IS-IS Protocol Hardware Implementation for VPN Solutions

Transcription

1 IS-IS Potocol Hadwae Implementation fo VPN Solutions MOHAMED ABOU-GABAL, RAYMOND PETERKIN, DAN IONESCU School of Infomation Technology and Engineeing (SITE) Univesity of Ottawa 161 Louis Pasteu, P.O. Box 450, Station A, Ottawa, Ontaio, K1N 6N5 CANADA Abstact: - One of the majo poblems elated to the gowth of netwok technology is the limitations it pesents when the potection and the esilience of a netwok has to be assued fo fast ecovey as is the case fo 1 and 10 Gbps links. It is well known that calculating the shotest path equies significant computational time. Steam-based applications (such as voice and video) unning on Gigabit links can suffe damatic packet loss duing link failues, intoducing lage delays on eceiving hosts in the pocess. In ode to alleviate the delay in such netwoks, this pape intoduces hadwae achitectue fo the IS-IS potocol. The achitectue implements mathematical algoithms fo calculating the shotest path in FPGAs. Such an implementation impoves the shotest path computation time, allowing fo a apid calculation of the second path. Key-Wods: - IS-IS, hadwae, FPGA, VPN, netwok, OSPF, Dksta 1 Intoduction In ode to ovecome and enginee some of the pefomance issues of packet based netwoks, hieachical and logical outing achitectue potocols wee developed in the aea of packet netwoks. Some of these potocols include Hieachical Pee Netwokto-Netwok inteface (HPNNI) [1] which is applied to ATM netwoks, Open Shotest Path Fist (OSPF) [2], Intemediate-System to Intemediate-System (IS-IS) [3] and Bode Gateway Potocol (BGP) [4] which ae used to oute taffic in autonomous IP netwoks. Most of these potocols ae based on computing Dksta s, Bell-man Fod s o othe algoithms to find the shotest path fom a souce node to a destination node. OSPF and IS-IS potocols ae well known potocols fo suppoting outing in a netwok laye potocol with datagam sevice. While both potocols have numeous similaities (authentication, flooding mechanisms, small contol packets, etc.), thee ae diffeences that become significant. In the constuction, tansmission and pocessing of link state PDUs (LSPs), OSPF is memoy intensive as moe bits ae tansmitted with lage link state heades and lage link state packets [5]. Consequently, OSPF equies moe bandwidth than IS-IS to tansmit infomation to its neighbos. Howeve, IS-IS packets cannot be easily diffeentiated at lowe (kenel) levels (because IS-IS is tansmitted on top of the data link laye) and most IS-IS fields ae of vaiable length, making packet pasing elatively difficult. Theefoe, the effective tade off between OSPF and IS-IS is that OSPF has optimized pocessing with inceased packet sizes while IS-IS has minimized stoage and bandwidth equiements with slow pocessing time. IS-IS outpefoms OSPF in link state packet aival times which is consideed the most impotant pefomance citeion in analyzing how outing infomation is tansmitted thoughout netwoks [6]. Theefoe, IS-IS is the pefeed potocol fo disseminating outing infomation ove boadcast netwoks. Fo these easons, we pusue the development of hadwae achitectue fo IS-IS. Hadwae achitectues fo IS-IS o outing potocols in geneal can be used to optimize pocessing tasks that othewise seve as significant bottlenecks in compute communications. The achitectue in [7] illustates how the shotest path can be calculated in hadwae using Dksta s algoithm. That shotest path achitectue can be used with any potocol equiing shotest path calculations to optimize outing computations. An IS-IS potocol achitectue is given in [8] illustating seveal modules inteacting with each othe to pefom IS-IS tasks, including a sepaate module to calculate the shotest

2 path. A simila achitectue could be implemented in hadwae with FPGAs to optimize pocessing, addessing the advantage of OSPF compaed to IS-IS, while maintaining low stoage and bandwidth equiements. This pape will pesent a new hadwae achitectue fo the IS-IS potocol. This achitectue allows fo a netwok topology to be diectly enteed o emoved as IS-IS pefoms petinent outing opeations. The pape is oganized in the following manne. Section 2 povides a bief oveview of the IS- IS potocol. Section 3 mathematically descibes the shotest path poblem while section 4 illustates a linea pogamming solution specific to shotest path outing. Section 5 descibes why hadwae should be used to addess taffic shaping in outing potocols. Section 6 descibes the hadwae achitectue of IS-IS as it would be implemented on an FPGA. Section 7 descibes expeimental esults achieved thus fa with espect to calculating the shotest path fo IS-IS. Finally, in Section 8 the conclusion to this wok is listed, summaizing elevant aspects of the achitectue and descibing futue wok. 2 IS-IS Oveview IS-IS is an inteio gateway potocol and link state potocol which uses Dksta s algoithm to find the shotest path between two outes within an aea. In this section of the pape a bief oveview of IS-IS is given by descibing the netwok elements and opeations. Fig.1 shows the netwok elements involved in an IS-IS domain. A host is efeed to as an End System (ES), a oute is called an Intemediate System (IS), and a designated oute is efeed to as a Designated Intemediate System (DIS). The data link inteface addess (MAC addess) is known as a Sub-netwok Point of Attachment (SNPA). The netwok laye addess (IP Addess) is known as a Netwok Sevice Access Point (NSAP). IS-IS has two levels of aea outing; level 1 () and level 2 (L2). In, ISs oute ES IS Y Level 1 Aea A Z L2 DIS Level 2 T L2 Backbone M L2 Fig.1. IS-IS Domain Level 1 Aea B K N within thei own aeas. If the destination is not within the aea then data will be outed to the closest L2 IS. L2 acts as a backbone whee ISs oute towads othe aeas. Cetain ISs can be configued fo both and L2. Routing infomation packets used among ISs ae known as Link PDUs (LSPs). Infomation collected by LSPs is stoed in a Link Database (LSDB). If an IS belongs two levels (L2) then that IS will have two LSDBs; one fo each level. Fig.2 illustates a high level opeation of IS-IS. The hello state illustates the activities pefomed in establishing a connection between two ISs. Fom Fig.1, it is assumed that Y is an IS coming up. Z acts as a DIS (i.e. pefoms the flooding of LSPs) and as a Pseudo-node (PSN) (i.e. the vitual node that emulates a boadcast link). When Y comes up it will be idle and it must establish its adjacencies. Y will send out IS-IS Hello (IIH) packets with a null SNPA. Z eceives IIH packets and checks its LSDB to detemine if an adjacency aleady exists. The IIH packet is ignoed if the adjacency exists; othewise Z ceates a new adjacency and sends an IIH packet to Y. Y eceives the IIH packet fom Z and etuns an acknowledgement. Z etuns an additional IIH packet to completely establish the connection. The next state is the Database (DB) Synchonization state whee exchanges of LSPs occu. The sequence numbe integated with LSPs is used to diffeentiate olde LSPs fom newe LSPs. Fom Fig.2, afte Y has established its adjacency, it will send out its LSP with sequence numbe 1. Upon eceiving the LSP Z sends othe LSPs to Y. Y uses these LSPs to ceate its LSDB. Once databases ae synchonized, all ISs compute the shotest path within thei aea in a state known as Shotest Path Fist (SPF). Hello IDLE INIT Y 1 way 2 way UP Veify CSNP Update LSDB IIH ID = Y SNPA = Null IIH ID = Z SNPA = Y IIH ID = Y SNPA = Z IIH ID = Z SNPA = Y DB Exch LSP ID = Y SeqNum = 1 DB Sych LSP ID = Z SeqNum =, LSP ID = SeqNum = n Update LSDB SPF LSP Update Eo, Missing Y ISs Compute Spanning Tee CSNP, Z, Y PSNP, LSP ID = Z SeqNum =, LSP ID= SeqNum = n Fig.2. IS-IS Opeations Z DIS INIT 1 way 2 way UP Update LSDB DB Exch Time fo Update Pocessing PSNP Flood LSPs

3 The next state is known as LSP Update. In this state two kinds of sequence numbes ae intoduced. The fist kind is the Complete Sequence Numbe PDU (CSNP) and the second kind is the Patial Sequence Numbe PDU (PSNP). CSNPs ae used to detemine if ISs have the cuent copies of all LSPs. PSNPs ae used by ISs to espond to CSNP if the CSNP had a missing LSP. F ig.2 shows an example of this scenaio. Afte a specific peiod of time, Z advetises CSNPs with summaies of all known LSPs. Y discoves that the LSP is missing. Hence, Y sends a PSNP equest fo the missing LSPs. Z pocesses the PSNP and floods LSPs that includes the missing. Y eceives the complete LSPs, updates its LSDB and ecomputes the shotest path. 3 Shotest Path Poblem The following notations can be used to descibe the shotest path poblem; G denotes a gaph, N denotes a set of nodes, A epesents a set of acs, s symbolizes the souce node and t denotes the temination node. G = (N,A) (1) { x ( A} (2) whee x denotes the ac/link connecting the node i to node j. The following VPN specific netwok fom [9] expands this definition to include custome nodes (c), custome edges (ce), povide nodes (pe) and povide edges (p). N = N ce N pe N p N a (3) N ce N pe = (4) N pe N p = (5) N ce N p = (6) whee c denotes the link cost between node i and node j. The equation is minimized subject to the following constaints. 1, i = s x x = 1, i = t (8) { j ( } { j ( j, i) } 0, othewise 0, ( A (9) x Solving the shotest path poblem in softwae typically equies O(n 2 ) o O(nlogn) algoithms. Those algoithms use data stuctues whose opeations un in O(1) to O(n) time. Significant inefficiency can exist depending how which algoithms and data stuctues ae used to solve the shotest path poblem. The use of econfiguable hadwae fo the shotest path poblem helps to alleviate the inefficiency obseved in softwae. 4 Shotest Path Routing Optimal pefomance in tems of bandwidth consumed on each link can be achieved with a set of shotest paths by solving the following linea pogam and dual shown in [10]. The linea pogam can be descibed as min R d j, i) j, i) 0 ( R subject to ji c d = 0, i s, t = 1, i = t ( A 1( A, R R R With this notation, the shotest path poblem is descibed as the minimization of the following equation whee T( s, t ) = d fo assumed taffic matix T, ( c x (7) (10) souce (ingess) node s and destination (egess) node t. is the faction of taffic fo though link (. The dual to the linea pogam is descibed as

4 max t R, t V ( subject to U W U j s whee U 0 i = 0. W U W + 1 c W R,( A (11) denotes the link weight fo link (. The linea pogam and dual shown hee illustate the impotance of efficient pocessing fo shotest path calculations, as a diffeent set of next hops may be geneated souce-destination pai whee taffic may be fowaded. The achitectue in this pape is also linea so efficiency in shotest path outing is of significant impotance. The following section illustates the justification of FPGAs in pefoming taffic shaping tasks though outing potocols 6 Hadwae Achitectue In this section of the pape the IS-IS hadwae achitectue will be pesented as follows; a desciption of the inputs and outputs of the IS-IS system and a system desciption is given fist. Then moe detailed discussions ae given fo the contol unit state machine and the data path. Fig.3 shows the inputs and outputs of the IS-IS system. The IS-IS system takes the following inputs: ingesspacket, which is whee incoming packets will be eceived. afivalue, which will be used to set the OSI NSAP addess (the fist octet), the value of this field indicates the top-level addessing domain associated with the NSAP. aeaaddess, which along with afivalue fom what s called the aeaid. systemid, which is the MAC addess of the IS. nsel, which specifies a use of the netwok laye sevice, if left un-initialized it will be set to zeo. psnid, the ID that will be used by the DIS to act as a PSN. 5 Taffic Shaping and Hadwae dis, which acts as the DIS. IS-IS and othe outing potocols play substantial oles in taffic shaping (alteing taffic to incease netwok efficiency). The potential impovements offeed by econfiguable hadwae (FPGAs, Systemson-Chip) to taffic shaping and othe compute communications tasks is best illustated by examining pefomance equiements. The most estictive taffic shaping equiements come fom high speed devices that must opeate at high ates. The infomation given in [11] illustates that slot duations ange fom 2us to 42us fo connections of at least 155Mbps whee the minimum packet sizes wee 40 bytes to 64 bytes. Taffic shaping at those ates is only achievable with dedicated hadwae. These ates ae of paticula impotance in IP netwoks since packets opeations ae expensive due to vaiable packet size. Futhemoe FPGAs ae pefeable as hadwae implementation devices because they ae econfiguable, so a given platfom can be optimized as much as possible. clock, this signal povides a clocking souce to the system fo synchonization. eset, this signal is used to eset IS-IS system to its default configuation. The IS-IS system povides the following outputs: egesspacket, is the inteface at which IS-IS system will be outputting packets such as LSPs, CSNP, PSNP,etc. is, infoms the IS-IS system use about the state of the IS. The IS-IS system is composed of two majo subsystems, a contol unit and a data path (as shown in Fig.4). The contol unit is composed of 4 pocessos, the Main Pocesso (MP) is esponsible fo invoking and updating the othe 3 pocessos based on feedback fom all othe pocessos. The ingesspacket ISIS Data afivalue System Signals aeaaddess egesspacket systemid Contol Signals nsel psnid dis clock eset Fig.3. IS-IS I/O is

5 Ingess Packet Contol Unit Ingess Packet Pocesso Main pocesso Shotest Path Pocesso Data Path Egess Packet Pocesso Egess Packet Fig.4. IS-IS system view ingess packet pocesso (IPP) is esponsible fo pocessing and buffeing packets eceived on the ingess path. It also updates the MP with status signals on the type of packets eceived. The Shotest Path Pocesso (SPP) is esponsible fo computing the SPF. The Egess Packet Pocesso (EPP) handles all tasks elating to sending packets as the esult of LSP advetisements, esponding o acknowledging packets. 6.1 Contol Unit The contol unit is pesented in the state machine shown in Fig.5. The Hello state is whee the adjacency establishment is achieved. If an adjacency was aleady established then the contol unit ignoes the hello packet and goes back to the IDLE state. If an adjacency was not established then the contol unit emains in the hello state and pefoms all necessay computations. In the DB Exchange state the contol unit eceives and advetises LSPs to make sue that its LSDBs ae synchonized with the latest netwok topology. Upon completing the DB Exchange state, the contol unit pocesses buffeed LSPs and stoes them into the appopiate LSDB, in a state known as LSDB Update. Once the LSDB update state is complete, the SPF state is executed and the shotest path is computed. The contol unit moves to an IDLE state whee it waits fo times to be tiggeed. In the case of a DIS deployment, the tiggeed times foce the contol unit to ente the C/P-SNP Pocessing state whee CSNP packets ae sent out to the netwok. The contol unit stays in the C/P-SNP Pocessing state fo a cetain amount of time to ensue that no PSNPs ae eceived. In a egula IS deployment, the contol unit moves to the C/P-SNP Pocessing state if a CSNP is eceived on the ingess path. In some cases, if a CSNP was missing some LSP summaies, then LSP advetisements will be flooded on the netwok and as a esult the contol unit will go to the LSDB Update state and SPF states. 6.2 Data Path As shown in F ig.6, the data path is composed of ingess components, egess components, LSDBs, system inputs, the SPP data path and the muxdemux components. The ingess and egess components ae buffes that stoe packets. The ingess components ae denoted by in in font of the component name and the egess components ae denoted by eg. Below is bief desciption of each buffe: IIH, buffes hello packets. DB, buffes database packets. LSP-, buffes Level 1 LSP packets. LSP-L2, buffes Level 2 LSP packets CSNP, buffes CSNP packets. PSNP, buffes PSNP packets. Thee ae two majo LSDBs; the active LSDB- and the active LSDB-L2. The active LSDB- stoes the pocessed LSPs fo and the active LSDB-L2 muxdemux Hello snpdone hellodone LSDB Update dbdone lspdbdone DB Exchange ingesspacket systeminputs iniih indb inlsp- SPP datapath egiih egdb eglsp- egesspacket inlsp-l2 eglsp-l2 C/P-SNP Pocessing snpnone snppoc IDLE spfdone SPF incsnp inpsnp active LSDB- egcsnp egpsnp standby LSDB- adjavailable active LSDB-L2 standby LSDB-L2 Fig.5. IS-IS main contol unit Fig.6. IS-IS data path majo components

6 stoes the pocessed LSPs fo L2. The standby LSDBs ae initialized to zeo. It is used duing the deletion (link failues o IS cashes) o the addition of LSPs. In the scenaio of adding a new LSP, the IS-IS system adds the new LSP to the standby LSDB, copies the active LSDB to the standby LSDB, then it activates the standby LSDB and deactivates the active LSDB (the standby LSDB becomes active and the active LSDB becomes standby). In the scenaio of deleting a LSP, the modification (eplacing LSPs with zeos) is done on the active LSDB, then the IS-IS system copies the active LSDB (skipping peviously inseted zeos) to the standby LSDB, then it activates the standby LSDB and deactivates the active LSDB. The switching between active and standby LSDBs occus wheneve necessay. The system inputs component ae egistes whee the IS-IS inputs ae stoed. The SPP data path descibed in [7] is used hee. The muxdemux component epesents multiplexes and demultiplexes (fo egulating data flow) that wee hidden fom F ig.6 to simplify the data path diagam. 7 Expeimental Results Simulation esults have been accumulated thus fa with espect to calculating the shotest path fo IS-IS. Othe aspects of IS-IS hadwae implementation ae not completed and consequently no esults can be given at this time. Netwoks of seven nodes o less wee used to geneate esults. Hadwae simulations wee pefomed using Cadence softwae while softwae benchmaks wee found with Java implementations of Dksta s algoithm. The shotest path was calculated in appoximately clock cycles in hadwae simulations. In softwae, those netwoks had thei shotest paths detemined in about 0.2 ms on a 267 MHz with a standad deviation of appoximately 8% ove 50 samples pe netwok. Those esults indicate that the shotest path can be calculated in appoximately 200 cycles in hadwae and the equivalent netwok has its shotest path calculated in cycles in a typical softwae envionment. 8 Conclusion The IS-IS hadwae achitectue pesented in this pape is flexible in adapting to netwok topology changes. The achitectue is scalable though FPGA implementation. Delays fo steam-based applications can be minimized by using this achitectue as demonstated in the expeimental esults achieved fo computing the shotest path. Refeences: [1] ATM Foum Technical Committee, Pivate Netwok-Netwok Inteface Specification, Mach [2] J.Moy, OSPF Anatomy of an Intenet Routing Potocol, Addison-Wesley, Febuay [3] White, Russ, IS-IS: Deployment in IP Netwoks, Addison-Wesley, [4] Y. Rekhte, P. Goss, Application of the Bode Gateway Potocol in the intenet, RFC 1772, Mach [5] Pelman, Radia, A Compaison Between Two Routing Potocols: OSPF and IS-IS, IEEE Netwok Magazine, Vol.5, No.5, 1991, pp [6] Shaon, Oan, Dissemination of Routing Infomation in Boadcast Netwoks: OSPF vesus IS- IS, IEEE Netwok, Vol.15, No.1, 2001, pp. 64. [7] Abou-Gabal, Mohamed, Petekin, Raymond, Ionescu, Dan, Lambi Cistian, Goza, Voicu, A Shotest Path Pocesso fo Taffic Engineeing of VPN Sevices, PERIODICA POLITECHNICA, Tansactions on AUTOMATIC CONTROL and COMPUTER SCIENCE, Vol.49, No.63, [8] Yang, Meong, Hahm, Jinho, Kim, Youngsun, and Kim, Sangha, Design and Implementation of the IS-IS Routing Potocol with Taffic Engineeing, APCC 2003, the 9th Asia-Pacific Confeence on Communications, Vol.3, 2003, pp [9] Lambi Cistian, Ionescu, Dan, Ionescu, Bogdan. Sevice Contol in Connection Oiented Netwoks, Recent Advances in Communications and Compute Science (WSEAS), 2003, pp [10] Sidhaan, Ashwin, Guein, Roch, Diot, Chistophe, Achieving Nea-Optimal Taffic Engineeing Solutions fo Cuent OSPF/IS-IS Netwoks, INFOCOM Twenty-Second Annual Joint Confeence of the IEEE Compute and Communications Societies, Vol.3, 2003, pp [11] Ophanoudakis, T, Leligou, H.-C., Konaos, Geoge, Chaopoulos, Ch. Accuate Schedule Implementation fo Shaping Flows of Vaiable Length Packets in High-Speed Netwoking Applications, Recent Advances in Communications and Compute Science (WSEAS), 2003, pp. 96.