School of Electrical Engineering & Informatics Institut Teknologi Bandung, Indonesia

Transcription

1 School of Electrical Engineering & Informatics Institut Teknologi Bandung, Indonesia Saleh Havid, S.Kom Prasetiyo Hadi P, S.T Rifqy Hakimi, M.T Dr.ing. Eueung Mulyana

2 INHERENT : Indonesia Higher Education Research Network started on nodes (2007) to 312 nodes (2012) Deployed on back-up mode ( ) Using GRE Tunnel Planned to rebuild INHERENT through the IIX (Indonesia Internet exchange) by collaborating with Telco provider for using idle core in Telco

3 INHERENT with Indonesia IIX

4 INHERENT Traffic Monitoring Traffic between Border Gateway ITB and INHERENT Traffic between INHERENT and TEIN4

5 Official Course : EL5244 : Software Defined Networking Lectured by : Dr.ing. Eueung Mulyana Since July 2013 SDN Research Group (SDNRG-ITB) Built on Nov 2014 Mini workshop Introduction to SDN, Openflow, NFV (Nov 2014) Introduction to Openstack (Feb 2015) Website : Github :

6 Current SDN Graduate Thesis Research Design & Implementation Multi-Streaming on Unicast Openflow Network Design & Implementation of Openflow Testbed in ITB Implementation & Analysis of Elastic Load Balancing in DNS Service on Openstack Cloud Design & Implementation Site-to-Site IPsec VPN on Openstack

7 Design & Implementation Multi-Streaming on Unicast Openflow Network Dummy client Streaming server OpenFlow Controller Client 1 Client 2 Design multi-streaming video application on unicast network using floodlight openflow 1.0 Client 3

8 Implementation of Openflow Testbed in ITB Based on distributed Openflow Testbed (DOT) with Ofelia feature Next research goal : enabling the services of : On-Demand, Redundant & Load balancing, Scheduling Instant, Simplify, Secure, Machine to Machine

9 Implementation of Elastic Load Balancing in DNS Service on Openstack Cloud Background : The needs of Load Balance as a Service (LBaaS) on DNS traffic LBaaS Openstack is using Haproxy that only support for TCP, HTTP, and HTTPS traffic (not UDP) High DNS traffic must to be served by several DNS servers, and needs to be efficient for utilization load balance between busy and non-busy hour

10 Implementation of Elastic Load Balancing in DNS Service on Openstack Cloud (2) internet client (1) request (3) process request.3 (5) replies (2) rescheduling & rewriting packets Keepalived qrouter-xx (4) rewriting replies Virtual distribution switch Network DNS Server.5 Integrating LVS+Keepalived to load balance DNS request (UDP Traffic) Implement elastic resource allocation based using Openstack Heat

11 Implementation of Elastic Load Balancing in DNS Service on Openstack Cloud (2) DNS scale out : CPU usage > 80% high load (QPS > 30K) DNS scale in : CPU < 35-40% low load (QPS < 10K) Scale Out & Scale In Result

12 Design & Implementation Site-to-Site IPsec VPN on Openstack Background Infrastructure as a service (IaaS) is a type of cloud computing in which a third-party provider hosts virtualized computing resources over the Internet IPsec is a framework of open standards for ensuring private communications over public networks Problem statement What methods are available to secure communication from existing ip network to servers in the cloud? VM Instance as VPN gateway per tenant (ex: HP Public Cloud) VPN as a Service on Neutron + Service Provider (ex: Amazon AWS) Current Limitation VPN as a Service Only support PSK encryption Proposed Solution Extend Neutron VPN Plug-in to support RSA Signature

13 Design & Implementation Site-to-Site IPsec VPN on Openstack (2) Implement Site-to-Site IPsec VPN on Openstack Performance evaluation : s2s IPsec routers s2s IPSec using Openswan in Fedora Instance as VPN Gateway s2s IPSec using VPN as a Service (Neutron + Openswan)

14 conn %default ike=aes256-sha1-modp1536! ikelifetime=28800s keyexchange=ikev1 keyingtries=10 esp=aes256-sha1-modp1536! keylife=3600s rekeymargin=5m type=tunnel pfs=yes compress=no authby=secret conn vpn-test left=%defaultroute leftid= leftsubnet= /24 leftfirewall=yes right= rightid= rightsubnet= /24 dpdaction=hold dpddelay=60 dpdtimeout=500 auto=add Design & Implementation Site-to-Site IPsec VPN on Openstack (3) Openswan VM as VPN Gateway Configuration Neutron VPN as a Services

15 SDN Research Openflow Implement BGP over Openflow Network Cloud Implement Dynamic Routing on Openstack Neutron Implement VPN as a Service between Cloud & Existing IP Network Deploy File Sharing Service over Openstack Swift

16 Collaboration Plan Connecting Testbed to network Deploy hybrid cloud between Testbed and Deploy cloud application & service over the hybrid cloud