Conference Traffic Shaping at UBC Internet Border. University of British Columbia. Network Management Centre

Transcription

1 Conference 2017 Traffic Shaping at UBC Internet Border University of British Columbia Network Management Centre

2 High Level of UBC Network Overview Internet UBC teaching & research network for Faculty of Medicine Canada Research Network UBC Robson Square campus network BCNET 500+ network devices UBC Okanagan campus networks 10G x 2 for ORAN and WAN traffic 10GIG 10GIG 10GIG 10GIG 10G x 2 for Internet traffic 8000 network ports Resilient 10GIG MPLS core network Resilient high performance datacenter networks High speed building & voice networks High speed residence networks High speed ubiquitous wireless network Energy efficient Resilient 10Gig FabricPath departments in 200+ buildings 2,000+ switches 58,000 network ports 200+ network switches 8000 network ports Cover all campuses and teaching hospitals in BC province 60,000 concurrent clients, 5000 indoor/outdoor wireless AP Support Eduroam Traffic Shaping at UBC Internet Border 2

3 Three Types of Traffic at UBC Border Inter-campuses and teaching hospitals traffic Research network traffic(oran) Internet traffic ØTransit Exchange (TX) ØPeering(IX) Two 10G fibers for Internet traffic to BCNET Redundant path and share the traffic Traffic Shaping at UBC Internet Border 3

4 Group Classification in TX Traffic All IPs ØAll IP ranges used in UBC Vancouver campus Resident network ØIP ranges assigned to residents on the campus VPN ØIP ranges assigned to remote access VPN users Wireless ØIP ranges assigned to regular wireless users ØIP ranges assigned to visitors in the campus Traffic Shaping at UBC Internet Border 4

5 The Policy For Shaping TX Traffic Avoid shaping ordinary academic traffic Shaping P2P traffic based on different groups Use Volume Based Shaping (VBS) to set up quota for certain groups Ad-hoc traffic shaping Traffic Shaping at UBC Internet Border 5

6 Analyze TX Traffic Analyze TX traffic based on service categories Analyze TX traffic based on network groups Analyze TX traffic volume Analyze TX traffic connections Traffic Shaping at UBC Internet Border 6

7 Real Time Statistics for Troubleshooting Shows a lot of useful statistics of an individual IP, network groups, a service and a category of service i.e. inbound/outbound traffic, CPS, In RTT and Out RTT. Displays shaping drops and latency information in real time Traffic Shaping at UBC Internet Border 7

8 Search Function For Investigation Search for top users of a specific service i.e. Netflix offline Audit for specific traffic i.e /tcp Identify weird behaviours of a host i.e. excessive ssh access Traffic Shaping at UBC Internet Border 8

9 Considerations of Shaping Traffic at Border It has limited effect to shape the inbound traffic from ISP. It can detect volume and connection based DoS and DDoS attacks, but cannot stop inbound attacks. It is very effective to shaping outbound traffic to ISP. How to fair share the shaped bandwidth with all hosts? How to categorize or group services and hosts to apply proper shaping policies? How to apply the shaping policy per IP (client) or per user id (multiple devices)? HW resource limitation. Traffic Shaping at UBC Internet Border 9

10 Conference 2017 Simon Fraser University ITS Network Services

11 SFU Internet Connections 11

12 Three Traffic Sources at the Border Research (ORAN) Transit Exchange (TX) Peering (IX) One 10Gig Interface in Vancouver with a Procera PL8720 to BCNET (VANTX) One 10Gig Interface in Surrey (Backup via BGP) 12

13 Traffic Classification All SFU IP ranges are assigned to one of four traffic priorities for shaping Traffic priorities in order Datacentre services Hosted data services Campus wired & wireless 13

14 Traffic Classification Some addresses need to be manually excluded from ranges so they don t get preferential treatment i.e. Linux distro repository We can also enter a host or network IP to be blocked 14

15 Traffic Classification No Residence Internet traffic on our campus network All student residence Internet services are outsourced 15

16 Traffic Classification Only inbound TX traffic needs to be shaped as the volume of our outbound We only shape two specific types of traffic Wireless P2P, restricted to 15Mbps Video Conference provider (Blue Jeans) is given higher priority than normal campus traffic 16

17 Traffic Monitoring We also use the packet shaper for monitoring. By adding rules that don t actually shape traffic but alert at a certain threshold. Rule monitors concurrent connections with a threshold of 15k. 17

18 Traffic Monitoring 18

19 Traffic Reporting Real Time 19

20 Traffic Reporting Trending 20

21 Traffic Reporting Trending 21

22 Q&A 22