Wire-once, provision-many: optimizing compute resources in the data center. (Storage Networking).

Data center architecture has taken strides toward logical organization in the past few years as the computing model has moved toward disaggregation. By breaking out the functions of storage, computing, and networking, and optimizing the delivery of each, enterprises have made some significant improvements in data center performance. Disaggregation, in general, provides three primary benefits:

Better Performance: When a function (storage, computing, or networking) is bundled together with other functions, the critical services are typically delivered by running software on general-purpose processors. This delivers far slower performance than is possible using purpose-built hardware devices. By isolating each function, thus limiting the scope of what each box must do, it becomes possible to deliver dedicated hardware and software that dramatically increases performance.

Superior Scalability: Because functions are isolated from each other, disaggregation gives data center operators the freedom to alter one function without impacting the other two. For example, storage capacity can be increased by adding more storage devices, without having to do anything to the computing and networking tiers. This point may seem intuitive, but it was not that long ago that it was a regular practice to increase storage capacity by buying more computers.

Improved Economics: Storage, computing and networking infrastructure can be deployed cost-effectively because provisioning is improved and disparate equipment is consolidated. Much of the complexity of administering each function is hidden, since each is isolated from the other. Disaggregation is also very tightly linked with virtualization, which allows for sharing of physical equipment across multiple customers, departments or applications. Virtualization significantly decreases up-front capital expense, as well as long-run operational expense, because there are simply fewer boxes to buy and manage, and compute resources can be managed as a consolidated pool, rather than on a box-by-box basis.

Disaggregation thus represents a major force in the evolution of the computing model in the data center. The storage industry has led the charge into disaggregation, with virtualized storage, and has made significant progress in proving the benefits of this approach. Virtualized storage has enabled data center operators to make far more efficient use of their storage resources by managing them as a single shared pool of resources, independent of the computing and networking tiers. This eliminates the phenomenon of one storage device being jammed to capacity while another sits idle.

However, while virtualization has improved storage efficiency, it is a different story m the computing tier. The computing tier of data centers still looks like a collection of hardwired boxes, each dedicated to a specific application silo. This creates a situation where you'll see, for example, the machines running PeopleSoft wheezing at maximum capacity, while the 12 application across the way is barely being used. Wouldn't it make sense if the PeopleSoft application could "borrow" computing power from the boxes running the 12 application? Of course it would, but there's never been a way to dynamically provision computing resources to make this happen.

Today, this is changing. There is a new trend afoot: Virtualized computes. Just like virtualized storage, virtualized computes lets data center operators manage the computing tier as a single, shared pool of resources, where computing power can be provisioned on the fly to optimize the performance of applications. This enables both the simplification and optimization of the computing tier, resulting in a more efficient and productive data center.

Virtualizing Computes in the Data Center

There are a number of basic requirements to successfully virtualizing computing power in the data center. First, there must be a way to offload compute-intensive overhead like SSL processing and TCP termination, so it does not bog down the compute resources. SSL decryption is also critical because there must be layer 4-7 switching in place, which can make intelligent decisions on resource allocation and protect servers from malicious application-level attacks. Obviously this cannot be accomplished if the traffic is encrypted.

Furthermore, it's one thing to inspect incoming traffic and provision the appropriate computing power to service it. It's another thing to do this at the gigabit speeds required to maintain appropriate levels of performance. So the devices performing all these functions must be hardware-based.

Traditional switches may scale effectively, but given their packet-centric architecture, they are not designed to deliver higher layer application services like protection against Nimda and CodeRed. They can't inspect incoming data up to layer 7 and still sustain gigabit scale. Software-based appliances are more application-aware than switches, but fall short in the throughput department.

For example, Nauticus Networks approached this problem with its N2000 Intelligent Data Center Switches by developing the TideRunner chipset. This enables the switch to inspect data at the object level instead of at the packet level, which combines the speed and scalability of fast switches with the intelligence of smart security appliances. This approach integrates high performance network and security application services like attack protection, denial of service mitigation, and advanced URL and application filtering, with load balancing, advanced layer 4-7 switching and SSL acceleration. Nauticus also added software to enable switch-level partitioning, or virtualization.

The Nauticus system also supports virtual switching technology, or VST. VST has an exclusive focus on virtualizing the compute domain of the enterprise data center, enabling the dynamic partitioning of a switch into multiple logical application switches. VST enables data center operators to instantiate high performance virtual switches on the fly, providing relief from an entire class of problems that plague the enterprise data center.

The first problem area is the proliferation of point-appliances that have been deployed in the access tier of the data center. Many of these devices were selected to solve specific application challenges, such as per-application load balancing, SSL offload, IDS and firewall load balancing, VPN termination and others. Each appliance has varying performance levels and often congests the data path with extraneous traversals out one appliance and into another.

A perfect example of this "box bloat" in the access tier is firewall load balancing. The typical data center uses load balancer "sandwiches," involving up to four load balancers, two deployed (for redundancy) in the "dirty" side of the firewall and two deployed on the clean side. This configuration may work at the outset, but it is highly problematic to maintain. VST enables an entire bank of firewalls (as well as any number of load balancers and SSL offload appliances) to be consolidated onto a single physical switch. This radically simplifies data center operations by obviating the need for so many disparate computing devices while significantly improving performance and application-level security.

While data center consolidation is an important capability, especially in today's money-tight times, it is not the most compelling application of VST. Perhaps the most interesting application of VST is the dynamic creation of multiple computing tiers in both the legacy data center and emerging blade-server-enabled data centers, as well as hybrid environments.

Applications are typically deployed as silos in the legacy data center. Each silo may contain load balancers, SSL appliances and other point solutions in the access tier. There are typically lower-end servers in the Web tier, more powerful computers in the application tier, with the most capable computing platforms relegated to the database tier.

These application silos create massive disparities in utilization across the entire data center. At any given time, a silo application tier may be out of resources, while another silo application tier has plenty of excess capacity.

VST offers an alternative to the rigid silo-based model by enabling "wire-once, provision-many" (WOPM) virtualization. WOPM mirrors the efficiencies gained in the virtualization of storage, whereby common storage media (spinning drives) can be dynamically partitioned and presented to servers as private dedicated volumes. VST enables data center operators to dynamically partition virtual switches to create logical application silos that can be constructed entirely from undifferentiated pools of data center servers (legacy computers and racks of blade servers). A virtual switch can therefore be created to "carve" Out a computing tier to load balance its members, health check resident services, perform application-level switching and security filtering, and add SSL offload.

Once the transition is made from the traditional hard-wired application silos to the virtualized infrastructure model, compute resources can be reallocated with unparalleled agility and fairness.

Additionally, once computing resources are pooled, a layer of abstraction is created between end-users and the inner-workings of the data center. Operators have the flexibility to add and remove machinery without affecting the quality of service. Likewise, server crashes and other unpredictable events no longer impact end users because new compute resources can be allocated on the fly.

Compute virtualization is a requirement for data centers to achieve the vision of "utility computing" put forth by companies such as IBM, Sun and HP. This vision calls for a future in which data center resources are no longer dedicated to specific applications. Rather, they are pooled and used on an as-needed basis.

David Caplan is director of product management at Nauticus Networks (Framingham, Mass.)

www.nauticusnet.com