SDN Overview. Southern Partnership in Advanced Networking John Hicks, November 3, 2015

Transcription

1 SDN Overview Southern Partnership in Advanced Networking John Hicks, November 3, 2015 Slide material excerpted from presentations at the OIN workshop series and other sources.

2 Acknowledgement Overview material excerpted from presentation at the OIN workshop series. Credit to Ed Balas (and others) of Indiana University ; -> Prior Workshops -> {Pittsburgh PA} (March 18, ) ; SDN folder Or

3 My definition of SDN apps that control networks are decoupled from network equipment consider other information could be cross layer, or external Find better ways to align network to your organization s mission statement 4

4 SDN Drivers Automation improve quality, increase scale Orchestration get customers what they want faster combine network and biz logic Control find special snowflakes and act 8

5 What do you want in Campus? support divergent use case science vs commodity keep security zones separate automation to maintain quality and scale baked in security for reactive protection automation and control are drivers 10

6 Network Function Virtualization traditional network functions moved into a vm and not require physical hardware. allows scaling with your DC i386 stack, because that is what you are using for everything else? could also consider things like VRFs as a way to do this at line rate. 13

7 Service Chaining I have a virtual router, firewall and load balancer build a forwarding pipeline to combine the feature set required for the virtual community RTR FW LoadBalancer srv1 srv2 client 14

8 OpenFlow Specification control forwarding on a switch from external app programs an abstract forwarding table application does not run on route engine TCP session between TLS optional Versions 1.0 and 1.3 Application Controller Switch OpenFlow Event Loop Management Network NorthBound APIs Built in Modules OpenFlow Agent Forwarding Table 21 Port Port Port Port Port Port

9 Matches Action Counters Forwarding Table Model 23

10 Interaction Patterns When does the Controller program the forwarding rules on the switch? 3 basic approaches Proactive Reactive Combined Application Controller Switch OpenFlow Event Loop Management Network NorthBound APIs Built in Modules OpenFlow Agent Forwarding Table 30 Port Port Port Port Port Port

11 SciPass Secure OpenFlow Based Science DMZ Edward Balas July 9,

12

13

14

15 Internet2 Network: Controlling a Slice of the National Network Eric Boyd Senior Director of Strategic Projects

16

17 I2 Production Service Service User I2 Prototype Service Internet2 Service Taxonomy Implemented Using LHCONE NET+ External Provider Services Dependencies XSEDE GENI? Layer 3 R&E IP and TR-CPS Services I2-Run Service Specific Hardware Connectors GENI Learning Switch ONOS? General Purpose VLAN Service - AL2S SDN Controller ESNET NOAA NVS (Network Virtualization Service) Virtualized Ethernet Switching Hypervisor Ethernet Switches Circuits and Wavelengths - AL1S Fiber & Optical Transport

18 Internet2 Network Software Stack KEY Vendor Developed Internet2 Developed Internet2 Modified 3rd Party Developed Experimenter Code API SDN-IP API EXP APP API FOAM STITCHING AGGREGATE API OESS UI OESS API EXP APP Oscars API GENI Learning Switch ONOS MD-OESS NOX OESS NOX OSCARS IDCP OpenFlow OpenFlow FIU FSFW Utah FSFW MAX FSFW OpenFlow OpenFlow FlowSpaceFirewall OpenFlow OpenFlow OpenFlow OpenFlow Switch OpenFlow Switch OpenFlow Switch

19 September 2015 status OpenFlow 1.0 in production OF 1.3 support in FSFW and OESS in design Experimenting with Brocade 5.8b implementation of OF1.3 Working with Juniper on implementing requirements for OF 1.3 Hypervisor (FlowSpace Firewall1.0.5) in production Supports L2 and L3 matching Vendor Updates (current versions Juniper 13.3, Brocade 5.6dc) Vendor-specific limits do exist. Controller (OESS 1.1.6) in production Supports Layer 2 Trace Accepting 3 rd party controllers Questionnaire Mininet Emulation of AL2S Test Lab Production GENI Aggregate Manager in production Allow provisioning of a sliver across AL2S as part of a larger GENI slice

20 Internet Plans Continue to support network research on AL2S, and we are in particular interested in understanding and meeting needs of GENI researchers Deploy NSI on AL2S Begin conversations about continued IDCP support ONOS Deployment, with Global Peers as a prototype service Work with vendors to get OF 1.3 Support Brocade -> 5.8x ( now ) in testing Juniper -> In discussion Continue to support and enhance OESS, FSFW Evaluating OF 1.3 support in FSFW Refine Slice Deployment Process Faster? Test for correctness, then safety Testing constraints?

21 Network virtualization with FlowSpace Firewall OpenFlow 1.0 today Simple VLAN Tag based flowspace firewall / proxy (nonoverlapping ranges) Policy definition and enforcement support range operations < 1,000 policies to support 3 slices using the entire flowspace Per slice total rule limits Per slice per switch flow modification rate limits Built upon FloodLight Designed for production use. Developed by Internet2 with GlobalNOCSoftware Engineering

22 Operating SDN Networks Possible to build and operate a reliable Layer 2 and Layer 3 network atop an SDN Substrate Possible to support multiple controllers concurrently on an SDN substrate through network virtualization Possible to create a multi-domain SDX using network virtualization Possible to build a global Layer 3 network through software on a router-less network in ~1 month

23 Challenges in Operating SDN Networks Vendor implementations of OpenFlow 1.0 have been buggy and incomplete Vendor implementations of OpenFlow 1.3 have been very slow to appear, as well as buggy and incomplete OpenFlow 1.0 and 1.3 standards have too many optional features, making the implementation of new features a painstaking negotiating process with multiple vendors OpenFlow 1.0 and 1.3 specs are sufficiently vague that we had to write supplemental specs to ensure vendor interoperability

24 More Challenges in Operating SDN Networks Building a network software stack requires absolutely rigorous testing when any component changes Testing harness becomes the resource bottleneck Testing for safety!= testing for correctness Supporting multiple controllers concurrently on a production network software stack: Requires significant FTE resources Moves slower than researchers are accustomed Requires more productization(logging, release management, documentation) than normally done by researchers