VMware

This Question is Possibly Answered

1 "correct" answer available (10 pts) 2 "helpful" answers available (6 pts)
1 2 Previous Next 20 Replies Last post: Dec 10, 2008 8:20 AM by williambishop  

FCoE - Friend or Foe? posted: Dec 3, 2008 5:20 PM

Click to view RBurns-WIS's profile Novice 28 posts since
Dec 18, 2007
I'm trying to get the opinion from various professionals in the industry on their thoughts of FCoE (Fiber Channel over Ethernet). I myself am a big supported. For those who are new to the concept of FCoE I'll briefly explain: FCoE allows the consolodation of multiple traffic flows including LAN, Management, Storage, IPC, VMotion etc over a shared medium. This medium is 10G ethernet. FCoE uses Priority Flow Control (PFC) and congestion control utilizing a buffer credit mechanism to provide a "lossless" medium essential to carry Fiber Channel storage traffic. Take an ESX server in a corporate network. You probably have two or three 1GB LAN connections, two FC connections for Storage, one dedicated connection for Management, one connection for Vmotion and potentially more depending on your configuration. At minimum most ESX servers have no less than 6 Network connections at any time. These connections can be replaced with two redundant FCoE connection. Understandibly FCoE requires special switches such as the Cisco Nexus 5000 series which can aggregate Native Fiber Channel, Ethernet and FCoE traffic. In turn these switches would link up to the backbone core switches and Fiber Channel director switches.

There is a slight cost associated to the new type of network card called a Converged Network Adapter (CNA) as well as the switches. These costs can normally be recouped by the reduction in cables & switch ports, power savings, increased performance and centralized management.

I'd like to hear anyones opinion, concerns or comments. If you have any questions I'll be glad to answer them.

Cheers.

Rob

Re: FCoE - Friend or Foe?

1. Dec 3, 2008 5:40 PM in response to: RBurns-WIS
Click to view K-MaC's profile Expert 478 posts since
Jun 16, 2008

Do you work for Cisco?


Cheers

Kevin

Re: FCoE - Friend or Foe?

3. Dec 3, 2008 7:37 PM in response to: RBurns-WIS
Click to view williambishop's profile Master 1,159 posts since
Mar 9, 2006

I know I'm shocked.... ;)

Seriously though, FCOE and the new datacenter network (both from cisco and brocade) basically call for a plant forklift replacement. For those of us with substantial installations, this is not a "slight" cost upgrade...

Starting new, yeah, it's feasible. But it's also bleeding edge, so it will take a while before it gets grip and starts gaining momentum. Personally, in 6-10 years, I imagine it will be mainstream. But it's VERY expensive tech right now. Sure, I'm going to throw out the million dollars just in FC infrastructure I own.....Or am I? Would I be willing to try it? Yep. Just bring down the chassis into a smaller form factor so I can afford to test it. The last 9000 series switch I bought cost me about 12k vs. the 50k of the competing switch just two years earlier, and offers a lot more functionality. FC is cheap to implement these days. I don't see FCOE biting into that anytime soon. And that's not even taking into consideration the worry that a lot of us have with lowering our security by moving it to copper based connectivity from glass....Or the risk of running all of our eggs through one basket. Pass for now.

Re: FCoE - Friend or Foe?

4. Dec 4, 2008 4:41 AM in response to: RBurns-WIS
Click to view Rodos's profile Expert 444 posts since
Apr 20, 2007
Rob, you just got branded as failing the "don't be evil" test. Shame on you Cisco. As soon as I read your post I thought, he works for Cisco. I jumped in to ask and I was beaten to it. I do give you credit for being brave enough to state it.

As someone who is delving into this deeply (I have the kit in my lab) I am not going to answer your question, even if you had the best of intentions. There are plenty of us here who will be discussing this in depth, but this is a cummunity forum and we all try to leave our organisations and agenda at the door if we can (or be better at hiding it :) )

If you had of said. "Hey guys, I work for Cisco and I am trying to find out these specific things and here is why " or if you had a post history above 13, you may have got some traction.

Sorry if I sound harsh, its been a 19 hour day.

In summary. Great question. Answer, hang around here for a few months and read the forums and I think you will get lots of insight into what people thing.

Considering awarding points if this is of use

Re: FCoE - Friend or Foe?

5. Dec 4, 2008 5:11 AM in response to: Rodos
Click to view king@it.ibm.com's profile Virtuoso 2,927 posts since
Jan 16, 2004
Rodos, don't be so bad.... Xmas is coming... ;-)

I don't think there is nothing wrong in a vendor asking that. It might turn into an interesting discussion for the whole community which might have been looking into this and they have now an opportunity to express their concerns (and possibly the vendor providing a rational why that shouldn't be a concern). Do you agree?

I tend to see these things as an opportunity rather than an offense. It might also give you a chance to challenge the vendor. Let me start first ;-)

As far as the converged network, Nexus 5000 hw switches / Nexus 1000 sw switches ..... is the Cisco x86 blade the new frontier to provide an integrated end-to-end solution for virtual environments?
http://www.virtualization.info/2008/12/cisco-to-enter-x86-server-market-with.html

Massimo.

Re: FCoE - Friend or Foe?

6. Dec 4, 2008 5:31 AM in response to: king@it.ibm.c…
Click to view Texiwill's profile Guru 10,212 posts since
Jan 13, 2004
Hello,

Lots of thought needs to go into using Converged networks. The question arises as to how this would actually be used, how security would be implemented. But before those questions can be answered we need to know how FCoE itself and it's switches protects against MiTM attacks as well as the other current crop of Layer 2 and Layer 3 switch attacks.


Best regards,
Edward L. Haletky
VMware Communities User Moderator
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
SearchVMware Blog: http://itknowledgeexchange.techtarget.com/virtualization-pro/
Blue Gears Blogs - http://www.itworld.com/ and http://www.networkworld.com/community/haletky
As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

Re: FCoE - Friend or Foe?

8. Dec 5, 2008 3:54 AM in response to: RBurns-WIS
Click to view Rodos's profile Expert 444 posts since
Apr 20, 2007
Rob, I will take you at your word. For an engineer you write like a salesman, but I have probably been accused of that myself at times :) Obviously I am turning into a grumpy old man for which I apologize . For what its worth I am a big Cisco fan and have been flogging it for years. Some of my best friends run IOS. :)

So you are keen to discuss and answer questions. Excellent, that is what we like around here. Let me clear the slate and let the discussion begin.

I would be keen to see some thoughts around Texiwill (Eds) question on security. He gets this security stuff and I only know enough on it to get myself into deep water but not out of it. I would not even know what questions to ask.

For the CNAs, are they all the same or are there differences across manufacturers? What considerations should people look at when choosing product? Do all present a single HBA and a single 10G network interface or can you get one that presents multiple? What do you think is coming down the track, do we need to or how do we future proof?

Typically one ends up with lots of ports in a server where physical separation of networks is required (multiple vSwitches) rather than using VLANs (one vSwitch and multiple port groups). Is this something that CNAs can help with?

How do we compare and contrast a bunch of rack servers with CNAs connecting into a Nexus which then uplinks to the DC fabric for ethernet and fibre, to a blade chassis with internal interconnects which then has a few uplinks to the DC fabric for ethernet and fibre. Whats the pros and cons between the two? If someone has comitted to the blade path what does this mean for the converged network space? If I am interested in moving into converged networks how does this effect my decision on server platforms? What do the blade vendors have on the horizon here.

Would be keen to hear your thoughts and insights on these things, as well as the thoughts of others. These are just some of the topics I am pondering in this space. Am I on the right track?

Rodos

Re: FCoE - Friend or Foe?

10. Dec 8, 2008 2:09 AM in response to: RBurns-WIS
Click to view Texiwill's profile Guru 10,212 posts since
Jan 13, 2004
Hello,

As for security Texiwill, what I can offer to address your concerns is what Cisco has come out with called TrustSec. TrustSec will allow for encryption of data between switches or between hosts & switches preventing MiTM attacks. I'm not an expert on TrustSec, but do know one of its advantages will be to address security concerns that are being identified as part of virtualization's maturing. I do hope this will grow into a standard protocol that can be used in environements with hardware from multiple vendors similar to IPSec.

The safety of this depends on the algorithms used for TrustSec, whether each VLAN and FCoE uses its own keys and therefore is separate, and uses pre-shared keys or certificates that the Administrator can control. If it is not per VLAN/FCoE link then break the encryption and all is lost. If it is not pre-shared keys/certificates that the administrator can setup then MiTM is still possible? How does TrustSec work in the virtual environment is it just from the Cisco vSwitch to the Nexus or is it from the VM to the Nexus and beyond the Nexus?

Ideally I would want from the vNIC through the vSwitch to the Core Switch to the Firewall. I would very much like pre-shared leys/certificates using IPsec as the basis.

How much compute power is required for this?


Best regards,
Edward L. Haletky
VMware Communities User Moderator
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
Blue Gears and SearchVMware Pro Blogs: http://www.astroarch.com/wiki/index.php/Blog_Roll
Top Virtualization Security Links: http://www.astroarch.com/wiki/index.php/Top_Virtualization_Security_Links

Re: FCoE - Friend or Foe?

11. Dec 9, 2008 1:10 AM in response to: RBurns-WIS
Click to view Rodos's profile Expert 444 posts since
Apr 20, 2007
I have had this thread open in my browser all day to reply to. However I keep getting distracted and have not had the 10 minutes to digest before replying.

But quickly, Scott Lowe just did a post on this subject called "Continuing the FCoE Discussion" @ http://blog.scottlowe.org/2008/12/09/continuing-the-fcoe-discussion/

Go read the post but here is a snippet.

how is FCoE any better than iSCSI?

  1. FCoE is always mentioned hand-in-hand with 10 Gigabit Ethernet. Can’t iSCSI take advantage of 10 Gigabit Ethernet too?
  2. FCoE is almost always mentioned in the same breath as “low latency” and “lossless operation”. Truth be told, it’s not FCoE that’s providing that functionality, it’s CEE (Converged Enhanced Ethernet). Does that mean that FCoE without CEE would suffer from the same “problems” as iSCSI?
  3. If iSCSI was running on a CEE network, wouldn’t it exhibit predictable latencies and lossless operation like FCoE?

I have posted a comment on Scotts blog to direct people here for some comments.

Rodos
Considering awarding points if this is of use

Re: FCoE - Friend or Foe?

12. Dec 9, 2008 1:22 AM in response to: Rodos
Click to view Rodos's profile Expert 444 posts since
Apr 20, 2007
Just a thought on this great question from Scott.

One difference is if you want to integrate into an existing FC fabric. You can use FCoE at the access layer and then integrate that into your existing FC switches. Many SANs don't support iSCSI or FC at the same time or alternatively don't allow access to the same LUN via FC and iSCSI at the same time.

Another is the breadth of tools for monitoring and troubleshooting FC.

Just a thought as to some of the differences.

Considering awarding points if this is of use

Re: FCoE - Friend or Foe?

14. Dec 9, 2008 4:58 AM in response to: RBurns-WIS
Click to view williambishop's profile Master 1,159 posts since
Mar 9, 2006

So it's biggest saving is in cabling plant? That's why I went to blades, but it saves more than enough that I dont' have to worry about further consolidation. FC and Blades so far has been my biggest ally, streamlining the process and the installation 10x.

I'm going to go with waiting on it mainstream.


W

VMware Developer

SDKs, APIs, Videos, Learn and much more in the Developer community.

Learn More

Developer Sample Code

Increase your developer productivity with VMware API sample code.

Learn More

VMworld Sessions & Labs

Online access to the latest VMworld Sessions & Labs and online services.

Learn more

Purchase PSO Credits Online

Purchase credits to redeem training and consulting services online.

Buy Now

Community Hardware Software

View reported configurations or report your own.

Learn More

VMware vSphere

Come witness the next giant leap in virtualization.

Register Today

Communities