Open Networking Opens Opportunities

Transcription

1 WHITEPAPER Open Networking Opens Opportunities A Reference Architecture for Transition

2 ABSTRACT Open networking is an emerging technology that uncouples hardware from software in the network and creates broad new opportunities. This basic change in network design answers the long-standing need of cloud and network architects to move workloads and reconfigure the network effortlessly and independent of vendor elements. A fully integrated open networking solution is essential for crystallizing the value SDN delivers, and Pica8 is presently the only provider of a turnkey open networking solution. This white paper will describe open networking and then define an open architecture with three use cases. INTRODUCTION Networks are undergoing fundamental change as cloud providers and large data centers address the need to move workloads from one location to another rapidly and often. When workloads shift across servers, virtual servers and virtual networks, networks must reconfigure frequently and on the fly. To meet this requirement for unprecedented network agility, network infrastructures will continue to evolve from being hardware-bound to being software-led. The idea may sound radical, especially to those who remember the origins of the current network model as founded on the logical progression from the mainframe to the PC. At the time, tightly coupling hardware and software was a welcome advance. However, that network model greatly inhibits the easy change and customization that cloud providers and large data centers now demand. Frankly, any contemporary network that relies heavily on virtual technology now requires this new degree of flexibility and personalization. Today s networks must be, by nature, technological chameleons. SECTION ONE OPEN NETWORKING Defining Open Networking Open networking offers a common framework for people to open up their switching and routing devices in order to create a more tunable network that is controllable from external devices. It changes the essentials of network design by abstracting or decoupling the data/forwarding plane from the control plane. In essence, control over how data traffic is forwarded to its destination is separated from the switching hardware. Open networking is not happening in a vacuum: storage has already made the leap, and over the last decade, servers and applications have followed suit. Last to see the vision, the network s transformation toward openness is now driven by cloud s need for agile networking, something the traditional closed model sorely lacks. This advanced method for network control opens up all types of new possibilities for speed, flexibility, customization, scalability, high availability, accessibility and interoperability. Open networking or software-led infrastructure or software-defined networking (SDN) gives network administrators and others the ability to control the network in real time using external protocols and controlling devices that are independent from the vendors who supplied the network components. 1 WHITEPAPER

3 The Three Elements of Open Networking The three essential components of open networking are an open physical switch, an open vswitch to manage the VMs, and an open controller to orchestrate all the pieces. Figure 1 shows the three components of open networking relative to the network architecture. The control plane functions are separated from the physical switch and performed by an external controller whose server platform can be significantly faster than the control panel hardware found in many routers. SDN ARCHITECTURE APPLICATION LAYER CONTROL LAYER INFRASTRUCTURE LAYER (e.g. OpenStack, CloudStack) Cloud Orchestration Network Device Business Application Programmable Open APIs SDN Controller Network Device SDN Applications Control & Data Plane Programmable Interface (e.g. OpenFlow) Network Device Figure 1. The three components of open networking running on a common protocol decouple the data/forwarding plane from the control plane. All three of these elements currently run on a common protocol called OpenFlow that is achieving wide adoption because it gives everyone a common signaling/control plane tool. OpenFlow is the trigger or common language for making changes or controlling networks. The Open Networking Foundation (ONF) is leading the way for OpenFlow by promoting its value and fostering its adoption. Major players from the industry participating are giving their support, including Deutsche Telecom, Facebook, Google, Microsoft, Verizon and Yahoo! Open Networking Fosters New Opportunities The primary benefits from deploying open networking and using the OpenFlow protocol are a more dynamic, flexible, and controllable network architecture. But the payback of the technology includes many more enabling capabilities that afford new and inventive opportunities. In cloud environments, for example, resources can now be allocated in a highly elastic manner, enabling rapid provisioning and scaling both up and down at will. New network services can be delivered without configuring individual devices or depending on the device or having to create new functionality. The entire ecosystem can program network infrastructure, fostering innovation from industry participants beyond the equipment vendors. The benefits of centralized network management and improved automation through common APIs apply to both cloud providers and virtually any contemporary IT installation. The ability to utilize a wide variety of policies at the session, user, device and application levels opens up new opportunities for creativity and invention never before possible. In the data center, open networking eliminates the network s role as a bottleneck by delivering scalability and agility in a pioneering top-of-rack solution. Along with improvement in server utilization in the data center, open networking also helps to optimize bandwidth usage and to provide tighter integration with storage. Open Networking Opens Opportunities A Reference Architecture for Transition 2

4 The Money Motive for Open Networking The CapEx and OpEx savings from open networking will develop over time, but initially the realized increased flexibility and personalization has enabled early adopters to innovate and gain an early competitive edge. Signs that open networking will move quickly from an emerging technology to an established protocol are already in evidence, according to industry analysts. An International Strategy & Investment Group (ISI) report in August 2012 projects the market for SDN-related technologies could reach ~$3 bil over the next five years. ISI estimates that open networking can improve resource utilization in a datacenter by 20%: e.g., 10 racks in the data center goes to 8 racks with SDN. Moreover, ISI projects that by offering greater programmability and automation, open networking can completely eliminate most troubleshooting service requests for companies moving from a traditional data center to a private cloud, resulting in significant, even dramatic, cost savings. The Need for a Fully Integrated Open Networking Solution The promise of open networking requires a fully integrated solution to achieve its potential. Currently, technology incumbents, such as Cisco, IBM and HP, have announced solutions but none has offered a solution that delivers all three components running on a common protocol. Only one company, Pica8, has packaged open networking into a complete stack for fully integrated OpenFlow-driven SDN. Pica8 is bringing open networking to customers as an out-of-the-box turnkey solution. SECTION TWO OPEN SDN REFERENCE ARCHITECTURE Out-of-the-Box Turnkey Solution Cobbling together open networking pieces from separate vendors would expend large resources of time and manpower to get an SDN use case up and running. Integration of the self-contained, all-tuned open networking solution into your network is not necessary. Instead, simply place it on the top of the rack and start. In short, Pica8 gives you a turnkey open networking fabric tool in a complete stack that will integrate seamlessly into your existing network infrastructure. Pica8 s open switches are loaded with PicOS, its own purpose-built OS that runs in a highperformance L2/L3 protocol stack that has industry-leading OpenFlow 1.4 integration. Pica8 leverages Nicira s Open-vSwitch (OVS) v1.9 ( as the OpenFlow interface within PicOS. OVS runs as a process within PicOS, and is interoperable with any OpenFlow device, including leading OpenFlow controllers such as Ryu, Floodlight, and NOX. Starter Kits ship with Ryu ( as the primary controller. We collaborate closely with both the Open vswitch (OVS) and Ryu open-source projects. Pica8 has assembled these open networking components into a single stack that is ready for immediate implementation. Laying the Foundation for Software-Defined Data Centers Open networking ensures that your applications get the infrastructure characteristics they need for optimal performance. Its external programmability leverages the distributed intelligence of network devices, leading to meaningful control over application flows, and ultimate application performance. Pica8 has the building blocks of your software-defined data center available and production-ready. Leveraging the Starter Kit open SDN stack, using Ryu, the OpenFlow interface enables external programmability and these foundation-laying use cases: 3 WHITEPAPER

5 Traffic engineering: OpenFlow 1.4 statistics analyze utilization to help determine the best path for application flows GRE tunneling: Connect logical domains without disrupting the overall network fabric and isolating sensitive traffic Network Taps: OpenFlow 1.4 can both dynamically program a network TAP and adjust its characteristics, thereby greatly reducing CAPEX With these new capabilities, network and cloud architects can better understand how to best deploy SDN solutions and control individual flows. OpenFlow 1.4 supports statistics that give you visibility into application performance. Now the best path can be externally programmed into the physical network based on real-time information and this concept can be extended to manage WAN transit costs between data centers. APPLICATION LAYER Network TAP Tunneling Application Application CONTROLLER LAYER Redundant Controllers DATA PLANE LAYER Pica8 Open Switch With OVS Integration vswitch vswitch vswitch vswitch vswitch vswitch Hypervisor Switch Figure 2. Software-Defined Network Taxonomy Open Networking Opens Opportunities A Reference Architecture for Transition 4

6 Use Cases: Traffic Engineering Traffic engineering is a method of optimizing network performance by dynamically analyzing, predicting and regulating the behavior of data transmitted over the network. Software defined networking (SDN) delivers the ability to externally program network devices in real time, through emerging standards like OpenFlow. For latency-sensitive applications, such as a Hadoop cluster, traffic engineering increases cluster performance by dynamically programming the fast path for that application s traffic flows to traverse. For complete configuration details for PicOS 2.0, please visit our support site: Configuring MPLS for Traffic Engineering PICOS OVS supports MPLS, which is specified in OpenFlow 1.2. The basic action of the MPLS is push, swap and pop. User can add flow to modify and copy the MPLS TTL and IP TTL In current version, user can push at most 2 MPLS label for a flow User should note that each non-tagged will be tagged with the default VLAN-ID before push, pop and swap (1) Push a MPLS Header for Flows In following configuration, user specifies a flow, which should match { in_port=1,dl_ type=0x0800, dl_src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1}, the action is push a MPLS header whose label is 10 and forward to port te-1/1/2 Mark: The MPLS TTL will copy from the IP header and decrease ovs-ofctl add-flow br0 in_port=1,dl_type=0x0800,dl_ src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,actions=push_mpls:0x8847,set_field:10- \>mpls_label,output:2 (2) Push Two MPLS Headers for Flows In following configuration, user specifies a flow, which should match { in_port=1,dl_ type=0x0800, dl_src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1}, the action is push two MPLS header whose label is 10 and 20 and forward to port te-1/1/2 ovs-ofctl add-flow br0 in_port=1,dl_type=0x0800,dl_ src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,actions= push_mpls:0x8847,set_field:10- \>mpls_label, set_field:20-\>mpls_label,output:2 5 WHITEPAPER

7 (3) Swap the MPLS Packet In following configuration, user specifies a flow, which should match { in_port=1,dl_ type=0x0800, dl_src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,mpls_ label=10}, the action is swap and set the Label as 20, then forward to port te-1/1/2 ovs-ofctl add-flow br0 in_port=1,dl_type=0x8847,dl_ src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,dl_type=0x8847,mpls_label=10, actions= set_field:20-\>mpls_label,output:2 (4) Pop a MPLS Header for Flows In following configuration, user specifies a flow, which should match { in_port=1,dl_ type=0x0800, dl_src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,mpls_ label=10}, the action is pop the MPLS header and forward to port te-1/1/2 Mark: The MPLS TTL will be copied to IP header TTL and decrease. ovs-ofctl add-flow br0 in_port=1,dl_type=0x8847,dl_ src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,mpls_label=10,actions=pop_ mpls:0x8847,output:2 (5) Pop a MPLS Header for Flows that have Two MPLS Headers In the following configuration, users specifies a flow that has two MPLS headers (10 and 20). The pop action is always popping the outer MPLS header. Mark: User should remember, two label flow is popped only one label, the output packet is also a MPLS packet. Thus, the pop_mpls:0x8847 must be configured. ovs-ofctl add-flow br0 in_port=1,dl_type=0x8847,dl_ src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,mpls_label=10,actions=pop_ mpls:0x8847,output:2 (6) Pop two MPLS Headers for Flows that have Two MPLS Headers In following configuration, users specifies a flow which has two labels to pop. The output flow is IP packet. User should configure two pop entries to pop the flow. ovs-ofctl add-flow br0 in_port=1,dl_type=0x8847,dl_ src=22:11:11:11:11:11,dl_dst=22:00:00:00:00:00,dl_vlan=1,actions=pop_mpls:0x0800,output:2 Configure One Label MPLS Network In following topology, we configure a simple MPLS network. Traffic (Red) from host-a to host-b will forward by MPLS network with Label 10. The traffic (Blue) from host-c to host-d will forward by MPLS network with Label 20. All the flow will only push ONE MPLS header. Open Networking Opens Opportunities A Reference Architecture for Transition 6

8 Host C Source Host D Destination /24 Switch B /24 te-1/1/ /24 te-1/1/3 te-1/1/1 te-1/1/2 te-1/1/3 te-1/1/ /24 Switch A Switch D te-1/1/ /24 te-1/1/4 te-1/1/1 te-1/1/2 te-1/1/4 te-1/1/ /24 Switch C / /24 MPLS Network Host A Source Host B Destination Figure 3. MPLS Network Configuration (1) Configure Switch-A In switch-a, you need to configure two flow that will push the MPLS Label 10 and 20 for traffic RED and BLUE respectively. ovs-vsctl --db=tcp: :6633 add-br br0 -- set bridge br0 datapath_type=pica8 device br0 entered promiscuous mode ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/1 vlan_ -- set Interface te-1/1/1 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/2 vlan_ -- set Interface te-1/1/2 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/3 vlan_ -- set Interface te-1/1/3 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/4 vlan_ -- set Interface te-1/1/4 type=pica8 ovs-ofctl add-flow br0 in_port=1,dl_type=0x0800,nw_ src= , nw_dst= ,dl_vlan=1,actions= push_mpls:0x8847,set_field:10-\>mpls_label,output:4 7 WHITEPAPER

9 ovs-ofctl add-flow br0 in_port=2,dl_type=0x0800,nw_ src= ,nw _dst= ,dl_vlan=1,actions=push_mpls:0x8847, set_field:20-\>mpls_ label,output:3 The received packet format in port te-1/1/1 and te-1/1/2 is shown as following (ingress): Ethernet IP Header The transmitted packet format to port te-1/1/3 and te-1/1/4 is shown as following (egress): Ethernet MPLS lable 10 IP Header Ethernet MPLS lable 20 IP Header (2) Configure Switch-B In switch-b, you need to configure one flow that will SWAP the MPLS Label 20 to 200 for traffic BLUE. ovs-vsctl --db=tcp: :6633 add-br br0 -- set bridge br0 datapath_type=pica8 device br0 entered promiscuous mode ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/1 vlan_ -- set Interface te-1/1/1 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/2 vlan_ -- set Interface te-1/1/2 type=pica8 ovs-ofctl add-flow br0 in_port=1,dl_type=0x08847,nw_ src= ,nw _dst= ,dl_vlan=1,mpls_label=20,actions= set_ field:200-\>mpls_label,output:2 The transmitted packet format to port te-1/1/2 is shown as following (egress): Ethernet MPLS lable 200 IP Header (3) Configure Switch-C In switch-c, you need to configure one flow that will SWAP the MPLS Label 10 to 100 for traffic RED. ovs-vsctl --db=tcp: :6633 add-br br0 -- set bridge br0 datapath_type=pica8 device br0 entered promiscuous mode ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/1 vlan_ -- set Interface te-1/1/1 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/2 vlan_ -- set Interface te-1/1/2 type=pica8 Open Networking Opens Opportunities A Reference Architecture for Transition 8

10 ovs-ofctl add-flow br0 in_port=1,dl_type=0x08847,nw_ src= ,nw _dst= ,dl_vlan=1,mpls_label=10,actions= set_ field:100-\>mpls_label,output:2 The transmitted packet format to port te-1/1/2 is shown as following (egress): Ethernet MPLS lable 100 IP Header (4) Configure Switch-D In switch-d, you need to configure two flow that will POP the MPLS Label 100 and 200 for traffic RED and BLUE, respectively. ovs-vsctl --db=tcp: :6633 add-br br0 -- set bridge br0 datapath_type=pica8 device br0 entered promiscuous mode ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/1 vlan_ -- set Interface te-1/1/1 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/2 vlan_ -- set Interface te-1/1/2 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/3 vlan_ -- set Interface te-1/1/3 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 te-1/1/4 vlan_ -- set Interface te-1/1/4 type=pica8 ovs-ofctl add-flow br0 in_port=4,dl_type=0x08847,nw_ src= ,nw _dst= ,dl_vlan=1,actions=pop_mpls:0x8847,output:1 ovs-ofctl add-flow br0 in_port=3,dl_type=0x08847,nw_ src= ,nw _dst= ,dl_vlan=1,actions=pop_mpls:0x8847,output:2 The transmitted packet format to port te-1/1/1 and te-1/1/2 is shown as following (egress): Ethernet IP Header 9 WHITEPAPER

11 Use Cases: Tunneling Generic Routing Encapsulation (GRE) is a tunneling protocol that encapsulates a wide variety of network layer protocols inside virtual point-to-point links over IP. You can transport multicast traffic and IPv6 through a GRE tunnel, for example. More recently, the idea of using SDN to help orchestrate the movement of virtual machines (VM) provides protection and dedicated paths for a specific VM domain. OpenFlow 1.4-based tunnels can be externally programmed into the physical network to connect logical domains and protect the traffic traversing between them. For complete configuration details for PicOS 2.0, please visit our support site: Configure GRE Tunnel Example In following topology, we need to configure a GRE tunnel between switch A and B. The IP address of the GRE tunnel is /24 and /24. GRE / /24 ge-1/1/1 ge-1/1/5 ge-1/1/5 ge-1/1/1 Host A Switch A Switch B Host B Figure 4. GRE tunnel configuration (1) Configure Switch-A In switch-a, you need to configure a GRE tunnel and two flows as following: ovs-vsctl --db=tcp: :6633 add-br br0 -- set bridge br0 datapath_type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 ge-1/1/1 vlan_ mode=trunk tag=1 -- set Interface ge-1/1/1 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 ge-1/1/5 vlan_ mode=trunk tag=1 -- set Interface ge-1/1/5 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 gre1 -- set Interface gre1 type=pica8_gre options:remote_ip= options:local_ ip= options:vlan=1 options:src_mac=00:11:11:11:11:11 options:dst_ mac=00:22:22:22:22:22 options:egress_port=ge-1/1/5 ovs-ofctl add-flow br0 in_port=1,actions=output:91 ovs-ofctl add-flow br0 in_port=5,actions=mod_dl_ src:00:11:11:11:11:11,mod_dl_dst:00:33:33:33:33:33,output:1 Open Networking Opens Opportunities A Reference Architecture for Transition 10

12 (2) Configure Switch-B In switch-a, you also need to configure a GRE tunnel and two flows as following: ovs-vsctl --db=tcp: :6633 add-br br0 -- set bridge br0 datapath_type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 ge-1/1/1 vlan_ mode=trunk tag=1 -- set Interface ge-1/1/1 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 ge-1/1/5 vlan_ mode=trunk tag=1 -- set Interface ge-1/1/5 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 gre1 -- set Interface gre1 type=pica8_gre options:remote_ip= options:local_ ip= options:vlan=1 options:src_mac=00:22:22:22:22:22 options:dst_ mac=00:11:11:11:11:11 options:egress_port=ge-1/1/5 ovs-ofctl add-flow br0 in_port=1,actions=output:91 ovs-ofctl add-flow br0 in_port=5,actions=mod_dl_ src:00:22:22:22:22:22,mod_dl_dst:00:66:66:66:66:66,output:1 Use Cases: Dynamic Network Taps Traditionally, a network tap is a purpose-built hardware device that provides a way to access the data flowing across an IP network. Network taps are commonly used for network intrusion detection systems, VoIP recording, network probes, RMON probes, packet sniffers and other monitoring and collection devices. OpenFlow 1.4 provides the means to externally program network tap-like functionality into any OpenFlow-compliant physical switch. This SDN-driven capability reduces CapEx by dynamically adjusting the tap s characteristics, thereby increasing flexibility and avoiding dedicated devices. For complete configuration details for PicOS 2.0, please visit our support site: Configuring Network Taps For the Network Tap application, users can configure the OpenFlow switch to direct port-level traffic, duplicate traffic, mirror and aggregate traffic to a smart network trap for traffic analysis and storage. Below we provide examples for creating a bridge, multicasting and mirroring configuration for a Tap application. (1) Create Bridge and Add Port ovs-vsctl --db=tcp: :6633 add-br br0 -- set bridge br0 datapath_ type=pica8 other-config=datapath-id=000060eb69d29cde ovs-vsctl --db=tcp: :6633 add-port br0 ge-1/1/1 -- set interface ge-1/1/1 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 ge-1/1/2 -- set interface ge-1/1/2 type=pica8 ovs-vsctl --db=tcp: :6633 add-port br0 ge-1/1/3 -- set interface ge-1/1/3 type=pica8 11 WHITEPAPER

13 (2) Create Multicasting Traffic to Duplicate Traffic For port-based multicasting, we can use: ovs-ofctl add-flow br0 in_port=1,actions=output:2,3 For forwarding specific traffic based on IP header, we can use: ovs-ofctl add-flow br0 in_port=1,tcp,nw_src= ,actions=output:2,3 (3) Create Mirror Port to Monitor Traffic To mirror bi-directional traffic between port 1 & 2 then mirrored it to port 3, we can use: ovs-vsctl --db=tcp: : set bridge br0 mirrors=@m -- --id=@ ge-1/1/1 get Port ge-1/1/ id=@ge-1/1/2 get Port ge-1/1/ id=@ ge-1/1/3 get Port ge-1/1/ id=@m create Mirror name=mymirror select-dstport=@ge-1/1/1,@ge-1/1/2 select-src-port=@ge-1/1/1,@ge-1/1/2 output-port=@ ge-1/1/3 (4) Create Aggregated Traffic For port-based aggregation, we can use: ovs-ofctl add-flow br0 in_port=1,actions=output:3 ovs-ofctl add-flow br0 in_port=2,,actions=output:3 For flow based aggregation: ovs-ofctl add-flow br0 in_port=1,nw_src= ,nw_dst= ,ac tions=output:3 ovs-ofctl add-flow br0 in_port=2,nw_src= ,nw_dst= ,ac tions=output:3 Open Networking Opens Opportunities A Reference Architecture for Transition 12

14 Pica8, Inc. Corporate Headquarters 1032 Elwell Court, Suite 105 Palo Alto, California USA Pica8, Inc., All rights reserved. Produced in the United States 4/14. Pica8 and PicOS are trademarks of Pica8, Inc. Pica8 and PicOS trademarks are intended and authorized for use only in countries and jurisdictions in which Pica8, Inc. has obtained the rights to use, market and advertise the brand. Pica8, Inc. shall not be liable to third parties for unauthorized use of this document or unauthorized use of its trademarks. References in this publication to Pica8, Inc. products or services do not imply that Pica8, Inc. intends to make these available in all countries in which it operates. Contact Pica8, Inc. for additional information.