Explain virtualization fundamentals (server virtualization, containers, and VRFs)

Virtualization means creating a software version of something that used to be hardware: a server, a network, a switch, or a router. It lets one physical resource be split into many logical ones, or many physical resources be pooled into one, and it is the foundation of both modern data centers and the cloud.

Server virtualization

Historically each application ran on its own physical server, and most servers sat at 10 or 20 percent utilization. Server virtualization runs multiple virtual machines (VMs) on one physical server. Each VM is a complete computer in software, with its own virtual CPU, memory, disk, and network interface card (vNIC), running its own guest operating system, and completely isolated from the other VMs. The software that creates and runs VMs is the hypervisor.

Benefits of server virtualization: higher hardware utilization, fewer physical servers (less power, cooling, and rack space), fast provisioning (a new VM in minutes from a template), snapshots for backup and rollback, and live migration (vMotion), which moves a running VM to another physical host with no downtime. VMs can also be moved to a cloud provider, which is what IaaS fundamentally offers.

Networking inside a virtualized host matters to a network engineer. The hypervisor includes a virtual switch (vSwitch) that connects the VMs’ vNICs to each other and to the physical NICs of the server. VMs on the same host in the same VLAN can talk without any traffic ever leaving the server, which is invisible to the physical switch. The physical NICs usually connect to the top-of-rack (leaf) switch as 802.1Q trunks so that VMs in many VLANs can share the same uplinks. Distributed virtual switches (VMware vDS, Cisco Nexus 1000V historically) manage vSwitches across many hosts as one.

Containers

A container is a lighter-weight form of virtualization. Instead of virtualizing the hardware and running a whole operating system per instance, a container engine such as Docker virtualizes at the operating-system level: all containers on a host share the host’s kernel and each container packages only the application plus the libraries and files it needs. Containers start in seconds (or less), use megabytes instead of gigabytes, and can be packed far more densely on a host than VMs. Kubernetes is the standard orchestration system that schedules, scales, and heals containers across a cluster of hosts.

Containers often run inside VMs in practice, combining the strong isolation of VMs with the density of containers. Cisco IOS-XE itself can host containers (for example ThousandEyes agents) on Catalyst 9000 switches.

VRFs

Network virtualization applies the same idea to network devices. A VRF (Virtual Routing and Forwarding instance) lets a single physical router or Layer 3 switch maintain multiple independent routing tables, each with its own set of interfaces and routes. Think of it as VLANs for Layer 3: a VLAN divides a switch into separate Layer 2 broadcast domains; a VRF divides a router into separate Layer 3 routers. Traffic in one VRF cannot reach another VRF unless an administrator deliberately leaks routes between them, and the same IP subnet can exist in two VRFs at once without conflict.

VRFs are used to keep customers separate on a shared service provider router (MPLS Layer 3 VPNs), to separate guest, IoT, and corporate traffic on a campus core (Cisco SD-Access uses VRFs as its virtual networks), and to isolate a management network from user traffic. VRF-Lite is the name for using VRFs on a single device without MPLS.

The modern IOS and IOS-XE syntax is vrf definition; the legacy IPv4-only syntax is ip vrf. Both are seen on the exam and in the field.

! Modern syntax (IOS 15 and IOS-XE): supports IPv4 and IPv6
R1(config)# vrf definition CUSTOMER-A
R1(config-vrf)# rd 65000:1
R1(config-vrf)# address-family ipv4
R1(config-vrf-af)# exit-address-family
R1(config-vrf)# exit
!
R1(config)# vrf definition CUSTOMER-B
R1(config-vrf)# rd 65000:2
R1(config-vrf)# address-family ipv4
R1(config-vrf-af)# exit-address-family
R1(config-vrf)# exit
!
! Assign interfaces. Note: applying a VRF REMOVES any existing IP address,
! so configure the VRF first, then the address.
R1(config)# interface gigabitethernet 0/0
R1(config-if)# vrf forwarding CUSTOMER-A
R1(config-if)# ip address 10.1.1.1 255.255.255.0
R1(config-if)# no shutdown
!
R1(config)# interface gigabitethernet 0/1
R1(config-if)# vrf forwarding CUSTOMER-B
! The SAME subnet is legal in a different VRF
R1(config-if)# ip address 10.1.1.1 255.255.255.0
R1(config-if)# no shutdown
!
! A static route inside a VRF
R1(config)# ip route vrf CUSTOMER-A 0.0.0.0 0.0.0.0 10.1.1.254

The legacy equivalent uses ip vrf CUSTOMER-A in global configuration and ip vrf forwarding CUSTOMER-A on the interface. Verification and testing commands need the VRF name, or they will use the default (global) routing table:

R1# show vrf
  Name                   Default RD            Protocols   Interfaces
  CUSTOMER-A             65000:1               ipv4        Gi0/0
  CUSTOMER-B             65000:2               ipv4        Gi0/1

R1# show ip route vrf CUSTOMER-A
Routing Table: CUSTOMER-A
Codes: L - local, C - connected, S - static, ...
Gateway of last resort is 10.1.1.254 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.1.1.254
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0

R1# ping vrf CUSTOMER-A 10.1.1.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

The RD (route distinguisher) is a 64-bit value prepended to routes so that identical prefixes in different VRFs remain distinct; it is required for MPLS VPNs and optional for VRF-Lite.

Other forms of network virtualization you should recognize by name: virtual routers and virtual firewalls (Cisco Catalyst 8000V, ASAv, FTDv) that run as VMs; VXLAN, which tunnels Layer 2 over a Layer 3 fabric to create virtual overlays in the data center and in SD-Access; and virtual switches inside hypervisors.