% Network Virtualization

Computing Virtualization gives the capability to run multiple VMs and containers on the same physical server and this introduced additional issues and requirements for the network\break communication.
The first challenge is at Layer 2 (Ethernet connectivity) in which the VMs or containers must:
\begin{itemize}
	\item 
	exchange traffic between them and from/to the physical network, which means to have the possibility to reach, or to be reached by, external destinations;
	\item
	exchange traffic between them in the same physical host.
\end{itemize}
Additional requirements must be provided to achieve this communication pattern with Layer 3 connectivity:
\begin{itemize}
	\item 
	all the VMs/containers must have an IP address that needs to be assigned to them;
	\item
	all the physical network devices, as firewall, load balancing or NAT, should be provided as well to instances in the virtual environment.
\end{itemize}

The main idea is to give the same view from the physical network to the VMs and vice versa, so the virtual network must work as the physical one.
There are three options, given the architecture depicted in Figure~\ref{fig:virtual_network_architecture}, to solve these requirements that have different characteristics.

The former is called \textit{Host-based switching} that uses a software, called ``virtual switch'', which behaves like a physical switch device. Usually it runs in the host OS or in the Hypervisor of the machine and for this reason it provides high bandwidth reducing the traffic flowing in the network. This solution introduces additional overhead to the virtualization, because some CPU cycles are spent to running network processes. In this case is not so clear who is in control of this switch and this part of network. It is a problem to understand which people have to configure it and monitoring it.

The latter is \textit{Hairpin switching} that solves the problem of the additional overhead, because it uses the hardware already present. This means that the traffic exits the server, it goes to the physical network and arrives on the switch that puts back the packets to the same server. There are two problems related to this solution, one is that the traffic needs to pass on the physical link so the bandwidth is reduced, the other problem is that the physical switch must change his configuration to forward packets on the same interface where the traffic comes from.
\pagebreak

The last solution is \textit{NIC switching} and is the trade off between the others options. It solves the problem of ``who is in charge of the edge network'', because the interfaces are under the network management, and the bandwidth is mostly like the host-based solution.\newline

Nowadays the \textit{Host-based switching} is the most spread solution for its simplicity and, in this way it easy to distinguish traffic coming from different VMs, because each virtual switch knows exactly which VM generates each frame.  This is more hard to reach for the physical solutions, may be they need some way to tag the traffic before they send it back on the network. 

\hfill
\begin{figure}[ht]
	\centerline{\includegraphics[width=0.8\textwidth]
		{networking-02.png}}
	\caption{Virtual network architecture.
		\label{fig:virtual_network_architecture}}
\end{figure}

Virtual Networks has an impact on the networking in physical world, because level two\break connectivity must be provided also on a level 3 network that links all the servers, which\break introduces segmentation. Solutions based on VLAN-tag are used but there are more problems correlated to the L2 networks such as the limited number of VLAN IDs and the loss of scalability of the LANs. \newline

The last problem, but not least, the \textit{policy migration} is not available, this means that if a VM is migrated to another server that may be is on a different L3 network, all the policies correlated to this VM are not following this change.\newline

The main solution to offer a transparent connectivity to the virtual environment is \textit{tunnelling}, this is done using GRE protocol or VxLAN tagging. Both provide a L2 network over different IP subnets.
