Enterprise networks the same due to rigid constraints placed by Proprietary Hardware, Software and APIs. • Leads to inflexible network architectures that do not meet the business needs. The Problem: Limited Choices/Flexibility • Each market has very different problems, yet we try and solve the same way with today’s technology.
close to the hardware. o Do systems administrators configure their services in x86 Bios? Guess what? We do. • Generic components decomposed into resources to consume anywhere, any9me. • Abstrac9on of Forwarding, State and Management. o Forwarding: Networking gear with flow tables and firmware. o State: Bag of protocols destruc9on. o Management: Orchestra9on, CMDB etc. Join the rest of the data center (and world) My Obligatory Rationalizing
the Edge. • Traffic Engineering Classifica9on at the edge. • Opera9onal Complexity at the Edge. • QOS Policy at the Edge. • Cost at the Edge. The Problem Has Always Been the Edge
all vendors are using the same pieces and parts where is the value? Software becomes the differentiation. • “We want to create a dynamic where we have a very good base set of vendor- agnostic instructions. On the other hand, we need to give room for switch/ chip vendors to differentiate.” -Nick McKeown • “You don’t have to have an MBA to realize there is a problem. We are still ok but not for very long.” -Stuart Selby,Verizon • When you run a large data center it is cheaper per unit to run a large thing rather than a small thing, unfortunately in networking that’s not really true. - Urs Hoezle, Google • “Work with existing silicon today; tomorrow may bring dedicated OpenFlow silicon.” -David Erickson • “The path to OpenFlow is not a four lane highway of joy and freedom with a six pack and a girl in the seat next to you, it’s a bit more complex and a little hard to say how it will work out, but I’d be backing OpenFlow in my view” – Greg Ferro Etherrealmind.com What Changed? Why Now? #1 HW Commoditization
LIB, TCAM, Memory, CPU, ASIC. Virtualization HyperVisors, Vmware, Hyper-‐‑V, KVM, Xen, X86 Instruction Set Physical Server Infrastructure Servers, CPU, Memory, Disk, NIC, Bus. Physical HW Slices SDN Network VM Farms Today WindowS lice Windows Slices WindowS lice Windows Slices WindowS lice Windows Slices WindowS lice General Purpose Slice WindowS lice Research Slices WindowS lice Secure Network Slice Not New Ideas
src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Ac9on * * * * * * * * 22 drop -Routing * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Ac9on * * * * * 5.6.7.8 * * * port6 * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Ac9on * * vlan1 * * * * * 00:1f.. Conceptually Simple, Yet Powerful -Flow Switching port3 Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Ac9on 00:20. 00:1f.. 0800 vlan1 1.2.3.4 5.6.7.8 4 17264 80 port6, port7, port9 -VLAN Switching
Vlan ID IP Dst IP Src TCP Dst TCP Src IP Proto Port 0/1 * * * * * * 80 * * * * * * * 192.168.1.0/20 * * * * * * * * * 192.168.1.0/24 * 25 * * Port 0/3 * * * * 192.168.1.1/32 * * * * Port 0/3 * * * * 192.168.1.1/32 * * * * 0/5 * * * * 172.24.16.5/32 * 80 * * Packet-‐in with match in TCAM – Ac9on is forward to port 0/2 Packet-‐in with NO match in TCAM – Ac9on is Punt to Controller Ac9on Bucket Send Packet to Controller Send Packet to Port 0/2 In (n)RAM Ac9on Bucket TCAM Lookup TCAM Lookup Open vSwitch – Scale HW vs. SW • VM rack density East-‐West traffic could be problema9c for general purpose top of rack. • 100K+ entries in a rack is unrealis9c in HW today.
“The network is in my way” -‐James Hamilton, Amazon • Networking is complex because the appropriate abstrac9ons have not yet been defined.” –A Case for Expanding OpenFlow/SDN Deployments On University Campuses • “If you look at the way things are done today, it makes it impossible to build an efficient cloud. If you think about the physical network because of things like VLAN placements, you are limited on where you can place workloads. So even without thinking about the applica9on at all, there are limits on where you can place a VM because of capacity issues or because of VLAN placement issues.” – Mar9n Casado • The tools we have today for automa9on: snmp, netconf, subprocess.Popen(Python), Net::Telnet(Perl),#!/bin/bash, autoexpect, etc.
Cloud Scale • VID Limita9ons -‐ ~4094 Tags • ¼ of Servers are Virtualized • Customers want flat networks but they do not scale. • Complexity in the network substrate to support bad applica9on design. • Required-‐ Flexible & Open APIs to consume Network Resources. • East-‐West policy applica9on. • East-‐West BW Consump9on. • L2 Mul9-‐Tenancy. • Hypervisor Agnos9c. • VM port characteris9c mobility. • Traffic Trombone for Policy. VM1 Port1 VM4 Port4 VM3 Port3 VM2 Port2 Physical x86 Hardware VM Farm Physical Network Policy The Edge Needs to Be Smarter but also manageable: Below is neither
to the OVS controller (slowpath) • Subsequent are forwarded by the OVS data path (fastpath) • When axached to a controller datapaths are determined by the OpenFlow Controller. • Ac9ons: Forward, Drop, encapsulate (packet-‐in) and send to controller. Open vSwitch Data Path Open vSwitch Controller or Controller (x) First Packet in a Flow Subsequent Packets VM 1 Physical Hardware/Hypervisor VM 2
Hybrid Private/Public Cloud. Visibility, OAM, Dynamic Provisioning, Brokerage and Analytics. Tenancy X Tenancy Y Tenancy Z SDN Overlays (GRE, STT, VXLan) Traditional and SDN Network Substrates Creating Dynamic Network Resource Pools Data Center Overlays • Early SDN adoptions are happening today in Data Centers. decouple the virtual from the physical discreetly. Where do we terminate Tunnel endpoints? HW or SW for De-Encap?
Layer 3 Network e.g. Carrier MPLS/VPN, Internet, L3 Segmented Data Center Data Center West Segment Data Center East Segment Disaster Recovery Warm/Hot Site Cloud Provided Elas9c Compute Tenancy X Tenancy Y Tenancy Z Does This Make Sense?
is Doing this Today. VM to VM(East-‐West) Traffic is Filtered by the OVS Libvirt Plugin Tenancy X = Vlan1 Tenancy Y = Vlan2 Tenancy Z = Vlan3 Vnet0 Vnet1 Vnet2 Network Gateway Network East - West Traffic
addr on one NIC Public Cloud Spoke Controller Dnsmasquerading & IPTables Aka, Router, Switch and Firewall Internets VM Instance VM Instance How Public Cloud Feels VM Networks How it Really is:
OpenvSwitch Libvirt Plugin Tenancy X = Vlan1 or GRE1 Tenancy Y = Vlan2 or GRE2 Tenancy Z = Vlan3 or GRE3 Eth1=br-‐int(OVS) FIXED_RANGE Vnet0 Vnet1 Vnet2 Overlays Between Physicals Host HyperVisors NETWORK_GATEWAY 172.24.17.1 Data Center Orchestration Stacks– A Quick Look Eth1=br-‐int(OVS) FIXED_RANGE Vnet0 Vnet1 Vnet2 NETWORK_GATEWAY 172.24.17.1
Private Cloud On Your Network Public Cloud Spoke Encapsulated Tunnels Network is Unaware of Underlying Substrate An x86 Node Can Aggregate the Tunnel Endpoints. Hub and Spoke. The Alterna9ve would be a Full Mesh. Policy could centrally be applied there. Hub Gateway Spoke Spoke Tunneling & Hybrid Cloud
Cloud Spoke Hub Gateway Spoke Spoke De-Duping Policy is the best Reason for Tunnels • Leverage exis9ng centralized policy Applica9on and Orchestra9on. • However, sending the client directly to a cloud provider outside of a tunnel via the Internet is by far the easiest and most scalable solu9on. Crypto, IDS/IPS, Firewall etc.
to Cloud Providers. xAAS driven as a commodi9es market through Emerging Open API Standards. Programmability Should Enable Efficiency in Usage and Allow for Time Sharing via Orchestra9on. OpenStack Resources Either Local w/the ability to leverage Hybrid Private/Public Cloud offerings based on the best market price that year, month maybe even day depending on the elas9city and flexibility to move workloads. Also balancing workloads amongst each other through scheduling and predic9ve analysis and magic. Tenants would be any community anchor, state, city, educa9on non-‐profit etc. Op#on 3: Internet2, Ideally begin leveraging their peering and Colos globally for a broader net to capture compe99vely priced resources Op#on 2: Dedicated peerings to any node from tenant to colo into the super-‐regional anyone selling resource pools with open APIs. Rackspace, HP, Dell, Piston Cloud. Companies whose end game is not 100% cloud. Op#on 1:General Internet1 best effort connec9vity through commodity I1 drains like a Cogent for example at ~ ¢25-‐¢50 cents per/mb. Capture that as service level as a lower 9er SLA but priced significantly lower. Primary op9on. Public Cloud: The Internet will be the new LAN
never make it past an “fail open” policy? • Relying on SNMP, DHCP or any distributed “OS” Embedded in the Network Device. Dirty Vlan/VRF Dirty Vlan/VRF AAA/NAC SNMP
! = mean distributed systems in networks go away. • The problem is a distributed systems theory problem managed in software independent of hardware. • We centralize the control plane in traditional hierarchical campus architectures today in big expensive chassis. Distributed SDN/OF Controllers
• The Alternative to apply policy is Business as usual. Un- Scalable and cost prohibitive bumps in the wire • NAC and BYOD at w/ low Cap and OpEx is even more Mythical than and SDN. Edge Switches The Alternative is More of the Same
Engine Example Security Use Case #1 • Monitoring either particular data sets or entire links often requires expensive, purpose built hardware. SDN Enabled Switch B
B * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Ac9on * * * * 192.1.1.0/24 * * * port6, port7 * Match: IP_DST 192.168.1.0/24 Instruction: Forward to Port6 AND Port7 Corporate Financials 192.168.1.0/24 Port-‐6 Port-‐7 SDN Controller Example Security Use Case #1 Security Analytics Engine
Ships in the Night. • We virtualize networks at varying degrees of scale today. • Operational overhead, provisioning and cost of hardware is a barrier in many cases PCI Financials HIPPA
Operations and Proper Abstractions to Facilitate IT Objectives. • Exposes Data to Analytics. Security Use Case #2 – Operational Sanity and Cost Control
a “global view” of the network during attacks. • Feed network data into predictive analysis engines. • All Flow Data is exposed. Today’s Network Data resides in /dev/null
Cri9cal) pci.domain.com -‐ (Compliance Cri9cal) *.*.*.*/* -‐ (Everything Else) 2 Separate Physical or Logical Paths. SDN Enabled Switch A SDN Enabled Switch B Example Scenario: Classify Traffic Based on DNS Values and Select the path Based on Policy Proac9vely or Reac9vely Residing on the SDN Controller. It does not have to be just the path. There are many powerful headers between Layer2-‐4 for starters. Simple use Case: Name Based Path Selec9on Easy as Calling a Method -IPv4.fromIPv4Address(match.getNetworkDestination())
L2 LearningAlgorthym) 1. Update Source Address in (T)CAM or SW tables. 2. Is destination address a Ethertpe LLDP or Bridge Filtered MAC, or is? Drop or FWD to Controller or even hand off to STP. LLDP may be used to build a topology (important for future). 3. Is Multicast? Yes Flood. 4. Is the destination address in port mac address table. If no Flood. 5. Is output port the same as input port? Drop to prevent loops. 6. Install flow and forward buffered and subsequent packets. Tradi9onal Network OF and/or SDN Enabled Switch (Seman9cs) POX, FloodLight/Beacon etc. Controller Tradi9onal Layer 3 Gateway Redistribu9on. Legacy Vlan/20 10.200.1.0/24 802.1q Trunk or (M)LAG group Access Port to Controllers Vlan 1 Port 24 1 11 10 SDN -‐ Vlan/10 10.100.1.0/24 Simple Hybrid Deployment Layer2 Path Isola9on between SDN and Na9ve networks leveraging Vlans
livdayseo
mayunak
rkendrick25
chrisshort
kristinabergwall1
honnibal
kimpetersen
aleyda
akosma
bryan
marcoroth
tessaabrams
