Key Considerations for Cloud Networking

Every enterprise has a unique network infrastructure for accessing servers and allowing applications to communicate between components.  Various layers support the management of network addressing, deliver critical services, and ensure security.  The infrastructure includes specific addressing (sub-nets), address services like DHCP/DNS, identity and directory services like LDAP, and firewals and routing rules – all reflecting the specific requirements and evolution of the given enterprise.

Clouds are not different from the enterprise in this respect; they have unique networking infrastructures that support complex and flexible multi-tenant environments.  Remember that the cloud providers have to control their networking so that they can route traffic within their infrastructure.  More important, their design is completely different from your enterprise networking architecture, design, and addressing.  This is not a problem if you’re doing something stand-alone in the cloud because you don’t care what the network structure is as long as you can access it over the internet.  However, if you want to extend your existing networks and use your existing applications, there are serious discontinuities that have to be addressed.
First, you have to deal with addressing.  The typical cloud provider will assign you a block of addresses as part of your cloud account.  For example, Flexiscale and GoGrid essentially give you get a block of assigned addresses that you can attach to the servers you create.  In some cases these are external addresses (meaning that they are public addresses that can be accessed from the internet), while in others, they are internal. 

In either case, they are not assigned as part of your addressing.  This means that even if you manage to connect these resources to your data center, you need to build new routes and alter your services to allow these “foreign” addresses into your system. Amazon originally took a different approach by providing a dynamic system where an address is assigned every time a server is started.  This made it hard to build multi-tier applications, requiring developers to design systems able to pass changing address information between application components.  The new VPC offering partially solves this problem for connecting to the Amazon cloud, although some key challenges remain.  Other cloud providers are investigating similar networking capabilities.

The next major issue with networking in the cloud is data protection.  In your data center, there is a secure perimeter defined and developed by your IT organization that is comprised of firewalls, rules, and systems to create a protected environment for your internal applications.  This is important because most applications need to communicate over ports and services that are not well protected and certainly not safe for general internet access.  Since applications are developed for the protected environment of the data center, it can be dangerous to move them unmodified into the cloud.  Under normal circumstances, the application owner or developer has to build protection on a per-server basis and enact corporate protection policies.

The loss of control of the infrastructure mentioned earlier has additional implications – in most clouds you can’t control the physical interface level.  That is, in addition to assigned IP addresses, you get MAC addresses assigned to you as well.  These addresses can change every time a server is started which means that the identity of the server (and associated IP addresses) cannot be based on this familiar attribute.
All of these networking issues are at play whenever enterprise applications require the support of your data center infrastructure – things like identity services, naming services, and access to internal databases and other resources.  Because of this, your cloud resources need a way to connect to your data center, of which the easiest approach is a VPN.  In building this solution, you need to design for routing to the cloud and provide a method for cloud applications to “reach back” to the applications and services running in your data center. Ideally, this connection would allow Layer-2 connectivity because a number of services require this level to function properly.

To wrap up this segment, networking, like storage, is a very important part of your IT infrastructure, and the cloud adds a number of interesting new variables to the design and operation of your data center environment.  What’s needed is a well-constructed architecture and a good understanding of the limitations imposed by the cloud if you want to integrate successfully with the public clouds.  Today, this can be a major barrier to cloud adoption since enterprises are understandably reluctant to re-architect their network environments or become knowledgeable about the complexities of each cloud provider’s underlying infrastructure.  When designing your cloud strategy, make sure to select a migration path that addresses these issues and protects you from costly engineering projects and cloud risks.

Original Article - http://cloudcomputing.sys-con.com/node/1166941