Network Virtualiza/on on Internet2. Eric Boyd Senior Director for Strategic Projects

Transcription

1 Network Virtualiza/on on Internet2 Eric Boyd Senior Director for Strategic Projects

2 Internet2 Mission University Corpora=on = for Advanced Internet Development

3 Internet2 Community Innova=on Story Abundant Bandwidth 100G, for now Network Programmability SDN, Network Virtualiza=on Fric=on- Free Science Science DMZ

4 Internet2 Community Innova=on Story Abundant Bandwidth 100G, for now Network Programmability SDN, Network Virtualiza=on Fric=on- Free Science Science DMZ

5 Network Virtualiza=on on Internet2

6 Network Virtualiza=on on Internet2

7 Network Virtualiza=on on Internet2

8 Network Virtualiza=on on Internet2 Control a slice of the na=onal network! Enable: Rapid prototyping of advanced applica=ons Rapid prototyping of new network services Rapid advancement of network research

9 Network Virtualiza=on Roll- Out Being able to build virtual networks will enable: Rapid prototyping of advanced applica=ons Rapid prototyping of new network services Rapid advancement of network research Network virtualiza=on experiments are already underway Prototyping IP over SDN solu=on (no routers!) Prototyping cloud- based services Prototyping mul=- domain virtual networks Etc.

10 Realizing a Community Vision Internet2 s support for network virtualiza=on instan=ates the Group B request from 2005/6 that asked for a mul=- purpose, large- scale, mul=- tenant innova=on pla^orm. Internet2 s network virtualiza=on service implements the vision laid out at the April, 2012 Member Mee=ng. What does the service enable? Opportunity to deploy your own controller on the na=onal backbone Slice of the na=onal backbone resources (e.g. VLAN range, flow table subset, etc.) Ability to create a persistent na=onwide service using a frac=on of the na=onal backbone

11 Network Virtualiza=on on Internet2 Network Virtualiza=on: Puts members in control of (a slice of) the network Change in paradigm: Turning the commons on its head Private network capabili=es with shared network costs Large scale networking is normally about lowest common denominator Large scale virtualized networking is about crea=ng custom facili=es Extend the local domain into the na=onal (eventually global) arena

12 Technology behind Network Virtualiza=on Internet2 and Indiana University have developed a second- genera=on, open source hypervisor, called Flowspace Firewall (FSFW). FSFW divvies up the available VLANs on a network into VLAN ranges, known as slices. FSFW acts as a proxy between one or more OpenFlow controllers and a set of switches within a single administra=ve domain. FSFW only carries OpenFlow commands from a controller to a switch (or the reverse) if the command falls within the allocated range of VLANs for that controller. FSFW acts as a resource protector, ensuring that no controller overconsumes scarce resources such as the rate at which OpenFlow rules can be fed to a switch or the number of OpenFlow entries in the Flow Table. Technology enables Innova=on in the Internet2 Community

13 KEY OpenFlow Switch Internet2 Software Stack Experimenter Code EXP APP FOAM STITCHING AGGREGATE OESS UI EXP APP API API API OESS API NSI API GENI Learning Switch MD-OESS NOX OESS NOX NSI OSCARS NSI IDCP OpenFlow FIU FSFW Utah FSFW MAX FSFW OpenFlow OpenFlow FlowSpaceFirewall OpenFlow OpenFlow OpenFlow OpenFlow Switch OpenFlow Switch OpenFlow Switch

14 I2 Production Service Service User I2 Prototype Service Internet2 Service Taxonomy Implemented Using LHCONE NET+ External Provider Services Dependencies XSEDE GENI? Layer 3 R&E IP and TR-CPS Services I2-Run Service Specific Hardware Connectors GENI Learning Switch ONOS? General Purpose VLAN Service - AL2S SDN Controller ESNET NOAA NVS (Network Virtualization Service) Virtualized Ethernet Switching Hypervisor Ethernet Switches Circuits and Wavelengths - AL1S Fiber & Optical Transport

15 Network Virtualiza=on Use Case For most applica=ons run in a campus environment, the tradi=onal routed Layer 3 infrastructure provided by the Internet2 Advanced Layer 3 Service (AL3S) provides all the needed func=onality and performance. For some applica=ons, the ability to run on a server in a campus environment or on a GENI Rack, connected by a Layer 2 VLAN, should suffice. For a few advanced applica=ons, par=cularly in the network research arena, there is a need to run their own controller on a virtual network.

16 Use Case Examples Produc=on Service Staging GENI wants to move to S=tching v3.0, but S=tching 2.0 is in wide use Set up a slice, deploy a second OESS, deploy new version of FOAM S=tching Aggregator When it s tested and ready, move to the produc=on OESS stack Network Research Network researcher has a beher idea how to do networking Set up a slice, deploy new network controller, write paper Service Prototyping Look at alterna=ves to AL3S Implement a route server that speaks OpenFlow on southbound interface with no routers Deploy in a slice, begin peering with other domains Evaluate efficacy, opera=onal savings Over =me transi=on to new service Private Networks Want something akin to Atlan=c Wave, original vision for LHCONE, or GENI Virtual Network Set up a distributed SDX across mul=ple domains

17 GENI Learning Switch GEC21: Last week the GENI Program Office demonstrated the first non- Internet2 controller running a slice on the Internet2 network The GENI Learning Switch Worked through the process of gemng a slice on the network What does Internet2 expect of slice owners? What do Slice Owners expect of Internet2? How do we balance between innova=on and produc=on?

18 Network Virtualiza=on Underway Innova=on through network virtualiza=on underway GENI Community Prototyping IP over SDN solu=on (no routers!) Prototyping cloud- based services Prototyping mul=- domain virtual networks DANCES project Etc.

19 Prototype Mul=- Domain Layer 2 Service AL2S: Advanced Layer 2 Service Enables provisioning of Layer 2 VLANs across the Internet2 Network Fast provisioning Automa=c failover to redundant path Enables interdomain provisoning through interdomain protocol Slower provisioning No automa=c failover

20 Prototype Mul=- Domain Layer 2 Service Backdrop: Internet2 operates a Layer 2 Service Campuses (e.g. University of Utah) operate a Layer 2 Service Regional Networks (e.g. MAX) operate a Layer 2 Service Exchange Points (e.g. AMPATH/FIU) operate a Layer 2 Service Is there a way to create a Mul=- Domain Layer 2 Service? Common capabili=es Willingness to collaborate Willingness to contribute to a common project Maintain local control Withdraw at any =me Enable (illusion of) global control Control remote administra=ve domains No change in sonware, just configura=on

21 OESS Local VLAN Provisioning Service FlowSpaceFirewall Virtual Switch Physical switch SDX1

22 OESS OESS OESS Local VLAN Provisioning Service Local VLAN Provisioning Service Local VLAN Provisioning Service FlowSpaceFirewall FlowSpaceFirewall FlowSpaceFirewall Virtual Switch Virtual Switch Virtual Switch Physical switch SDX1 Physical switch SDX2 Physical switch SDX3

23 NSI OESS OESS OESS NSI NSI Local VLAN Provisioning Service Local VLAN Provisioning Service Local VLAN Provisioning Service FlowSpaceFirewall FlowSpaceFirewall FlowSpaceFirewall Virtual Switch Virtual Switch Virtual Switch Physical switch SDX1 Physical switch SDX2 Physical switch SDX3

24 FlowSpaceFirewall OESS MD -OESS OESS OESS Utah MAX FlowSpaceFirewall Local VLAN Provisioning Service Local VLAN Provisioning Service Local VLAN Provisioning Service Physical switch Physical switch Virtual Switch Virtual Switch Virtual Switch Virtual Switch Virtual Switch Virtual Switch Virtual Switch Virtual Switch Virtual Switch Virtual Switch Physical switch Physical switch Physical switch FlowSpaceFirewall Internet2 FlowSpaceFirewall OESS FIU Local VLAN Provisioning Service Physical switch Virtual Switch Virtual Switch

25

26 Mul=- Domain Sample Network Utah 3505 HP PS HP PS FIU Internet2 AL2S MAX PS Brocade Brocade Brocade PS PS Brocade DELL Brazil PS 3502

27 DEMO

28 MAX FlowSpace Firewall Deployment and Tes=ng Tom Lehman and Xi Yang University of Maryland Mid- Atlan=c Crossroads (MAX)

29 MAX FSFW Deployment MAX regional network is interested in using FSFW as part of the overall SDN capability set Provides the basis for the construc=on of applica=on/ workflow specific network topologies includes layer2 isola=on and protec=on of other network resources and slices on local network provides the basis for automa=ng instan=a=on of mul=- domain private topologies MAX will build on this via integra=on of FSFW/OESS driven network provisioning and topologies with compute and storage resources Building Sonware Defined Services (SDS)

30 MAX Current Deployment Two network elements Brocade MLXe, Dell/Force10 S4810 Two perfsonar Nodes Two slices: MAX- OESS and MD- OESS

31 MAX Future Deployment Sonware Defined Services Addi=onal network elements Integrate High Performance Parallel File System (Ceph) Integrate Compute nodes and Workflow Hos=ng

32 Americas Lightpaths - AmLight Jeronimo Bezerra jbezerra@fiu.edu

33 What is AmLight? AmLight Network Collabora=on among FIU, RNP, ANSP, AURA, REUNA and RedCLARA to connectsouth America to the U.S. Works as a Distributed IXP Connects AMPATH and SouthernLight IXPs Connects more than 1000 universi=es and research centers and 13 Research Networks 40Gbps (4x10Gbps)

34 Why Virtualiza=on/Programmability in regional networks and/or IXP environments make sense? Reduces the provisioning =me Beher support for new protocols and features Beher support experimenta=on/no need for overlays

35 What is AmLight s current plan and configura=on? All AmLight switches support Openflow 1.0 Internet2 s FlowSpace Firewall for virtualiza=on/ programmability Internet2 s OESS to manage the AmLight slice (default users) OSCARS for inter- domain provisioniong

36 What does AmLight plan for the future? Improve the troubleshoo=ng techniques and skills Create beher documenta=on and share informa=on to help researchers to use AmLight Upgrade the network to support more features: SDX, Security, Metering, etc

37 University of Utah Joe Breen

38 Why Support of virtual slices with different security contexts and network characteris=cs Network/Security experiment environment Minimal protec=on Science DMZ as a slice More security than experimental slice, less than hospital/campus produc=on environments; high performance characteris=cs Support of dynamic domain science workflow between resources, i.e. dedicated instrument and HPC clusters or storage

39 University of Utah s current plans Migrate current InstaGENI and ProtoGENI infrastructure to AL2S from ION and DWDM infrastructure (hhp://geni.net, hhp://protogeni.net) Setup incoming research clusters and HPC infrastructure Connect Apt cluster to AL2S infrastructure (hhp://aptlab.net) Connect incoming Cloudlab infrastructure (hhp://cloudlab.us)

40

41 University of Utah future plans Deploy Network Management research pla^orm in a slice Test new security research with friendly users Poten=ally deploy Entrepreneurship building (Engineering and Business collabora=ons) with slice capabili=es for suppor=ng student projects in garage bays Poten=ally work with other disciplines, such as the Entertainment Arts and Engineering

42 Ques/ons? Eric Boyd