# LotusCloud Network Architecture ## Overview LotusCloud networking provides cloud-native virtual networking similar to AWS VPC / GCP VPC / Azure VNet, built on OpenStack Neutron + OVN + SDN. ## Network Layers ``` Layer 1: Physical (Underlay) Spine-leaf switches, BGP, ECMP Layer 2: Virtual (Overlay) VXLAN tunnels, OVN, Open vSwitch Layer 3: Cloud (Virtual Network) VPC, Subnet, Security Group, Route Table Layer 4: Edge CDN, WAF, DDoS, Global LB, Anycast ``` ## Underlay Network Physical network within the datacenter. ### Topology: Spine-Leaf ``` Spine-01 (100G/400G) Spine-02 (100G/400G) / | \ / | \ 100G 100G 100G 100G 100G 100G / | \ / | \ Leaf-01 Leaf-02 Leaf-03 Leaf-04 Leaf-05 Leaf-06 25G 25G 25G 25G 25G 25G | | | | | | Rack1 Rack2 Rack3 Rack4 Rack5 Rack6 ``` ### Protocols | Protocol | Purpose | |----------|---------| | BGP | Spine-leaf routing, ECMP | | EVPN | MAC/IP learning across racks | | VXLAN | L2 overlay tunneling | | LLDP | Neighbor discovery | | BFD | Fast failure detection | ### Bandwidth ``` Server → Leaf: 25GbE (bonded 2x 25G) Leaf → Spine: 100GbE Spine → Spine: 400GbE (optional mesh) Cross-site WAN: 10Gbps dedicated fiber ``` ## Overlay Network Virtual network built on top of physical network using tunneling. ### Technology Stack ``` OVN (Open Virtual Network) ├── ovn-northd (central controller) ├── ovn-controller (per compute node) └── ovs-vswitchd (Open vSwitch data plane) ``` ### VXLAN Tunnel ``` VM1 (node-01) ──► VTEP ──► VXLAN Tunnel ──► VTEP ──► VM2 (node-02) Packet flow: Original packet → OVS encapsulates in VXLAN → Physical network → OVS decapsulates → Destination VM ``` ### OpenStack Neutron Integration ``` Neutron API │ ▼ Neutron Server (ML2 plugin) │ ▼ OVN Mechanism Driver │ ▼ OVN Northbound DB │ ▼ ovn-northd │ ▼ OVN Southbound DB │ ▼ ovn-controller (per node) │ ▼ Open vSwitch (per node) ``` ## Cloud Virtual Networking (VPC) ### VPC Architecture ``` VPC (10.0.0.0/16) │ ├── Subnet A (10.0.1.0/24) — Availability Zone 1 │ ├── VM-1 (10.0.1.10) │ ├── VM-2 (10.0.1.11) │ └── LB-1 (10.0.1.100) │ ├── Subnet B (10.0.2.0/24) — Availability Zone 2 │ ├── K8s Worker-1 (10.0.2.10) │ └── K8s Worker-2 (10.0.2.11) │ └── Subnet C (10.0.3.0/24) — Private (DB) ├── Postgres Primary (10.0.3.10) └── Postgres Replica (10.0.3.11) ``` ### Hub-and-Spoke Topology Replaces complex VPC peering with centralized hub. ``` ┌──────────┐ │ Hub VPC │ │ (shared │ │ services)│ └────┬─────┘ │ ┌────────────┼────────────┐ │ │ │ ┌────┴────┐ ┌────┴────┐ ┌────┴────┐ │Spoke VPC│ │Spoke VPC│ │Spoke VPC│ │ Team A │ │ Team B │ │ Team C │ └─────────┘ └─────────┘ └─────────┘ ``` Hub VPC contains: - NAT Gateway - VPN Gateway - Internet Gateway - Shared services (DNS, monitoring) ### VPC Peering Direct connection between two VPCs without traversing internet. ``` VPC-A ←── Peering Connection ──→ VPC-B Properties: - Non-transitive - Same region (initially) - No overlapping CIDR ``` ### Peering Performance Targets | Metric | Target | |--------|--------| | Latency | < 0.5ms (same AZ), < 2ms (cross-AZ) | | Throughput | 10Gbps (default), 25Gbps (scalable) | | Packet loss | < 0.001% | ## Routing ### Route Table ``` Route Table: rt-main Destination Target 10.0.0.0/16 local 0.0.0.0/0 igw-001 (internet gateway) 172.16.0.0/16 pcx-001 (peering connection) 10.1.0.0/16 tgw-001 (transit gateway) ``` ### Internet Gateway Provides internet access for public subnets. ``` VM (public subnet) │ ▼ Internet Gateway │ ▼ Internet ``` ### NAT Gateway Allows private subnets to access internet without being publicly reachable. ``` VM (private subnet) │ ▼ NAT Gateway (in public subnet) │ ▼ Internet Gateway │ ▼ Internet ``` ## Site-to-Site VPN ### IPSec VPN ``` On-premise Network │ ▼ Customer VPN Device │ ▼ IPSec Tunnel (encrypted) │ ▼ LotusCloud VPN Gateway │ ▼ VPC ``` ### Technology - Protocol: IPSec IKEv2 - Encryption: AES-256-GCM - Authentication: Pre-shared key or certificate - Redundancy: Dual tunnel (active-active) ### WireGuard VPN (Alternative) ``` On-premise → WireGuard tunnel → LotusCloud VPN Gateway ``` ## Security Groups Stateful firewall rules per VM/instance. ### Example Rules ``` Security Group: sg-web Inbound: TCP 80 0.0.0.0/0 (HTTP) TCP 443 0.0.0.0/0 (HTTPS) TCP 22 10.0.0.0/16 (SSH from VPC only) Outbound: ALL ALL 0.0.0.0/0 (allow all outbound) Security Group: sg-db Inbound: TCP 5432 sg-web (Postgres from web tier) TCP 22 10.0.0.0/16 (SSH from VPC) Outbound: ALL ALL 0.0.0.0/0 ``` ## Load Balancer ### Types | Type | Layer | Use Case | |------|-------|----------| | Application LB | Layer 7 | HTTP/HTTPS routing | | Network LB | Layer 4 | TCP/UDP high performance | | Global LB | Layer 7 | Multi-region traffic distribution | ### Global Load Balancer ``` User (Vietnam) ──→ Global LB ──→ VN-South (60%) VN-North (40%) ``` Traffic strategies: - Geo routing (nearest region) - Latency routing (lowest latency) - Weighted routing (60/40, 70/30) - Failover routing (active/standby) ## DNS Service Cloud DNS similar to Route 53 / Cloud DNS. ``` lotuscloud.vn ├── api.lotuscloud.vn → API Gateway ├── console.lotuscloud.vn → Frontend ├── *.apps.lotuscloud.vn → App Service └── *.db.lotuscloud.vn → DBaaS endpoints ``` ## Bandwidth Scaling ``` Requirement: scale from 1Gbps to 10Gbps without downtime Method: 1. LACP bond aggregation 2. ECMP multi-path routing 3. Switch port upgrade (25G → 100G) No downtime because: - BGP reconverges traffic - ECMP distributes across paths - LACP gracefully adds members ``` ## Multi-NIC VM VM can have multiple NICs in different VPCs. ``` VM ├── eth0 → VPC-A, Subnet-1 (management) ├── eth1 → VPC-B, Subnet-2 (application) └── eth2 → VPC-C, Subnet-3 (database) ``` ## IPAM (IP Address Management) Centralized IP allocation. ``` IPAM Service │ ├── VPC CIDR pool ├── Subnet allocation ├── Floating IP pool ├── VPN IP pool └── Internal service IP pool ``` ## Edge Network ### CDN + Anycast ``` Users │ ▼ Anycast DNS (closest POP) │ ▼ Edge POP (CDN cache + WAF + DDoS) │ ▼ Origin (LotusCloud region) ``` ### Edge Services - CDN (content caching) - WAF (web application firewall) - DDoS Protection (volumetric + application layer) - Anycast routing (BGP anycast) - TLS termination ## SDN Architecture Summary | Component | Technology | Layer | |-----------|-----------|-------| | Physical switches | Arista/Cisco | Underlay | | Routing protocol | BGP + EVPN | Underlay | | Tunneling | VXLAN | Overlay | | Virtual switch | Open vSwitch | Overlay | | SDN controller | OVN | Overlay | | Cloud integration | Neutron | Cloud | | Firewall | OVN ACL | Cloud | | Load balancer | HAProxy/Envoy | Cloud | | DNS | CoreDNS + PowerDNS | Cloud |