Next-generation Data Center Solution Big Switch Monitoring Fabric

Slide 1

Slide 1 text

Next-generation Data Center Solution Big Switch Monitoring Fabric Phil Huang SDN Solution Engineer, Open Networking Division

Slide 2

Slide 2 text

About Me © 2017 Edgecore Networks. All rights reserved | www.edge-core.com Phil Huang § Edgecore SDN Solution Engineer § Big Switch Networks § Cumulus Linux § Pica8 § OF-DPA & Open Network Linux § ONOS/CORD Ambassador § blog.pichuang.com.tw

Slide 3

Slide 3 text

Agenda © 2017 Edgecore Networks. All rights reserved | www.edge-core.com § Why Big Switch Networks? § Why Big Monitoring Fabric (BMF)? § Overview § Out-of-Band && Inline § Architecture § Use Cases § Big Secure Architecture § Big Switch Networks Labs

Slide 4

Slide 4 text

Slide 5

Slide 5 text

About Big Switch Networks © 2017 Edgecore Networks. All rights reserved | www.edge-core.com Delivery Hyperscale-style Networking/Monitoring To Any Datacenter Big Cloud Fabric Integrate with • VMWare • OpenStack DC Switching Solution DC Security and Monitoring Solution Big Monitoring Fabric • Pervasive Visibility • DMZ Security

Slide 6

Slide 6 text

Shared ”One Big Switch” Architecture © 2017 Edgecore Networks. All rights reserved | www.edge-core.com • Traditional Netframe Design • Single point of management • Proprietary, Vendor Lock-in, Fixed slots BIG CLOUD FABRIC CONTROLLER Hierarchical Control Plane 1 3 SPINE SWITCHES 2 10G/40G Backplane 4 1 3 2 4 COMPUTE WORKLOAD SERVICES & CONNECTIVITY RACKS COMPUTE WORKLOAD LEAF SWITCHES Physical & Virtual Workloads 1G/ 10G/40G Workloads • Disaggregated Netframe – One “Big Swich” • Open, Centralized management, Vendor choice Easy for scale-out your network

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Application Performance Monitoring Network Performance Monitoring Security Monitoring Customer Experience Monitoring Traffic Analytics / Recorders Network Monitoring Solution Landscape © 2017 Edgecore Networks. All rights reserved | www.edge-core.com

Slide 9

Slide 9 text

Legacy NPB Challenge © 2017 Edgecore Networks. All rights reserved | www.edge-core.com PRODUCTION NETWORK Non-optimal Monitoring Monitoring at Core due to High NPB costs Want to Monitor deeper? Buy more NPBs (& tools) NPB VISIBILITY TOOLS NPB VISIBILITY TOOLS Growing your network? Buy even more NPBs NPB VISIBILITY TOOLS Box-by-box config, troubleshooting (Complex & Expensive) Limited, siloed network visibility (Suboptimal tool usage) Siloed access to your high-priced tools (Suboptimal tool usage) TAPS / SPAN Ports NPB: Network Packet Breaker

Slide 10

Slide 10 text

BMF Inline Architecture © 2017 Edgecore Networks. All rights reserved | www.edge-core.com Trusted Zone DC / Enterprise / Campus Network Untrusted Zone Internet / ISP 10/40/100G Big Monitoring Fabric Controller Web Proxy IPS SSL Decryption Inline Tool Chains Traffic Distribution / Load Sharing CABS APT Protection DMZ Firewall Perimeter Firewall

Slide 11

Slide 11 text

Use Case – DMZ / Inline Security © 2017 Edgecore Networks. All rights reserved | www.edge-core.com Untrusted Zone Internet / ISP 10/40/100G Big Monitoring Fabric Controller Trusted Zone Switch B Trusted Zone Switch A Trusted Zone Switch C A B C Firewall Pool IPS Pool

Slide 12

Slide 12 text

Use Case – Active Defense System © 2017 Edgecore Networks. All rights reserved | www.edge-core.com 10/40/100G Big Monitoring Fabric Controllers (HA-enabled) Trusted Zone Campus Network Untrusted Zone Internet / ISP Firewall Log Analysis IDS IPS Non-whitelisted Data Traffic Whitelisted Data Traffic SPAN Control Plane Alerts Alerts 1. Whitelisted Traffic Notification 2. Invoke BMF Controller REST API 3. Auto-program whitelist rules Research Institute • Easy to use • Simplified deployment for handing high performance data transfers

Slide 13

Slide 13 text

BMF Out-of-Band Architecture © 2017 Edgecore Networks. All rights reserved | www.edge-core.com TAP / SPAN DC / Enterprise / Campus Network Visibility Tools 1. Network Performance Monitoring 2. Application Performance Monitoring 3. Security Tools 4. VoIP Monitoring 5. Flow-based Monitoring Centralized Tool Farm Scale-up/out Network 1/10/40/100G Open Network Switch Service Ports Filter Ports Delivery Ports Service Nodes / NPB Switch Fabric with Service Nodes Big Monitoring Fabric Controller

Slide 14

Slide 14 text

Use Case – Centralized Tools and Management © 2017 Edgecore Networks. All rights reserved | www.edge-core.com Remote Location Monitoring Troubleshoot network problems in remote locations via centralize tools Building A US Advanced Technology Provider L2 GRE Tunnels Big Monitoring Fabric Controllers Service Ports Tunnel Ports Delivery Ports Service Nodes / NPB Visibility Tools Primary Data Center / NOC 10/40G Open Network Switch Building X

Slide 15

Slide 15 text

Use Case – Pervasive Security Centralized Tool Farm Tier-1 US Financial Services Institution • Centralized tool farm for 120 racks • Mix of 1/10/40G TAPs, SPANs and Tools • NPB costs were reduced by more than 60% • Increasing monitoring network capacity

Slide 16

Slide 16 text

© 2017 Edgecore Networks. All rights reserved | www.edge-core.com • Dynamic, Terabit-scale Cyber-defense Programmability Traffic path Attack Detection & Scale-out Mitigation Internet-based Applications/Services BigSecure Architecture Big Mon Controller(s) 2. High-BW Attack Signatures API L2 – L4 Mitigation 3rd party Security Tool Chain 1. Attack Detection, Mitigation INTERNET DMZ NFV Nodes for Tool VNFs 3. Elastic Mitigation (Terabit- scale) L4 – L7 Mitigation Big Mon Service Nodes BigSecure Architecture • Security tools detect & mitigate attack • For high-BW attacks, security tool communicates attack signature(s) to BMF Controller • Programs switch fabric to mitigate L2-L4 attacks • Programs service node(s) to mitigate L4- L7 attacks • Load balances tool VNFs on NFV node(s) • Re-orders service chain to front-end elastic mitigation

Slide 17

Slide 17 text

Big Mon Service Node © 2017 Edgecore Networks. All rights reserved | www.edge-core.com § Accton DPDK Advanced Packet Services Appliance § 40G Service Node § 160G Service Node § Advanced Packet Services § De-duplication § Packet Slicing § Regex/DPI Filtering § Netflow Generation § Header Decapsulation § Packet Masking § Software-based Timestamping BigSecure Architecture Big Mon Controller(s) L4 – L7 Mitigation Big Mon Service Nodes

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Try Different BSN Use Cases © 2017 Edgecore Networks. All rights reserved | www.edge-core.com Big Monitoring Fabric § Inline § Out-of-Band § Analytics Big Cloud Fabric § P / P+V Edition § OpenStack Integration § VMWare vCenter § Programmability and Automation