Network Virtualization using Extreme Fabric Connect

Network Virtualization Using Extreme Fabric Connect
© 2019 Extreme Networks, Inc. All rights reserved. 164
The most stealth VSN is an L2 VSN where no IP interface has been defined, as this is a totally closed L2
environment where nothing can enter or exit unless otherwise provisioned. It is invisible to the IP protocol
as IP is not being used. IP can still run ‘inside’ the L2 VSN but with the IP subnet being established by the
devices that are attaching into it. This type of service is useful for protocols that are used for control and
management of security critical infrastructure such as power grids, subways, and trains as well as
automated production and manufacturing floors. These environments are extremely sensitive and
providing a totally closed L2 environment for these types of applications is very important.
Note
An L2 VSN where IP address(es) are defined on the VLAN of the terminating BEB(s) will
expose the L2 VSN to the routing domain (GRT IP Shortcuts, or VRF which may or may
not be part of an L3 VSN) to which that IP interface belongs. In this case, we would
consider the stealthness of that routing domain service.
With L3 VSN and IP Shortcuts, each IP subnet is advertised from its point of presence into IS-IS. Within
these service types, IP routing happens exclusively at ingress and egress of the SPB fabric. Each subnet
views itself as one hop away even though in reality there are a wide variety of potential ESPs involved in
the actual data transits. The core of the network is consequently ‘dark’ to the IP protocol.
As such, IP scanning yields little information, and no sense of topology. Even the IP routing table, which
clearly exists in the GRT / VRF where the service is terminated will show all the IP routes known within the
service, but those routes which are reachable across the Fabric Connect crucially do not have a next-hop IP
address. The next-hop is in fact the IS-IS System-ID (BMAC) of the SPB node where that destination subnet
has its point of presence. This is illustrated for the GRT below .
Figure 94 Stealth Networking with IP Shortcuts (L3 VSN)
An L3 VSN will present additional stealth properties due to the fact that, in the Extreme Networks VSP
series platforms, VRF IP interfaces are not bound to any higher layer sockets (no management access) and
hence cannot be used to gain any additional information from such interfaces and any interaction with
them will be mostly limited to ARP and ICMP.