Transformation of the enterprise WAN with dynamic-path networking

Transcription

1 Transformation of the enterprise WAN with dynamic-path networking Greg Ferro November 24, 2014 This report is underwritten by Sonus Networks.

2 TABLE OF CONTENTS Executive summary... 3 How dynamic-path networking addresses current problems... 5 Current networking problems... 5 Elements of dynamic-path networking... 5 Flow tables and actions Network controller Service capabilities Use case: secure multi-tenancy Use case: choosing latency paths for better application performance Conclusion and key takeaways Key Takeaways About Greg Ferro About Gigaom Research Transformation of the enterprise WAN with dynamic-path networking 2

3 Executive summary An emerging market of products addresses the limitations of packet routing in traditional wide area networks (WAN) with a dynamic-path management technology that is based on programmable network devices. These devices have APIs that enable new applications to configure a WAN reliably and predictably without risk. WAN services consume a large part of the IT telecommunications budget, which accounts for around 40 percent of the total IT spend. WAN will continue growing and consuming budget with the adoption of cloud-based applications, so managing cost while extracting value from these networking resources is vital. At the same time, applications are consuming network resources and must be able to request and provision network services on demand; sometimes they require additional bandwidth to fulfill service requirements. Other types of application traffic, such as IP telephony, unified communication, and market-trading data, are sensitive to network latency and need specific network management capabilities to ensure that they deliver services that meet business objectives. This report looks at the business value of dynamic-path networking, flow networking, the atomic element of path control, and the opportunity to transform the nature of the WAN so that it can better deliver applications instead of packets. It will help IT executives understand the limitations of packet routing in traditional WAN networks as well as the key factors they should consider when adopting dynamic-path networking. Key findings include: Routing protocols can calculate only a single path. Load sharing or multi-path selection would reduce costs and improve services, but current technology cannot deliver. Flow networking can. Today s network services must match services and application requirements, each potentially requiring different reliability, application control, and capacity requirements. The corporate network is typically built with a mix of networks from multiple carriers that use differing transmission technologies and performance characteristics. Service-provider networks are increasingly diverse in access technology and use a variety of multiprotocol label switching (MPLS) technologies to present Ethernet or IP connectivity or, in some cases, older time-division multiplexing (TDM) technology. Transformation of the enterprise WAN with dynamic-path networking 3

4 WAN complexity is increasing, while reliability and resiliency are perceived to be declining. The current approaches to carrier diversity and path redundancy increase complexity and deliver unreliable networks. The most common industry approach is an MPLS overlay network for path management that further increases complexity and operational expense (OpEx). For many, the MPLS reality falls far short of business expectations or need. Transformation of the enterprise WAN with dynamic-path networking 4

5 How dynamic-path networking addresses current problems Dynamic-path networking, a new approach to path management, addresses the technology limitations in today s networking solutions. The future of networking is to build services from connectivity that closely align with the new infrastructure needs of mobility, security, and growth. Current networking problems Experienced network engineers will recognize this list of problems that currently impact network operations cost, efficiency, and complexity. The use of redundant WAN links is inefficient. Because of cumbersome IP policy and configuration management, utilizing available WAN resources efficiently is more difficult. Utilizing multi-path routing based on applications and available network resources in not possible. Traditional packet routing and MPLS architecture are not efficient at handling the rapidly changing dynamics in traffic flow. Providing burst/elastic WAN capacity dynamically isn t possible and neither is handling application traffic spikes. The current model does not provide on-demand bandwidth/qos that could rapidly handle changing application requirements. Without tools that can actively tune and enhance the application experience, visibility into application performance is limited. Elements of dynamic-path networking Five elements of the dynamic path network enable software control of the network. 1. Flow networking. Considering application flows instead of packets is fundamental to path networking. Routers forward packets from one interface to another and provide network connectivity so that two applications can exchange data and packets in both directions between the client and server a flow in the network. The flow state is instantiated into the device s internal silicon. When a packet is received, the input routine matches the packet header to a flow rule and then forwards the packet. The next packet in the flow undergoes the same process. In a packet network, the flow state is derived from BGP/MPLS or OSPF routing protocols, but loading flow rules directly into any network device is not possible. Flow networking is the atomic Transformation of the enterprise WAN with dynamic-path networking 5

6 element of path control. When two applications communicate, a flow of packets moves along a path and control of the path allows for granular control and administration of paths in the network. (Source: Gigaom Research) 2. APIs. Many technologies make up the software-defined-networking (SDN) market, but the most significant is the addition of a programming interface to network devices. These APIs allow programmers comprehensive access to a network device s on-board software that enables new ways of configuring the network. More profound is the ability to allow applications to talk directly to a network as a total system, rather than device by device. Today, device functions are exposed using a command line interface (CLI) and often configured manually by an engineer. As networks expand and complexity increases, manual configuration is less efficient and less reliable than automated and predictable configuration via an API. (Source: Gigaom Research) Transformation of the enterprise WAN with dynamic-path networking 6

7 APIs also improve performance and status monitoring. The widely used SNMP protocol has been recognized as insufficient since 2004, when standards bodies deprecated it. Limited features, poor extensibility, and an inability to perform reliable write-actions are just a few of its problems. Many APIs are under development in networking as the evolving market adopts this new approach. OpenFlow is currently the most popular for devices, while the OpenDaylight Consortium is defining application-controller APIs. Vendors are also promoting their own APIs, which support a device s specific features and capabilities or different network applications. API data models can be more comprehensive. Flow information, topology, QoS, hop count, latency, and traffic statistics can all be read and drawn from the network devices flow tables. One of the advantages of network controllers is that the applications have an end-to-end view of the network path. Most network-monitoring systems check and analyze individual devices without knowledge or reference to the entire network architecture. They mostly offer data about individual device performance such as QoS, CPU, or memory, and nothing about the application or service. Engineers must apply extensive skills and knowledge to the data to make decisions about network issues. This legacy approach does not scale and requires highly skilled individuals to read the runes from device monitoring. Networking APIs enable three functional applications for monitoring, analytics, and path management. 3. Network monitoring. Visibility, performance, and operational status are the reasons for network monitoring. The most common functions are graphs, status, thresholds, and alerts. The adoption of APIs allows for major improvements in network monitoring. RESTful APIs are robust, bi-directional, and rich in data. Existing methods via XML or SNMP are complex and difficult to use. With improved data sources, network monitoring can provide deep visibility into the network s operation, configuration, and function. Combined with new tools and processes for developing software, networking is finally getting platforms that can deliver reliable business intelligence on the overall system and network state. 4. Network analytics. This category involves the discovery and communication of patterns by monitoring the data from the APIs. In the last few years, analytics technology has advanced quickly and some products can now apply analytics to network configuration. Flow information, Transformation of the enterprise WAN with dynamic-path networking 7

8 routing topology, QoS tags, MPLS tags, hop count, latency, and traffic throughput are just a few of the criteria an analytics engine can ingest. Many methods for network analysis exist, but consider the following as guidelines: Has the response time for a flow changed? Does a given path have packet drops? What is the status of routing protocol database? How much traffic is there for a given flow category against a service level agreement (SLA)? Has the performance of an individual application crossed a threshold so that it requires recalibration? The second part of analytics is for the results to trigger events. For example, a combination of threshold alerts in the monitoring system and verification with analysis could trigger an overloaded network path that would confirm application performance degradation. 5. Path control system. How does path management control the network? The three most common path control approaches are: a) Inline devices. Networking devices placed inline to network data have two functions. They provide the capability of inspecting the network data deeply so that the analysis application has sufficient data for informed decision-making and they provide source-data performance and status-monitoring applications. The most common location is at the WAN edge where the router connects to the carrier network. b) Flow management. The device in the network path can manage the flows. The flow table in the device is configured by the path management application. The process of flow management using APIs and programmed automation is a reliable network-configuration method. The most important aspect of flow management is that modifying the flow table in a given device is a safe change. Updates to the flow tables usually involve changing the next hop data in the flow table. In autonomous networking, path changes are made by influencing the routing protocol. Any changes require the routing algorithm to work through the Transformation of the enterprise WAN with dynamic-path networking 8

9 process of signaling, discovery, and recalculation before the change is made. Packets are often dropped for loop safety and so a significant risk is that the engineer and protocol may have different outcomes. c) Overlay networking. The most common method of path control it using overlay networking. Traffic encapsulation has been used in networking protocols for many years, but where protocols like EoMPLS or L2VPN rely on autonomous and self-configuration for their path, dynamic-path networking uses software applications and controller technology to configure the overlay paths. When this was first proposed for use in the LAN and WAN in 2011, most engineers resisted, but the value of a controller-based architecture has been established and is an infrastructure element for nearly all path-management technologies. The encapsulation process that drives overlay networking: Point 1 is the ingress router that receives the packet from a server. The router encapsulates the incoming Ethernet frame or IP packet into an outer IP packet. At each of points 2, the external IP packet is routed across the core according to the routing of the outer IP header. At Point 3, the outer IP is stripped and the frame or packet forwarded normally. (Source: Gigaom Research) As the payload is routed according to the outer header, the underlying network does not change. Other than the load of traffic now carried in the encapsulated path, IP routing protocols to enable this new path through the network did not change. The configuration and management of the tunnel configuration at Point 1 and 2 is now the primary issue. Transformation of the enterprise WAN with dynamic-path networking 9

10 Flow tables and actions The flow state in the network device includes the concept of actions. In the same way that traditional networking can insert a VLAN ID into the Ethernet frame or a MPLS tag onto an IP packet, the flow table can have actions for encapsulation. This is to highlight that device silicon can perform encapsulation in a similar way to adding MPLS tags in an existing network. (Source: Gigaom Research) Network controller The logically centralized network controller that enables dynamic-path networking reduces complexity. Consider an architecture that implements individual software applications for monitoring, analytics, and path control. As in the following figure, the interaction between applications and devices becomes a fullmesh connectivity map. (Source: Gigaom Research) Transformation of the enterprise WAN with dynamic-path networking 10

11 A network controller is a software infrastructure component that acts as a gateway for configuring the network devices. Applications communicate through APIs to the controller to each network devices. The controller handles all simple tasks like authentication and device management, freeing up the application developers to focus on more useful development activities. (Source: Gigaom Research) Transformation of the enterprise WAN with dynamic-path networking 11

12 Service capabilities Following are two uses cases that examine how dynamic-path control really changes enterprise networking. Use case: secure multi-tenancy Isolation of traffic in the WAN is quite difficult. The most common method is an MPLS Tags that signals zone membership and isolates traffic. Dynamic path uses encapsulation to achieve path isolation in a similar way, but without the complexity of MPLS. In the following diagram, the network controller configures two devices that act as tunnel-edge devices. The middle device represents the existing network. The preliminary step and five key steps for forwarding a multi-tenant network using overlay networking are: Step 0. Network application configures the flow table in the edge network devices at points 1 and 5. Step 1. Packet arrives at edge device and is matched to a flow entry in the device. The flow entry contains an extended tuple of up to 12 segments of data matching such as source and destination IP, source and destination TCP Port, QoS marking, and many more. In this case, the flow matches a rule and is encapsulated into one of three possible overlay tunnels. Each tunnel represents a tenant. Step 2. The tunnel packet moves over the wire to the next device. Step 3. The network core performs a normal IP lookup and forwards the tunnel packet like any other IP packet. Step 4. The edge device receives the payload and matches the flow entry loaded by the controller to remove the outer tunnel header. Step 5. The frame or packet received in Step 1 heads into the network according to the configuration of that network. Transformation of the enterprise WAN with dynamic-path networking 12

13 (Source: Gigaom Research) Note that the protocol for encapsulation is not critical as long as the devices support the encapsulation protocol and the controller is able to configure it. A number of possible protocols are in use today and each has a purpose or feature that may or not be currently useful. The most important enabling factor in this architecture is the network controller and applications. By having end-to-end control over the tunnel paths, the integrity of an overlay network for multipath isolation is very high for design, configuration, and auditing phases of security control. In many respects, the edge overlay network is similar to MPLS, where the PE routers impose tags at the network s edge, while a simple high-performance core is maintained. In MPLS, BGP and LDP are used to distribute tag path information while the controller performs the tunnel path management. At the same time, the controller can use APIs to extract much more information about the state of the network. Use case: choosing latency paths for better application performance Enterprises have a growing numbers of latency-sensitive applications such as IP telephony and Oracle/SAP, among others. The most common solution is implementing traffic shaping through DiffServ Transformation of the enterprise WAN with dynamic-path networking 13

14 technology that can identify and manage packets as they pass through each device. This requires detailed, methodical planning and project implementation with significant costs, and complicates the network operation on every device. Dynamic path management uses the network controller to analyze the operational performance of the various paths in the network. Using modern device APIs, the network controller can extract status information about network flows and then perform high-function analysis on the performance and, using overlay networking methods that are described here, choose different paths for traffic flows. The following figure shows three possible WAN paths between two site edge routers. For the purposes of this use case, Path 1 is the highest bandwidth and speed, but is a long-distance geographic path that has higher latency compared to Path 2 or Path 3. The network architect must manually account for bit miles and circuit performance in the physical network path, because IP Routing protocols do not measure latency, jitter, or drop rates. (Source: Gigaom Research) For an IP-routed network, Path 1 would be best path by speed and all IP voice would traverse this suboptimal path. The use of edge network devices that are managed by the network controllers can establish multiple overlay tunnels that would each traverse Path 1, 2, and 3. The network analytics application can monitor the quality of each overlay path and determine if one or the other experiences performance degradation. If so, the edge switches can modify the path and steer the critical voice traffic down the best possible path. In more complex situations, such as failure of the lowest-latency path, the network application could shape traffic into the tunnel over an alternative path to ensure that bandwidth is reserved and the best possible network conditions are achieved. This process also demonstrates the Transformation of the enterprise WAN with dynamic-path networking 14

15 ability of dynamic path management to increase network utilization by managing traffic into overlay paths. (Source: Gigaom Research) A key aspect of dynamic path management is that the overlay tunnel has zero impact on the operation or configuration of the core network. Changes are made at the edge of the network by directing flows into stable tunnel paths. The use of APIs and software programming means that these changes are predictable and repeatable, so that network operations can quickly have confidence that a given condition will result in the network adapting around problems. This is critical for assurance and SLAs. Transformation of the enterprise WAN with dynamic-path networking 15

16 Conclusion and key takeaways The flow nature of existing networks and the repurposing of the existing silicon technology with network controllers, applications, and APIs can transform a WAN from a static, fixed, and selfconfiguring system to a stable core with scalable edge component that can be monitored and programmed. Enhanced APIs enable true analytics by accessing better data sources and enabling better configuration than can be achieved by the command line. With WAN networks consuming such a large percentage of IT budgets, dynamic path management can dramatically reduce costs by increasing utilization without major changes or transforming the existing network. Dynamic path management provides an easy, fast, and efficient architecture for addressing the emerging shifts in enterprise WAN services: Seamless and efficient use of multiple WAN links with built in redundancy Dynamically utilizing the optimum path based on applications and available network resources Automatically increasing network WAN capacity to handle application traffic spikes End-to-end monitoring and analytics tools enabling IT managers to manage and improve application performance proactively Easy deployment over existing L1/L2 infrastructure without compromising security Key Takeaways Dynamic path management is a crucial step in building network services. The use of APIs in network devices empowers analytics in software that, combined with an end-to-end visibility of inline devices, mean software applications can have the necessary data to make intelligent path decisions about the network. Vendors are moving to build analytics-driven configurations that can be reliably implemented using the same APIs. Because the devices are connected at the edge of existing WAN networks, the technology can be deployed today with little impact or risk. Over time, standards-based APIs should emerge or software can extend to support the existing network devices but this is not a requirement. Transformation of the enterprise WAN with dynamic-path networking 16

17 The attraction of orchestrated network change is reliability and predictability. In actual use, the first few automated changes are unnerving to most network engineers, but this process is functionally identical to the automated configuration the routing convergence performs. Networking must be more flexible in future to meet the changing requirements of applications, mobility of servers and devices, and rapidly changing dynamics in traffic flows. In the mid 1990s, network traffic was more predictable, while applications changed infrequently. The adoption of virtualization and hypervisors for operating systems and continuous delivery deployment of applications are two high profile technology shifts that require networking to be configured ondemand and adapt rapidly. Analytics-driven network change provides better support for budgets, design, and monitoring. This area has been deficient in networking for many years and networking is adapting to meet future requirements. Transformation of the enterprise WAN with dynamic-path networking 17

18 About Greg Ferro Greg Ferro is a freelance network architect and engineer currently working in Great Britain for Fortune 100 companies on a wide range of enterprise networking and security technologies. He has more than 20 years of experience in networking with a recent focus on architecture and design for cloud networking. Security infrastructure is also a key part of his expertise. He is the co-host of the Packet Pushers Podcast, a weekly podcast on data networking. Covering all areas of networking, Packet Pushers is a roundtable discussion of users, customers, and vendors who cover the networking industry. The discussion is focused on enterprise and cloud networking. His blog at EtherealMind.com is a widely respected source of networking news. Ferro also writes regularly for Gigaom Research and Network Computing, for which he covers a range of networking topics, including product and strategy from the vendors, technology reviews, and coalface experiences, and he is well known for his blog, EtherealMind.com. About Gigaom Research Gigaom Research gives you insider access to expert industry insights on emerging markets. Focused on delivering highly relevant and timely research to the people who need it most, our analysis, reports, and original research come from the most respected voices in the industry. Whether you re beginning to learn about a new market or are an industry insider, Gigaom Research addresses the need for relevant, illuminating insights into the industry s most dynamic markets. Visit us at: research.gigaom.com Giga Omni Media, Inc. All Rights Reserved. This publication may be used only as expressly permitted by license from Gigaom and may not be accessed, used, copied, distributed, published, sold, publicly displayed, or otherwise exploited without the express prior written permission of Gigaom. For licensing information, please contact us. Transformation of the enterprise WAN with dynamic-path networking 18