ronments provide some basic overlay functional- ity, specifically single tenant VLAN support. This is defined in the OpenStack Neutron (OpenStack) specification. At the time of this writing, Neutron lacks advanced networking capabilities such as multitenant layer 2 and layer 3 IP service chains. It also lacks support for QoS that is needed to prioritize different traffic streams. In a service provider network, network functions, while vir- tual, can still be multitenant in that the function can support several virtual customer networks. Therefore, VLAN tagged Ethernet and layer 3 VPNs must be supported on the overlay to maintain Network Functions Virtualization SDN Controller Models Server Server VNF-1 VNF-2 Logical Port Logical Port (ordered set of related packets) Source Destination Data Center Fabric Physical Port Physical Port FIGURE 3.10 Overlay and underlay. network separation even when attaching to a common and shared network function. OpenContrail (Apache) can be used as a complement to Neutron to support these more advanced network con- structs. OpenContrail is an Apache project that is built using standard protocols like MPLS to pro- vide the necessary components for advanced network virtualization. In a VMWare cloud, VMWare NSX (VMWare, VMWare NSX), can provide the overlay functionality and it is integrated with the hypervisor. NSX would be the common choice for a service provider or enterprise data center where VMWare is already being used to manage the compute and storage resources. 3.3.4 REUSABILITY VNFs need to be reusable and location independent. Figure 3.11 illustrates network solutions whereby a VNF could be deployed at a customer premises (Model A), in the service provider's network on the access circuit supporting a single site (Model B), or centrally located in the service provider's network supporting multiple sites (Model C). Consider the example of a firewall for an enterprise customer, who has an Internet connection to support Guest Wi-Fi, or employee Internet access. If this is done at 