introduction to openflow / sdn & its effects on the future of internet mohammad moghaddas...
Post on 14-Dec-2015
214 Views
Preview:
TRANSCRIPT
Introduction to OpenFlow /SDN&
its effects on the future of Internet
Mohammad Moghaddasmoghaddas.it@gmail.com www.1cisco.com
2012, July
Welcome
Goals of this Seminar
By the end, everyone should know:
– Knowledge about OpenFlow/SDN • What these are • How they relate • What’s available now • Where it’s going • How it’s used – OpenFlow/SDN and You • How you can use it • How you can build on top of what’s available • How you can build something completely new
Have fun!
Original Question
How can researchers on college campuses test out new ideas in a real network, at scale?
We like to do new experiments: Mobility management New naming/address schemes Network access control New features of Cloud Computing Virtualization features ….
ProblemMany good research ideas
on college campuses…
No way to test new ideas at scale, on real networks, with real user traffic
Many good research ideas on college campuses…
No way to test new ideas at scale, on real networks, with real user traffic
Consequence: Almost no technology transfer
Consequence: Almost no technology transfer
Research problems
Well known problemsSecurity, mobility, availability
Well known problemsSecurity, mobility, availability
Incremental ideasFixing BGP, multicast, access control,
Mobile IP, data center networks.
Incremental ideasFixing BGP, multicast, access control,
Mobile IP, data center networks.
More radical changesEnergy management, VM mobility, …
More radical changesEnergy management, VM mobility, …
The only test network large enough to evaluate future Internet technologies
at scale, is the Internet itself.
Today’s Networks are Defined by the “Box”
• Hardware, Operating System, and Applications Built Into a “Box”.
• Cannot Mix and Match • Barrier to Entry
Vertically integratedClosed, proprietary
Slow innovationSmall industry
SpecializedOperatingSystem
SpecializedHardware
AppAppAppAppAppAppAppAppAppAppApp
SpecializedApplications
HorizontalOpen interfacesRapid innovation
Huge industry
Microprocessor
Open Interface
Linux MacOS
Windows(OS) or or
Open Interface
Vertically integratedClosed, proprietary
Slow innovation
AppAppAppAppAppAppAppAppAppAppApp
HorizontalOpen interfacesRapid innovation
ControlPlane
ControlPlane
ControlPlane or or
Open Interface
SpecializedControlPlane
SpecializedHardware
SpecializedFeatures
MerchantSwitching Chips
Open Interface
What is SDN?
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
OperatingSystem
OperatingSystem
OperatingSystem
OperatingSystem
OperatingSystem
App
App
App
13
Current Internet Closed to Innovations in the Infrastructure
Closed
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
App
App
App
Specialized Packet Forwarding Hardware
OperatingSystem
OperatingSystem
OperatingSystem
OperatingSystem
OperatingSystem
App
App
App
Network Operating System
App App App
“Software Defined Networking” approachto open it
Software Defined Network (SDN)
Global Network View
Network Virtualization
PacketForwarding
PacketForwarding
PacketForwarding
PacketForwarding
PacketForwarding
Network OS
Abstract Network View
ControlPrograms
ControlPrograms
ControlPrograms
Software Defined Network (SDN)
Global Network View
Network Virtualization
PacketForwarding
PacketForwarding
PacketForwarding
PacketForwarding
Abstract Network View
ControlPrograms
ControlPrograms
ControlPrograms
firewall.c…
if( pkt->tcp->dport == 22)dropPacket(pkt);
…
firewall.c…
if( pkt->tcp->dport == 22)dropPacket(pkt);
…
PacketForwarding
Network OS1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action>6. …7. …
With SDN we will:1. Formally verify that our networks are
behaving correctly.2. Identify bugs, then systematically
track down their root cause.
How do other industries do it?
Making ASICs Work
$10B tool businesssupports a
$250B chip industry
$10B tool businesssupports a
$250B chip industry
SpecificationSpecification
Functional Description (RTL)
Testbench & Vectors
Functional Verification
Logical Synthesis
Static Timing
Place & Route
Design Rule Checking (DRC)
Layout vs Schematic (LVS)
Layout Parasitic Extraction (LPE)
Manufacture& Validate
Making Software Work
Static Code Analysis
Invariant Checker
Interactive Debugger
Model Checking
Run-time Checker
SpecificationSpecification
TestbenchFunctional Description (Code)
$10B tool businesssupports a
$300B S/W industry
$10B tool businesssupports a
$300B S/W industry
Example: New Data Center
Cost200,000 serversFanout of 20 10,000 switches$5k vendor switch = $50M$1k commodity switch = $10M
Savings in 10 data centers = $400M
Making Networks Work (Today)
traceroute, ping, tcpdump, SNMP, Netflow
…. er, that’s about it.
Why debugging networks is hard
Complex interaction – Between multiple protocols on a switch/router.– Between state on different switches/routers.
Multiple uncoordinated writers of state.
Operators can’t…– Observe all state.– Control all state.
Networks are kept working by
“Masters of Complexity”
A handful of booksAlmost no papers
No classes
A handful of booksAlmost no papers
No classes
Philosophy of Making Networks Work
YoYo “You’re On Your Own”
YoYo Ma “You’re On Your Own, Mate”
With SDN we will:1. Formally verify that our networks are
behaving correctly.2. Identify bugs, then systematically
track down their root cause.
Three Methods
Static Checking“Independently checking correctness”
Automatic Testing“Is the datapath behaving correctly?”
Interactive Debugging“Finding bugs, and their root cause, in an operational network”
Static checkingIndependently checking correctness
Peyman Kazemian
Hongyi ‘James’
Zeng
GeorgeVarghese(UCSD)
Motivations
In today’s networks, simple questions are hard to answer:
– Can host A talk to host B?– What are all the packet headers from A that can
reach B?– Are there any loops in the network?– Is Group X provably isolated from Group Y?– What happens if I remove a line in the config file?
29
Software Defined Network (SDN)
Global Network View
Network Virtualization
PacketForwarding
PacketForwarding
PacketForwarding
PacketForwarding
Abstract Network View
ControlPrograms
ControlPrograms
ControlPrograms
PacketForwarding
Network OS1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
Static Checker
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
1. <Match, Action>2. <Match, Action>3. <Match, Action>4. <Match, Action>5. <Match, Action> 6. …7. …
“A can talk to B”
“Guests can’t reach PatientRecords”
“A can talk to B”
“Guests can’t reach PatientRecords”
Policy
How it works
Header Space Analysis
Header Space Analysis
12
3 4
1
2
3
4
Port ID
A B
Header Space Analysis
12
3 4
1
2
3
4
Port ID
A B
Use Cases
• Can host A talk to B?
34
Box 1Box 2
Box 3Box 4
A
B
T1(X,A)
T2(T1(X,A))
T4(T1(X,A))
T3(T2(T1(X,A)) U T3(T4(T1(X,A))
T-13
T-13
T-14
T-12T-1
1
T-11
All Packets sent from A can use to communicate with B
Use Cases• Is there a loop in the network?
– Inject an all-x text packet from every switch-port– Follow the packet until it comes back to injection port
35
Box 1
Box 2
Box 3
Box 4
T1(X,P)T2(T1(X,P))
T3(T2(T1(X,P)))T4(T3(T2(T1(X,P))))
Original HS
Returned HS
T-14
T-13
T-12
T-11
Use Cases
• Is the loop infinite?
36
Finite Loop Infinite Loop ?
Header Space Analysis
Consequences1. Finds all packets from A that can reach B2. Find loops, regardless of protocol or layer3. Can prove that two groups are isolated
Proves if network adheres to policyWorks on existing networks and SDNs
Stanford Backbone
Hassell tool 1. Reads Cisco IOS Configuration 2. Checks reachability, loops and isolation3. 10 mins for Stanford Backbone4. Easily made parallel: 1 sec is feasible
Hassell is available for free, for you to run
Stanford backbone network
39
~750K IP fwd rule.~1.5K ACL rules.
~100 Vlans.Vlan forwarding.
Stanford backbone network• Loop detection test – run time < 10 minutes on a
single laptop.
40
Vlan RED Spanning Tree
Vlan BLUE Spanning Tree
Performance
41
Generating TF Rules ~150 sec
Loop Detection Test (30 ports) ~560 sec
Average Per Port ~18 sec
Min Per Port ~ 8 sec
Max Per Port ~ 135 sec
Reachability Test (Avg) ~13 sec
Performance result for Stanford Backbone Network on a single machine: 4 core, 4GB RAM.
What is OpenFlow?
Short Story: OpenFlow is an API
• Control how packets are forwarded• Implementable on COTS hardware• Make deployed networks programmable
– not just configurable• Makes innovation easier• Goal (experimenter’s perspective):
– No more special purpose test-beds– Validate your experiments on deployed hardware
with real traffic at full line speed
OpenFlow: a pragmatic compromise
• + Speed, scale, fidelity of vendor hardware• + Flexibility and control• Leverages hardware inside most switches
today• Vendors don’t need to expose implementation
Put an open platform in hands of researchers/students to test new ideas at scale through production networks.
An open development environment for all researchers
Give access to flow tables in switches: - lookup tables, access control list, etc.. - Control packet forwarding in routers and switches.
How Does OpenFlow Work?
Ethernet Switch
Data Path (Hardware)
Control PathControl Path (Software)
Data Path (Hardware)
Control Path OpenFlow
OpenFlow Controller
OpenFlow Protocol (SSL/TCP)
Controller
PC
HardwareLayer
SoftwareLayer
Flow Table
MACsrc
MACdst
IPSrc
IPDst
TCPsport
TCPdport Action
OpenFlow Firmware
**5.6.7.8*** port 1
port 4port 3port 2port 1
1.2.3.45.6.7.8
OpenFlow Flow Table Abstraction
OpenFlow BasicsFlow Table Entries
SwitchPort
MACsrc
MACdst
Ethtype
VLANID
IPSrc
IPDst
IPProt
TCPsport
TCPdport
Rule Action Stats
1. Forward packet to port(s)2. Encapsulate and forward to controller3. Drop packet4. Send to normal processing pipeline5. Modify Fields
Packet + byte counters
ExamplesSwitching
*
SwitchPort
MACsrc
MACdst
Ethtype
VLANID
IPSrc
IPDst
IPProt
TCPsport
TCPdport Action
* 00:1f:.. * * * * * * * port6
Flow Switching
port3
SwitchPort
MACsrc
MACdst
Ethtype
VLANID
IPSrc
IPDst
IPProt
TCPsport
TCPdport Action
00:20.. 00:1f.. 0800 vlan1 1.2.3.4 5.6.7.8 4 17264 80 port6
Firewall
*
SwitchPort
MACsrc
MACdst
Ethtype
VLANID
IPSrc
IPDst
IPProt
TCPsport
TCPdport Forward
* * * * * * * * 22 drop
ExamplesRouting
*
SwitchPort
MACsrc
MACdst
Ethtype
VLANID
IPSrc
IPDst
IPProt
TCPsport
TCPdport Action
* * * * * 5.6.7.8 * * * port6
VLAN Switching
*
SwitchPort
MACsrc
MACdst
Ethtype
VLANID
IPSrc
IPDst
IPProt
TCPsport
TCPdport Action
* * vlan1 * * * * *
port6, port7,port9
00:1f..
http://geni.net
GENI OpenFlow deployment (2010)
83 Universities/Research centers & 2 National Backbones
http://groups.geni.net/geni/wiki/ProtoGENIFlashClient
Switches
• Linux based Software Switch
• Release concurrently with specification
• Kernel and User Space implementations
• Note: no v1.0 kernel-space implementation
• Limited by host PC, typically 4x 1Gb/s
• Not targeted for real-world deployments
• Useful for development, testing
• Starting point for other implementations
• Available under the OpenFlow License (BSD Style) at http://www.openflowswitch.org
Stanford Reference Implementation
Wireless Access Points
• Two Flavors:– OpenWRT based (Busybox Linux)
• v0.8.9 only
– Vanilla Software (Full Linux)• Only runs on PC Engines Hardware• Debian disk image
• Available from Stanford
• Both implementations are software only.
NetFPGA
• NetFPGA-based implementation – Requires PC and NetFPGA card– Hardware accelerated– 4 x 1 Gb/s throughput
• Maintained by Stanford University• $500 for academics• $1000 for industry• Available at http://www.netfpga.org
• Linux-based Software Switch
• Released after specification
• Not just an OpenFlow switch; also supports VLAN trunks, GRE tunnels, etc
• Kernel and User Space implementations
• Limited by host PC, typically 4x 1Gb/s
• Available under the Apache License (BSD Style) at http://www.openvswitch.org
Open vSwitch
OpenFlow Vendor Hardware
more to follow...
NEC IP8800
HP ProCurve 5400
Juniper MX-seriesCisco Catalyst 6kCore
EnterpriseCampus/DC
CircuitSwitch
Wireless
Pronto
Prototype Product
Ciena CoreDirector
WiMAX (NEC)
Cisco Cat3750 Arista 7100 series
(Q4 2010)
63
HP ProCurve 5400 Series
Praveen Yalagandula
Jean Tourrilhes
SujataBanerjee
Rick McGeer
CharlesClark
• Chassis switch with up to 288 ports of 1G or 48x10G (+ other interfaces available)
• Line-rate support for OpenFlow
• Deployed in 23 wiring closets at Stanford
• Limited availability for Campus Trials
• Contact HP for support details
NEC IP8800• 24x/48x 1GE + 2x 10 GE
• Line-rate support for OpenFlow
• Deployed at Stanford
• Available for Campus Trials
• Supported as a product
• Contact NEC for details:
• Don Clark (don.clark@necam.com)
• Atsushi Iwata (a-iwata@ah.jp.nec.com)
HideyukiShimonishi
JunSuzuki
MasanoriTakashima
NobuyukiEnomoto
PhilavongMinaxay
ShuichiSaito
TatsuyaYabe
YoshihikoKanaumi
(NEC/NICT)
AtsushiIwata
(NEC/NICT)
Umesh Krishnaswamy
MichaelaMezo
ParagBajaria
JamesKelly
BobbyVandalore
Juniper MX Series• Up to 24-ports 10GE or 240-ports 1GE
• OpenFlow added via Junos SDK
• Hardware forwarding
• Deployed in Internet2 in NY and at Stanford
• Prototype
• Availability TBD
FlavioBonomi
SaileshKumar
PereMonclus
• Various configurations available
• Software forwarding only
• Limited deployment as part of demos
• Availability TBD
Work on other Cisco models in progress
Cisco 6500 Series
– The individual controllers and the FlowVisor are applications on commodity PCs (not shown)
Demo Infrastructure with Slicing
Flows
OpenFlow switches
WiMax
Packet processors
WiFi APs
Be sure to check out the demos in www.openflow.org
OpenFlow Demonstration Overview
Network Virtualization FlowVisor
Hardware Prototyping OpenPipes
Load Balancing PlugNServe
Energy Savings ElasticTree
Mobility MobileVMs
Traffic Engineering Aggregation
Wireless Video OpenRoads
Topic Demo
FlowVisor Creates Virtual Networks
OpenFlow Switch
OpenFlow Switch
OpenFlow Switch
OpenFlowProtocol
FlowVisor
OpenPipesDemo
OpenRoadsDemo
OpenFlowProtocol
PlugNServeLoad-balancer
OpenPipesPolicy
FlowVisor slices OpenFlow networks, creating multiple isolated and programmable
logical networks on the same physical topology.
Each demo described here runs in an isolated slice of Stanford’s production network.
•Plumbing with OpenFlow to build hardware systemsOpenPipes
Partition hardware designs
TestMix
resources
Goal: Load-balancing requests in unstructured networks
Plug-n-Serve: Load-Balancing Web Traffic using OpenFlow
OpenFlow means…
Complete control over traffic within the networkVisibility into network conditionsAbility to use existing commodity hardware
What we are showing
OpenFlow-based distributed load-balancer Smart load-balancing based on network and server
load Allows incremental deployment of additional resources
This demo runs on top of the FlowVisor, sharing the same physical network with other experiments and production traffic.
ElasticTree: Reducing Energy in Data Center Networks
• The demo:• Hardware-based 16-node
Fat Tree• Your choice of traffic
pattern, bandwidth, optimization strategy
• Graph shows live power and latency variation
• Shuts off links and switches to reduce data center power• Choice of optimizers to balance power, fault tolerance, and BW• OpenFlow provides network routes and port statistics
• Available at http://NOXrepo.org
• Open Source (GPL)
• Modular design, programmable in C++ or Python
• High-performance (usually switches are the limit)
• Deployed as main controller in Stanford
NOX Controller
MartinCasado
ScottShenker
TeemuKoponen
NatashaGude
JustinPettit
• www.geni.net
• www.openflow.org
• www.openflowswitch.org
• www.noxrepo.org
• www.opennetworking.org
• www.cisco.com/go/one
• onrc.stanford.edu
• www.usenix.org
• http://www.techrepublic.com
References
Thank you!
top related