topic Re: vSZ-D Network Configuration in SmartZone and Virtual SmartZone

vSZ-D Network Configuration

ross_halliday — Tue, 28 Jun 2016 17:08:04 GMT

Hello,

I'm attempting to turn up a vSZ-D instance in my lab. I've got a pair of vSZ controllers running in a cluster, each with three interfaces (Management, Cluster, Control). The vSZ-D documentation is pretty bad, as it calls the one interface "Management/Control" and doesn't really say what it does, or really how it's supposed to connect to the vSZ controllers. I've tried it on both the "Management" and "Cluster" networks but I can't get it to connect. I have not tried it on the "Control" (which is Public) for the controllers as this is the same subnet as the "Data" interface should be on.

Also, I have no idea how the "Data" interface is supposed to work VLAN-wise. Is the IP I assigned just untagged?

Could someone share how theirs is configured and working? I would really appreciate it!

Thanks

Re: vSZ-D Network Configuration

michael_brado — Tue, 28 Jun 2016 17:27:07 GMT

Quick Setup Guide: https://support.ruckuswireless.com/documents/972-vsz-d-quick-setup-guide-for-smartzone-3-2-1
Configuration Guide: https://support.ruckuswireless.com/documents/971-vsz-d-smartzone-3-2-1-mr-configuration-guide

Re: vSZ-D Network Configuration

ross_halliday — Tue, 28 Jun 2016 17:38:50 GMT

Thanks for the reply Michael, I have already scoured those documents and they do not contain the information I need.

What network should the "Management" interface of the dataplane module be configured on, and what IP does it need to connect to the control plane one?

Re: vSZ-D Network Configuration

michael_brado — Tue, 28 Jun 2016 17:45:12 GMT

You might benefit more from a conversation with your locar VAR or Ruckus SE, as the entirety of virtual controller deployment and separate vitual Dataplane for tunnelled client traffic is a little more complex than simple ZoneDirector model.

Re: vSZ-D Network Configuration

ross_halliday — Tue, 28 Jun 2016 20:59:11 GMT

I am the VAR. I've reached out to our SE for any design documents he may have. This really should be covered in your manual...

Re: vSZ-D Network Configuration

eddie_sanmarco — Thu, 28 Jul 2016 21:07:23 GMT

MY SE says he has not learned this deployment yet as it is so new. We are having a heck of a time getting this to work on Cisco UCS using direct I/O.

Re: vSZ-D Network Configuration

ross_halliday — Fri, 29 Jul 2016 17:59:22 GMT

I should follow up on this post, then! We have managed to get the vSZ-D working. The software has a problem in that, unlike the controller, it doesn't let you select which interface should be used for default routing. It turns out that the vSZ-D talks to the controller on the Control interface - not Management. This meant, for us, that it was trying to send all packets out of the Management interface, instead of the "Data" interface.

On the vSZ-D we had to change the Management and Control/Data to be in the SAME subnet/VLAN, and point it to the public IP of the controller. It then worked flawlessly. Of course management protocols now need to be firewalled off.

Our SE is working on getting this behaviour corrected so it acts more like the vSZ software.

Re: vSZ-D Network Configuration

eddie_sanmarco — Tue, 02 Aug 2016 13:24:51 GMT

So what I'm hearing is that when asked for the IP address of the vSZ-H controller I should be giving the vSZ-D the IP address of the control interface and not the management interface of the controller? The instruction specifically say that on the vSZ-D the management and data interface need to be on separate networks, so one of your statements confused me. I need the vSZ-D to communication on the 1Gig interface to the vSZ controller and all of the client data to use the data Direct I/O 10Gig interface on the vSZ-D.

Re: vSZ-D Network Configuration

ross_halliday — Tue, 02 Aug 2016 19:03:58 GMT

Yeah, it's very confusing. The important parts are:

- vSZ-D "Management/Control" must connect to vSZ-H "Control"
- vSZ-D "Data" is in totally separate routing table and not used as a candidate for routing any traffic other than tunnels

I eventually tried setting the vSZ-D to connect to the vSZ-H's Control IP (which is public). I expected the vSZ-D to start sending packets out of its own Data interface, which has an IP in the same subnet. This was not the case - it just sent them out the Management interface towards the default gateway. My setup has a totally isolated management VLAN so that default gateway was fake - if I had a firewall or router in there of some sort, the vSZ-D probably would have been able to communicate outwards to the vSZ-H with NAT or something, but it would have been ugly.

You can absolutely run the vSZ-D's Management/Control and Data interfaces on different network. In my setup it was easier to just put them on the same VLAN as I only allocate one /24 of public IPs per site. The APs still connect to the vSZ-D's Data interface.

Hope that makes sense now!

Re: vSZ-D Network Configuration

eddie_sanmarco — Thu, 04 Aug 2016 16:18:47 GMT

Mind if I ask you, What VM platform are you using and are you using Direct I/O as recommended by Ruckus since they say vSwitch can cause random reboots to the vSZ-D.

I basically got this answer from them so far: "I spoke with our developer and below is the recommended NICs. If your Cisco UCS server is using other than the recommended then we don't support it." with a picture of their infamous documentation. Not very happy being told too bad so sad.

Re: vSZ-D Network Configuration

ross_halliday — Thu, 04 Aug 2016 16:23:23 GMT

I'm running ESXi 5.5, the "data" NIC is VMXNET3 like the OVA was configured with. Not using Direct I/O as I need vMotion to still work. The underlying chips are Broadcom on Lenovo/IBM x3550 M5

Haven't heard of this random reboot thing, where did you read that?

Re: vSZ-D Network Configuration

eddie_sanmarco — Thu, 04 Aug 2016 16:29:34 GMT

Straight from support. They recommend when setting up vSZ-D that the Management/Control can be vSwitch but Data interface should be Direct I/O. I asked why and they said they have had customers with random reboots of the vSZ-D and when they went direct I/O is fixed it. Yeah see Cisco UCS ESXi5.5 is what we have but they won't support the NIC blades with the proper driver. I told them they need to either log in and do their magic loading the driver into my VM appliance or write a hotfix to add the drivers for Cisco UCS support. Haven't heard back but my Local Sales rep. is sending emails to SE and updating the case. I have a feeling I'm going to hit a brick wall with these guys. Thinking maybe I should have gone with the ZD3000 or ZD5000. How long has yours been deployed and how large scale is your environment that yo uhave not experienced what they claim will happen?

Re: vSZ-D Network Configuration

eddie_sanmarco — Thu, 04 Aug 2016 16:37:23 GMT

We also have a cluster pair of controllers and purchase 2 vSZ-D 1 for each. I am wondering if when running and my primary vSZ-D connected to the primary controller dies doe the "Following" controller and its associated vSZ-D take over the tunneled traffic. That's my next question to them if we even stay on VM platform.

Re: vSZ-D Network Configuration

ross_halliday — Thu, 04 Aug 2016 16:59:49 GMT

Just in the testing phase, I got it set up maybe a month ago. Yeah that's another reason I don't like Direct I/O... driver nonsense... misses the point of virtualization!

I have no idea how multiple vSZ-Ds is supposed to work. I'm not entirely certain my SE does either, haha! It's on my to-do list. I'd like it if the tunnels failed over, but I'm not sure how that would be configured yet as I don't see many knobs at all in the controller's web interface.

Re: vSZ-D Network Configuration

yogesh_ranade — Thu, 04 Aug 2016 20:18:53 GMT

@salad and @ Eddie, This is Yogesh here. I am the Product Manager for the vSZ-D. Thanks for raising very pertinent queries related to the vSZ-D deployment. We sincerely appreciate and value your feedback. Would you be kind enough to send me an email to yogesh.ranade@ruckuswireless.com. I would like to schedule a conference call with you and our vSZ-D engineering team to answer all your technical queries sometime next week, if that's okay with you.

Re: vSZ-D Network Configuration

eddie_sanmarco — Fri, 05 Aug 2016 13:49:20 GMT

I'm fine with the call set up for Monday. You should know that my SE has informed me that his is spesking with, i assume your team, to see about getting this driver issue fixed. He did mention it could take a little while. I have also spoke to our sales and SE regartding maybe they recommended the wrong product as it seems your tech team as stated that if or Cisco ucs vw doesn't have the drivers in your manual, too bad they can't help. You should know that I've been in the IT industry for over 35 years and know very well that code can be written to hit fix this issue and add drivers to an ova for your customers. We will see how this evolves next week but i can't help feel that had we gotten the ZD3000 out 5000 i wouldn't be in this position. Another note for you is that we are migrating off of our Enterasys wifi solution that has been running just fine for over 8 years tunneling client traffic back to the controllers, of course those are physical not virtual. Thanks for your time,
Eddie

Re: vSZ-D Network Configuration

ross_halliday — Fri, 05 Aug 2016 16:48:17 GMT

I appreciate the offer, Yogesh, but I am away on vacation all of next week. My co-worker and I would certainly like to sit down and talk vSZ when I'm back, if that is an option!

Re: vSZ-D Network Configuration

yogesh_ranade — Fri, 05 Aug 2016 21:27:31 GMT

Hi Eddie, Thanks again for the feedback. Sure let's get on a call for me to better understand what your deployment use-case is ? vSZ-D is a product built on top of Intel DPDK architecture and there are platform limitations due to the DPDK toolkit. Regarding utilizing ZD 3K/5K, we probably need to understand your needs for tunneling of data and throughput requirements. As you are aware, with the vSZ-D the dataplane function is completely decoupled from the control plane (vSZ) which provides flexibility in deployments. We need to understand better what you need and your tunneling throughput requirements so that we could provide our inputs. Can you share with me your official email id where i can send a meeting invite ?

Re: vSZ-D Network Configuration

yogesh_ranade — Fri, 05 Aug 2016 21:28:42 GMT

Sure, would be glad to set something up the week after next. Can you send me your official email id where i can send a meeting invite ?

Re: vSZ-D Network Configuration

eddie_sanmarco — Mon, 08 Aug 2016 13:06:58 GMT

Unfortunately I had forgotten about my training all this week from 7-5 so I will not be able to take a call as I will be in a classroom environment. I will however have my laptop for emails if you like.
eddie.sanmarco@mesaaz.gov