Layer 7 Visibility for vcpe Services. Sponsored By

Transcription

1 Layer 7 Visibility for vcpe Services Sponsored By

2 Today s Presenters Moderator Presenter Presenter Gabriel Brown Senior Analyst Heavy Reading Nicolas Bouthors Distinguished Engineer, NFV & SDN, Qosmos Murray Cooke Network Computing Solutions Architect, Intel Corporation

3 Agenda Introduction Heavy Reading Rationale for vcpe Intel Importance of Layer-7 Visibility Qosmos Q&A

4 Why Virtual CPE? What are the Benefits? Reduced deployment costs. In the vcpe model a single, lower-cost device can be installed on premises to replace several specialized devices. Reducing truck roll is especially useful for remote offices and international offices where it is costly to send technicians. Inject value into Enterprise WAN services. By virtualizing functions, such as firewalls, IPS, and SBCs, that previously ran on dedicated on-premises equipment, operators can create a catalogue of software-based services that can be deployed on-demand by enterprise customers using self-service portals. Leverage economies of scale in COTS server market. Classic CPE devices are already cost-optimized; however, there is an opportunity to benefit from the volume economics associated with standard off-the-shelf servers if they can be optimized to run VNFs from multiple vendors.

5 Virtual CPE / Cloud VPN Service Offers Operator Service Description Cloud VPN services launched Q on Pan European IP network Automatic provisioning of service via customer console Virtualized networking functions run in OpenStack environment Progressive commercial service from an enterprise-focused provider Low cost Ethernet access device at customer premises Virtual CPE functions running on/behind IP edge router Pre-commercial trial of virtual CPE underway Automatic provisioning of VPN services via customer console Multivendor deployment using a cloud orchestration tool Based on AT&T s Network on Demand platform White-box devices on premises; Leverages SDN for service config. Multivendor deployment; Currently in advanced trial-phase True cloud-based SSL VPN targeted at smaller office locations Wide-range of cloud-based virtual network services Reports significantly reduced service provisioning times

6 Classic & Virtual CPE Models Customer Premises MPLS/Ethernet/IPsec/SSL VPN Operator Network Classic Model CPE Stacking Switch NAT Web Filter DDoS IPS/IDS Firewall Router IP Edge IT XaaS Data Center Multiple Physical Appliances Single Smart CPE Firewall WAN Router Acceleration CPE VNFs (L3 Access Device w/ compute ) IP Edge Other VNFs IT XaaS Data Center Basic Thin CPE NID (Low Cost Access Device) IP Edge Web Filter NAT DDoS IPS/IDS Firewall Router CPE VNFs IT XaaS Data Center

7 3 Key Use-cases for Layer-7 Visibility Monitoring/reporting via a service dashboard or portal. Typical requirements are for usage monitoring and metering, service assurance, SLA monitoring, accounting, and compliance Layer 7 firewall capability. Enterprise may want to either block or rate-limit certain types of traffic (bittorrent, for example) or manage the QoE of certain users or applications VNF service chaining. Optimize the use of Layer 4-7 VNFs in enterprise WAN scenarios by directing only the flows that need processing by a particular VNF into the correct processing path

8 NFV vcpe Solutions Murray Cooke Network Computing Solutions Architect February 2016 Layer 7 Visibility for vcpe Services Webinar, 10 th February 16

9 Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. A "Mission Critical Application" is any application in which failure of the Intel Product could result, directly or indirectly, in personal injury or death. SHOULD YOU PURCHASE OR USE INTEL'S PRODUCTS FOR ANY SUCH MISSION CRITICAL APPLICATION, YOU SHALL INDEMNIFY AND HOLD INTEL AND ITS SUBSIDIARIES, SUBCONTRACTORS AND AFFILIATES, AND THE DIRECTORS, OFFICERS, AND EMPLOYEES OF EACH, HARMLESS AGAINST ALL CLAIMS COSTS, DAMAGES, AND EXPENSES AND REASONABLE ATTORNEYS' FEES ARISING OUT OF, DIRECTLY OR INDIRECTLY, ANY CLAIM OF PRODUCT LIABILITY, PERSONAL INJURY, OR DEATH ARISING IN ANY WAY OUT OF SUCH MISSION CRITICAL APPLICATION, WHETHER OR NOT INTEL OR ITS SUBCONTRACTOR WAS NEGLIGENT IN THE DESIGN, MANUFACTURE, OR WARNING OF THE INTEL PRODUCT OR ANY OF ITS PARTS. Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the absence or characteristics of any features or instructions marked "reserved" or "undefined". Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The information here is subject to change without notice. Do not finalize a design with this information. The products described in this document may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order. Copies of documents which have an order number and are referenced in this document, or other Intel literature, may be obtained by calling , or go to: Intel processor numbers are not a measure of performance. Processor numbers differentiate features within each processor family, not across different processor families: Go to: Learn About Intel Processor Numbers Intel, the Intel logo, Itanium, Intel Atom, Intel Xeon Phi, Intel AppUp, and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others. Copyright 2016 Intel Corporation. All rights reserved Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 9

10 Agenda Intel s Network Transformation Strategy Portfolio of Enterprise vcpe solutions Network Builders for Service Providers Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 10

11 Intel is Investing to Lead the Transformation Intel Architecture Linux KVM ADVANCE OPEN SOURCE AND STANDARDS COLLABORATE WITH END USERS INTEL TECHNOLOGY LEADERSHIP DELIVER OPEN REFERENCE ARCHITECTURES DRIVE AN OPEN ECOSYSTEM INTEL NETWORK BUILDERS Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 11

12 Transforming Enterprise Customer Premises Equipment Accelerating Deployment and Service Upgrade Times Firewall VNF WAN Acceleration VNF IPS VNF CE Router VNF Providing on Demand Software Service Delivery through Customer Portals Reduces costs Enabling a Trial Before Buy Sales Model Network Edge Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 12

13 V E-Cpe Small Enterprise Multi VNF 5 < 50 Users Router VM Firewall Site Users 5-50 Switching Requirements 4Mbps 140 Mbps (for legacy TDM T1/E1 T3/E3, DSL, or OTL links) Hardware Intel C25XX (Atom) Intel C25XX (Atom) Open VSwitch C C C C C C C C Network Interface Crypto Workloads TDM WAN and 100 MbE E LAN, 10MbE Mgmt Mbps, to suit WAN 1-3 VMs from: vrouter, Firewall, WAN Acceleration, or Mgt probe VM Applicable for Small (SME) Premise/Office Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 13

14 LTE OOB Legacy SSD Customer Premise located : C25xx Pizza Box Form Factor Hardware Intel C25xx (Rangeley); 2 to 8 Cores 88E1112 PHY Network Interface 1GbE WAN + LAN+ 1 Mgmt Mini- PCIe Mini- PCIe Intel C25XX X1 PCIe SGMII Mgmt Eth 88E1112 PHY Mag Mag Management Enterprise LAN Workloads Legacy Access I/F (DSL, TDM OTL) Storage 1-3 VNFs from : VPN, NGFW, vrouter, Mgt VM 1 x PCIE for Legacy WAN Add on Card SATA3.0, SATA2.0 or SSD (80-360G) via 1xPCIe 80G SSD SATA esata SGMII 88E1112 PHY Mag WAN LTE OOB Management Security options 1 x PCIe UEFI Secure Boot Expansion Lanes For Legacy WAN Access and OOB Management (e.g. POTS, LTE) Options for Extended Local Storage and Extended Office Capabilities Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 14

15 V E-Cpe Large Enterprise Multi VNF 50 Users < 500 Site Users Switching Requirements 100Mbps Mbps (to suit 10MbE- 622M BPON Lines) Router VM Management VM Firewall Hardware Intel XEON D (Broadwell) Intel X552 NiC 8GB Memory min. Open VSwitch C C C C C C C C Network Interface Crypto Workloads DSL - OTL WAN and 100 GbE LAN, 1 Mgmt As Per WAN 2-4 VNFs from vrouter, IPSec, NG Firewall, IPS, WAN Acceleration, WAN Optimizer Intel XEON D Applicable for MNC and SME branch offices Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 15

16 LTE OOB Legacy Customer Premise located : Xeon D Form Factors Pizza Box Performance Benchmarking Hardware Intel Xeon-D, 4-16 cores Cortina* CS4227 Chipset 89XX Niantic X552 Network Interface Workloads 10GbE WAN + LAN+ 1x1Gbe Mgmt 2-5 VNFs: From IPSec, NGFW, vrouter, WAN Acceleration, SBC Mini- PCIe X1 PCIe Mini- PCIe Intel Broadwell DE X8 PCIe NC-SI NC-SI SGMII, KR Springville 1210-IT Cortina* CS4227 Mag Management Enterprise Legacy Access I/F (DSL, TDM etc) Storage x1 x PCIe SATA3.0 or SSD (80-360G) via 1xPCIe 80G SSD SATA Cortina* CS4227 WAN LTE OOB Management Security options 1 x PCIe UEFI Secure Boot + TXT + 89XX (Coleto Creek) IPSEC acceleration Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 16

17 DPDK Software Architecture Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 17

18 Intel NETWORK BUILDERS VALUE Technology Enablement Marketing Matchmaking Intel Network Builders Program Lead, Disrupt, Innovate, and Scale via a robust and mature ecosystem based on Intel Technologies to drive network transformation Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 18

19 Network Builders Facilities for Service providers PLAN CONNECT Deploy Solution Briefs Publication of technical collateral, including blueprints of top use cases Members only Industry Events Meet with Industry leaders at key summits, with state of the art panel discussions, and video interviews Member Portal Wiki for connection to industry experts, with Closed User Groups for project communications Network Builders University Curriculum of technical course offerings geared for end user education. Focus Workshops Face to face and hands on workshops delivered to support service providers. Joint Development Co-development opportunities for optimization of reference solution stacks Solutions Catalog An extensive repository showcasing products from ecosystem vendors Benchmarking, PlugFests Prove interoperability with Multi vendor Lab environments & plugfests Custom Microsites Custom sites developed for members based on specific project requirements. Sign-up as a member to leverage ecosystem benefits Layer 7 Visibility for vcpe Services Webinar, 10 th February 16

20 Summary Intel s Network Transformation Strategy Portfolio of Enterprise vcpe solutions Network Builders for Service Providers Layer 7 Visibility for vcpe Services Webinar, 10 th February 16 20

21 Placeholder Footer Copy / BU Logo or Name Goes Here

22 Poll #1 What proportion of new Enterprise Network connections in 2016 will use virtualised CPE? 0 to 5% 5 to 15% 15 to 50% 50 to100%

23 Layer 7 IP Classification for vcpe Services Use Cases Nicolas Bouthors, Distinguished Engineer - NFV & SDN February 2016

24 Deployment Context for vcpe Services Regional Site Remote Site SFC Services Regional Site IPSec Internal Cloud Services External Cloud Services Focus is on flexibility for service delivery and cost reduction VPN and vcpe services are linked vcpe and data-center-based services are linked Page 24

25 Operator Challenges with vcpe Services Providing detailed application usage reporting to customers Facilitating Service Function Chaining and data center troubleshooting Enabling traffic visibility and control per subscriber and per application Optimizing resources for service chaining and data-center-based services L7 Securing network traffic Offering new Value-Added Services (e.g. content filtering) Granular and continuous Layer 7 visibility helps operators overcome challenges associated with vcpe services Page 25

26 Use Cases with L7 Visibility in the Network Network Headend Data Center Enterprise Site Service Function Service Function Virtual Network Function Virtual Network Function VPN Tunnels Layer 7 IP Classification Layer 7 IP Classification Enterprise Site Service Classifier & Service Function Forwarder vswitch IMPLEMENTATION L7 IP classification is part of data plane and control plane; passive and inline Configured using reference implementations such as OpenStack or OpenDaylight BENEFITS Optimization of services delivered to premises based on subscriber and application L7 reporting for operators and customers L7 micro-segmentation for security Page 26

27 Use Cases Leveraging End-to-End L7 Visibility Enterprise Site QoS NAT Network Headend Service Function Service Function Virtual Network Function Data Center Virtual Network Function Layer 7 IP Classification VPN Tunnels Layer 7 IP Classification Layer 7 IP Classification vswitch with conntrack Service Classifier & Service Function Forwarder vswitch IMPLEMENTATION Uses OpenDaylight and OpenStack Extends iptables and Open vswitch with Layer 7 IP Classification BENEFITS Enables subscriber-aware service delivery Links VPN services and CPE services for traffic prioritization Extends the Service Chain domain to the enterprise and data center Page 27

28 Examples of New Services Enabled by L7 Visibility L7-based QoS / prioritization for VPN Per subscriber / subscriber-class services Support for end-to-end troubleshooting Support for capacity upgrades Inter-site L7-aware routing and firewalling L7-aware East-West visibility for data-center-based services Layer 7 visibility is an essential ingredient of any vcpe strategy for both equipment vendors and operators Page 28

29 Qosmos, Qosmos ixengine, Qosmos ixmachine and Qosmos DeepFlow are trademarks or registered trademarks in France and other countries. Other company and products name mentioned herein are the trademarks or registered trademarks of their respective owners. Copyright Qosmos Non-contractual information. Products and services and their specifications are subject to change without prior notice Qosmos

30 Poll #2 Which L7-enabled VAS do you think will be most important to vcpe customers? Customer reporting & dashboards Traffic shaping for Quality of Service L7 Firewall Service Chaining Other

31 Q&A Moderator Presenter Presenter Gabriel Brown Senior Analyst Heavy Reading Nicolas Bouthors Distinguished Engineer, NFV & SDN, Qosmos Murray Cooke Network Computing Solutions Architect, Intel Corporation