School of Electrical Engineering & Informatics Institut Teknologi Bandung, Indonesia Saleh Havid, S.Kom Prasetiyo Hadi P, S.T Rifqy Hakimi, M.T Dr.ing. Eueung Mulyana
INHERENT @ITB INHERENT : Indonesia Higher Education Research Network started on 2007 30 nodes (2007) to 312 nodes (2012) Deployed on back-up mode (2013-2014) Using GRE Tunnel Planned to rebuild INHERENT through the IIX (Indonesia Internet exchange) by collaborating with Telco provider for using idle core in Telco
INHERENT with Indonesia IIX
INHERENT Traffic Monitoring Traffic between Border Gateway ITB and INHERENT Traffic between INHERENT and TEIN4
Official Course : SDN @ITB EL5244 : Software Defined Networking Lectured by : Dr.ing. Eueung Mulyana Since July 2013 SDN Research Group (SDNRG-ITB) Built on Nov 2014 Mini workshop Introduction to SDN, Openflow, NFV (Nov 2014) Introduction to Openstack (Feb 2015) Website : http://sdnrg.itb.ac.id/ Github : https://github.com/sdn-rg/community-book
Current SDN Research @ITB Graduate Thesis Research Design & Implementation Multi-Streaming on Unicast Openflow Network Design & Implementation of Openflow Testbed in ITB Implementation & Analysis of Elastic Load Balancing in DNS Service on Openstack Cloud Design & Implementation Site-to-Site IPsec VPN on Openstack
Design & Implementation Multi-Streaming on Unicast Openflow Network Dummy client Streaming server OpenFlow Controller Client 1 Client 2 Design multi-streaming video application on unicast network using floodlight openflow 1.0 Client 3
Implementation of Openflow Testbed in ITB Based on distributed Openflow Testbed (DOT) with Ofelia feature Next research goal : enabling the services of : On-Demand, Redundant & Load balancing, Scheduling Instant, Simplify, Secure, Machine to Machine
Implementation of Elastic Load Balancing in DNS Service on Openstack Cloud Background : The needs of Load Balance as a Service (LBaaS) on DNS traffic LBaaS Openstack is using Haproxy that only support for TCP, HTTP, and HTTPS traffic (not UDP) High DNS traffic must to be served by several DNS servers, and needs to be efficient for utilization load balance between busy and non-busy hour
Implementation of Elastic Load Balancing in DNS Service on Openstack Cloud (2) internet client (1) request (3) process request.3 (5) replies 10.205.11.121 (2) rescheduling & rewriting packets 192.168.10.1.4 Keepalived qrouter-xx (4) rewriting replies Virtual distribution switch Network DNS Server.5 Integrating LVS+Keepalived to load balance DNS request (UDP Traffic) Implement elastic resource allocation based using Openstack Heat
Implementation of Elastic Load Balancing in DNS Service on Openstack Cloud (2) DNS scale out : CPU usage > 80% high load (QPS > 30K) DNS scale in : CPU < 35-40% low load (QPS < 10K) Scale Out & Scale In Result
Design & Implementation Site-to-Site IPsec VPN on Openstack Background Infrastructure as a service (IaaS) is a type of cloud computing in which a third-party provider hosts virtualized computing resources over the Internet IPsec is a framework of open standards for ensuring private communications over public networks Problem statement What methods are available to secure communication from existing ip network to servers in the cloud? VM Instance as VPN gateway per tenant (ex: HP Public Cloud) VPN as a Service on Neutron + Service Provider (ex: Amazon AWS) Current Limitation VPN as a Service Only support PSK encryption Proposed Solution Extend Neutron VPN Plug-in to support RSA Signature
Design & Implementation Site-to-Site IPsec VPN on Openstack (2) Implement Site-to-Site IPsec VPN on Openstack Performance evaluation : s2s IPsec VPN @Cisco routers s2s IPSec VPN @Openstack using Openswan in Fedora Instance as VPN Gateway s2s IPSec VPN @Openstack using VPN as a Service (Neutron + Openswan)
conn %default ike=aes256-sha1-modp1536! ikelifetime=28800s keyexchange=ikev1 keyingtries=10 esp=aes256-sha1-modp1536! keylife=3600s rekeymargin=5m type=tunnel pfs=yes compress=no authby=secret conn vpn-test left=%defaultroute leftid=10.2.0.21 leftsubnet=10.2.0.0/24 leftfirewall=yes right=192.168.1.50 rightid=192.168.1.50 rightsubnet=192.168.2.0/24 dpdaction=hold dpddelay=60 dpdtimeout=500 auto=add Design & Implementation Site-to-Site IPsec VPN on Openstack (3) Openswan VM as VPN Gateway Configuration Neutron VPN as a Services
SDN Research Plan @ITB Openflow Implement BGP over Openflow Network Cloud Implement Dynamic Routing on Openstack Neutron Implement VPN as a Service between Cloud & Existing IP Network Deploy File Sharing Service over Openstack Swift
OF@TEIN Collaboration Plan Connecting Openstack@ITB Testbed to OF@TEIN network Deploy hybrid cloud between Openstack@ITB Testbed and Openstack@TEIN Deploy cloud application & service over the hybrid cloud