Internet2 SDN. APAN39 March 3, 2015 John Hicks, Internet2

Transcription

1 Internet2 SDN APAN39 March 3, 2015 John Hicks, Internet2

2 Overview Internet2 SDN ( on AL2S) Flowspace Firewall (Network izanon)

3 Seattle Internet2 Network Advanced Layer2 s Topology Map June 2014 Portland Minneapolis Albany Boston Equinix Starlight Sunnyvale Salt Lake City Denver Chicago Cleveland Pittsburgh New York Philadelphia Kansas City Ashburn Washington D.C. Columbia Raleigh Los Angeles Phoenix Tulsa Charlotte Tucson Atlanta El Paso Dallas Jackson Baton Rouge Jacksonville Advanced Layer2 PoP Houston

4 PacWave SEAT PWNGP TR-CPS Internet2 Network Advanced Layer2 s Connector Map June 2014 Starlight NEREN PORT CIC XSEDE XSEDE 6 MINN ESnet SUNN LOSA CENIC XSEDE SALT PacWave PHOE TUCS TR-CPS Sun Corridor UNM UEN XSEDE NOAA DENV Internet2 ELPA LEARN MREN UIUC ESnet TR-CPS KANS COLU4 GPN TULS DALL TR-CPS HOUH EQCH Indiana Gigapop JCSN BATO CHIC STAR OARnet CLEV PITT PSC TR-CPS MARIA NIH Smithsonian 6 CHAR ATLA JACK RALE NEWY PHIL ASHB WASH ALBA BOST NOX MAGPI MANLAN TR-CPS UPENN MAX Gigapop CAAREN WIX NOAA RENCI SoX Clemson FLR DALL AL2S Juniper MX960 FLR HOUH AL2S Brocade MLXe-16 Exchange Points Connector 10G 100G

5 AL2S: What can you do with it today? AL2S allows users to create VLANs on the Internet2 AL2S backbone StaNc or Dynamic Point- to- point or MulNpoint Intra- domain or Inter- domain Via web interface, API (nanve or GENI), or inter- domain signalling For example, Connect SDN islands Connect GENI resources together; connect to GENI resources Set up a discipline network or a private network As part of a regional build- out For disaster recovery For back- up connecnons to the Advanced Layer 3 (AL3S, the Internet2 R&E IP Network)

6 : Open Exchange So^ware Suite Layer2 Circuit Features Sub second intra- domain provisioning Point to point and point to mulnpoint End user controlled provisioning portal Workgroup system for shared access control nonficanons License Apache Online DocumentaNon Videos and presentanons h`ps://globalnoc.iu.edu/sdn/oess.html DocumentaNon h`ps://globalnoc.iu.edu/sdn/oess/using- oess.html

7 Supported es requires the following OpenFlow 1.0 support: flow stats rules that match on input port rules that match on vlan tag rules that set the output port of a flow - Support rules that change the vlan tag of a flow rules that set output port of a flow, including the ability to support sending out mulnple ports with differing VLAN IDs (for use cases which require muln- point VLANs) rules that send packets to controller rules that match on ether type ability to add and remove flows barrier messages

8 Monitoring Monitor control channel resources to detect failures Per Slice and per Slice/ Control Channel Bandwidth Packet In/Out FlowMods/Sec Total AcNve Flow Mods Controller ReconnecNons FSF rejecnons FlowSpace Firewall (FSF) CPU / Memory / Running State Controller ConnecNon Status

9 WG: Network Status

10 KEY OpenFlow Internet2 Software Stack UI FOAM EXP APP EXP APP EXP APP Experimenter Code API So^ware Architecture API API API OSCARS API NSI NSI API NSI FOAM NOX OSCARS IDCP OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow

11 Overview Internet2 SDN ( on AL2S) Flowspace Firewall (Network izanon)

12 FlowSpace Firewall (FSF) FSF has two main goals Allow mulnple openflow controllers to configure an openflow Prevent each openflow controller from interfering with other openflow controllers communicanng with the.

13 Features Rate Limi)ng Each Slice/ combinanon has a configurable rate limit of control channel messages (from a controller to a ) Return errors to the offending controller if limit has been exceeded Allow/Deny Rules based on FlowSpace Rules are verified before being sent to a in the controllers FlowSpace If denied, an error is returned to the controller XID Transla)on/Barrier/Error repor)ng All message XIDs are translated to an internally mapped XID If an error occurs on the for a given FlowMod then only the controller that sent the FlowMod receives the error.

14 Features FlowStat Slicing FlowStats are connnually queried from the and cached in memory. When a slice requests the flow stats for a device, the flow stats are fetched from memory Only flows that exist in the slice's flowspace are returned Web- s JSON- RPC web- services allow for monitoring and configuranon reloads Configurable Logging Logging level can be changed for each module of FSF/ Floodlight individually without restarnng FSF

15 Features Managed Tag Mode FSF will append and strip vlan tags from matches and acnons for controllers that do not know how to do vlan translanon Idle/Hard Timeout FSF can intercept and remove the flows for devices that do not support idle/hard Nmeouts in openflow

16 FlowSpace Firewall OpenFlow 1.0 today Simple VLAN Tag based flowspace firewall / proxy (non- overlapping ranges) Per slice total rule limits Per slice per flow modificanon rate limits Built upon FloodLight Designed for producnon use. Developed by Internet2 with GlobalNOC So^ware Engineering

17 Network izanon: Working DefiniNon From a customer perspecnve, what does the service offer and how it is unlized? The Network izanon service/enhancement offers the ability to write a controller and control a slice of the nanonal Layer 2 infrastructure. The customer unlizes the service by operanng their own service across the Internet2 service. From an internal operator perspecnve, how is the service implemented? An instance of Flowspace Firewall sits between the Layer 2 es and other controllers (including those used in producnon services like AL2S) Who is the target audience? Advanced Networking Community Network Researchers OrganizaNons InnovaNve ApplicaNon Developers What are the goals for the service? SupporNng network researchers Deployment of private networks Prototyping of new services

18 ApplicaNon Vemng Process Researcher wannng to run in the lab, on the test network or AL2S opens Ncket with Internet2 NOC Submi`ers required to submit a companbility document FuncNonality Resource requirements All applicanons desnned for AL2S will be tested in the lab first. TesNng will be performed in lab running the ennre AL2S stack to ensure companbility

19 Lab TesNng Verify Behavior Does it behave as described in companbility document Can it funcnon in a constrained FlowSpace Verify Interoperability with ennre system When there is network churn or other event does the system as a whole funcnon correctly How does it handle network life cycle events like new ports or devices added? Does this app exhibit behaviors that interfere with higher priority apps? Verify FlowSpace Firewall is adequately protecnng resources AnNcipated failure modes are covered TesNng if addinonal resources need protecnon VulnerabiliNes not covered in current environment Oddly formed flowmod crashes scenario

20 I2 Production User I2 Prototype Internet2 Taxonomy Implemented Using LHCONE NET+ External Provider s Dependencies XSEDE GENI? Layer 3 R&E IP and TR-CPS s I2-Run Specific Hardware Connectors GENI Learning ONOS? General Purpose VLAN - AL2S SDN Controller ESNET NOAA NVS (Network ization ) ized Ethernet ing Hypervisor Ethernet es Circuits and Wavelengths - AL1S Fiber & Optical Transport

21 KEY OpenFlow Internet2 Software Stack UI FOAM EXP APP EXP APP EXP APP Experimenter Code API So^ware Architecture API API API OSCARS API NSI NSI API NSI FOAM NOX OSCARS IDCP OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow

22 KEY OpenFlow Internet2 Software Stack Experimenter Code Exp OF App Exp OF App UI FOAM EXP APP EXP APP EXP APP API OpenFlow API API API OSCARS API NSI API NSI NSI FOAM FlowVisor NOX OSCARS IDCP OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow OpenFlow

23 Use Case Examples ProducNon Staging GENI wants to move to SNtching v3.0, but SNtching 2.0 is in wide use Set up a slice, deploy a second, deploy new version of FOAM SNtching Aggregator When it s tested and ready, move to the producnon stack Network Research Network researcher has a be`er idea how to do networking Set up a slice, deploy new network controller, write paper Prototyping Look at alternanves to AL3S Implement a route server that speaks OpenFlow on southbound interface with no routers Deploy in a slice, begin peering with other domains Over Nme transinon to new services Private Networks Want something akin to AtlanNc Wave, original vision for LHCONE, or GENI Network Set up a distributed SDX across mulnple domains

24 SDX SDX1

25 SDX SDX1 SDX2 SDX3

26 SDX NSI NSI NSI SDX1 SDX2 SDX3

27 Multi-Domain SDX SDX1 SDX2 SDX3

28 Multi-Domain SDX SDX2 SDX3

29 Multi-Domain SDX GENI Controller SDX2 SDX3

30 Multi-Domain SDX FlowSpace Firewall SDX2 SDX3

31 Multi-Domain SDX SDX2 SDX3

32 NORDUnet Multi-Domain SDX Internet2 SDX2 SDX3

33 Thank You APAN39 March 3, 2015 John Hicks, Internet2