L7 Application Visibility for NFV and Data Centers

Transcription

1 L7 Application Visibility for NFV and Data Centers Creating Service-Awareness across Networks October 2015

2 Agenda 1. Who is Qosmos? 2. What is L7 visibility and application awareness? 3. Use cases L7 application visibility for Gi-LAN (SFC) L7 application visibility for micro-segmentation (security) 4. Summary Page 2

3 Qosmos L7 Visibility and Application Awareness Microsegmentation Service Chaining QoE/Analytics vcpe Visibility on thousands of application protocols Extraction of 4,000+ Metadata Caller, called party, jitter, packet loss, latency, call duration, setup time, codec, throughput, mobile ID (IMSI, IMEI), phone number, user login, IP address, MAC address, date & time of login / logoff, subject of / chat / Webmail, sender, receiver, attached documents, response time, data transfer sessions (type, content, time), visited Website, page content, time spent on visit, basket share, referent, etc. Page 3

4 Qosmos Vision of the Networking Industry Future networks will be built using components linked by interfaces Standards and open source projects will form the framework of a new, open network architecture There will be a shift in value From closed software and hardware To: 1. Maintenance, support and integration of open source software 2. Standard-based hardware 3. Value-added commercial extensions Interfaces must be open + standardized + application-aware! Page 4

5 Qosmos Contribution to Standards & Open Source Organization Area Qosmos Contribution L4/L7 ONF Service Chaining Solution Architecture and API document OpenFlow enhancements for application-aware Service Chaining (extra fields) SWA EVE SFC SFC ODL GBP GBP, Port Chaining SFC VNFC, DPI VNFC Report on SDN Usage in NFV Architectural Framework Impact of Policy-Based Configuration Scheme ETSI POC #28 on Service Chaining IPFIX for metadata and congruent metadata messages (NSH) Application ID metadata field (leverage ODL spec). Draft issued by Cisco & Qosmos. Extension of data model to support Application ID-based matchers Generic matchers enabling Layer 7 classification Layer 7-aware support for Security Group via ODL Group Based Policies Blueprints for application-awareness Participation in VNF Forwarding Graph POC OVS 2.4 and upcoming 2.5 Architecture for OVS 2.4 Conntrack design enabling mainstream DPI support for application-awareness Page 5

6 Agenda 1. Who is Qosmos? 2. What is L7 visibility and application awareness? 3. Use cases L7 application visibility for Gi-LAN (SFC) L7 application visibility for micro-segmentation (security) 1. Summary Page 6

7 Creating L7 Application Awareness Microsegmentation Service Chaining QoE/Analytics vcpe Application Aware Network Raw packet flows L7 Classifier Classified flows + metadata Page 7

8 Separation between Data Plane and Control Plane Standardized management Service Clients SFC NBI SFC Application SFC manager Orchestrator SF Locator & Transport Cap SFC instance manager Forwarding Graphs SFC SBI (SDN NBI) SFC SDN Controller SFC SDN Controller Non-OpenFlow Service Functions OpenFlow configuration of switches SDN SBI OpenFlow Extension IPS FW OpenFlow-Enabled Service Functions IDS NAT SDN SBI OpenFlow Extension Cache Load Balancer QoS VPN WOC NSH headers Traffic Source L7 Classifier SF Forwarder (OF-Switch) L7 Classifier SF Forwarder (OF-Switch) Traffic Destination Page 8

9 Agenda 1. Who is Qosmos? 2. What is L7 visibility and application awareness? 3. Use cases L7 application visibility for Gi-LAN (SFC) L7 application visibility for micro-segmentation (security) 4. Summary Page 9

10 L7 Application Awareness for SFC in Gi LAN Telco / 3GPP Services NFV SFC-aware function (e.g. Parental Control) SFC-aware function (e.g. Video Opt.) SFC-Unaware function (e.g. Caching) NFV Orchestrator PCRF SFC Proxy VNF Manager Incoming traffic SFC SDN Controller Service Function Forwarder VIM P-GW L7 Classifier Network L7 Classifier IT / SDN Page 10

11 The Role of a L7 Service Classifier for SFC in Gi LAN 1. Controller configures classifier with service chaining rules based on App ID and Sub class 2. Controller Telco configures / 3GPP network equipment (SFF) to ensure classifier tags are well-understood SFC-aware function 3. Service Classifier tags the traffic (e.g. HD video (e.g. Parental Control) tag) 4. Network equipment (SFF) sends HD video into the appropriate PCRF service chain (video optimization + cache) Incoming traffic SFC SDN Controller 1 2 SFC-aware function (e.g. Video Opt.) 4 Service Function Forwarder Services SFC-Unaware function (e.g. Caching) SFC Proxy NFV NFV Orchestrator VNF Manager VIM P-GW L7 Classifier 3 Network IT / SDN L7 Classifier Page 11

12 Example: Using ODL to Configure L7 SFC Based on L7 Classification In ODL Lithium you can configure SFC based on L7 classification Page 12

13 Agenda 1. Who is Qosmos? 2. What is L7 visibility and application awareness? 3. Use cases L7 application visibility for Gi-LAN (SFC) L7 application visibility for micro-segmentation (security) 4. Summary Page 13

14 Historically: Firewall Before and After L7 Visibility Before L7 Visibility After L7 Visibility Page 14

15 NOW: Micro-segmentation Before and After L7 Visibility Security Policy Management Before After Packet data path (iptables, vswitch, WFP) Hypervisor Physical Server / Host Packet data path (iptables, vswitch, WFP) L7 Classifier Hypervisor Physical Server / Host Page 15

16 Example: L7 Classifier with Security Management Using OpenStack Security Groups Security Groups Packet data path (iptables, vswitch, WFP) L7 Classifier Hypervisor L7 Classifier based on iptable or OVS Physical Server / Host Page 16

17 Example: OpenStack Security Groups Before After New applicationbased rules, based on L7 visibility L7 Rule Database SSH Web Page 17

18 Example: Security Management Using your own Tools Your security configuration Packet data path (iptables, vswitch, WFP) Your Classifier embedding DPI Engine Hypervisor Physical Server / Host Page 18

19 Agenda 1. Who is Qosmos? 2. What is L7 visibility and application awareness? 3. Use cases L7 application visibility for Gi-LAN (SFC) L7 application visibility for micro-segmentation (security) 4. Summary Page 19

20 A Way Forward: Additional L7 Application Criteria in OpenStack Additional L7 extensions for management and control plane OpenStack Group Based Policy (GBP) OpenStack FWaaS logging APIs Extensions for OpenStack Service Function Chaining (SFC) OpenStack Neutron Common Classifier Object proposal More general approach serving a wide range of use cases Additional L7 extensions for data plane L7 Classifier for OpenStack Page 20

21 Summary: L7 Application Visibility for NFV and Data Centers L7 visibility and application awareness should work efficiently with standard management tools such as OpenStack and ODL L7 visibility and application awareness needs to be part of protocols (e.g. OpenFlow, NSH) and APIs (e.g. OpenStack, ODL SFC) Key use cases include: Service Chaining for Gi-LAN Security based on micro-segmentation for datacenter environments L7 application visibility is key for NFV and datacenter environments Page 21

22 Copyright 2015 Qosmos S.A. All rights reserved. Qosmos, the Qosmos logo, Qosmos Classifier, Qosmos Service Aware Module, Qosmos Service Aware Module for vswitch, Qosmos SAM and Qosmos ixengine are trademarks of Qosmos. Other names and brands may be claimed as the property of others. Non-contractual information. Products and services and their specifications are subject to change without prior notice.