Skip to content

Commit 8bd6d3c

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #264473 from joemarshallmsft/joe/Isolation-domains-overview
Joe/isolation domains overview
2 parents 0a399be + d3622e9 commit 8bd6d3c

6 files changed

+530
-2
lines changed

‎articles/operator-nexus/TOC.yml

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,17 @@
2222
href: concepts-network-fabric-controller.md
2323
- name: Network Fabric Services
2424
href: concepts-network-fabric-services.md
25-
- name: Access Control Lists
26-
href: concepts-access-control-lists.md
25+
- name: Isolation Domains
26+
expanded: false
27+
items:
28+
- name: Isolation Domains overview
29+
href: concepts-isolation-domain.md
30+
- name: Isolation Domain configuration
31+
href: reference-isolation-domain-configuration.md
32+
- name: Technical requirements for Isolation Domains
33+
href: reference-isolation-domain-technical-requirements.md
34+
- name: Access Control Lists
35+
href: concepts-access-control-lists.md
2736
- name: Nexus Kubernetes
2837
href: concepts-nexus-kubernetes-cluster.md
2938
- name: Observability
@@ -101,6 +110,8 @@
101110
items:
102111
- name: Isolation Domain
103112
href: howto-configure-isolation-domain.md
113+
- name: Isolation Domain Configuration Examples
114+
href: reference-isolation-domain-configuration-examples.md
104115
- name: Network Fabric Route Policy
105116
href: how-to-route-policy.md
106117
- name: Network Packet Broker

‎articles/operator-nexus/concepts-isolation-domain.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
title: Azure Operator Nexus Isolation Domains
3+
description: Overview of Isolation Domains for Azure Operator Nexus.
4+
author: joemarshallmsft
5+
ms.author: joemarshall
6+
ms.reviewer: jdasari
7+
ms.date: 01/29/2024
8+
ms.service: azure-operator-nexus
9+
ms.topic: conceptual
10+
---
11+
12+
# Isolation Domain Overview
13+
14+
An Isolation Domain resource enables the creation of layer-2 and layer-3 networks that your network functions can connect to. This enables inter-rack and intra-rack communication between the network functions. The Operator Nexus Network Fabric (NNF) Service enables three types of isolation domain:
15+
16+
- **Layer-2 isolation domain** - provides layer-2 networking capabilities within and across the racks for workloads running on servers. Workloads can take advantage of the isolated layer-2 network to establish direct connectivity among themselves at layer 2 and above.
17+
18+
- **Layer-3 isolation domain with Internal Networks** - provides workloads the ability to connect across a layer 3 (IP) network.
19+
20+
- **Layer-3 isolation domain with External Network** - provides workloads the ability to connect across a layer 3 network, and provides connectivity to the operator's network outside of the Operator Nexus network fabric.
21+
22+
An isolation domain offers:
23+
24+
- Unified network capabilities with full integration with your compute resources, enabling connectivity between your Operator Nexus platform workloads.
25+
26+
- Northbound connectivity with customer routers using BGP peering sessions between the Operator Nexus network fabric and the operator's external network.
27+
28+
- Southbound connectivity with telco workloads using internal networks.
29+
30+
- API driven unified layer 2 and layer 3 configuration for North-South and East-West traffic.
31+
32+
- Full isolation between isolation domains - packets from one domain aren't sent to workloads in another isolation domain on the same Operator Nexus Network Fabric. Services in one domain are invisible to services in another.
33+
34+
- The ability to create flexible network topologies by adding or removing workloads to an isolation domain as needed.
35+
36+
## Layer 2 Isolation Domains
37+
38+
A layer 2 isolation domain provides L2 networking capabilities between workloads within across racks. Workloads can use the isolated layer-2 network to establish direct connectivity among themselves.
39+
40+
The NNF enables operators to provision and manage layer 2 isolation domains below resource level. Each layer-2 isolation domain has an associated VLAN ID. If a workload needs connectivity to multiple VLANs, multiple layer-2 isolation domains must be created. A separate NIC resource is required for each layer-2 domain that the workload connects to.
41+
42+
## Layer 3 Isolation Domains
43+
44+
A layer 3 isolation domain provides workloads with the ability to exchange layer-3 routing information through the Operator Nexus network fabric and with external networks.
45+
46+
Layer-3 isolation domains can provide two types of network:
47+
48+
- **Internal Network** - a Layer 3 Isolation Domain Internal Network enables east-west layer 3 communication between workloads on the Operator Nexus Network fabric. An internal network is a complete solution for layer-3 inter and intra-rack communication for compute workloads. Each workload can connect to multiple internal networks.
49+
50+
- **External Network** - a Layer 3 Isolation Domain External Network enables workloads to communicate with external services via the operator network. An external network creates a communication channel between Operator Nexus workloads and services hosted outside of the Operator Nexus network fabric. Each Layer 3 isolation domain supports one external network.

‎articles/operator-nexus/media/isolation-domain-multidomain-tenant-networking.png

116 KB
Loading

‎articles/operator-nexus/reference-isolation-domain-configuration-examples.md

Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
---
2+
title: Azure Operator Nexus Isolation Domain configuration examples
3+
description: Isolation domain configuration examples.
4+
author: joemarshallmsft
5+
ms.author: joemarshall
6+
ms.reviewer: jdasari
7+
ms.date: 02/02/2024
8+
ms.service: azure-operator-nexus
9+
ms.topic: reference
10+
---
11+
12+
# Configuration examples for creating an isolation domain
13+
14+
This article gives examples of how to configure isolation domains in various scenarios.
15+
16+
## Create an L2 isolation domain
17+
18+
In this example, we create a layer 2 isolation domain with the following properties:
19+
20+
- Name: `l2domain1`
21+
- Resource group: `rg1`
22+
- Location: `eastus`
23+
- Network fabric ID: `nf1`
24+
- VLAN ID: 600
25+
26+
**Command**:
27+
28+
```azurecli
29+
az networkfabric l2domain create \
30+
--resource-group rg1 \
31+
--name l2domain1 \
32+
--location eastus \
33+
--network-fabric-id nf1 \
34+
--vlan-id 600
35+
```
36+
37+
**Expected output:**
38+
39+
```
40+
{
41+
"administrativeState": "Enabled",
42+
"id": "/subscriptions/xxxxxx-xxxxxx-xxxx-xxxx-xxxxxx/resourceGroups/rg1/providers/Microsoft.ManagedNetworkFabric/l2IsolationDomains/l2domain1",
43+
"name": "l2domain1",
44+
"networkFabricId": "/subscriptions/xxxxxx-xxxxxx-xxxx-xxxx-xxxxxx/resourceGroups/NFResourceGroupName/providers/Microsoft.ManagedNetworkFabric/NetworkFabrics/nf1",
45+
"provisioningState": "Succeeded",
46+
"resourceGroup": "rg1",
47+
"systemData": {
48+
"createdAt": "2023-XX-XXT12:34:56.789012+00:00",
49+
"createdBy": "[email protected]",
50+
"createdByType": "User",
51+
"lastModifiedAt": "2023-XX-XXT12:34:56.789012+00:00",
52+
"lastModifiedBy": "[email protected]",
53+
"lastModifiedByType": "User"
54+
},
55+
"type": "microsoft.managednetworkfabric/l2isolationdomains",[^2^][2]
56+
"vlanId": 600
57+
}
58+
```
59+
60+
## Create an L3 isolation domain.
61+
62+
To create an L3 isolation domain, you can follow these steps:
63+
64+
- Use the `az networkfabric l3domain create` command to create an L3 isolation domain. You must specify the required parameters:
65+
66+
- Resource group
67+
- Resource name
68+
- Location
69+
- Network fabric ID.
70+
71+
You can also specify optional parameters, such as:
72+
- Redistribute connected subnets
73+
- Redistribute static routes
74+
- Aggregate route configuration
75+
- Connected subnet route policy.
76+
77+
- Use the `az networkfabric internalnetwork create` command to create one or more internal networks for the L3 isolation domain. You need to provide:
78+
79+
- The VLAN ID
80+
- Connected IPv4 or IPv6 subnets
81+
- BGP configuration for each internal network.
82+
83+
You can also specify optional parameters, such as:
84+
85+
- MTU
86+
- Static route configuration
87+
- Extension.
88+
89+
- Use the `az networkfabric externalnetwork create` command to create an external network for the L3 isolation domain. You need to choose the peering option (Option A or Option B) and provide the corresponding properties, such as peer ASN, VLAN ID, primary and secondary IPv4 or IPv6 prefixes, and route targets.
90+
91+
- Use the `az networkfabric l3domain update-admin-state` command to enable the L3 isolation domain. You must enable the isolation domain to push the configuration to the network fabric devices.
92+
93+
**Example** :
94+
95+
In this example, we create an L3 isolation domain with the following properties:
96+
97+
- Name: `example-l3domain`
98+
- Network fabric ID `/subscriptions/xxxxxx-xxxxxx-xxxx-xxxx-xxxxxx/resourceGroups/NFResourceGroupName/providers/Microsoft.ManagedNetworkFabric/NetworkFabrics/NFName`.
99+
100+
**Command:**
101+
102+
```azurecli
103+
az networkfabric l3domain create \
104+
--resource-group "ResourceGroupName" \
105+
--resource-name "example-l3domain" \
106+
--location "eastus" \
107+
--nf-id "/subscriptions/xxxxxx-xxxxxx-xxxx-xxxx-xxxxxx/resourceGroups/NFResourceGroupName/providers/Microsoft.ManagedNetworkFabric/NetworkFabrics/NFName"
108+
```
109+
110+
## Create an Internal Network
111+
112+
In this example, we create an internal network with the following properties:
113+
114+
- VLAN ID: 1001
115+
- IPv4 subnet: 10.0.0.0/24
116+
- L3 isolation domain name: `example-l3domain`
117+
118+
**Command:**
119+
120+
```azurecli
121+
az networkfabric internalnetwork create \
122+
--resource-group "ResourceGroupName" \
123+
--l3-isolation-domain-name "example-l3domain" \
124+
--resource-name "example-internalnetwork" \
125+
--vlan-id 1001 \
126+
--connected-ipv4-subnets '[{"prefix":"10.0.0.0/24"}]' \
127+
--mtu 1500
128+
```
129+
130+
This similar example uses an IPv6 address instead of IPv4:
131+
132+
```azurecli
133+
az networkfabric internalnetwork create \
134+
--resource-group "ResourceGroupName" \
135+
--l3-isolation-domain-name "example-l3domain" \
136+
--resource-name "example-internalnetwork" \
137+
--vlan-id 1002 \
138+
--connected-ipv6-subnets '[{"prefix":"10:101:1::0/64"}]' \
139+
--mtu 1500
140+
```
141+
142+
In this example, we add BGP configuration:
143+
144+
```azurecli
145+
az networkfabric internalnetwork create \
146+
--resource-group "ResourceGroupName" \
147+
--l3-isolation-domain-name "example-l3domain" \
148+
--resource-name "example-internalnetwork" \
149+
--vlan-id 1003 \
150+
--connected-ipv4-subnets '[{"prefix":"10.1.2.0/24"}]' \
151+
--mtu 1500 \
152+
--bgp-configuration '{"defaultRouteOriginate": "True", "allowAS": 2, "allowASOverride": "Enable", "PeerASN": 65535, "ipv4ListenRangePrefixes": ["10.1.2.0/28"]}'
153+
```
154+
155+
## Creating External Networks
156+
157+
This example creates an external network using Option B with IPv4 and IPv6 route targets
158+
159+
**Command:**
160+
161+
```azurecli
162+
az networkfabric externalnetwork create \
163+
--resource-group "ResourceGroupName" \
164+
--l3domain "example-l3domain" \
165+
--resource-name "example-externalnetwork" \
166+
--peering-option "OptionB" \
167+
--option-b-properties "{routeTargets:{exportIpv4RouteTargets:['65045:2001'],importIpv4RouteTargets:['65045:2001'],exportIpv6RouteTargets:['65045:2002'],importIpv6RouteTargets:['65045:2002']}}"
168+
```
169+
170+
**Expected output:**
171+
172+
```
173+
{
174+
"administrativeState": "Enabled",
175+
"id": "/subscriptions/xxxxxx-xxxxxx-xxxx-xxxx-xxxxxx/resourceGroups/NFResourceGroupName/providers/Microsoft.ManagedNetworkFabric/l3IsolationDomains/example-l3domain/externalNetworks/example-externalnetwork",
176+
"name": "example-externalnetwork",
177+
"optionBProperties": {
178+
"exportRouteTargets": [
179+
"65045:2001",
180+
"65045:2002"
181+
],
182+
"importRouteTargets": [
183+
"65045:2001",
184+
"65045:2002"
185+
],
186+
"routeTargets": {
187+
"exportIpv4RouteTargets": [
188+
"65045:2001"
189+
],
190+
"importIpv4RouteTargets": [
191+
"65045:2001"
192+
],
193+
"exportIpv6RouteTargets": [
194+
"65045:2002"
195+
\,
196+
"importIpv6RouteTargets": [
197+
"65045:2002"
198+
]
199+
}
200+
},
201+
"peeringOption": "OptionB",
202+
"provisioningState": "Succeeded",
203+
"resourceGroup": "ResourceGroupName",
204+
"systemData": {
205+
"createdAt": "2023-XX-XXT15:45:31.938216+00:00",
206+
"createdBy": "[email protected]",
207+
"createdByType": "User",
208+
"lastModifiedAt": "2023-XX-XXT15:45:31.938216+00:00",
209+
"lastModifiedBy": "[email protected]",
210+
"lastModifiedByType": "User"
211+
},
212+
"type": "microsoft.managednetworkfabric/l3isolationdomains/externalnetworks"
213+
}
214+
```
215+
216+
This example creates an external network using Option A with IPv4 and IPv6 prefixes:
217+
218+
```azurecli
219+
az networkfabric externalnetwork create \
220+
--resource-group "ResourceGroupName" \
221+
--l3domain "example-l3domain" \
222+
--resource-name "example-externalnetwork" \
223+
--peering-option "OptionA" \
224+
--option-a-properties '{"peerASN": 65026,"vlanId": 2423, "mtu": 1500, "primaryIpv4Prefix": "10.18.0.148/30", "secondaryIpv4Prefix": "10.18.0.152/30", "primaryIpv6Prefix": "fda0:d59c:da16::/127", "secondaryIpv6Prefix": "fda0:d59c:da17::/127"}'
225+
```
226+
227+
**Expected output:**
228+
229+
```
230+
{
231+
"administrativeState": "Enabled",
232+
"id": "/subscriptions/xxxxxx-xxxxxx-xxxx-xxxx-xxxxxx/resourceGroups/ResourceGroupName/providers/Microsoft.ManagedNetworkFabric/l3IsolationDomains/example-l3domain/externalNetworks/example-externalnetwork",
233+
"name": "example-externalnetwork",
234+
"optionAProperties": {
235+
"fabricASN": 65050,
236+
"mtu": 1500,
237+
"peerASN": 65026,
238+
"primaryIpv4Prefix": "10.18.0.148/30",
239+
"secondaryIpv4Prefix": "10.18.0.152/30",
240+
"primaryIpv6Prefix": "fda0:d59c:da16::/127",
241+
"secondaryIpv6Prefix": "fda0:d59c:da17::/127",
242+
"vlanId": 2423
243+
},
244+
"peeringOption": "OptionA",
245+
"provisioningState": "Succeeded",
246+
"resourceGroup": "ResourceGroupName",
247+
"systemData": {
248+
"createdAt": "2023-XX-XXT09:54:00.4244793Z",
249+
"createdAt": "2023-XX-XXT07:23:54.396679+00:00",
250+
"createdBy": "[email protected]",
251+
"lastModifiedAt": "2023-XX-XX1T07:23:54.396679+00:00",
252+
"lastModifiedBy": "[email protected]",
253+
"lastModifiedByType": "User"
254+
},
255+
"type": "microsoft.managednetworkfabric/l3isolationdomains/externalnetworks"
256+
}
257+
```

0 commit comments

Comments
 (0)