Skip to main content

Understanding Network Zones and Segmentation

In the realm of networking, the concept of zones plays a pivotal role in ensuring security, manageability, and efficiency within complex network infrastructures. A zone essentially defines a virtually separated network segment, with specific nodes and assigned permissions, aimed at restricting users to certain zones and their contained Virtual Networks (VNets). Let's delve into the various technologies utilized for network segmentation and the creation of zones:

Simple Isolated Bridge

A simple isolated bridge involves the implementation of a basic layer 3 routing bridge, often accompanied by Network Address Translation (NAT).

How it Works:

  • Simple Network Bridge (Layer 2): A bridge operates at the data link layer (Layer 2) of the OSI model, connecting multiple network segments into a single network. It filters and forwards traffic based on MAC addresses, learning which addresses are on which segments, thus reducing unnecessary traffic and improving network efficiency.

  • Layer 3 Routing Bridge: This bridge operates at the network layer of the OSI model and serves as a gateway for traffic between different network segments or zones. It examines the destination IP address of incoming packets and forwards them accordingly.

  • Network Address Translation (NAT): NAT is used to modify the source or destination IP addresses in packets as they traverse through the bridge. This allows multiple devices within a zone to share a single public IP address, effectively hiding the internal IP addresses from external networks.

Benefits:

  • Isolation: By employing NAT, the internal structure of each zone remains concealed from others, ensuring isolation and security.

  • Simplicity: Simple isolated bridges are relatively straightforward to set up and manage compared to more complex segmentation technologies.

VLAN (Virtual LAN)

Virtual LANs (VLANs) represent a fundamental method for subdividing a Local Area Network (LAN) into multiple logical segments.

How it Works:

  • Logical Segmentation: VLANs logically segment a physical LAN into multiple broadcast domains, allowing different groups of devices to communicate as if they were on separate physical networks.

  • Tagging: Each VLAN is identified by a unique VLAN identifier (VLAN ID), which is added as a tag to Ethernet frames. Switches use these tags to direct traffic to the appropriate VLANs.

Benefits:

  • Flexibility: VLANs enable network administrators to group devices based on logical criteria rather than physical location, providing flexibility in network design.

  • Efficiency: By reducing broadcast traffic and segmenting network traffic, VLANs enhance network performance and bandwidth utilization.

QinQ (Stacked VLAN)

QinQ, formally known as IEEE 802.1ad, extends the capabilities of VLANs by enabling the stacking of multiple VLAN tags within a single frame.

How it Works:

  • Nested VLANs: QinQ allows for the creation of nested VLANs, where VLAN-tagged frames are further encapsulated within another VLAN tag. This enables finer-grained control over network segmentation.

  • Double Tagging: Each frame contains two VLAN tags: an outer tag, which identifies the customer or service provider network, and an inner tag, which identifies the VLAN within the customer network.

Benefits:

  • Enhanced Segmentation: QinQ provides additional levels of segmentation, allowing for more granular control over network traffic.

  • Service Provider Support: QinQ is commonly used in service provider networks to isolate customer traffic and maintain security and privacy.

VXLAN (Virtual Extensible LAN)

VXLAN serves as a powerful technology for building layer 2 network overlays over existing layer 3 infrastructure.

How it Works:

  • Overlay Network: VXLAN encapsulates layer 2 Ethernet frames within layer 3 UDP packets, creating virtual networks that span across physical boundaries.

  • VXLAN Tunneling: VXLAN packets are transmitted over the existing IP network infrastructure, enabling the creation of virtual networks without the need for dedicated physical infrastructure.

Benefits:

  • Scalability: VXLAN supports a much larger number of virtual networks compared to traditional VLANs, making it suitable for large-scale deployments.

  • Multi-Tenancy: VXLAN facilitates the creation of multi-tenant environments, where different tenants or customers can have their own isolated virtual networks.

EVPN (BGP EVPN) Zones

The EVPN zone revolutionizes network architecture by creating a routable Layer 3 network capable of spanning across multiple clusters. This is achieved through the establishment of a Virtual Private Network (VPN) and leveraging the Border Gateway Protocol (BGP) as the routing protocol.

Key Features:

  • Anycast IP and MAC Addresses: The Virtual Network (VNet) of EVPN can have anycast IP and/or MAC addresses. This means that the bridge IP remains consistent across all nodes, allowing virtual guests to use this address as their gateway.

  • Routing Across VNets: EVPN enables routing across Virtual Networks (VNets) from different zones through the utilization of a Virtual Routing and Forwarding (VRF) interface.

Configuration Options:

  • VRF VXLAN ID: A dedicated VXLAN-ID used for routing interconnect between VNets, ensuring segregation. It must differ from the VXLAN-ID of the VNets.

  • Controller: Specifies the EVPN controller to be used for this zone, facilitating management and control of the EVPN network.

  • VNet MAC Address: Anycast MAC address assigned to all VNets in this zone. Auto-generated if not explicitly defined.

  • Exit Nodes: Configuration of nodes as exit gateways from the EVPN network to the real network. They announce a default route within the EVPN network. Optional.

  • Primary Exit Node: If multiple exit nodes are used, this specifies the primary exit node for traffic routing, useful for load balancing or ensuring consistent traffic routing.

  • Exit Nodes Local Routing: Special option enabling access to VM/CT services from exit nodes. By default, exit nodes only allow traffic forwarding between the real network and EVPN network.

  • Advertise Subnets: Announces the full subnet in the EVPN network, ensuring connectivity even for silent VMs/CTs.

  • Disable ARP ND Suppression: Optionally disables the suppression of ARP or Neighbor Discovery (ND) packets, necessary for systems utilizing floating IPs.

  • Route-target Import: Allows importing a list of external EVPN route targets, facilitating interconnectivity between different EVPN networks.

  • MTU (Maximum Transmission Unit): Specifies the MTU, considering VXLAN encapsulation overhead. Defaults to 1450, but adjustment may be necessary based on network configuration.

In summary, EVPN zones provide a powerful framework for building scalable and efficient Layer 3 networks, offering a wide range of configuration options to tailor network behavior according to specific requirements and use cases.

Back to top