Carpathia Hosting Inc., a provider of managed hosting services, recently added support for Vyatta software network appliances in its cloud service. The Vyatta net tools introduce an interesting new dimension to cloud computing because they can be evoked at will, where and when needed, something that is impossible with hardware, says Carpathia CTO Jon Greaves. Network World Editor in Chief John Dix caught up with Greaves via phone to find out how the combination of these technologies is changing the game.
Before we dig in on how you’re using the Vyatta tools, give us a thumbnail on your company.
Carpathia started off in 2003 in what used to be generically called the hosting space. Today, we have two specialties: complex hosting solutions and compliant hosting solutions. On the complex side, there is a metric used by analysts depicting the number of servers per customer. For most hosting firms, this falls in the 2-4 server range, while our average is north of 20. The second focus is on compliance, particularly in the public sector, which counts for roughly 45% of our revenue.
Our portfolio of services is actually pretty straightforward. It consists of three key product sets: co-location — available in 13 data centers around the world; managed services, where we provide the infrastructure (server, router and network assets) and the care and feeding of those resources; and the most recent service, a very robust cloud service portfolio. And we can wrap all of those with compliance.
Our cloud services can be used in a few different ways. There is the pure infrastructure-as-a-service (IaaS) model, the kind of hands-off Amazon-like solution where we give the customer the platform and they do whatever they want. But we see a lot of demand for a more highly-managed cloud, where customers want certain virtual machines that are deemed valuable to fall under the rigor of our ITIL-based operating process and procedures and get an extra level of support.
SERVER VIRTUALIZATION: 6 management myths
OK. How are you using Vyatta’s software appliances?
One of the things we have been looking at on the cloud front is making complex hosting more enterprise-friendly from a network point of view. When you look at most cloud platforms — let’s pick on Amazon, for example — you really have a flat network. You have a VM that has a public IP space and there is probably some degree of isolation between your VM and other VMs, but it’s pretty minimal.
And what we’ve heard from customers is, that’s great if you have a nice green field application you’re designing for the cloud and you can build in extra controls, but in reality there are a lot of legacy applications going to the cloud. These applications require a degree of segregation between either the tiers of applications — say, the database and app tier — or different functional areas. This is especially true in federal computing. So we’ve been building a very unique set of network capabilities into our cloud platform. I’ll run through them quick and then plug in how Vyatta fits in.
The first unique capability is, our cloud has true private networking. So as a cloud user you can provision on-demand VLANs (true tagged VLANs) and have as many of those as you need. They are delivered in real time through our orchestration engines and turned on and off as needed. That allows us to accommodate VMs that are more complex from a topology point of view. For example, you can have a VM that has a public interface with a public IP address and a private network interface that you may call DMZ, or you may have a Web server that sits on two segments that are isolated.
Then we added the ability to extend those networks into and out of the cloud. Often customers are already in a data center we’re in and they either want to connect directly with our cloud or want to use the cloud as a way of getting extra capacity on demand for existing platforms. So we can take a cross connect, a fiber connection from wherever the customer is in that data center, terminate that in our back-end cloud switches, and then take the customer cloud-provisioned VLAN and deliver this over the cross connect to allow a Layer 2 connection from our cloud directly into the customer’s infrastructure. This provides an extremely low-latency form of cloud bridging.
Since these networks are basically Layer 2-provisioned, the customer can use their own IP addressing scheme, allowing them to easily integrate our cloud platform into their own security domains and infrastructure — or perhaps fitting behind a firewall and used as a demarcation point between the cloud and their dedicated infrastructure. In any event, it gives them a huge amount of flexibility to use our cloud for an on-demand computing resource, versus what you typically see with an Amazon, Terremark or any of the other cloud providers where you VPN in and out of the cloud (incurring bandwidth charges) to get that kind of capability. Carpathia can do a home run direct connection into our cloud — and that makes us pretty unique.
And Vyatta’s role?
Vyatta enables us to deliver virtual machine appliances that provide firewalling, intrusion prevention, VPN, etc., that we can snap into this infrastructure wherever the customer wants. So a simple example might be to use a Vyatta VM to span a public network and a private network. You can then put your Web servers on the private network on true private address space and have Vyatta act as a traditional firewall and provide intrusion prevention.
Another example is to move Vyatta deeper into your infrastructure and have it sit between your VLAN supporting your application servers and the VLAN supporting your database servers. Then you can implement some deep policy checking to ensure only the right traffic — say SQLnet traffic — flows between those domains.
The really interesting thing with the Vyatta appliance is you can now fully inspect all the traffic as it flows through the network. Normally with a cloud platform you get a little bit of monitoring on the front end, but when you get deep into the cloud the VM-to-VM communication is pretty much the “Wild West.” You have very little control over that. The Vyatta appliances allow us to embed — really anywhere the customer wants — an instance of firewall, IPS, VPN — all of the great capabilities of Vyatta — deep into the application architecture.
And with Vyatta the customer can define policy for all of those. So they can say, “On my front-end network, I am going to have two VLANs and those VLANs have this rule set between them.” In the old Carpathia model that rule set was something the customer would have to solve for. With the Vyatta VM, the customer can now deploy a Vyatta instance and then completely tailor it for themselves.
Before we dive deeper, what’s driving the rest of your network infrastructure?
A combination of Carpathia-developed tools and an orchestration engine we use extensively from a company called Yunteq.
And in terms of your core switches?
We have a mix of environments, but we use a lot of Cisco equipment. But when it comes to the way we are doing this back-end switching, I think we’ve taken quite a novel approach. Many virtualization companies try to put a lot of intelligence in the switching fabric. You see, for example, the Cisco Nexus switches providing VMware-aware switching.
What we elected to do is different. We actually use commodity Layer 2 switches and our own orchestration layer. So as VMs move around and VLANs need to be created, instead of the switch doing that, we treat the switch as a slave device we can direct on demand. So we can use commodity switches inside the core of our cloud versus a lot of high-end switches like other folks do.
Is that to say you’re creating a flat Layer 2 network?
It’s not really a flat network. There are multiple networks. In fact, inside one of these switching fabrics we have about 4,000 networks, all of these VLANs. And we use the orchestration tier to connect VMs to the right networks and make sure those networks are optimized appropriately between all of the switches we have inside our fabric.
If you look at the Cisco Nexus approach, you have a set of policies defined in the switch and the switch watching for traffic coming through and realizing that this tag from a VM belongs to that switch port. What we’ve done is flipped that on its head and use commodity switches and moved that controller intelligence into our orchestration tier. So when the VMs are provisioned or migrated or action is performed on those VMs, the controller is directing the VM to connect to the right switch configurations.
So to summarize, Vyatta gives us a lot of flexibility. Now instead of customers having cloudwide controls, we have some basic policies at the front of our clouds and then within each customer’s instantiation of their cloud environment they can deploy one or many Vyatta instances, giving them very fine-grain controls over everything from the traffic flow, to the firewall, to maybe inspecting traffic with IPS. I am not aware of any other clouds out there that have an IPS capability that the customer can turn on.
How far along are you with this?
We’re just starting. We have a few beta customers using the Vyatta platform and now are looking to ramp up and get more and more customers on board.
Did you consider approaches other than Vyatta?
We looked at a few. We looked at the usual suspects in hardware networking, but what we found is it is very difficult to do this level of integration. If we had Cisco or a Juniper at the front door, it would be easy to use their APIs and configure that one hardware instance to set basic policy. But it becomes difficult to do that on a per-tenant basis and offer really fine-grain controls. With Vyatta, it’s a VM that is dedicated to one customer and if they want a firewall, they just turn on the firewall and the customer can control their policy on that firewall. I am not aware of other products that do that. I think a lot of larger network companies have aspirations, but I think Vyatta is the pretty clear leader in that space.
Did you have reservations about doing business with a small company for this functionality?
Almost the opposite. It was great to get the engagement we’ve had with the Vyatta executive team. Vyatta is deployed in some interesting locations globally, so we have confidence in the software. The bigger mental leap was going from having a brick you can point at, like a Cisco ASA or a Juniper SRX that provides a function, and going to a virtual machine. Once you make that leap you can move from having your networking being constrained by a box it runs in, to being free to run wherever there is a hypervisor. That really starts to allow you to embrace some cool things in the cloud.
And that’s the big driver for us: Customers have said loud and clear that the cloud needs to be more than just simple flat networks where everybody’s got a public IP and there is little security between everybody. They want more robust, topology-driven environments where they can set fine grain controls and policies and move traffic as appropriate, which is what the Vyatta approach gives us.
How do customers evoke the Vyatta tools?
We have a template library and customers can create a VM based on those templates and inherit all the software that is in that template. So when a customer says, “I want to create a Vyatta VM,” our orchestration layer sends the request into the template server that then deploys an instance of Vyatta into one of the virtual machines in our cloud farm.
Do you see software network appliances ever displacing some of your more standard, legacy network equipment?
I think it’s a complement, rather than a displacement. I can give you a good example. If you have a traditional switch and you plug in six or seven servers to form a small cloud and you deploy a VM, the orchestration layer defines where that VM is going to live and the switch needs to be aware of how the cloud is operating. That goes the same for a lot of these traditional platforms. You can’t have a static set of hardware and then run a dynamic configuration inside of it.
So, I think there is going to be a lot of pressure for network vendors to embrace the cloud so if components fail in the cloud, say a server fails, the cloud heals by the moving workloads elsewhere. That is a very alien process to many of the switching/routing platforms out there. You can run them in high availability mode so if one side fails the other side takes over, but you rarely see the whole application just moved to another location inside an environment or data center. That is the power of the cloud, so a lot of these providers have to catch up with that kind of thinking versus trying to use the old way of doing things to try to engineer clouds.
How do you manage these new, complex, fluid environments?
We have a whole bunch of monitoring tools that give us a single-pane glass view of the environment. So if the customer is looking for us to manage all this infrastructure, if they want Carpathia to respond to monitoring alarms, etc., that is easy for us to do. Everything is already instrumented for that. But customers have a lot of choices. We are very flexible.
OK. Thanks. Interesting stuff. Anything in closing?
We are just getting started; the network is the next logical target for cloud innovation. The cloud offers us a chance to start delivering per-tenant networking as a virtual machine. We are working with many other partners to extend this approach to areas such as load balancing, WAN optimization, etc. It’s an exciting time to be involved in the innovation being driven in networking by the cloud.
