Implementing A High Performance Virtualized CPE Solution

Transcription

1 Implementing A High Performance Virtualized CPE Solution Hongjun Ni & Singfu Lee Intel HuachenTel Acknowledgement: Chuanguo Xuekun Hu, Jerry Ray Kinsella, Radu Ping Yu, Fan

2 Agenda Why Choosing FD.io SD-WAN Solution SD-WAN Core Component vcpe Proposed Solution vcpe Architecture based on vcpe Key Implementation on Next Steps

3 Orchestration & Controller Ligato Data Plane Services Dataplane Management Agent Honeycomb Data-plane Management Networking- Contiv- Analytics trex Packet Processing Packet Processing NSH_SFC PMA Tools DMM P4 Sandbox o Testing /Support CSIT trex Network IO Operating Systems OSV Packaging deb_dpdk rpm_dpdk 3

4 SD-WAN Solution Enterprise 1 Orchestrator Controller Cloud Ready and Multi-tenant Decouple Control and Data Plane POP Network1 vcpe DC VNFs Plug and Play Hypervisor Enterprise 2 Network2 Cost Save and Easy Deployment Intelligent Path Selection Secure Transport and Self Manage

5 SD-WAN Core Component vcpe Features Enterprise 1 Orchestrator Controller High Reliability High Performance POP Network1 DC vcpe VNFs Hypervisor Extensibility ACL/QOS/NAT IPSec/VxLAN/RE tunnel Enterprise 2 Network2 Multilink Load Balancing Router / Switch Mode Multi-tenant RESTful/Netconf API

6 vcpe Proposed Solution Orchestrator ODL Controller Provide high performance data plane based on and DPDK. Netconf Netconf/Restful Agent RESTful DPDK Honeycomb acts as an Agent for SDN Controller and manages vcpe via Netconf. Manage vcpe through RESTful using Web or mobile APP. vcpe Intel Xeon 6

7 vcpe Architecture on DHCP Server Video Server vdpi VMs WEB/APP Controller vpbx OA/ERP QOS/ACL NAT bvi Bridge/Router VTE 1 VTE n QOS/ACL RESTful Netconf vcpe and vcpe runs on and DPDK. Creates one VTE endpoint for each CPE, which can leverage VxLAN and IPSec. Internet VxLAN + IPSec Each VTE endpoint enables ACL and Qos. Network NAT

8 Creating VTE Endpoints Bridge/Router RESTful Controller Issue: CPE often enables NAT that introduces uncertain IP address and Port, which causes that vcpe cannot connect CPE directly. NAT VTE 1 Network Snooping Module Netconf vcpe Solution: Creates a Snooping Module and snoops control protocol packets. vcpe sends registered info to SDN Controller. SDN Controller authenticate the CPE. If passed, then creates a new VTE endpoint. Data plane packets will flow through VTE endpoint directly.

9 Access Services on VMs DHCP Server Video Server vdpi vpbx OA/ERP VMs Enterprise Services run on VMs. Bridge/Router Redirect traffic to VMs. QOS/ACL VTE 1 VTE n vcpe Enforces different ACL and Qos Policy for each service. Network

10 Communication among CPEs Bridge/Router QOS/ACL VTE 1 VTE n vcpe CPE could communicate with each other through Layer 2 VPN or Layer 3 VPN. Network Enforces different ACL and Qos Policy for each subscriber.

11 Integration with Legacy Application Kernel NIC DPDK NIC TAP() TAP(Kernel) Legacy APPs IKEv2 & dhcpd socket dispatches control plane packets and data plane packets. steers control plane packets to Legacy Application through tap interface. Tap interface could meet low bandwidth requirement for control plane packets. red line: control plane flow black line: data plane flow

12 Next: Integration with DPI plugin Bridge/Router VTE 1 VTE n IDS/IPS 3~6x SD-WAN/DPI Linear Scaling Network and Web Security Save CPU cycles up to + 20% QOS/ACL vcpe Spine DPI Hyperscan-based DPI plugin Network Leaf DPI inspects packets from clients before encryption. Leaf DPI Spine DPI inspects packets from all CPEs after decryption. 12

13 Next: Multi-link Support Support Dual WAN links: Wired and Wireless. On normal case, need to support load balancing for multiple links as per some policy. Support Link Protection and Recovery WAN connection automatically switch to wireless link if wired link failure detected. Switch back to formal link if failure is recovered. 13

14 Thank you! Q & A Please stop by our demo at Intel Booth hongjun.ni@intel.com & lixingfu@huachentel.com 14