Reti di Accesso e di Trasporto (Reti di Accesso) Stefano Salsano AA2008/09 Blocco 8 (v2)

Transcription

1 Reti di Accesso e di Trasporto (Reti di Accesso) Stefano Salsano stefano.salsano@uniroma2.it AA2008/09 Blocco 8 (v2) Virtual LANs

2 Broadcast issues Switches: - did partition collision domains - bud DID not partition broadcast domain The obvious solution: : IP subnets Partition network into several subnets Critical approach (especially in the past): routers were slow Need to replace switches with routers No more a problem of efficiency, today layer 3 switches = hardware-based routers, very fast! However

3 Cons of physical IP subnets Floor 2 LAB 1 (telecom) LAB 2 (nanotech) OFFICES One switch per lab! Even if all switches in a same floor box, manual connection necessary Different LAB rooms = different subnets! Broadcast domain cannot extend through routers more complex management needed Floor 1 LAB 2 (telecom) Physical Network Design vs Logical Network Design Standard design for physical network Well before network partitioning needs emerge from customers of the building! Armadio di piano Armadio di piano Cablaggio orizzontale in rame Prese RJ45 Stanza Stanza Stanza Canalina metallica forata Canalina in PVC Prese RJ45 Stanza Stanza Stanza Tubo in PVC Cablaggio verticale in Fibra Ottica Canalina metallica - Cablaggio verticale di backup in rame

4 Solution: Virtual LAN (VLAN) VLAN = area which limits the broadcast domain Benefits Broadcast confinement solves scalability issues of large flat networks Isolation of failures and network impairments Security (more later) Multiple VLANs may coexist over a same Switched LAN VLAN Membership Per Port THE typical VLAN approach The IEEE 802.1Q approach Per User Via MAC address Via VLAN tag Results: anarchic VLAN but too easy to break into Per Protocol New feature in IEEE 802.1v Combination (cross-layer) Supported as proprietary extensions Via IP subnet address. Classification hierarchy may be defined E.g. per IP subnet; if not IP per protocol; if not in the set of classified protocols per MAC; if not in MAC list per port.

5 Physical vs logical view (i.e. why VLANS instead of IP network) Layer 3 subnets ought to be physically separated BUT many VLANs may overlap on the same, unique physical network structure! Robust, failureproof, single managed VLANs and IP subnets /1 1 VLAN = 1 IP subnet Routers are needed to move frames from different VLANs Even if STAs are in the same physical network Inter-VLAN connectivity through router: improves security May apply packet filtering mechanisms such as ACL, etc

6 VLANs and IP subnets / / /24 Routers for VLAN interconnection may have as little as just one physical interface Also called, in jargon, one-armed routers Multiple IP addresses on the single interface VLAN tagging

7 Port types TRUNK port: transmits and receives tagged frames i.e. with explicit VLAN membership indication ACCESS port: transmits and receives untagged frames i.e. with no VLAN membership indication HYBRID ports: may handle both tagged and untagged frames Access links A link connected to an access port Typically the PC-to-switch link or small-hub-to-switch link Access port Connected STAs belong to only 1 VLAN Connected STAs DO NOT NEED TO KNOW they are on a VLAN They just assume to be on a dedicated IP subnet TX/RX frames: standard Ethernet (no QTAG prefix) S1 S2 S3 HUB

8 Access links (legacy regions) May be switched LANs themselves Made up by VLAN-unaware switches VLAN-aware switch Access port VLAN-unaware switch VLAN-unaware switch S3 S1 S2 Trunk links A link connected to a trunk port Typically switch-to-switch or switch-to-router links frequently server-to-switch link If PC-to-switch link: Anarchic VLANs considered Trunk port Support tagged Ethernet frames Explicit tagging mechanism to differentiate them Does not belong to a VLAN but transport VLAN frames Either from all VLANs Or just from selected VLANs However, may belong to a VLAN Case of hybrid link Untagged frames assumed to belong to a VLAN

9 Hybrid links Support both tagged and untagged Ethernet frames Untagged frames belong to the same VLAN (in the example, VLAN C) Modern understanding and implementations: all links are of hybrid type Ethernet Frame format for VLAN (802.3ac, 1998) QTag type = 0x8100 QTag prefix = 4 bytes Maximum frame: 1522 (!!) > 1518 = baby giant

10 User Priority (802.1p) BE BK --- EE CL VI VO NC Best Effort (default) Background Unspecified Excellent Effort Controlled Load Video < 100ms latency/jitter Voice < 10 ms latecny/jitter Network Control Managed via separated output queues - typically with priority queueing - but more complex scheduling mechanisms can be used May a station belong to more than 1 VLAN? Access links Access links Trunk link Yes! (typical case: servers)

11 Switch operation with VLANs VLAN and forwarding Green Blue, Green Trunk ports may forward only selected VLAN tags Manual (static) configuration Red, Green Automatic (dynamic) configuration via specially devised protocols (GVRP: GARP VLAN Registration Protocol) GARP = Generic Attribute Registr. Prot. See clause 10, 802.1D 1998 version No spanning tree considerations at the moment

12 VLAN switch: relay functions Ingress function Classification of each received frame as belonging to one and only one VLAN Based on tag Based on port (e.g.) for untagged frames Discard frame based on normal bridging rules PLUS VLAN classification E.g. unallowed VLAN tag from port Ingress function = Access control using switches rather than routers! Forward function Only on specific enabled ports for given VLAN Egress function Add tag (or leave previous tag) if trunk link; Remove tag if access link Learning Learning process affected by VLAN MAC address is no more the only information to consider! VLAN Identifier is also necessary Shared VLAN Learning (SVL) 1 single filtering DB if individual MAC Address learned in one VLAN, learned information used in forwarding decisions relative to all other VLANs Independent VLAN Learning (IVL) 1 filtering DB per each VLAN ID if individual MAC Address learned in one VLAN, learned information NOT used in forwarding decisions relative to all other VLANs General case (SVL/IVL) Many filtering DBs (each with a Filtering ID FID) Each FID may include more than 1 VLAN

13 Filtering DB Shared VLAN Learning (SVL) Dest MAC Address Ports Age vlan aa-01 1/ b0-8d-13-1a-f1 1/ a b-b4 2/ a7-64 2/ ff / Filtering DB Independent VLAN Learning (IVL) FID=12 Dest MAC Address Ports Age aa-01 1/1 1 a b-b4 2/ ff /6 5 FID=43 Dest MAC Address Ports Age b0-8d-13-1a-f1 1/7 4 FID=1 Dest MAC Address Ports Age a7-64 2/4 1 Distinct Filtering DBs (each assigned a Filtering ID)

14 Filtering DB Independent VLAN Learning (IVL) In most cases, no matter wthere IVL or SVL is used However, in some particolar cases, IVL or SVL are necessary Notation used in what follows: Member set Set of ports through which members of the VLAN can be reached Untagged set Set of ports through which, if frames are to be transmitted, they shall be transmitted without tag» Untagged set for a port may include multi VLANs (see SVL example next) PVID (Port VLAN ID) VLAN associated to the port See 802.1Q-2003, Annex B (pag ) for detailed explanation of following examples Nella larga maggioranza dei casi, utilizzare il meccanismo IVL o quello SVL è equivalente. Vi sono casi particolari in cui questo non è vero e bisogna utilizzare uno dei due meccanismi. Nel primo esempio ( Why IVL? ) si considera l utilizzo di dispositivi ibridi detti Connector che operano in modalità intermedia tra livello 2 e 3. In pratica effettuano l inoltro di una trama da una VLAN all altra. Nel secondo esempio ( Why SVL? ) si mostra come è possibile far lavorare un server legacy (cioè che non sia progettato per operare sulle VLAN ma su una LAN tradizionale) in modo da interoperare contemporaneamente con dispositivi su diverse VLAN.

15 Why IVL? /1 Note: is a bridge device! Were it a router, no problems! SVL would not work!! (A learned from both port 1 and 4) (no STP in the example ) Why IVL? /2 SVL would not work!! (A learned from both port 1 and 3) (STP enabled, VLAN-aware connector)

16 Why SVL? VLAN unaware server to be shared among VLANs Must use untagged access link Asymmetric VLANs! Metro Ethernet services for the enterprise Mark Fishburn MEF, Chairman of the Board

17 MEF (Metro Ethernet Forum) priorities and scope MEF Mission: Accelerate adoption of optical Ethernet as the technology of choice in metro networks worldwide The primary priorities of the MEF are to define: a. Ethernet Services for metro transport networks Such services shall be delivered over native Ethernet-based Metro networks and can also be supported by other transport technologies. b. Carrier-class Ethernet-based metro transport technologies by specifying architecture, protocols and management for Ethernet-based metro transport networks Market Objective: Deployment of robust, lower cost, industry standard services that seamlessly enable enterprise applications MEF objectives Ethernet as carrier-class transport technology Services Definition E-Line and E-LAN Protection, QoS, OAM, UNI, NNI New Opex and Capex quantified business cases

18 Carrier Ethernet Overview presented at In The Beginning Metcalfe created Ethernet and he saw it was good! 1976 Metcalfe & Boggs 1980 DEC, Intel, Xerox "blue book" Mbps IEEE Fast Ethernet Gigabit Ethernet over Copper Gigabit Ethernet Copper LAN 1985 IEEE Ethernet 10 Mbps Gigabit Ethernet over Fiber Gigabit Ethernet LAN 1970s 1980s 1990s 2000s Management, Higher bandwidth, wireless First Products Mbps 10Mbps 100Mbps 1Gbps 10Gbps Expansion from LAN to MAN Adoption of Ethernet datagram by other technologies

19 Global Expansion from Metro to Carrier Ethernet The Beginning: Metro Ethernet The MEF was formed in 2001 to develop ubiquitous business services for Enterprise users principally accessed over optical metropolitan networks to connect their Enterprise LANs Expansion to Carrier Ethernet The success of Metro Ethernet Services caught the imagination of the world as the concept expanded to include Worldwide services traversing national and global networks Access networks to provide availability to a much wider class of user over fiber, copper, cable, PON, and wireless Economy of scale from the resulting converged business, residential and wireless networks sharing the same infrastructure and services Scalability & rapid deployment of business applications Adoption of the certification program While retaining the cost model and simplicity of Ethernet Carrier Ethernet is a Service Carrier Ethernet Defined Carrier Ethernet Carrier Ethernet is a ubiquitous, standardized, carrier-class SERVICE defined by five attributes that distinguish Carrier Ethernet from familiar LAN based Ethernet It brings the compelling business benefit of the Ethernet cost model to achieve significant savings Standardized Services Carrier Ethernet Attributes Scalability Service Management Reliability Quality of Service

20 Carrier Ethernet Scope Bringing vastly extended scalability for business and residential users Internet Video Source HD TV TVoD, VoD Video Source Gaming, Business Backup, ERP Voice/Video Voice Telephony gateway Wireless Backhaul Global/National Carrier Ethernet Metro Carrier Ethernet Broadband mobile data/video Business Broadband E-Line and E-LAN service Access Carrier Ethernet Residential Triple-Play Small/Medium Business FTTx, DSLAM, Cable Modem, Meshed WiFi