VortiQa Software for Networking Equipment

Transcription

1 VortiQa Software for Networking Equipment Satish Swarnkar, Director of Engineering Software Products Division, Networking and Multimedia Group 1

2 Agenda VortiQa Software Announcement & the new Software brand of Freescale VortiQa software details Challenges for Network equipment vendors & VortiQa helps vendors meet the challenges? VortiQa software Overview Product lines, Alignment with QorIQ Processors VortiQa product - key differences between Product lines Business model VortiQa Deployment Solutions, Architecture & highlights Fast Development Optimized Performance Migration to Multicore CPU CPU CPU CPU Accel I/O I/O Accel DRAM DRAM VortiQa software solution system performance Some sample data to highlight scaling and performance of overall system Summary & Q&A Throughput Mbps IMIX IPV4 Firewall IPSEC AES32-SHA1 IPSEC 3DES-SHA1 Packet size (bytes) 2

3 VortiQa Software Announced on June 15, 2009 VortiQa software: a new brand of Freescale software for networking equipment that helps accelerate product development and increase the pace of innovation Four new VortiQa product lines of production-ready software applications: VortiQa software for service provider equipment VortiQa software for enterprise network equipment VortiQa software for small business gateways VortiQa software for SOHO/Residential gateways A comprehensive solution-centric approach for networking applications in targeted vertical segments: Silicon QorIQ and PowerQUICC communications processors Software VortiQa software products Expanded Ecosystem - hardware, OS, ISVs, system integrators \vór ti ka\: A whirlwind of innovation June EE Times, citing Gartner analyst Christian Heidarson: "VortiQa is a first-of-its-kind in the embedded market" and that "no other processor company targeting this market has offered software at such a high level". VortiQa software is catalyst for solution centric approach Complete solution optimized on FSL, to Drive Customer Success Allows vendors & partners to build solution for many market segments & meet challenges 3

4 Complex networks Challenges for Network Equipment Vendors Network complexity & Performance expectations Complex network topology, policies & segmentation for privacy Vulnerable software applications & diverse & complex traffic pattern Threats on rise with malicious hackers >>> Performance Traffic at Gigabit speeds Threats from within the core (inside) and from external world raise the bar on performance requirements with GB speeds of traffic Time to Market Vendors adapting complex multicore silicon with Security acceleration, Pattern Matching engine Need for highly optimized and comprehensive software solution in short time frame For faster time to market with lower cost is challenge Potpourri of software stacks and products Need to integrate multiple software components Maintain & support software components & releases Multiple products for each market segment MALICIOUS HACKERS INTERNET DoS Attacks Application Attacks OS Finger Printing Attacks Anti-NIDS Attacks Many challenges require a comprehensive field tested solution, catering to each market segment that can scale with the contemporary networks and their demands. VortiQa helps meet these challenges. Server ENTERPRISE NETWORK Application security hole: Patch not applied App Server CENTRAL SERVICES Web Server Confidential App security hole: Patch unavailable MARKETING SUBNET Insider Attacks Dishonest Employee FINANCE SUBNET Trojan Attack 4

5 VortiQa Software for Network Equipment Solution for complex networks: Unified Threat Management system: Firewall Intrusion Prevention Network Anti-Virus, Anti-Spam IPsec VPN Traffic Management () Solution for High performance networks High performance, multicore software Highly optimized for best throughput Solution for single core & multicore silicon Completely leveraging hardware features SEC, PME etc. Field Proven Solution with ecosystem support Faster time to market Complete solution for varied market segments Complete solution on FSL processors Four product lines to cover complete market spectrum Fully supported by developers & support teams Fast Development Optimized Performance Migration to Multicore CPU Accel CPU CPU CPU I/O I/O Accel DRAM DRAM VortiQa software provides comprehensive solution & helps customers, and partners meet the challenges: It is licensed on Freescale processors.. 5

6 VortiQa Software Solution: an Overview 6

7 VortiQa Software Product Lines For For service service provider provider equipment equipment Firewall, Firewall, NAT, NAT, Deep Deep Packet Packet Inspection, Inspection, IPSec IPSec VPN VPN & & Virtual Virtual Security Security Gateway Gateway (VSG) (VSG) For For enterprise enterprise network network equipment equipment Firewall, Firewall, NAT, NAT, Deep Deep Packet Packet Inspection Inspection & & QoS, QoS, VPN, VPN, Anti-X, Anti-X, and and High High Availability Availability For For small small business business gateways gateways Firewall, Firewall, NAT, NAT, IPSec IPSec VPN, VPN, Dual Dual WAN WAN load load balancing balancing & & fail-over fail-over & & service service provider provider provisioning provisioning For For SOHO/Residential SOHO/Residential gateways gateways Firewall, Firewall, NAT, NAT, IPSec IPSec VPN VPN and and service service provider provider provisioning provisioning VortiQa software is targeted for different market segments and utilizes range of Freescale Processors. 7

8 How QorIQ Platforms and VortiQa Products Align QorIQ Platforms/Products QorIQ P5 QorIQ P4 PRODUCTS: P4080 QorIQ P3 QorIQ P2 PRODUCTS: P2020 P2010 QorIQ P1 PRODUCTS: P1020 P1010 P1011 VortiQa Software for Service Provider Metro Carrier Edge Router Equipment Unified Threat Management Service Provider Routers Converged Media Gateway Integrated Services Router VortiQa Software Products IMS Controller VortiQa Software for Enterprise Equipment VoIP Carrier-Class Media Gateway Network Admission Control SSL, IPSec, Firewall Network Attached Storage Radio Network Control VortiQa Software for Small/Medium Business Gateways Wireless Media Gateway Storage Networks Access Gateway Home Media Hub Serving Node Router (GSN) VortiQa Software for SOHO/ Residential Gateways Basestation Comprehensive & extensive VortiQa software solutions to meet most deployment scenarios & requirements. 8

9 VortiQa Software Products Overview Delivers integrated networking and security functionality Freescale Silicon Examples Example Applications Key Features Service Provider Equipment QorIQ processors (P4080) Multi-service edge routers, Switches, Wireless infrastructure, security gateway Networking protocols & Utilities L2 or L3 Stateful Packet Inspection Firewall, NAT IPSec VPN + IKEv1 + IKEv2 Stateful deep packet inspection: P2P filtering, Protocol Anomaly, Traffic Anomaly QoS / Traffic Management Virtual Security Gateways (VSG) Extensive CLI configuration Enterprise Equipment PQIII and QorIQ processors (8572E, P2020, P4080) Enterprise U, security appliances, secured routers and switches Networking protocols & Utilities L2 or L3 SPI Firewall support IPSec Enterprise VPN + IKEv + IKEv2 Stateful deep packet inspection: P2P filtering, Protocol Anomaly, Traffic Anomaly QoS / Traffic Management Anti-Virus and Anti-Spam HA Support Extensive CLI & GUI Configuration Small Business Gateways PQIII and QorIQ processors (8377E, P2010) Multi-service business gateways Networking protocols & Utilities Advanced IPSec VPN + IKE supports SPI Firewall + Advanced NAT features + Dual WAN with Load balancing / Fail Over Optional service provider provisioning Medium grained control and configuration for businesses. SOHO / Residential Gateways PQIII and QorIQ processors (8315E, 8314E, P1010) xdsl, PON, FTTH, and other CPE devices Networking protocols & Utilities SPI Firewall + NAT + Residential Gateway IPSec VPN Optional service provider provisioning Easy and intuitive configuration for homes. VortiQa software is used by ODMs and OEMs. It is licensed & supported for distribution. 9

10 Software Business Model Terms and deliverables LICENSING DELIVERABLES SUPPORT Development license Toolkit libraries Term of support Source license Terms: Ability to modify, enhance, make derivatives Run-time distribution license License to sublicense only in binary form as included with FSL silicon based hardware product Term 5 years with automatic annual extensions thereafter Indemnity Covered for software delivered by Freescale Warranty 30 days initial warranty Thereafter, defects are covered under support agreement Library files required to complete integration and link with customer application modules Complete source code and make files for customer to modify the product, integrate and link with other application modules Other deliverables Release notes Image on target platform To jumpstart the usage of the product by development team API documentation User/Admin guide for GUI/CLI where applicable Test documents including test reports, test plans and test cases Minimum of 2 years subject to support payments Support provided for current release and most-recent previous release Training Fee based training either onsite or Freescale location Modes of support Telephone Instant messaging Web-based defect tracking system VortiQa software is available, licensed & supported for distribution for different deployment scenarios. 10

11 VortiQa Software Solution: Deployment Scenarios & Architecture 1. VortiQa software for service provider equipment 2. VortiQa software for enterprise network equipment 3. VortiQa software for small business gateways 4. VortiQa software for SOHO/Residential gateways 11

12 VortiQa Software for Service Provider Equipment QorIQ processors (P4080) Multi-service edge routers, Switches, Wireless infrastructure, security gateway Networking protocols & Utilities L2 or L3 Stateful Packet Inspection Firewall, NAT IPSec VPN + IKEv1 + IKEv2 Stateful deep packet inspection: P2P filtering, Protocol Anomaly, Traffic Anomaly QoS / Traffic Management Virtual Security Gateways (VSG) Extensive CLI configuration 12

13 VortiQa for Service Provider / Datacenter Deployment Server Farm Aggregation Switches With VortiQa Software Core Switches With VortiQa Software P4080E P4040 / P304X / MPC 8572 Up to 1500MHz e500mc core; 1MB L2, DDR2/3, PCI-Express, 10G/GbE, USB DPAA, Security Up to 1500MHz 8 Cores; 1 MB L2, DDR2/3, PCI-Express, 10G/GbE, USB DPAA, Security Internet 13

14 VortiQa Software Solution for Service Provider Solution = Fath Path U + Freescale Enablement Software + QorIQ P Customer Software Fast Path U Control Plane CLI LDSV Engine Management WEB-HTTP(*) Config Demux User space daemons - Configuration Databases, VSG, Interfaces Event Manager: Dispatcher/Generator/Receiver LOG TRACE Signaling/Misc IKE DNSRD(*) EVM-API CP-DP Communication Handler DP State Monitor Image upgrade(*) Kernel Routing Table (VRF) HA Monitor(*) Route Updater Interface Helper ARP Helper Interface Demux/Packet Announcer DP/CP Interface Compiled with User Space Applications CP-DP Demux CP-DP Transport Compiled with Kernel Space Applications Queues Data Plane HA(*) Stateful Sync, Monitor Firewall IPS IPDB Databases IPSec URLF Services Session Mgmt. DNS Cache IP Reassembly Packet Processing Engine Firewall ALGs IPS IPSec Traffic Mgmt(*) P2P DP Monitor HW Accelerators Interface Event Manager, Dispatcher Logger CLI Management Trace LDSV Engine CP-DP replicated information (VSG, I/F, Routes, ARP, Cache) Light-Weight Executive (LWE) for Data Plane Hypervisor Freescale QorIQ (P4080) Linux SMP for Control Plane This paradigm extends to ecosystem operating systems and stacks 14

15 VortiQa for Service Provider Equipment Architectural Highlights Control Plane and Data plane to achieve optimal performance with less complexity. Two Planes : CP and DP Divide cores between CP and DP. DP running on Light Weight Executive (LWE) and CP running on Linux. 2 X 10Gig ports CPDP packet path CPDP message path CP SMP Linux DP- LWE Data Plane Modules that are needed for higher throughput and higher connection rate. Packet processing and session Management modules. No OS overhead. Complete control on packet processing from reception to transmission due to run to completion model. Predictable performance Session Parallelization supported Control Plane: Rest of modules such as Management modules such as IKE Services which require complete TCP/IP stack such as socket based applications. Signaling and Control protocols. Linux Operating System. 15

16 VortiQa Software Solution: Deployment Scenarios & Architecture 1. VortiQa software for service provider equipment 2. VortiQa software for enterprise network equipment 3. VortiQa software for small business gateways 4. VortiQa software for SOHO/Residential gateways 16

17 VortiQa Software for Enterprise Network Equipment PQIII and QorIQ processors (8572E, P2020, P4080) Enterprise U, security appliances, secured routers and switches Networking protocols & Utilities L2 or L3 SPI Firewall support IPSec VPN + IKEv1 + IKEv2 Stateful deep packet inspection: P2P filtering, Protocol Anomaly, Traffic Anomaly QoS / Traffic Management Anti-Virus and Anti-Spam HA Support Extensive CLI & GUI Configuration 17

18 MPC8572E P2020 P4080E Up to 1500MHz 2x1.2GHz, Up to 1500MHz Dual- single e500 DDR2/3 8 Cores; core; 800MHz 1MB 1 MB L2, L2, 800 Mhz DDR2/3, 512kB PCI-Express, Shared L2 w 10G/GbE, 4xGbE, ECC USB USB SRIO, Security, DPAA, SEC3.0 Security, WPME Internet Enterprise Deployment Logging Console Admin Console ENTERPRISE NETWORK Security Domain 4 MPC8315 MARKETING SUBNET Marketing Users Other Internal Users 400MHz 2 x GigE (SGMII) PCI, PCI-Exp USB, DDR1/2, Security Security Domain 2 400MHz MALICIOUS HACKERS VortiQa Software BRANCH OFFICE DoS Attacks Access Control Lists Security Domain 1 Confidential Data HOMEOFFICE App Server Server EDI Server Security Domain 3 Finance Users MPC8548 FINANCE SUBNET Web Up Confidential to 1500MHz Single Core; 512KB L2, Server Data DDR2/3, PCI-Express, 4xGbE, USB SRIO, Security Trojan Attack TELECOMMUTER Policies for individual security domains Policies for Individual users Policies for user groups Allow remote access Allow access to web server Deny access to finance server Deny access to confidential data 18

19 Architecture: VortiQa Software for Enterprise Network Equipment SSLVPN Reverse Proxy Socks App Tunnel L2 Tunnel Portal CMS/Embedded Management: CLI, HTTP, LDSV, SYSLOG, , SNMP AV/AS SMTP/S Proxy POP3/s Proxy HTTP Proxy FTP Proxy AV DB AS DB IPS Manager IKEv1/v2 PKI (SCEP, OCSP, LDAP) XAUTH, EAP IRAC IRAS Authentication Services LDAP Client RADIUS Client Local User Space SPI Firewall Inline IPS IPSec VPN Anti-Virus Anti-Spam Routing TCP/ IP Firewall Policy Mgmt Session Management and Packet processing Traffic Policing Transparent Proxy Support Application Level Gateway Drop-in Clustering Intrusion Detection/ Prevention Engine Ethernet, Bridging and WAN Protocols IPSec Packet Processing Traffic Shaping Kernel Space QoS Transparent mode support High availability (active-backup) Clustering (activeactive) Hardware Layer Ethernet Controllers Crypto Acceleration Pattern Matching Acceleration 19

20 VortiQa for Enterprise Architectural & Performance Highlights Architecture Packet Processing Modules run in SMP Kernel Space E.g IPSec, Firewall / NAT, IPS as Kernel Loadable modules Application Level Modules run in User Space E.g. Anti-X Control & Management Modules run in User Space E.g. IKE, HTTP Server Linux TCP /IP stack Used for Routing Performance Optimization for Enterprise Software Reduced & granular SMP locks in data path Session Parallelization Only one processor at any time processes firewall, IPS or VPN sessions. No binding of processor to the sessions. Packet processing in softirq context to reduce the context switches Hardware Acceleration for Performance VPN for IPsec and IKE acceleration IPS for pattern matching and regular expression search Processor Processor 3 VortiQa VortiQa VortiQa 1 Software VortiQa Software Software Software Linux Interrupt Scheduler Firewall Network Controller Network Controller Network Controller IPS IPsec VPN HW Accelerator Eco-System Glue Layer HW Accelerator 20

21 VortiQa Software Solution: Deployment Scenarios & Architecture 1. VortiQa software for service provider equipment 2. VortiQa software for enterprise network equipment 3. VortiQa software for small business gateways 4. VortiQa software for SOHO/Residential gateways 21

22 VortiQa Software for Small Business Gateways PQIII and QorIQ processors (8377E, P2010) Multi-service business gateways Networking protocols & Utilities Advanced IPSec VPN + IKE supports SPI Firewall + Advanced NAT features + Dual WAN with Load balancing / Fail Over Optional service provider provisioning Medium grained control and configuration for businesses. 22

23 SMB Deployment Branch Office VortiQa Software for Enterprise Networks VPN Tunnel Internet SMB Network MPC8378E P2010 MPC8377E MHz 2 x GigE (SGMII) Dual e500 Core, PCI 800, PCI-Exp MHz 512 KB USB, L2 Cache DDR1/2, Security, SATA 667MHz Telecommuters & Road Warriors 23

24 Architecture: VortiQa Software for Small Business Gateways Embedded Management: CLI, HTTP, TR069/TR098, LDSV, SYSLOG, SPI Firewall IKEV1 PKI (SCEP,OCSP) XAUTH IRAS, IRAC L2TPoIPSEC LAN/WAN Mgmt DHCPC, DHCPS, Relay PPPoE, PPTP Client DynDNS, DNSRD Routing (RIP v1/v2) IGMP proxy Authentication LDAP RADIUS Local DB User Space IPSec VPN with IKEv1 Routing QoS TR069 & TR098 TCP/IP Firewall/NAT ACLs ALGs Proxy Infra Session Management ToS Based QoS IPSec Engine Kernel Space Dual-WAN load balance User-friendly GUI Ethernet, VLAN, Bridging, WAN Protocols, WAN Load Balancing/Fail Over for Dual WAN Hardware Layer Ethernet Controller Security Engine (SEC) 24

25 VortiQa for Small Business Architectural Highlights Packet Processing Modules in Linux Kernel Space Examples IPSec, Firewall / NAT as Kernel Loadable modules Control & Management Modules in Linux User Space Examples IKE, HTTP Server Comprehensive Management Interfaces CLI, GUI, TR-069 & TR-098 support Dual WAN interface support for fail-over & load balancing 25

26 VortiQa Software Solution: Deployment Scenarios & Architecture 1. VortiQa software for service provider equipment 2. VortiQa software for enterprise network equipment 3. VortiQa software for small business gateways 4. VortiQa software for SOHO/Residential gateways 26

27 VortiQa Software for Residential Gateways PQIII and QorIQ processors (8315E, 8314E, 8358, P1010) xdsl, PON, FTTH, and other CPE devices Networking protocols & Utilities SPI Firewall + NAT + Residential Gateway IPSec VPN Optional service provider provisioning Easy and intuitive configuration for homes. 27

28 SOHO/RG Deployment FRIENDS ONLINE SCHOOL WORK INTERNET FRIENDS ONLINE SCHOOL WORK Malicious Hackers BANKING SHOPPING NEWS AND ENTERTAINMENT TRAVEL AND LEISURE VoIP DoS Attacks URL Keyword Filtering Trojan Attack OFFICE VPN CONNECTION Confidential Data VPN Firewall BANKING SHOPPING NEWS AND ENTERTAINMENT TRAVEL AND LEISURE HOMEOFFICE EDI Server Server x Unauthorized Users LAPTOP WITH WIRELESS LAN CONNECTION A/B/G Wireless Security MPC8358E MPC8315E e300 core with MHz and QUICC engine support 28

29 Architecture: VortiQa Software for SOHO / Residential Gateways Embedded Management: CLI, HTTP, TR069/TR098, LDSV, SPI Firewall IKEV1 IRAS, IRAC LAN/WAN Mgmt DHCPC, DHCPS PPPoE, PPTP Client DynDNS, DNSRD Routing (RIP v1/v2) Authentication Local DB User Space IPSec VPN with IKEv1 Routing QoS IGMP proxy TR069 & TR098 TCP/IP Firewall/NAT ACLs ALGs Proxy Infra Session Management ToS Based QoS IPSec Engine Kernel Space Easy-to-use GUI Ethernet, VLAN, Bridging, WAN Protocols Hardware Layer Ethernet Controller Security Engine (SEC) 29

30 VortiQa SOHO / RG Architectural Highlights Packet Processing Modules in Linux Kernel Space Examples IPSec, Firewall / NAT as Kernel Loadable modules Control & Management Modules in Linux User Space Examples IKE, HTTP Server Fastpath API Framework for NAT/Firewall offloading to h/w assist/accelerator Intuitive Management GUI Interfaces as well as CLI 30

31 Performance on Freescale Processors 31

32 MPC 8572 Enterprise Firewall Performance single core and dual core Throughput(Mbps) IMIX Packet Size (bytes) % 90.00% 80.00% 70.00% 60.00% 50.00% 40.00% 30.00% 20.00% 10.00% 0.00% CPU bandwidth available, hence performance expected to cross 4 Gbps CPU Utilization Throughput(Mbps)-SC Throughput(Mbps)-DC CPU Utilization-SC CPU Utilization-DC Single Core to Dual core Firewall Performance improvement 64 byte: +91% IMIX: +92% 32

33 MPC 8572 Enterprise FW + VPN Performance single core and Dual Core % 90.00% AES32-SHA1-SC Throughput(Mbps) IMIX Packet Size(bytes) 80.00% 70.00% 60.00% 50.00% 40.00% 30.00% 20.00% 10.00% 0.00% CPU Utilization AES32-SHA1-DC 3DES-SHA1-SC 3DES-SHA1-DC AES32-SHA1 CPU utilization-sc AES32-SHA1 CPUutilization-DC 3DES-SHA1 CPUutilization-SC 3DES-SHA1 CPUutilization-DC Single Core to Dual core VPN improvement 64 byte: +73% IMIX: +74% Note: Static ARP, IPS off, 2 FW session, and 1 VPN 33

34 MPC 8377 SMB performance results Packet size Throughput in Mbps IPV4 Forwarding Firewall IPSEC AES32-SHA1 IPSEC 3DES-SHA Firewall performance at 1339 Mbps VPN performance at 488 Mbps IMIX NA NA Throughput Mbps IPV4 Firewall IPSEC AES32-SHA1 IPSEC 3DES-SHA1 MPC8377E MPC8378E MHz 2 x GigE (SGMII) PCI, PCI-Exp USB, DDR1/2, Security, SATA 667MHz IMIX Packet size (bytes) 34

35 P2020: Firewall + VPN Performance 2500 Firewall performance : full line rate VPN performance at 1333 Mbps 2000 Throuput in Mbps Firewall VPN + Firewall IMIX

36 Summary and Q&A 36

37 Summary Challenges in the market Integration of software components from many sources Optimization on complex Hardware, and lack of expertise Time to market pressure VortiQa software is new brand from Freescale Available on QorIQ and PowerQUICC processors Natural choice for vendors Highly optimized & performance tuned solution to get the most out of silicon & its capabilities Available on wide selection, allows vendors to diversify their portfolio. Accelerate time to market with a comprehensive system solution not just silicon or software component. Support from the developers who have experience with silicon and software VortiQa software accelerates time to market with robust, optimized & productized solution on Freescale processors. 37

38 38

39 VortiQa Software: Session information & Contacts VortiQa web site: FTF Session: Download from Session Number & Name: NET-F0298 VortiQa Software for Enterprise / SMB / Residential Networking Equipment Speaker Name : SATISH SWARNKAR SSWARNKAR@Freescale.com 39