Application Awareness: The Critical Enabler in Virtualized Networks

Transcription

1 Application Awareness: The Critical Enabler in Virtualized Networks

2 Contents Introduction... 3 Application Awareness Plays a Central NFV/SDN Role... 4 Handling Encryption... 5 Application Metadata... 6 Application Awareness as a Virtual Network Function... 7 NFV/SDN Use Cases Service Chaining Micro Segmentation Virtual CPE Top Five Considerations for Application Awareness in NFV/SDN About ipoque, a Rohde & Schwarz company

3 Introduction Application awareness including Deep Packet Inspection (DPI) is playing an increasingly important role in telecom networks, moving beyond traffic management to becoming a service enabler for application-based data plans, virtual CPE services, network & subscriber analytics, data center and network security and more. With the revolution of Network Function Virtualization (NFV) and Software Defined Networking (SDN) firmly underway, how and where application awareness is deployed in networks will dramatically change. This will involve virtualizing network functions that will reduce the cost of running IP classification or DPI software on multiple appliances and reducing the need for dedicated hardware. The benefits of SDN and NFV to operators are evident. Firstly, the cost savings from using virtual network functions on standard servers and making networks simpler and more manageable can be significant, with projected CapEx and OpEx savings potentially as high as 70% 1. Secondly, operators gain a lot of flexibility by being able to distribute virtual network functions across geographies, data centers, and network PoPs. Last but not least, the most important commercial benefit is that operators can compete more effectively with faster service creation, service provisioning and even realtime service changes. Moving to NFV/SDN continues to be work in progress. Operators are looking to technology vendors to deliver virtual network functions but with a clear focus on ensuring reliability, security and service availability. For example, the ability to do root cause analysis and fault management, fully automated policy management and performance monitoring on services is very important for operators running carrier-grade networks. The expectation from operators is also that vendors work together on multi-vendor designs and implementations in live networks to move things forward. In this paper, we look at the central role of application awareness in providing essential network intelligence that enables more efficient routing of applications and vital analytics to drive new NFV/SDN service deployments. We also look at the key factors to consider when selecting IP classification software for application awareness in highperformance NFV/SDN environments. 1) NFV study with ACG Research, Affirmed Networks and Ware Rohde & Schwarz Application Awareness: The Critical Enabler in Virtualized Networks 3

4 Application Awareness Plays a Central NFV/SDN Role SDN/NFV: Best when combined Combination of NVF & SDN necessary to maximize benefits and achieve common goals SDN Decouples control plane from data plane More programmability Flexibility in traffic management Driven by open source community NFV Decouples Software from hardware Function control shifted to software More efficient allocation of network resources SDN & NFV Maximizes agility & flexibility Multi-vendor environment Automated realtime network operations low risk service innovation & creation Lower CapEx through COTS hardware According to Infonetics global carrier research, two primary factors are driving network operators to SDN and NFV: Service agility: operators can roll out new services in much shorter timeframes with quicker time to revenue typically, moving from months or weeks to days. It will be far easier to make changes to services by using SDN control software and NFV virtualized network functions on virtual machines (s) on commercial servers. Operational efficiency: network management becomes simpler with a global view of the network for provisioning across multi-vendor networks and multiple layers. The fine-grained control offered by SDN will enable carriers to run their networks hotter and minimize the amount of equipment they need, thus reducing CapEx costs. SDN transforms the way that networks are managed, controlled and used, by separating the control plane and the data plane. The high-bandwidth data plane remains on the hardware and the control plane (routing protocols and intelligence) is centrally managed using dedicated SDN controllers. OpenFlow, or similar open source software protocols, connects the control plane and data plane and becomes the common standard used to configure forwarding components, regardless if they are physical or virtual. As SDN and NFV deployments become reality, it s becoming clear that the ability to gain a detailed understanding of what is going on in the network will be key to the success of these new network architectures. The agility and flexibility of virtualized and software-driven networks depend on having detailed knowledge about the nature of the network traffic and applications. This is where application awareness enabled by DPI software plays a key role in providing operators with essential insights into OTT traffic and subscriber behavior. IP classification software is a high-speed packet filtering technology that analyzes Layers 3 through 7 of each packet using a range of techniques including Deep Packet 4

5 Inspection (DPI) as well as behavioral, heuristic and statistical analysis to reliably detect network protocols and applications and extract metadata in realtime. Applications to Layer 7 (e.g. Skype, Facebook, YouTube, etc.) can be accurately identified as well as services such as voice and video and calculation of key performance indicators (KPIs) for deeper insight. Once that packet information is extracted, the application intelligence can be used to support a wide range of virtual network functions e.g. policy enforcement and charging, video optimization and caching, QoS performance monitoring, application-driven service features, network security and subscriber analytics, etc. Application awareness software can be deployed in both virtual and physical appliances, software and cloud solutions, such as gateways, firewalls or WiFi access points. Basically, wherever the network needs to make intelligent decisions based on the nature of the traffic to offload video, realize Service Function Chaining, cache content or ensure security by blocking viruses or malware. Applications can be grouped into service types e.g. video, peer-2-peer, VoIP, instant messaging, making it easier to analyze and enable intelligent traffic decisions. In short, networks are becoming more application-aware and applications in turn are becoming more network-aware, IT and networking converge in a NFV/SDN world. IP classification software identifies application and network performance metadata Protocol And Application Classification Engine (R&S PACE 2) Embedded DPI technology for next-gen network equipment Examples for use cases Advanced suscriber analytics in CEM solution - NAT and tethering transparency - Control & user plane correlation - Heuristics for encryption insights - APN, Cell ID, IMSI, IMEI, RNC ID, TEID, - Full control plane decoding IP traffic Leading DPI for next-gen firewall - Classification of 2800 applications & protocols - Encrpytion metrics for SSL (ciphers, certificates, sessions) - Decoding of attachments, URLs and file downloads QoS measurement for CPE - Performance KPIs for VoLTE & ViLTE - DPI with smallest memory footprint - Protocol & application groups (e.g. streaming) - Bitrate, jitter, latency, aspect ratio, codec,... Handling Encryption Encrypted network traffic continues to rise with the growth of popular encrypted applications such as Facebook, Skype, WhatsApp, Gmail, and Office365. A question that frequently comes up is whether IP classification technology will continue to be effective in identifying encrypted protocols and applications. The answer is yes and this is achieved by using a combination of advanced detection techniques to accurately identify applications, including Deep Packet Inspection, byte pattern matching, flow tracking, and behavioral analysis. Pattern matching checks for recurring string and numbers inside IP packets. Behavioral analysis checks for packet sizes, order of different packet sizes within IP flow while tracking information of subscriber and host. Statistical/heuristic analysis detects common appearances such as recurring byte-order within an IP flow. In most cases, there are a variety of checks e.g. a set of specific requirements must be fulfilled in order to ensure a reliable application classification result. Rohde & Schwarz Application Awareness: The Critical Enabler in Virtualized Networks 5

6 Encrypted traffic is classified by heuristics and behavioral analysis Heuristics & behavioral analysis - Detection of application type (e.g. video, audio, chat) from encrypted applications such as Skype - True heuristics packet sizes, timings, ratios, byte patterns, etc. Deep Packet Inspection - Layer 4-7 classification for 2800 applications and protocols - Support for over 6000 metadata parameters - Full protocol decoding for HTTP, SMTP, FTP, SIP & many more Advanced subscriber analytics - Flow & subscriber tracking - OS, NAT & tethering detection - Client-server indication Application Metadata It is also possible to extract metadata in realtime, providing insight into user behavior and application usage. This insight can be used for a wide array of applications, such as customer experience management, network planning, policy management, network security and many others. Examples of metadata that can be extracted from IP traffic include: Flow statistics: e.g. the volume or throughput of traffic per application, per user and per protocol. Audio & video KPIs: e.g. jitter, bitrate or latency to evaluate the quality of a voice call or video stream Transferred content: e.g. used codec from video on demand applications can be used for security applications, QoS/QoE applications and others. Subscriber information: e.g. HTTP URL or client software can be used for intelligent traffic decisions as well as for customer experience management. 6

7 Application Awareness as a Virtual Network Function With the adoption of NFV, application awareness can migrate from being embedded in many network appliances e.g. in probes and dedicated appliances in GGSN and Gi- LAN in mobile networks, to becoming a shared virtual network function (VNF) hosted on standard servers. This approach lowers the total investment since IP classification technology is centralized and implemented on fewer machines, which means less CapEx as well as ongoing OpEx. Centralizing application identification with an intelligent load balancer at the entry to the Gi-LAN service layer allows traffic to be sent only where it needs to be. For example, video is sent to video compression, but web or other traffic would bypass this device. Another advantage of application awareness as a VNF is that operators gain a more consistent traffic and application detection policy between different functions and applications. It is easier to enforce a consistent format for application identification and metadata when the function is centralized and handles a multi-vendor environment across multiple layers. Also, since software such as R&S PACE 2 works the same way in physical or virtualized environments, application awareness can be used and tested in a hybrid environment until operators are fully ready to virtualize network functions. The promise of SDN is realized only when the controller has access to network intelligence in order to ensure that traffic is routed as efficiently and dynamically as possible. More granular network information that can be derived from Layers 4-7 via IP classification technology can then be analyzed, and that insight fed into the orchestration and control layer. Once application awareness is deployed extensively throughout the network, it can then be used to support operators SDN strategies, for example to simplify provisioning using service chaining and to create network services and features using virtual CPE more efficiently. NFV/SDN Use Cases 1. Service Chaining Service chaining of network functions - widely cited by operators as an early SDN/NFV use case - involves steering data traffic through a series of network functions in order to provision a service. This requires the ability to identify and classify the relevant traffic to be chained as it passes through the network. A service chain consists of a set of network services, such as firewalls or application delivery controllers (ADCs) that are interconnected through the network to support an application. SDN and NFV can make the service chain and application provisioning process a lot shorter and simpler. Specifically, SDN provides network operators with the ability to decouple the rules and topologies associated with the SGi-LAN service functions and chains from the forwarding functions, supporting more dynamic service decision-making. Current Situation: Hard-wired, static IP routing and policy routing are used Each service requires a hardware device, overprovisioned Increasing manual configuration complexity to make changes Service function chain coupled with underlying LAN topology With NFV/SDN: Automated service provisioning No new hardware required Dynamic decision making Simple, instant and flexible chain configuration Flexible virtualized service functions and chains Rohde & Schwarz Application Awareness: The Critical Enabler in Virtualized Networks 7

8 Service chaining enables differentiated app & service bundles Gold User Unlimited Data with best QoE GGSN Application awareness QoS Charging HTTP proxy Content optimization Content adaptation Caching Normal User 3G of contentoptimized data GGSN Application awareness Charging HTTP proxy Content optimization INTERNET Young User 20MB of data limited to YouTube, Twitter, Fabebook, Skype GGSN Application awareness Charging Content optimization Traffic Role of Application Awareness Because identifying the applications or application types (e.g. video streaming or online gaming) is essential in managing the actual services, application awareness will be a dedicated component - the service classifier - as introduced in the IETF s Service Function Chaining (SFC) Architecture. By incorporating metadata about subscribers, applications, services, or network conditions, real-time service chain and forwarding decisions can be made. This decision-making may even be an extension to the existing policy and charging rules function (PCRF), interacting with the northbound APIs of the SDN controller, allowing a network operator to centralize flow-handling decisions across both the SGi-LAN and mobile network. Application identification and metadata can be passed inline in a packet header, allowing the information to be shared among virtual devices throughout the network. Since IP classification technology is not run repeatedly, chained services run more efficiently, enabling higher performance and lower cost for the virtual networking applications. A service chain may consist of an edge router at the customer premises, followed by a VNF incorporating IP classification software. The application-aware service classifier determines the type of traffic and signals the controller software to create a service chain for that packet stream and that customer. An service chain, for example, would include virus, spam and phishing detection and could be routed through connections offering no delay and with jitter performance guarantees. Web traffic would be routed through a chain that includes virus scanning and an ADC. The chain created for video and voice traffic would include traffic shaping, so that traffic would be routed over links with the level of delay and jitter guarantees purchased by each customer. Each type of stream would receive only the service features needed, skipping the unnecessary ones. Benefits Application classification occurs just once and is used many times for load balancing, traffic steering or security, maximizing ROI and lower operating expenses. When more bandwidth is required, an additional virtual machine can be provisioned to take part of the load, so there s no need to overprovision since additional server-based capacity can be added when needed. Application awareness simplifies the the provisioning process; operators can create service chains to suit each application type e.g. , voice, video etc. and ensure the level of service each customer buys as a result e.g., extra bandwidth, parental control, application firewall, etc. New service chaining techniques help to generate revenue, e.g. new application-based service models and per application service enablement, where parental control or video QoS are immediately provisioned. In the case of enterprises, this could mean additional network bandwidth or security can be quickly provisioned. 2. Micro Segmentation Micro segmentation is a new security architecture enabled as a result of software defined data centers. Service providers and enterprises are interested in micro segmentation for data protection and security reasons, and also to meet compliance and audit standards.micro segmentation refers to the ability to run an instance of network security for every. Perimeter security controls will still be used, 8

9 but attaching individual firewalls to individual s in high volumes is possible because of the orchestration and automation capabilities of hypervisors and SDN orchestration platforms. Data centers are heavily protected using perimeter security technologies such as firewalls and intrusion detection and prevention systems (IDS and IPS) that focus on securing traffic into and out of the data center. While they are very effective protecting the perimeter, they are not built for securing east-west traffic within the data center. This is becoming an issue with the significant growth in east-west traffic due to an increasing number of communicating web, application, and database servers. This means that if a malware penetrates the outer security perimeter, it can launch further attacks inside a vulnerable data center. Therefore, many organizations are moving to a contained network segmentation zero trust approach to security strategy as recommended by Forrester Research s Zero- Trust Network Architecture. Role of Application Awareness in Micro Segmentation Micro segmentation divides the data center into smaller zones, which can be protected separately. The advantage is that in case of a breach, the damage can quickly be contained to a small number of compromised devices. This new approach requires a realtime association between applications and security policies. Therefore, traffic between virtual machines (s) can be analyzed in realtime up to the application layer. This provides a view of individual application flows and even an understanding of application attributes, for example separating Facebook messaging from the rest of Facebook traffic. Application identification at Layer 7 provides security within the data center and enables micro segmentation at the packet level and realtime intelligence at the infrastructure layer. DPI technology can be integrated inside the hypervisor and strengthen firewall rules between virtual switches and s based on application traffic by extending visibility up to Layer 7. Benefits of Micro Segmentation Security controls that match the application and data requirements of each Security that follows s wherever they go without additional administration, and adjusts automatically as s spin up/down Inspection and containment for east-west traffic and threats Increased automation of tasks for compliance and audit mandates Collapsed networking and application security layers Micro segmentation and application-aware security policy improves security in SDN-Data centers Perimeter firewall DMZ/web VLAN Perimeter firewall Finance HR HR group DMZ/web Finance group DMZ/web App VLAN Inside firewall DB VLAN App DB App DB Finance Finance HR Traditional data center HR Micro-segmented data center - Firewall policies on virtual NIC level - Grouping by logical functions Rohde & Schwarz Application Awareness: The Critical Enabler in Virtualized Networks 9

10 Use case 3: virtual CPE TODAY - DHCP - FW&UTM - Switch - Management - Wireless controller - Voice - NAT - Routing - Modem/ONT Full feature CPE NFV/SDN - Voice - Modem/ONT - Switch - Access Point Basic CPE Virtual CPE essentially replaces on-premises proprietary CPE with a virtualization platform running on COTS hardware that can be configured from a central console and that can dynamically add and run new services including software updates and downloads. This could be achieved by installing basic CPEs on customer premises and running more advanced CPE functions centrally in virtual machines hosted within a remote data center. This approach requires efficient and automated chaining of service functions such as firewall, VPN and NAT. Service provider IP edge Service provider CO/PoP/DC This is attractive for operators that want to grow in the small and medium-sized enterprise (SME) market where customers are more price-sensitive and only prepared to pay for a limited number of service features. data center data center - Virtual CPE functions - FW&UTM - Business apps - Storage - Management - Wireless controller - User/role awareness - Application awareness - Premesis security and automation - Routing - CGNAT - DHCP - VPN Role of Application Awareness in Virtual CPEs Application awareness is being used in commercial setups involving Virtual CPE for a number of purposes, such as: load balancing routing decisions measuring of QoS / QoE KPIs The virtualized CPE functionality can be hosted in the network. Layer 7 classification helps to optimize services delivered as part of service chaining to the customer premises such as security, acceleration and voice capabilities. Benefits of Virtual CPE 3. Virtual CPE Virtual CPE is one of the first SDN/NFV use cases that operators are keen to adopt, particularly for enterprise network services. Service providers see a big opportunity to offer new services to their wide area network (WAN) enterprise customers as VNFs. Network services that can be provisioned quickly with scalable bandwidth, are a key requirement for enterprises as they move to cloud IT services. Savings in operational costs and expenses More efficient deployment of services Elimination of truck rolls required to update and maintain equipment at remote locations Develop new sources of revenue Easier to add new services and service features Currently, if an operator wants to offer new network functionality or launch a new network service, this requires shipping a new CPE device to the customer site. This can be expensive and slow, especially when an enterprise customer has sites on a global basis. 10

11 Top Five Considerations for Application Awareness in NFV/ SDN 1. Encryption Handling Since encryption is making application detection challenging, ensure IP classification software is using a range of advanced techniques Deep Packet Inspection, behavioral, heuristic and statistical analysis to reliably detect network protocols and applications, even if they use advanced obfuscation and encryption techniques. 2. Performance Requirements for NFV/SDN Ensure that IP classification software fulfills the following performance requirements: fast throughput per core multi-thread support small memory footprint low CPU resource consumption linear scalability to handle large traffic volumes optimized flow tracking and detection speed no degradation of performance in a virtual environment When used in high-performance networks, the software should also support best practices as defined by ETSI 2, such as single root I/O virtualization and network acceleration technologies, such as Intel DPDK and Napatech. 4. Frequent & Dynamic Software Updates Regular updates ensure that the protocol and application library is up to date to improve performance and detection results. It is important that upgrades are conducted automatically, with no impact on the network, meaning the software can be updated during runtime without interruptions so detection improvements can be used in a live system. This update may include signature updates for known protocols, updated detection logic and may also seamlessly add new detections for newly supported protocols. 5. Experience in NFV/SDN Environments Most technology vendors are actively involved in NFV/ SDN proof of concepts and in some cases IP classification software is already being used as a virtual network function in real NFV/SDN carrier deployments. Affirmed Networks is using ipoque s IP classification software in AT&T s Carrier 2.0 NFV/SDN network. ipoque s application awareness technology is part of Alcatel-Lucent s Cloud- Band Ecosystem, a program designed to aid NFV innovation, share knowledge and help service providers get to NFV faster. 3. Reliability It s essential for traffic management that the software has a high application detection rate and can accurately identify the vast majority of network traffic. In the area of billing, for example, it is critical to avoid incorrectly identifying an application as that can have a real negative revenue impact and potentially damage the brand image of an operator. The software has to actively inspect network traffic to identify applications accurately, rather than basing detection results solely on the five-tuple. 2) ETSI Group Specification: NFV Performance & Portability Best Practises Rohde & Schwarz Application Awareness: The Critical Enabler in Virtualized Networks 11

12 About ipoque, a Rohde & Schwarz company ipoque, a Rohde & Schwarz company, provides network traffic and subscriber analytics solutions to enable operators to understand traffic patterns, monetize new data services and improve the quality of experience for their subscribers. ipoque s protocol and application classification and analysis engine (PACE), enables network infrastructure and security vendors to develop products with intelligent bandwidth control, prioritized quality of service delivery and reliable network security. Over 200 customers in more than 60 countries across the globe rely on ipoque s IP network analytics solutions to minimize equipment and operating expenditure, increase profitability and maximize user satisfaction.application awareness technology from ipoque empowers Rohde & Schwarz Cybersecurity products such as the Network Protector next generation firewall that provide companies, organizations and critical infrastructure around the world with protection against cyberattacks and data theft. About Rohde & Schwarz The Rohde & Schwarz electronics group is a leading supplier of solutions in the fields of test and measurement, broadcast and media, secure communications, cybersecurity, and radio monitoring and radiolocation. Founded more than 80 years ago, this independent global company has an extensive sales network and is present in more than 70 countries. The company is headquartered in Munich, Germany. Certified Quality Management ISO 9001 ipoque GmbH Rohde & Schwarz GmbH & Co. KG R&S is a registered trademark of Rohde & Schwarz GmbH & Co. KG Trade names are trademarks of the owners PD Version March 2016 Application Awareness: The Critical Enabler in Virtualized Networks Data without tolerance limits is not binding Subject to change 2016 Rohde & Schwarz GmbH & Co. KG Munich, Germany 2016 ipoque GmbH Leipzig, Germany PDP 1 en