Opendaylight Service Function Chaining + OVS integration.

Transcription

1 Opendaylight Service Function Chaining + OVS integration rapenno@gmail.com

2 Rapid and stable code development 4th gen programming language No Changes to OVS in switches or ODL No integration of ODL SFC Plug-in with N southbound protocols Reuse of current SFC RESTconf APIs

3 Architecture ODL Client RESTConf 1. Create Service Chains 2. SFC Plugin 3. REST (Create Service Chain) Linux 4. Python REST Micro framework 5.Python OVS Module or OVS CLI Commands OVS

4 Work Items (Code + test) Map relevant SFC RESTConf API to OVS commands. (3 weeks). For example, map PUT /config/service-function:service-functions to OVS command. Python code to process REST request and run OVS commands based on URI (1 week) Changes to ODL SFC Plug-in to call necessary REST APIs to Python REST Server (3 weeks)

5 Work Items (Code + test) Topology setup, full testing (3 weeks) Client work is not part of effort. We can use RESTConf API explorer or any REST client to drive product.

6 Test Bed (/24 subnets) FW1 FW2 VXLAN Tunnel Client Linux Ingress Linux Egress Server

7 Recipe (without firewall) (Original) VXLAN Tar Ball: OVS Commands for Linux Ingress Machine sudo ovs-vsctl add-br br1 (bridge is a misnomer, it is actually a OVS switch) sudo ovs-vsctl add-port br1 vxlan1 -- set interface vxlan1 type=vxlan options:remote_i p= options: key=0x5000 options:nsp=0x options:nsi=44 key is the same as VNI (0x5000), NSP is Service Path (0x123456), NSI is Service Index (44) sudo ovs-ofctl add-flow br1 "table=0 priority=300 in_port=eth0 actions=out_port;vxlan1 OVS Commands for Linux Egress Machine sudo ovs-vsctl add-br br1 (bridge is a misnomer, it is actually a OVS switch) sudo ovs-vsctl add-port br1 vxlan1 -- set interface vxlan1 type=vxlan options:remote_i p= options: key=0x5000 options:nsp=0x options:nsi=44 key is the same as VNI (0x5000), NSP is Service Path (0x123456), NSI is Service Index (44)

8 Recipe (Original) VXLAN Tar Ball: OVS Commands for Linux Ingress Machine sudo ovs-vsctl add-br br1 (bridge is a misnomer, it is actually a OVS switch) sudo ovs-vsctl add-port br1 vxlan1 -- set interface vxlan1 type=vxlan options:remote_i p= options: key=0x5000 options:nsp=0x options:nsi=44 key is the same as VNI (0x5000), NSP is Service Path (0x123456), NSI is Service Index (44) sudo ovs-ofctl add-flow br1 "table=0 priority=300 in_port=eth0 actions=mod_nw_dst: sudo ovs-ofctl add-flow br1 "table=0 priority=300 ip,nw_src= actions=mod_nw_dst: Linux Commands for Egress Machine sudo ovs-vsctl add-br br1 (bridge is a misnomer, it is actually a OVS switch) sudo ovs-vsctl add-port br1 vxlan1 -- set interface vxlan1 type=vxlan options:remote_i p= options: key=0x5000 options:nsp=0x options:nsi=44 key is the same as VNI (0x5000), NSP is Service Path (0x123456), NSI is Service Index (44)

9 Misc Notes If the firewall is not NSH aware, we need to decrement the service index and perform a MAC destination rewrite so that packet is accepted by firewall. Python module to control OVS switches com/openvswitch/ovs/tree/master/python page=utilities%2fovs-ofctl.8 Remember: Turn on ip_forwarding

10 OVS-OFCTL Command Reference sudo ovs-ofctl add-flow br2 "table=0 priority=300 tun_id=0x actions=resubmit(,1)" sudo ovs-ofctl add-flow br2 "table=0 priority=200 in_port=local actions=set_tunnel:0x444444,set_nsp:0x555555, set_nsi:0x66,resubmit(,3)" sudo ovs-ofctl add-flow br2 "table=0 priority=100 actions=,resubmit(,3)" sudo ovs-ofctl add-flow br2 "table=1 priority=200 nsp=0x actions=resubmit(,2)" sudo ovs-ofctl add-flow br2 "table=1 priority=100 actions=,resubmit(,3)" sudo ovs-ofctl add-flow br2 "table=2 priority=200 nsi=0x33 actions=resubmit(,3)" sudo ovs-ofctl add-flow br2 "table=2 priority=100 actions=resubmit(,3)" sudo ovs-ofctl add-flow br2 "table=3 priority=200 in_port=local actions=mod_nw_dst: ,resubmit(,4)" sudo ovs-ofctl add-flow br2 "table=3 priority=100 actions=resubmit(,4)" sudo ovs-ofctl add-flow br2 "table=4 priority=100 actions=normal"