Josef Ungerman, CCIE #6167. Openflow

Transcription

1 Josef Ungerman, CCIE #6167 Openflow

2 Stanford Clean Slate led to the development of

3 What is Openflow? (per Wikipedia definicon) OpenFlow is a communicacons protocol that gives access to the forwarding plane of a network switch or router over the network

4 Four parts to Openflow

5 Openflow Controller Central Administra.on and Opera.ons point for Network Elements

6 Northbound API Integral part of Controller Network enabled applica.on can make use of Northbound API to request services from the network Openflow Controller Northbound API

7 Agent runs on the network device Agent receives instruc.ons from Controller Agent programs device tables Openflow Device Agent

8 Openflow Protocol is A mechanism for the Openflow Controller to communicate with Openflow Agents Openflow Protocol

9 Examples of Openflow Open Source Controllers Openflow Agents Open Source eg. Indigo hdp:// +Open+Source+OpenFlow+Switches Vendor Specific eg. Cisco OnePK OF 1.3 agent (IOS, IOS- XE, IOS- XR, NX- OS)

10 Important lesson for today

11 Openflow does not equal SDN Openflow So\ware Defined Networking Openflow is one flavor of SDN

12 Openflow Protocol in more detail

13 Openflow Protocol Versions

14 Openflow 1.0

15 Incoming packet arrive at Switch OPENFLOW CONTROLLER Openflow v1.0 Data Data Data Switch FLOW TABLE ** CPU SWITCH FORWARDING ENGINE **Openflow 1.0 supports a lookup into a single flow table Symmetric Sync Messages (Hello, Echo, Vendor)

16 Fields from packet header used for lookup key Header fields used to build lookup key Lookup Key Openflow v1.0 Data Data Data Switch FLOW TABLE ** CPU SWITCH FORWARDING ENGINE **Openflow 1.0 supports a lookup into a single flow table

17 If no match, Controller programs switch flow table OPENFLOW CONTROLLER Openflow v1.0 Data Data Data Switch FLOW TABLE SWITCH FORWARDING ENGINE CPU

18 Forwarding Engine forwards packets OPENFLOW CONTROLLER Openflow v1.0 Switch FLOW TABLE ** CPU SWITCH FORWARDING ENGINE **Openflow 1.0 supports a lookup into a single flow table Data Data

19 Flow Table in more detail FLOW TABLE HEADER FIELDS COUNTERS ACTIONS Openflow v1.0 Flow Entry consists of one row in the Flow Table FLOW ENTRY

20 Flow Table in more detail FLOW TABLE HEADER FIELDS COUNTERS ACTIONS Openflow v1.0 Ingress Port Source MAC Dest MAC Ether Type VLAN ID VLAN Priority IP SRC IP DEST IP Protocol HEADER FIELDS IP TOS TCP/UDP SRC (ICMP Type) This is the Famous Openflow 12 Tuple TCP/UDP DEST (ICMP Code)

21 Flow Table in more detail FLOW TABLE HEADER FIELDS COUNTERS ACTIONS Per Port Openflow v1.0 Per Table AcCve Entries Packet Lookups Packet Matches 32 Bits 64 Bits 64 Bits Per Flow Received Packets Received Bytes DuraCon (seconds) DuraCon (nanoseconds) 64 Bits 64 Bits 32 Bits 32 Bits Per Queue Transmit Packets Transmit Bytes TX Overrun Errors 64 Bits 64 Bits 64 Bits Received Packets Transmit Packets Received Bytes Transmit Bytes Received Drops Transmit Drops Received Errors Transmit Errors Received Frame Alignment Errors RX Overrun Errors RX CRC Errors Collisions 32 Bits 64 Bits 64 Bits 64 Bits 64 Bits 64 Bits 64 Bits 64 Bits 64 Bits 64 Bits 64 Bits 64 Bits

22 Flow Table in more detail FLOW TABLE HEADER FIELDS COUNTERS ACTIONS Openflow v1.0 MulCple AcCons available to be programmed Let us explore those in more detail

23 Required AcCons Supported by Openflow 1.0 Switch OPENFLOW CONTROLLER Openflow v1.0 Packet Switch FLOW TABLE 1 CPU SWITCH FORWARDING ENGINE Required AcCon #1 Forward out all ports except input port

24 Required AcCons Supported by Openflow 1.0 Switch OPENFLOW CONTROLLER Openflow v1.0 Packet Switch FLOW TABLE CPU SWITCH FORWARDING ENGINE 2 Required AcCon #2 Redirect to Openflow Controller In addicon, there are other asynchronous Switch- to- Controller messages like this: Port- Status (up/down, STP state,) Flow- Removed (idle, Cmeout) Error

25 Required AcCons Supported by Openflow 1.0 Switch OPENFLOW CONTROLLER Openflow v1.0 Packet Switch FLOW TABLE 3 CPU SWITCH FORWARDING ENGINE Required AcCon #3 Forward to local CPU

26 Required AcCons Supported by Openflow 1.0 Switch OPENFLOW CONTROLLER Openflow v1.0 Packet Switch FLOW TABLE 4 CPU SWITCH FORWARDING ENGINE Required AcCon #4 Perform accon in Flow Table ( inject operacon)

27 Required AcCons Supported by Openflow 1.0 Switch OPENFLOW CONTROLLER Openflow v1.0 Packet 5 Switch FLOW TABLE CPU SWITCH FORWARDING ENGINE Required AcCon #5 Forward to Input Port

28 Required AcCons Supported by Openflow 1.0 Switch OPENFLOW CONTROLLER Openflow v1.0 Packet Switch FLOW TABLE CPU SWITCH FORWARDING ENGINE Required AcCon #6 Forward to DesCnaCon Port 6

29 Required AcCons Supported by Openflow 1.0 Switch OPENFLOW CONTROLLER Openflow v1.0 Packet Switch FLOW TABLE CPU SWITCH FORWARDING ENGINE 7 Required AcCon #7 Drop Packet

30 Required AcCons Supported by Openflow 1.0 Switch Required AcCons OPENFLOW CONTROLLER 1 2 Forward out all ports except input port Redirect to Openflow Controller Openflow v1.0 5 Switch FLOW TABLE CPU SWITCH FORWARDING ENGINE Forward to local Forwarding Stack (CPU) Perform accon in flow table 5 Forward to input port 6 Forward to descnacon port 7 Drop Packet OpConal AcCons: Modify- Field (eg. VLAN translacon) Enqueue (QoS) Forward Normally (L2/L3)

31 Openflow 1.1

32 Provides addiconal methods for forwarding i.e. broadcast/ mulccast OPENFLOW CONTROLLER Openflow v1.1 Data Data Data Switch GROUP TABLE FLOW TABLE 1 FLOW TABLE 2 FLOW TABLE n SWITCH FORWARDING ENGINE Openflow 1.1 Switch consists of one of more flow tables and a group table CPU

33 Match Fields ingress port + metadata + pkt headers AcCon Set Flow Table Match Fields ingress port + metadata + pkt headers AcCon Set Openflow v1.1 Ingress packet AcCon Set = {} Table 0 packet + input port + metadata AcCon Set Table 1 Table n packet AcCon Set Execute AcCon Set Matching starts at Table 1 and may concnue to next table

34 Table 0 Openflow v1.1 Flow Entry 1 Flow Entry 2 Flow Entry 3 Flow Entry 4 Flow Entry 5 Flow Entry 6 Flow Entry 7 Flow Entry 8 Flow Entry 9 Table 1 Flow entries match in packet order First matching entry in table used Table n

35 Table 0 Openflow v1.1 Flow Entry 1 Flow Entry 2 Flow Entry 3 Flow Entry 4 Flow Entry 5 Flow Entry 6 Flow Entry 7 Flow Entry 8 Flow Entry 9 MATCH FIELD COUNTERS ACTIONS Packet Forwarding Packet ModificaCon Pipeline Processing Group Table Processing AcCons in Flow Table define packet processing opcons

36 Table 0 Openflow v1.1 Ingress Port Source MAC Flow Entry 1 Flow Entry 2 Flow Entry 3 Flow Entry 4 Dest MAC Ether Type VLAN ID VLAN Priority MPLS Label MATCH FIELD COUNTERS ACTIONS MPLS Traffic Class IP SRC IP DEST IP Protocol IP TOS TCP/UDP SRC ICMP Type MPLS and VLAN Q- in- Q now supported in version 1.1 TCP/UDP DEST ICMP Code

37 OPENFLOW ONLY SWITCH Data Data Openflow Processing Pipeline Openflow v1.1 Data Data OF or STD OPENFLOW HYBRID SWITCH Openflow Processing Pipeline STD Ethernet Processing Pipeline Openflow v1.1 defines two processing pipeline opcons OPENFLOW ONLY and OPENFLOW HYBRID O U T P U T

38 Openflow 1.2

39 IPv6 now supported for lookup in flow table FLOW TABLE HEADER FIELDS COUNTERS ACTIONS Openflow v1.2 Ingress Port Source MAC Dest MAC Ether Type VLAN ID VLAN Priority IP SRC IP DEST Both IPv4 and IPv6 flows supported in header field lookup MPLS Label MPLS Traffic Class IP Protocol IP TOS TCP/UDP SRC ICMP Type TCP/UDP DEST ICMP Code

40 Openflow 1.3

41 IPv6 Extended Headers supported in OF 1.3 IPv6 Standard Header IPv6 Extended Headers Data Openflow v1.3 Allows match on following condicons Hop by Hop IPv6 extension header Router IPv6 extension header FragmentaCon IPv6 extension header DesCnaCon OpCons IPv6 extension header AuthenCcaCon IPv6 extension header Encrypted Security IPv6 extension header No Next Header IPv6 extension header IPv6 extension headers out of preferred order Unexpected IPv6 extension header

42 Flow meter provides rate limi.ng (policing) OPENFLOW CONTROLLER Openflow v1.3 Data Data Data Switch GROUP TABLE FLOW TABLE 1 FLOW TABLE 2 FLOW METER TABLE FLOW TABLE n SWITCH FORWARDING ENGINE CPU Openflow 1.3 Switch now adds a flow meter table

43 Per Flow Meters supported in OF 1.3 METER TABLE Openflow v1.3 METER IDENTIFIER METER BAND COUNTERS TYPE RATE COUNTERS TYPE/ARGUMENTS Controls the rate/flow of packets in a flow

44 Auxiliary Connec.ons supported in OF 1.3 BEFORE AFTER O/F CONTROLLER O/F CONTROLLER Openflow v1.3 Single TCP ConnecCon O/F SWITCH O/F SWITCH Auxiliary conneccons over UDP and DTLS to carry packet in/out messages between controller and switch Auxiliary ConnecCons

45 Other Openflow v1.3 Highlights Openflow v1.3 Match on MPLS Bovom of Stack (BoS) Bit label stacking Provider Backbone Bridging (PBB) support Mac- in- Mac DuraCon field added for StaCsCcs ** Support for Tunnel encapsulacons (i.e. GRE ) Ability to disable packet/byte counters on a per flow basis ** Generic Route EncapsulaCon

46 Openflow 1.3.x

47 Version NegoCaCon TLV supported in OF 1.3 Openflow v1.3.1 OPENFLOW CONTROLLER Version NegoCaCon** built into flexible TLV format OPENFLOW SWITCH ** Previously negocacon might fail due to lack of all versions being known by both sides Version NegoCaCon now incorporated into * TLV used during switch/controller negocacon * Type Label Value

48 Openflow Protocol Summary Openflow v1.0 Openflow v1.1 Openflow v1.2 Openflow v1.3 IniCal Standard Most prevalent in the market today Added support for mulcple flow tables Added support for MPLS Defines two operacng modes Hybrid Pure Openflow Adds support for IPv6 Adds support for Rate LimiCng IPv6 extension headers GRE The version deemed produc.on ready Openflow v Adds NegoCaCon TLV s, bug fixes Openflow v1.4 Extensibility, bundles, tcp/6633!6653, improvements

49 Application Frameworks, Management Systems, Controllers,... OnePK C/Java Python NETCONF REST OpenFlow ACI Fabric OpenStack Puppet Protocols RESTful Management Puppet OrchestraCon Network Services Neutron Protocols BGP, PCEP,... Control OpFlex Forwarding Device OpenFlow YANG JSON/XML onepk Plug- Ins API (OnePK) and Data Models (YANG) OperaCng Systems IOS / NX- OS / IOS- XR

50 Example: OpenFlow vs. Hardware CapabiliCes Open Flow 1.3 Match Fields Support Open Flow 1.3 Match Fields Support Open Flow 1.3 Set AcRons Support Match Fields OXM_OF_IN_PORT L2 L3 L2 only L2+L3 V4 only IPv4 + IPv6 Dual Stack Supported by ASIC X version Y OXM_OF_IN_PHY_PORT Yes Yes Yes Yes OXM_OF_METADATA OXM_OF_ETH_DST Yes Yes OXM_OF_ETH_SRC Yes Yes Yes OXM_OF_ETH_ETYPE Yes Yes Yes OXM_OF_VLAN_VID Yes Yes Yes OXM_OF_VLAN_PCP Yes Yes Yes OXM_OF_IP_DSCP Yes Yes Yes OXM_OF_IP_ECN Yes Yes Yes OXM_OF_IP_PROTO OXM_OF_IPV4_SRC Yes Yes Yes OXM_OF_IPV4_DST Yes Yes Yes OXM_OF_TCP_SRC Yes Yes Yes OXM_OF_TCP_DST Yes Yes Yes OXM_OF_UDP_SRC Yes Yes Yes OXM_OF_UDP_DST Yes Yes Yes OXM_OF_SCTP_SRC Yes Yes Yes OXM_OF_SCTP_DST OXM_OF_ICMPV4_TYPE OXM_OF_ICMPV4_CODE Match Fields L2 L3 L2 only L2+L3 V4 only IPv4 + IPv6 Dual Stack Supported by ASIC X version Y OXM_OF_ARP_OP Yes Yes Yes Yes OXM_OF_ARP_SPA OXM_OF_ARP_TPA Yes Yes OXM_OF_ARP_SHA Yes Yes Yes OXM_OF_ARP_THA Yes Yes Yes OXM_OF_IPV6_SRC Yes Yes Yes OXM_OF_IPV6_DST Yes Yes Yes OXM_OF_IPV6_FLABEL Yes Yes Yes OXM_OF_ICMPV6_TYPE Yes Yes Yes OXM_OF_ICMPV6_CODE OXM_OF_IPV6_ND_TARGET Yes Yes Yes OXM_OF_IPV6_ND_SLL Yes Yes Yes OXM_OF_IPV6_ND_TLL Yes Yes Yes OXM_OF_MPLS_LABEL Yes Yes Yes OXM_OF_MPLS_TC Yes Yes Yes OXM_OF_MPLS_BOS Yes Yes Yes OXM_OF_MPLS_PBB_ISID Yes Yes Yes OXM_OF_TUNNEL_ID OXM_OF_IPV6_EXTHDR Output Set- Queue Drop Group Push- Tag/Pop- Tag Change- TTL AcRons Port OFPP_IN_PORT OFPP_NORMAL OFPP_FLOOD OFPP_ALL OFPP_CONTROLLER OFPP_LOCAL Push VLAN header Pop VLAN header Push MPLS header Pop MPLS header Push PBB header Pop PBB header Set MPLS TTL Decrement MPLS TTL Set IP TTL Decrement IP TTL Copy TTL outwards Copy TTL inwards

51 Openflow & Hardware

52 Example: Pipelining L3 switch ASIC Netflow TCAM L3 fwd police classify L2 fwd classify police map queue FE ASIC (Forwarding Engine) TCAMs Parallel TCAM lookups Star lookup (eg. EARL) Pipeline lookup (eg. K10) TCAM4: 250M lookups/sec. DRAM map statistics headers only TM ASIC (Traffic Manager) - 16K queues - SRR (1L shaping) SRAMs Livle or no flexibility Not possible to reprogram the ASIC to support OF logic (12- tuple, table chains, etc.) Can emulate some OF funccons, but can t be fully compliant Missing features can t be added Older/cheaper ASIC s may have no MPLS, no IPv6, sparse counters, simpliscc QoS Can SDN help to reuse old/cheap ASIC s?

53 Flexible lookup stages (table chaining) MulCple flow tables with full 12- tuple matching L2, L3, ACL, IPv4/IPv6 12- tuple match requires lot bigger (expensive, complex) TCAM ACL- like match (MAC or FIB is 1- tuple) Example: Catalyst 3850 (UADP ASIC) has 17K entry TCAM table capacity for OF (the MAC or FIB is 80K) Group table with full accon list support MulRcast, MulRpath forwarding, SPAN, Apply accons support using high speed recirculacon Tunneling, Metadata support Labels, Full per- flow stacsccs flexible stacsccs counters assignment Full meter table support Cisco extensions using programmable packet parsing, programmable rewrite, regular expression matching, stacc metadata for L1,L2,L3 configuracon, advanced QoS

54 Another important lesson: So\ware can t control what hardware can t deliver.

55 Cisco Network Processors are narvely OF 1.3 capable Complete Programmability (C- language) OpCmized fast lookup memories, stcam But higher power and cost than fixed ASIC s (full 12- tuple match would be prevy expensive) QFP (Quantum Flow Processor) Examples QFP 60Gbps (ASR1000) Typhoon 120Gbps (ASR9000) npower X1 400Gbps (CRS, NCS) Processing Pool 256 Engines (64 PPEs x 4 threads) on-chip resources Clustering XC Fast Memory Access RLDRAM2 7 RLDRAM2 0 TCAM4 complete packets Resources & Memory Interconnect complete packets Distribute & Gather Logic TM ASIC - 128K queues - 5L shaping Pkt DRAM

56 Packet NPU s Broadcom, Marvel, newer versions are OF 1.0 or 1.3 compliant Various NPU limits (no L2 and L3 match at the same Cme, limited IPv6 match etc.) Smaller TCAM = cheaper, but limited OF tuple table size (2K entries, etc.), v6 troubles Service NPU s Cavium, Freescale/NetLogic, Complete programmability, definitely OF ready Typically no TCAM so\ware tree lookup (M- trie), low performance stability Intel x86 CPU s Complete programmability, definitely OF ready 40G capable today, but they are general purpose high power and high cost

57 Networking ASIC vs. x86 CPU CRS: 2004: 130nm NPU, 40Gbps 2010: 65nm NPU, 140Gbps 2013: 40nm NPU, 400Gbps 2015: 20nm ASR9000: 2009: 90nm NPU, 120Gbps per slot 2011: 55nm NPU, 360Gbps per slot 2014: 28nm NPU, 800Gbps per slot 1 Feature IP Forwarding Can I use Intel x86 as the forwarding engine? npower X1 = 400Gbps, 230Mpps, 75W (with IP, ACL, RPF, H- QoS) Xeon E5-2600v2 = 40Gbps, 6-22Mpps, 80W (same features, no QoS) 10G 5G 1G CPU Core (x86) Feature Processing Performance 2 Features IP Forwarding, MPLS Label x86 high power consumpcon (half of the chip is graphics ops, floacng point ops, etc.) 3 Features IP Forwarding, MPLS Label, NeVlow Legend: No Traffic Mgmt Basic QoS Hierarchical QoS N Features

58 Today, a decent Forwarding NPU/ASIC is ~10-20x faster, smaller, and more power efficient, than equivalent CPU solucon. Conclusion: Low- bandwidth = CPU (low- volume, well- paid traffic! NfV) High- bandwidth = NPU/ASIC (high- volume broadband- like traffic! switching&roucng+sdn)

59 Myth #1: Cisco uses only internal silicon, that s why it s so expensive. Not True. Cisco uses all hardware sources: Internal Development Whenever it makes sense (clear criteria) Example: CRS/NCS forwarding NPU, ASR9K fabric, ASR900 ASIC... Specific form: acquisicon/spin- in (eg. N7K/N9K) Merchant+ Cisco- only version with certain improvements (X years of exclusivity) Example: ASR9K Trident/Typhoon/Tomahawk NPU Another form of Merchant+: Merchant + Cisco ASIC together (eg. ACI/N9K) Merchant Broadcom, Marvell, Vitesse, Used if they fit our requirements (features, performance, strategy) Example: ASR901, ASR9000v, ME Value Proposition: Cisco delivers the best- class hardware. It has been like this for decades, and it is going to concnue.

60 Yet another lesson: Even in SDN world, there will be (a) good, (b) good- enough, or (c) poor hardware.

61 Who controls Openflow?

62 OPEN NETWORK FOUNDATION Non Profit ConsorCum Dedicated to the transforma.on of networks through SDN Mission to commercialize and promote SDNas a disrup.ve approach to networking

63 Deutsche Telekom : Facebook : Goldman Sachs : Yahoo Google : Microso\ : NTT CommunicaCons : Verizon ONF Board Members

64 6WIND A10 Networks ADVA OpCcal Networking Alcatel- Lucent Aricent Group Big Switch Networks Broadcom Brocade Centec Networks China Mobile Ciena Cisco Citrix CohesiveFT Colt CompTIA Cyan Dell/Force10 Elbrys Ericsson ETRI Extreme Networks EZchip F5 France Telecom Orange Freescale Fujitsu Gigamon Hitachi HP Huawei IBM Infinera Infoblox Intel IP Infusion Ixia Juniper Networks KDDI Korea Telecom Level 3 CommunicaCons LineRate Systems LSI Luxo\ Marvell Mellanox Metaswitch Networks Midokura NCL CommunicaCons NEC Netgear Netronome NetScout Systems Nokia Siemens Networks NoviFlow Oracle Overture Networks PICA8 Plexxi Inc. Qosmos Radware Riverbed Technology Samsung SK Telecom Spirent Sunbay Swisscom Tail- f Systems Telecom Italia Telefónica Tencent Texas Instruments Thales Transmode Turk Telekom / Argela Vello Systems Verisign VMware/Nicira Xpliant ZTE CorporaCon ONF Members

65 Urs Holzle, Senior Vice President of Technology Infrastructure at Google, at the 2 nd annual Open Networking Summit (April 2012) hdp:// news/ /google- describes- its- OpenFlow- network SDN WAN since 2011! Is that LAN- like Centralized SDN OF deployment? Not really. B4 is World- wide WAN The Network runs ISIS and BGP OF agent is used to set up TE tunnels from a central controller. (beder tools are evolving for this see IETF Spring rou.ng.net )

66 Openflow Sweetspot TradiConal Control Plane Architecture Distributed Control Plane (disconnected Net and Apps) NREN, EducaCon Secvor (Internet2) DC Overlay (OVS Open vswitch) OpenDaylight/XNC add- on (eg. SPAN) Centralized SDN Evolved Control Plane Architecture (Examples) Hybrid SDN Overlay (tunnels) Original SDN idea: Clean Slate Project (Stanford University) Underlay (Physical) Control/Network/Services- plane component(s) ASIC s, Data- plane component(s) ApplicaCons

67 DĚKUJI ZA POZORNOST Prosíme, ohodnoťte tuto přednášku. 67