Testing Software Defined Network (SDN) For Data Center and Cloud VERYX TECHNOLOGIES

Testing Software Defined Network (SDN) For Data Center and Cloud VERYX TECHNOLOGIES

Table of Contents Introduction... 1 SDN - An Overview... 2 SDN: Solution Layers and its Key Requirements to be validated... 3 Forwarding Plane Requirements... 3 1. Programmable Flow Support and Management... 3 2. Scalability Support... 3 3. Performance Guarantees... 4 4. Network Functionality Support... 4 5. Resilience/High Availability Support... 4 Control Plane Requirements... 4 1. Programmable Open Protocol and API Support... 4 2. Topology Discovery... 5 3. Physical and Virtual Networks Abstraction... 5 4. High Availability and Resiliency... 5 5. Path Computation Elements... 6 6. Dynamic Scalability... 6 7. Network Services Integration... 6 8. Legacy/Edge Network Management Support... 7 9. Security... 7 Application/Management Plane Requirements... 7 1. Traffic Engineering Support... 7 2. Network Orchestration and Management Support... 8 3. Network Virtualization Support... 8 4. Network Access and Usage Control... 8 5. Network Services... 8 Veryx Sample Test Coverage for Testing Software Defined Data Center... 9 1. Testing Forwarding Plane... 9 2. Testing Control Plane... 10 3. Testing Application Plane... 10 Conclusions... 11 Copyright 2002-2013 Veryx Technologies Page ii

Introduction As enterprises and service providers increasingly transition to cloud-based Data Centers, the demand for cloud-based solutions are steadily growing. Network Virtualization is being viewed as a new network capability in meeting the growing demands and to provide elastic, multi-tenant cloud operations. However, due to the tightly coupled distributed logic of the present network, the Data Center and Cloud infrastructure service providers are facing constrains in deploying the new network capabilities. The Open Networking Foundation (ONF) has been spearheading a broad industry effort to define and advance Software Defined Networking (SDN), in order to overcome the limitations that Carriers and Enterprises face in meeting the explosive demand for mobility and bandwidth in the next generation of networks: complexity, inability to scale and vendor dependence. The SDN architecture provides a new architecture for building of highly scalable, flexible networks that readily adapt to changing business needs. This mandates that the providers of such solutions perform specialized testing to ensure that the network is delivering to the expectations of new networking model. This document discusses the key testing requirements for reliable SDN infrastructure and how Veryx assists the equipment vendors and infrastructure providers comprehensively verify their products and solutions for software defined data center infrastructure (SD-DCI) requirements. Copyright 2002-2013 Veryx Technologies Page 1

SDN - An Overview SDN is being proposed as a new networking architecture design where the control and forwarding planes are decoupled, and the distributed network intelligence and states are logically centralized. Further, this design abstracts the underlying network infrastructure from applications and provides a way to move away from vendor lock-in solutions. As a result, Data Center and Cloud service providers gain unprecedented network control and automation support, with Network Virtualization paradigm to be able to offer diverse set of services for various business needs. Figure 1 - SDN Overview Copyright 2002-2013 Veryx Technologies Page 2

SDN: Solution Layers and its Key Requirements to be validated Forwarding Plane Requirements 1. Programmable Flow Support and Management The primary objective of SDN is to enable network programmability through an open and standard interface for elastic network provisioning, rapid service introduction and lowering operating expenses across multi-vendor platforms. Open Networking Foundation s OpenFlow and some proprietary SDN technologies like Cisco s OnePK are addressing this objective through programming the device s Forwarding Plane for individual or aggregate of flows. Network infrastructure should be able to support programming the Forwarding Plane with one of these open technologies for network automation and rapid delivery of services. It is crucial to verify the SDN infrastructure device support for flow level programming including proactive and reactive flow mode setups for efficient network provisioning, and better network management and control. 2. Scalability Support Figure 2 Programmable Flow Due to the adoption of more virtualized and dynamic application environments by data centers, the traffic patterns are more dynamic and therefore unpredictable. Thus manual provisioning of virtualized data center infrastructure becomes almost impossible. As a result, the network suffers from scalable limitations for serving needs of dynamic applications. The SDN architecture provides a new architecture for building dynamic, highly flexible and massively scalable data centers that are optimized and operationally efficient. Network infrastructure must support automated provisioning of large scale dynamic applications deployment. It is important to verify the support for dynamic provisioning of flows and measure the degree to which the device scales in terms of provisioning groups and flows per group. Copyright 2002-2013 Veryx Technologies Page 3

3. Performance Guarantees Performance is one of the key attribute for services running in cloud-based data centers. With SDN architecture, flows forwarding decision are taken at the controller and the updates are programmed into the devices forwarding plane. Network infrastructure must be able to support dynamic programming of forwarding plane while still maintaining the network performance characteristics according to the committed Service Level Agreements (SLAs). It is necessary to measure the performance characteristics such as Latency and Throughput under various instances such as on-the-fly adding of new flow entries, modifying existing flow entries and removal of flow entries from the devices flow tables. 4. Network Functionality Support SDN architecture on Southbound relies on open control protocols like OpenFlow (ONF) or onepk (Cisco) to deploy highly flexible, scalable and programmable network. This requires that the protocol is highly reliable and stable to meet the requirements defined by SDN. The open control protocol must be able to support delivery of required network functionalities for reliable network infrastructure deployment. It is important to verify the device open protocol support for delivering various network functionalities such as secure Switch-Controller communication, packet processing and forwarding behavior, quality-of-service delivery and ability for network performance measurement etc. 5. Resilience/High Availability Support High Availability and Resiliency are some of the key attributes in ensuring reliable network communication. Network infrastructure must support fast detection of any impairment along the path, perform fast failover switching, and quickly recover and restore the network states. It is crucial to verify the SDN infrastructure device support for high-availability like active/standby controllers support, quick notification of data path network events such as link down, and quick failover switching and fast network convergence in the event of any network components failure. Control Plane Requirements 1. Programmable Open Protocol and API Support SDN architecture offers an end-to-end network automation and management through programmable open protocol and standard APIs support. SDN control plane must support standard open APIs such as REST APIs on northbound for integrating SDN applications needed for business operations and open control protocols such as OpenFlow on southbound to program the network infrastructure. It is necessary to verify that the controller exposes an abstracted Copyright 2002-2013 Veryx Technologies Page 4

and centralized control plane to network applications to provide network services such as network virtualization, security, and traffic engineering through northbound APIs, and enables programmable network infrastructure using open control protocols and other standard management interfaces support through southbound APIs. 2. Topology Discovery Topology Discovery is the key for providing an abstracted and centralized control plane to network applications in SDN architecture. SDN control plane should provide a complete view of the underlying network infrastructure in terms of network resources deployment and their capabilities to SDN applications. It is important to verify the SDN controller support in building and maintaining a scalable virtual infrastructure based on control plane communications with the network infrastructure. 3. Physical and Virtual Networks Abstraction Enterprises and service providers are increasingly offering services over cloud-based data centers. Using traditional network change management processes, it takes days or weeks to provision networks for new service requests which creates large gap in expectations. Thus, network and cloud management software needs a centralized abstraction of physical and virtual networks for speedy network automation and better management. With SDN architecture, control plane is able to provide centralized view of both underlay and overlay networks. It is critical to verify the SDN controller support in providing real-time abstractions of underlying physical and virtual networks even when the virtual network topologies are undergoing rapid changes such as dynamic addition and removal of virtual network segments. 4. High Availability and Resiliency SDN architecture provides a single logical centralized control plane to application and management layer. This enables network operators in enforcing consistent network policies without human errors and hence increases network availability. On the other hand, there are likely chances for this design to suffer from single point of failure and hence decrease the overall network availability. SDN control plane must ensure high availability and resiliency support for both the controller and the network to ensure reliable network communication and business continuity. It is crucial to verify the ability to discover and set-up multiple paths between the source and the destination, rapid re-routing of traffic over active path in the event of network components failure and provide backup for the controller through redundancy and clustering. Copyright 2002-2013 Veryx Technologies Page 5

5. Path Computation Elements Figure 3 Controller High Availability Path computation is the key for delivering better Traffic Engineering to a network. SDN architecture abstracts entire network and presents as a single logical device thereby enabling fast path computation and traffic steering over an optimal network path. Further, this architecture enables support for applying and testing new routing and switching algorithms on real time network thus allowing network optimization and innovation. It is important to verify the SDN controller support in instantiating virtual routers and switches, ability to maintain associated network states and the ability to compute and setup shortest path from origin to destination in consideration of latency, resiliency and performance requirements of the traffic flow. 6. Dynamic Scalability SDN architecture provides a scale-out and scale-in networking model to accommodate the dynamic changes of business operations. Further this design supports centralized provisioning and management which enables data center network operators to build an extensible, scalable and flexible hyper-scale data center network. SDN control plane should support adding any new network functionalities or resources dynamically when needed. It is important to verify the controller s ability in handling infrastructure requests per second and measure the degree to which the controller scales in terms of number of switches, virtual networks and overlay tunnels. 7. Network Services Integration Delivering dynamic network services over static, non-programmable nature of closed, multivendor networks becomes difficult. SDN architecture enables programmable support for both physical and virtual networks whereby network operators can deliver high-value dynamic Copyright 2002-2013 Veryx Technologies Page 6

network services over hyper-scale network with speed and agility. SDN control plane must provide support for SDN applications to integrate and deliver the required L4-L7 core networking services. It is crucial to verify the controllers support for delivering various network services like data path security, load balancing, WAN optimization, application aware quality of service, bandwidth-on-demand services. 8. Legacy/Edge Network Management Support SDN architecture facilitates end-to-end network automation and inter-domain traffic forwarding through extensive co-ordination and integration support with all legacy network devices and edge devices. This requires the SDN control plane to provide full support for integration with network management systems (NMS) and other configuration tools. It is necessary to verify the controller support in providing standard southbound interfaces to manage legacy and edge/hybrid networking devices through network or element management systems (NMS/EMS). 9. Security Security is one of the leading challenges for data center operators in securing their virtualized data centers and its applications. SDN architecture provides a logically centralized intelligence which helps in enforcing dynamic security policies for virtualized data center networks. SDN controller should provide required level of flexibility and network abstractions to application layer for providing various network based security services. It is critical to verify the controller s ability in rate-limiting control plane traffic, support for real-time traffic monitoring, pro-active detection and prevention of malicious attacks, and enable authentication and authorization access to controller. Application/Management Plane Requirements 1. Traffic Engineering Support With explosion of mobile devices, server virtualization, and advent of cloud services, Traffic Engineering on a traditional routing infrastructure becomes more expensive and complex. With SDN architecture, the Application Plane can get the centralized network topology view, including link utilization and latency, to dynamically provision forwarding tables that can deliver the desired network performance characteristics. Traffic engineering can now be deployed as an application, thus providing automated traffic management, improved bandwidth engineering, and the ability to tailor the network "on demand" to customer needs. It is crucial to verify that the application delivers the required traffic engineering support for data center network including bandwidth calendaring, bandwidth-on-demand operations etc. while maintaining the network performance SLAs. Copyright 2002-2013 Veryx Technologies Page 7

2. Network Orchestration and Management Support With adoption of server virtualization and dynamic application environments, the data center network becomes hyper scale and dynamic. Thus, managing thousands of physical network devices and tens of thousands of virtual servers are complex and error prone if the services are delivered and managed manually. SDN is the key for network automation and orchestration which allows for dynamic network provisioning in conjunction with storage and compute for total data center orchestration. Deploying Network Orchestration and Management as an application will provide a highly scalable, flexible, dynamic and fast converged infrastructure. It is important to verify that the application delivers the required Orchestration and Management support such as automated elastic network provisioning, virtual server deployment, OS scripted install and storage configurations. 3. Network Virtualization Support SDN architecture facilitates Network Virtualization, which enables hyper scalability and elastic, multi-tenant cloud operations in data centers. Further, the support for Network Virtualization should be enabled at the Application layer for gaining high level of flexibility, scalability and better operational efficiency in multi-tenant data center networks. The application plane should support for various network virtualization technologies and virtualizing various network appliances including Servers, Storage, Switches, Routers, Load Balancers and Firewalls. It is necessary to verify that the application can support creation and management of multiple virtual network segments, maintain tenant-isolations and support for various VM operations including VM add/move/delete. 4. Network Access and Usage Control Ensuring network access and usage control becomes complex as network is becoming dynamic and often virtualized. With SDN architecture, network becomes programmable which enables creation of global access control policy and enforcing dynamically across entire network without human errors. Deploying network access and usage control at the application layer enables high level of flexibility in providing dynamic, programmable network-based security support. It is crucial to verify the application support in enforcing consistent and intelligent network access control policies across scale network deployment, the ability to enforce updated security policy during VM live migration and the ability to provide real-time network protection from DOS attacks. 5. Network Services Providing on demand elastic network services for cloud-based virtualized data centers becomes much easier with SDN architecture. Deployment of dynamic network services as applications Copyright 2002-2013 Veryx Technologies Page 8

can improve network performance, resiliency and availability, and end-user experience. It is necessary to verify the application support for various Layer 4-7 services including delivery of application aware QoS, monitoring services on virtual and physical ports, WAN traffic optimization, DNS, Firewall/VPN services etc. still maintaining the required level of network performance. Figure 4 Network Service Applications Veryx Sample Test Coverage for Testing Software Defined Data Center Veryx helps in validating all SDN solution layers and its key requirements that are discussed in the above sections to ensure that the provider s products and solutions is ready for deployment in the Software Defined Data Center network infrastructure. This is achieved through comprehensive and unique testing methodologies. Some of them include: 1. Testing Forwarding Plane Emulating a network topology with legacy and open flow switches, controllers and SDN applications, and verify some of the switch SDN functionalities including: Switch authentication mechanism with SDN controller Switch support for adding, deleting and modifying flow entries in the flow table both reactively and proactively using open control protocols like OpenFlow, Cisco s onepk. Switch ability in processing East-West and North-South traffic patterns according to the defined rules in flow tables when a wire speed real-time traffic streams flows on different switch ports. Copyright 2002-2013 Veryx Technologies Page 9

Switch performance characteristics such as latency and throughput while handling server and storage traffic. Switch support for redundant controllers (Active-Active and Active-Standby) Switch support in delivering intended quality of services for tenant traffic as per the flow definition. Switch functionality to discover adjacent devices using link layer protocols such as LLDP. Switch ability in supporting various logical ports including tunnel, link aggregation and lookback interfaces. Measuring switch scalability support in terms of number of flows and number of controller s requests that the switch can handle at a time. Measuring switch response time in the event of any network failures. 2. Testing Control Plane Emulating a network topology using mininet with several VMs, vswitches, vrouters, controllers and SDN applications, and verify some of the controller SDN functionalities including: Controller ability to interface with SDN applications using standard northbound APIs including RESTful APIs and Python and C languages. Controller ability to interface with network infrastructure using southbound open protocols including OpenFlow, and Cisco s onepk and other standard management interfaces like NetConf, SNMP, CLI for legacy device interactions. Controller backward compatibility support with switches running previous open protocol version. Controller ability to build virtual network infrastructure based on topology discovery mechanisms and ability to interface with database modules such as MongoDB for storing and retrieval of data. Controller ability abstracting physical and virtual network and also measure the degree to which the controller is scalable Measure the controller response time and ability to roll back the current provisioning in the event of network components failure Controller support for path computing with switching and routing algorithms including OSPF, BGP and MPLS. Controller ability to apply rate-limiting on control plane traffic communication. Controller ability to support redundancy and co-controllers communication. 3. Testing Application Plane Emulating a network topology using mininet with several VMs, vswitches, vrouters, SDN controllers and verify each of the SDN application functionalities. Some of them include: Copyright 2002-2013 Veryx Technologies Page 10

Traffic Engineering Application ability in discovering and setting up optimal path from a source VM to destination VM and measure end-to-end traffic performance including latency and throughput for the flow over the defined path. Simulating impairments on a path and verify the application ability to quickly re-route traffic on alternate path. Application ability in providing bandwidth calendaring, bandwidth-on-demand etc. provision. Measuring application performance over scale deployment scenario. Orchestration and Cloud Management Application ability for provisioning network for Infrastructure as a Service (IAAS) and Network as a Service (NAAS). Application ability for automating workflows for various network operations such as endend service provisioning, VM deployments etc. Application support for various overlay technologies such as NVGRE, VxLAN, TRILL, SPB etc. Application support for auto-provisioning network infrastructure in the event of network failures. Measure application performance for dynamic scale-in or scale-out network scenarios. Application support for Network Virtualization including virtual network segments creation, deletion and VM mobility. Network Services Application support in delivering several L4-L7 networking services such as server load balancing, WAN optimization for various application traffic, DNS and DHCP Application support for delivering software defined network security services (SDSec) such as NAT, ACL, VPN and Firewalls. Application support in delivering application aware QoS. Application support to follow VM movements and apply up-to-date network security policies. Application support in providing required isolations between virtual networks. Conclusions Network equipment vendors and infrastructure providers are racing to provide their customers the service providers and enterprises the capability to take advantage of the speed and efficiency Copyright 2002-2013 Veryx Technologies Page 11

of cloud paradigms using network virtualization and SDN solutions. However, they face numerous challenges in ensuring adequate and quicker testing of their products without sacrificing quality. Veryx Technologies provides innovative Verification and Measurement Solutions for the global communications industry. Veryx Professional Services effectively complements and supplements customer testing teams efforts and also delivers higher efficiency and flexibility with its execution models. For more information regarding testing services for network virtualization and SDN technologies, contact Veryx. Veryx Technologies (www.veryxtech.com) is an innovative enterprise providing solutions that enhance product quality and testing efficiency. Veryx offers flexible, cost-effective products that enhance the Service Assurance capabilities of Ethernet Service Providers. Leading equipment vendors, rely on the ATTEST range of products for testing applications in Access, Carrier Ethernet, Data Center, Edge, Enterprise, Industrial Networking and Security domains for over a decade. The unique offerings from Veryx enable customers to reduce the timerequired-to-test and enhance their time-to-market AMERICAS: +1-408-850-1247 ASIA: +91 (44) 45 67 22 22 EUROPE: +44-203-371-8691 www.veryxtech.com info@veryxtech.com 2002-2013 Veryx Technologies. Veryx and Veryx ATTEST are trademarks of Veryx Technologies. All other trademarks of respective owners are acknowledged. Copyright 2002-2013 Veryx Technologies Page 12