a set of applications that leverages the other components of the Visibility Fabric. The applications layer can provide a variety of enhancements and optimizations built on top of the Visibility Fabric. As an example, de-duplication is one such application. The de-duplication application enables tool optimization by recognizing multiple copies of packets that are tapped or mirrored across multiple points in the network then filters out the extraneous copies and delivers a single copy of the packet to the tool. Various other applications are currently under development. Taken together, the various components of the Unified Visibility Fabric architecture provide a versatile and comprehensive solution to addressing the growing challenge of visibility in the midst of industry shifts such as virtualization, cloud computing, mobility, and the consumerization of IT.

Benefits of the Unified Visibility Fabric Approach

The Unified Visibility Fabric is fundamentally changing the way data is delivered to tools. By consolidating and connecting tools into the Visibility Fabric instead of connecting them directly into the production network, several benefits are realized:

• Less disruption to the production network—The Visibility Fabric enables a “wire once” model where the Visibility Fabric is set up once to TAP or SPAN at various relevant points from the production network. Any tools that need to be enabled can be conveniently added to the Visibility Fabric with no disruption to the production network. Traffic patterns to the tools can be changed, tools can be upgraded, taken down, etc. similarly without any impact to the production network.
• Better tool accuracy and utilization—By delivering only the relevant data to the tools as well as reducing the processing the tools need to do through offload operations performed in the Unified Visibility Fabric such as packet slicing, or de-duplication, tools are better able to keep up with the traffic flow with fewer packet drops. This leads to more accurate analysis by the tools as well as better utilization of the tools.
• Lower TCO (and therefore better ROI) — By centralizing the tools and delivering only relevant data to the tools, the number of tools and probes deployed can be significantly reduced. Furthermore, as the network infrastructure is upgraded, the monitoring and tool infrastructure no longer has to go through a “rip and replace” cycle. The tools continue to connect into the Visibility Fabric and the Visibility Fabric can be tuned to manage the data streams to the tools. Finally, as the Visibility Fabric optimizes the data stream delivered to the tools, the load on the tools is reduced resulting in more efficient utilization of the tools—which extends the longevity of the tools, as well as results in fewer tools and probes. All of this taken together reduces the total cost of ownership for the monitoring and management infrastructure.

Summary

The Unified Visibility Fabric architecture provides a new approach to monitoring and management of IT infrastructure. By centralizing tools and connecting them into the Visibility Fabric, significant cost savings and operational efficiencies can be realized. The Unified Visibility Fabric architecture provides pervasive visibility across campus, branch, virtualized and, ultimately, SDN islands and consists of four key components—Visibility Fabric nodes, Management, Orchestration, and Applications, which when taken together provide a scalable, flexible and centralized Visibility Fabric solution.

*Denotes future feature/capability