CS-580K/480K Advanced Topics in Cloud Computing. Software-Defined Networking

Transcription

1 CS-580K/480K Advanced Topics in Cloud Computing Software-Defined Networking 1

2 An Innovation from Stanford Nick McKeown In 2006, OpenFlow is proposed, which provides an open protocol to program the flow-table in different switches and routers. People can try new routing protocols and security models by a controller. In 2007, Nicira was founded by Martin Casado, Nick McKeown and Scott Shenker. This company focuses on software defined networking and network virtualization. The aim is Network is programmable In 2008, one SIGCOMM paper: McKeown N, Anderson T, et al. OpenFlow: enabling innovation in campus networks[j]. ACM SIGCOMM Computer Communication Review, In 2009, INFOCOM Keynote: McKeown N, Software-defined Networking. 2

3 The Definition of SDN Software-Defined Networking (SDN) is an emerging architecture that is dynamic, manageable, cost effective, and adaptable, making it ideal for the highbandwidth, dynamic nature of today's applications. This architecture decouples the network control and forwarding functions enabling the network control to become directly programmable and the underlying infrastructure to be abstracted for applications and network services 3

4 The Definition of SDN emerging architecture cost-effective dynamic adaptable decouples abstracted programmable manageable 4

5 Motivation Networks are hard to manage Computation and storage have been virtualized Creating a more flexible and manageable infrastructure Networks are still notoriously hard to manage Network administrators large share of sysadmin staff 5

6 Motivation Networks are hard to evolve Ongoing innovation in systems software New languages, operating systems, etc. Networks are stuck in the past Routing algorithms change very slowly Network management extremely primitive Closed equipment 6

7 Motivation Networks design not based on formal principles OS courses teach fundamental principles Files, file systems, threads, and other building block Networking courses teach a big bag of protocols No formal principles, just general design guidelines 7

8 A Helpful Analogy From Nick McKeown s talk Making SDN Work at the Open Networking Summit, April

9 Mainframes AppAppAppAppAppAppAppAppAppAppApp Specialized Applications Specialized Operating System Specialized Hardware Windows (OS) Open Interface or Linux or Open Interface Microprocessor Mac OS Vertically integrated Closed, proprietary Slow innovation Small industry Horizontal Open interfaces Rapid innovation Huge industry 9

10 AppAppAppAppAppAppAppAppAppAppApp Specialized Features Specialized Control Plane Specialized Hardware Control Plane Open Interface or Control Plane or Open Interface Merchant Switching Chips Control Plane Vertically integrated Closed, proprietary Slow innovation Horizontal Open interfaces Rapid innovation 10

11 Data and Control Planes 11

12 Data and Control Planes data plane Processor control plane Line card Line card Switching Fabric Line card Line card Line card Line card 12

13 Data and Control Planes Control plane: Distributed algorithms Track topology changes, compute routes, install forwarding rules Data plane: Packet streaming Forward, filter, buffer, mark, rate-limit, and measure packets 13

14 Management Plane Human time scale Collect measurements and configure the equipment 14

15 Control Plane and Data Plane Control plane: compute the state in routers (forwarding state) Determines how and where packets are forwarded Routing, traffic engineering, firewall state, Implemented with distributed protocol Data plane: processing and delivery of packets with local forwarding state Forwarding state + packet header forwarding decision These planes require different abstractions 15

16 Data Plane Abstractions: Layers Applications built on Reliable (or unreliable) transport built on Best-effort global packet delivery built on Best-effort local packet delivery built on Local physical transfer of bits 16

17 But, No Abstraction for Control Plane 17

18 Control Plane: Without Abstraction Variety of goals: Routing: distributed routing algorithms Isolation: ACLs, VLANs, Firewalls, Traffic engineering: adjusting weights, MPLS, Control Plane: only mechanism without abstraction Too many mechanisms, not enough functionality 18

19 Control Plane Control plane must compute forwarding state. To accomplish its task, the control plane must: 1. Figure out what network looks like (topology) 2. Figure out how to accomplish goal on given topology (controlling algorithms) 3. Tell the swtiches what to do (configure forwarding state) 19

20 Control Plane Control plane must compute forwarding state. To accomplish its task, the control plane must: 1. Figure out what network looks like (topology information) 2. Figure out how to accomplish goal on given topology (algorithm) 3. Tell the swtiches what to do (configure forwarding state) What components that we can reuse (abstract)? 1. Determining the topology information 3. Configuring forwarding state on routers/switches 20

21 SDN: Two Control Plane Abstractions Abstraction: Global network view Provides information about current network Implementation: Network Operating System Runs on servers in network (replicated for reliability) Abstraction: Forwarding model Provides standard way of defining forwarding state E.g., the OpenFlow protocol 21

22 Traditional Network Feature Feature Feature Feature Feature 22

23 Logically-centralized control Software Defined Network (SDN) Smart, slow 3. Consistent, up-to-date global network view 2. At least one Network OS probably many. Open- and closed-source Feature Feature Network OS/Controller 1. Open interface to packet forwarding Dumb, fast 23

24 Software Defined Network (SDN) Decouple control and data planes by providing open standard API Control Program A Network OS Control Progrma B 24

25 Network OS (Global Network View) Network OS A (distributed) system that creates a consistent, up-to-date network view Runs on servers (controllers) in the network NOX, ONIX, Trema, Beacon, Maestro, Opendaylight + more Use forwarding abstraction to: Get state information from forwarding elements Give control directives to forwarding elements E.g., OpenFlow 25

26 Original Control Plane Will Be: Simpler management No need to invert control-plane operations Faster pace of innovation Less dependence on vendors and standards Easier interoperability Compatibility only in wire protocols Simpler, cheaper equipment Minimal software Network OS 26

27 Control Programs 27 Control program operates on view of network Input: global network view (graph/database) Output: configuration of each network device Control program is not a distributed system Abstraction hides details of distributed state AppAppAppAppAppAppAppAppAppAppApp Open Interface Network Operating System Open Interface Merchant Switching Chips

28 Forwarding Abstraction Purpose: Abstract away forwarding hardware Flexible Behavior specified by control plane Built from basic set of forwarding primitives Minimal Streamlined for speed and low-power Control program not vendor-specific OpenFlow is an example of such an abstraction 28

29 Summary: what we have now AppAppAppAppAppAppAppAppAppAppApp Open Interface Network Operating System Open Interface OpenFlow Merchant Switching Chips 29

30 Datacenter Facebook data center: Google data center: r 30

31 How does OpenFlow work? 31

32 Ethernet Switch Ethernet Switch 32

33 OpenFlow-based Network Hardware Juniper MX-series NEC IP8800 WiMax (NEC) HP Procurve 5400 Netgear 7324 PC Engines Pronto 3240/3290 Ciena Coredirector More coming soon... 33

34 Original Ethernet Switch Control Path (Software) Data Path (Hardware) 34

35 OpenFlow-based Switch OpenFlow Controller OpenFlow Protocol (SSL/TCP) Control Path OpenFlow Data Path (Hardware) 35

36 OpenFlow Example Software Layer Hardware Layer MAC src MAC dst OpenFlow Client IP Src IP Dst TCP sport TCP dport Action * * * * * port 1 Flow Table Controller PC OpenFlow Protocol (SSL/TCP) port 1 port 2 port 3 port

37 OpenFlow Usage Alice s Rule OpenFlow Switch Decision? OpenFlow Protocol Controller PC Alice s code OpenFlow Switch Alice s Rule Alice s Rule OpenFlow Switch OpenFlow offloads control intelligence to a remote software 37

38 Example OpenFlow Applications Dynamic access control Seamless mobility/migration Server load balancing Network virtualization Using multiple wireless access points Energy-efficient networking Adaptive traffic monitoring Denial-of-Service attack detection 38

39 E.g.: Dynamic Access Control Inspect first packet of a connection Consult the access control policy Install rules to block or route traffic 39

40 E.g.: Seamless Mobility/Migration See host send traffic at new location Modify rules to reroute the traffic 40

41 E.g.: Server Load Balancing Pre-install load-balancing policy Split traffic based on source IP src=0* src=1* 41

42 E.g.: Network Virtualization Controller #1 Controller #2 Controller #3 Partition the space of packet headers 42

43 Basics Flow Table Entries Rule Action Stats Packet + byte counters 1. Forward packet to zero or more ports 2. Encapsulate and forward to controller 3. Send to normal processing pipeline 4. Modify Fields 5. Any extensions you add! Switch Port VLAN ID VLAN pcp MAC src MAC dst Eth type IP Src IP Dst IP ToS IP Prot L4 sport L4 dport + mask what fields to match 43

44 Examples Switching Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * 00:1f:.. * * * * * * * port6 Flow Switching Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action port3 00: :1f vlan port6 Firewall Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * * * * * * * * 22 drop 44

45 Examples Routing Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * * * * * * * * port6 VLAN Switching Switch Port * MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport * 00:1f.. * vlan1 * * * * * TCP dport Action port6, port7, port9 45

46 Centralized vs Distributed Control Both models are possible with OpenFlow Centralized Control OpenFlow Switch OpenFlow Switch Controller Distributed Control OpenFlow Switch OpenFlow Switch Controller Controller Controller OpenFlow Switch OpenFlow Switch 46

47 Flow Routing vs. Aggregation Both models are possible with OpenFlow Flow-Based Every flow is individually set up by controller Exact-match flow entries Flow table contains one entry per flow Good for fine grain control, e.g. campus networks Aggregated One flow entry covers large groups of flows Wildcard flow entries Flow table contains one entry per category of flows Good for large number of flows, e.g. backbone 47

48 Reactive vs. Proactive (pre-populated) Reactive First packet of flow triggers controller to insert flow entries Efficient use of flow table Every flow incurs small additional flow setup time If control connection lost, switch has limited utility Proactive Controller pre-populates flow table in switch Zero additional flow setup time Loss of control connection does not disrupt traffic Essentially requires aggregated (wildcard) rules 48

49 Topology Discovery OpenFlow controller view is not always complete. For instance, what does the controller see here? OF switch X Non-OF switch OF switch Y Host A Non-OF switch Host B Internet Host C 49

50 HybNET: Network Manager in a Hybrid Network Infrastructure 50

51 Motivation Hybrid network has its reality due to Src Host -- Maturing existing legacy deployment -- Budget limitations Edge Controller Fabric Controller Dst Host SDN + Legacy Panopticon Fabric Fabric network SDN switches Legacy switches 51

52 Goal: Integrate legacy switches with SDN switches In a seamless way to provide network management automatically -- with flexible & dynamic management schemes -- without losing capability of SDN network 52

53 Virtual Links To solve compatibility using virtual links concept -- Limit legacy switches to packet forwarding -- Leave network intelligence to SDN switches 53

54 Other Challenges 54

55 Controller Delay and Overhead Controller is much slower the switch Processing packets leads to delay and overhead Need to keep most packets in the fast path packets 55

56 Distributed Controller Controller Applicatio n Network OS For scalability and reliability Partition and replicate state Controller Applicatio n Network OS 56

57 Testing and Debugging OpenFlow makes programming possible Network-wide view at controller Direct control over data plane Plenty of room for bugs Still a complex, distributed system Need for testing techniques Controller applications Controller and switches Rules installed in the switches 57

58 Programming Abstractions Controller APIs are low-level Thin veneer on the underlying hardware Need better languages Composition of modules Managing concurrency Querying network state Network-wide abstractions AppAppAppAppAppAppAppAppAppAppApp Open Interface Controller Open Interface Merchant Switching Chips 58

59 Summary 59 Networks becoming More programmatic Defined by owners and operators, not vendors Faster changing, to meet operator needs Lower opex, capex and power Abstractions Will shield programmers from complexity Make behavior more provable Will take us places we can t yet imagine

60 Material from: Marco Cello IEIIT Consiglio Nazionale delle Ricerche (CNR) Genova 28 Marzo 2014 Scott Shenker (UC Berkeley), Software-Defined Networking at the Crossroads, Standford, Colloquium on Computer Systems Seminar Series (EE380), Scott Shenker (UC Berkeley), A Gentle Introduction to Software Defined Networks, Technion Computer Engineering Center, Scott Shenker (UC Berkeley), The Future of Networking, and the Past of Protocols, Open Network Summit, Nick McKeown (Stanford), ITC Keynote, San Francisco, Microsoft Azure data center Jennifer Rexford COS 461: Computer Networks 60

61 State of the Art Architecture A Highly Available Software Defined Fabric, HotNets 2014 On the Scalability of Software-Defined Networking, IEEE Communications Magazine 2013 Fabric: A Retrospective on Evolving SDN,HotSDN 2012 Control Plane On the Co-Existence of Distributed and Centralized Routing Control-Planes, INFOCOM 2015 CoVisor: A Compositional Hypervisor for Software-Defined Networks, NSDI 2015 A Network State Management Service, SIGCOMM 2014 Data Plane The (Surprising) Computational Power of the SDN Data Plane, INFOCOM 2015 Compiling Packet Programs to Reconfigurable Switches, NSDI 2015 Reclaiming the Brain: Useful OpenFlow Functions in the Data Plane, HotNets 2014 Hybrid Networks Traffic Engineering in SDN/OSPF Hybrid Networks, ICNP 2014 Reaping the Benefits of Partial SDN Deployment in Enterprise Networks, USENIX 2014 HybNET: Network Manager for A Hybrid Network Infrastructure, Middleware

62 State of the Art Cloud Computing and Big Data Meridian: An SDN Platform for Cloud Network Services, IEEE Communications Magazine 2013 Programming Your Network at Run-time for Big Data Applications, HotSDN 2012 Dynamic Graph Query Primitives for SDN-based Cloud Network Management, HotSDN 2012 Monitoring and Measurement Cracking Network Monitoring in DCNs with SDN, INFOCOM 2015 DREAM: Dynamic Resource Allocation for Software-defined Measurement, SIGCOMM 2014 Software Defined Traffic Measurement with OpenSketch, NSDI 2013 Network Security A Survey of Securing Networks Using Software Defined Networking, Trans. on Reliability 2015 FlowGuard: Building Robust Firewalls for Software-defined Networks, HotSDN 2014 FRESCO: Modular Compostable Security Services for Software-Defined Networks, NDSS 2013 SDN in WAN SDX: A Software Defined Internet Exchange, SIGCOMM 2014 B4: Experience with a Globally-Deployed Software Defined WAN, SIGCOMM 2013 Virtualizing the Access Network via Open APIs, CoNEXT