NOCTION. Intelligent Routing Platform Lite Self-Deployment Guide. Intelligent Routing Platform. Lite (free version)

Transcription

1 NOCTION Intelligent Routing Platform Lite (free version) Intelligent Routing Platform Lite Self-Deployment Guide

2 Table of Contents Intro IRP Requirements...3 Hardware requirements...3 Software requirements...4 IRP Server Access requirements...4 Initial Data Requirements Pre-deployment activities IRP Deployment...8 Firewall configuration...8 Prepare for the installation...8 Yum configuration...8 SELinux configuration...8 YUM Repositories...9 IRP packages Installation IRP Configuration...9 Initial IRP Setup...10 Routers Configuration...11 Providers Configuration...11 IRP Launch...12 IRP Documentation...12 IRP Functional Modes...12 Noction Support...13 Self-Deployment Guide Page 2 of 14

3 This document presents the high level deployment process and the main required activities for preparation and proper implementation of the LITE version of IRP (Intelligent Routing Platform) Product. Introduction The Intelligent Routing Platform (IRP) is a product developed by Noction to help Service Providers and Enterprises optimally route traffic across multiple ISPs. The system makes intelligent routing decisions by analyzing various network performance metrics and selecting the best performing route for the traffic to pass through.oction recently released the Lite version of the Intelligent Routing Platform (IRP) - a limited version of the IRP platform available at no cost. The new product is well suited for budget conscious Service Providers and Enterprises that are willing to start taking advantage of automated internet route optimization for outbound traffic. 1. IRP Lite Requirements In order to deploy Noction Intelligent Routing Platform (IRP) LITE version into a network, a set of criterias must be met: Hardware Requirements In production, a dedicated server for each IRP instance is strongly recommended. The system can also be deployed on a Virtual Machine with matching specifications, provided that this is hardwareor paravirtualization (Xen, KVM, VMware). NOTE: OS-level virtualization (OpenVZ/Virtuozzo or similar) is not supported. 1. CPU A Intel Xeon Processor E3/E5 family, or equivalent, is recommended for every 20 Gbps of analyzed traffic; 2. RAM minimum 16 GB, recommended 32GB; NOTE: In case the traffic details are provided via SPAN (Port Mirroring), the amount of RAM should be same as the analyzed traffic volume (in case of high Traffic volumes) + at least 4 GB for IRP components requirements. 3. HDD At least 160GB of storage; SAS disks are recommended (SSDs are suitable only for 40Gbps+ networks); HDD partitioning: 1. LVM is recommended; 2. at least an 100GB separate volume for /var directory. Self-Deployment Guide Page 3 of 14

4 4. NIC if providing sflow/netflow data - 2 x 100/1000 Mbps NICs; if providing raw traffic data by port mirroring - additional 10G interfaces for each span port. NOTE: When needed, Noction could provide IRP appliances representing the required hardware platform for a quick and rapid product s implementation in the customer s network. The appliance is delivered with OS installed (latest 7th CentOS) and IRP software deployed. Software Requirements Clean Linux system, with: the latest CentOS 7 x86_64 version installed on the server; all installed packages updated ( yum update command must be performed). IRP Server Access Requirements Below are provided the access requirements to be met by the IRP server for a proper IRP LITE version product deployment. NOTE: In case the Firewall system does not allow the rules definition based on DNS names, the engineer has to identify the list of all hosts (IPs) for which the specific DNS records exist, via one of NS tools, such as in the examples below: # dig +short lmon.noction.com or # nslookup -type=a lmon.noction.com Outbound access (access from the IRP server): port 80 to the following destinations: lmon.noction.com; maxmind.com; alpaca.ripe.net; port 80 to the CentOS Repositories; port 80 to the Noction Repositories: repo-lite.noction.com; port 53 (UDP) to public DNS servers or to the internal DNS servers; port 123 (UDP) to CentOS NTP servers: 0.centos.pool.ntp.org; 1.centos.pool.ntp.org; 2.centos.pool.ntp.org; or to internal NTP servers, if any; ICMP To ANY # For probing purpose; UDP and TCP SYN (ports ) To ANY;# For probing purpose; Self-Deployment Guide Page 4 of 14

5 Initial Data Requirements For a proper deployment plan and design definition, the customer needs to collect and analyze at least the following data: network diagram with all the horizontal (own) as well as upstream (providers) and downstream (customers) routers included; the list of prefixes announced by customer AS that must be analyzed and optimized by IRP; edge routers configuration (config related to the bgp configuration, the prefixes announced by client s ASN, the route maps, routing policies, access control list, sflow/netflow and related interfaces configurations). Self-Deployment Guide Page 5 of 14

6 2. Pre-deployment activities When the initial data requirements are processed and the deployment plan is defined, the customer network infrastructure must be prepared for IRP installation as per the below: 1. The information about network traffic must be sent to the IRP server via sflow (v. 2, 4, 5) or Netflow/jFlow (v1, 5, 9, 10). For this to happen, the customer has to configure the flow or/and raw data to be sent from the edge routers to the main IRP server IP address. NOTE: It s important to ensure the IRP server gets both inbound and outbound traffic details. Egress and Ingress flow accounting should be enabled on the provider links, or, if this is not technically possible, Egress and Ingress flow accounting should be enabled on all the interfaces facing the internal network. NetFlow is the recommended option and it is specially used for high traffic volumes, or in the case of a sophisticated network infrastructure, where port mirroring is not technically possible. Recommended sampling rates: For traffic up to 10Gbps: 2048 For traffic up to 20Gbps: Setup Policy Based Routing (PBR) for IRP active probing: a. Apart from the main server IP, the customer needs to add one public IP address for each provider to be assigned as probing alias IP, and configure PBR for traffic originating from each of these IPs to be routed over different providers respectively: b. No route maps should be enforced for the main server IP, traffic originating from it should pass the routers using the default routes. In case the traffic from the IRP server will pass through multiple routers before getting to the provider and when a separate probing VLAN could not be configured across all routers, GRE tunnels from the IRP to the Edge routers should be configured. The tunnels are mainly used to prevent additional overhead from route maps configured on the whole IRP <--> Edge routers path. 3. Provide SNMP access (a read-only community will suffice) on the edge routers in order to be further configured in IRP for each provider link, by using the following information: SNMP interface name (or ifindex) SNMP IP (usually the router IP) SNMP community This information is required for the report generation and prevention of overloading a specific provider with an excessive number of improvements. At least access to the following MIBs is required: BGP4 -MIB IF -MIB SNMPv2- MIB IP -MIB Self-Deployment Guide Page 6 of 14

7 4. For a proper setup of cost related settings the customer needs to identify the following info: a. the maximum allowed interface throughput for each provider link (limit load); b. cost per Mbps for each provider (required only for the IRP s COST functional mode); The above is sufficient for a customer to proceed with a non-intrusive setup. To start the system in full Intrusive mode, ibgp sessions between IRP and the edge routers will be required. Self-Deployment Guide Page 7 of 14

8 3. IRP Deployment Before proceeding at the installation process some server s preparations activities are required, as described in the following sections. Firewall configuration In the process of the firewall configuration it is important to configure NOTRACK rules, using the following iptables entries/commands: # iptables -t raw -A PREROUTING -p icmp -j NOTRACK # iptables -t raw -A OUTPUT -p icmp -j NOTRACK # iptables -t raw -A OUTPUT -p udp -m udp --dport 33434: j NOTRACK # iptables -t raw -A OUTPUT -p tcp -m tcp --dport 33434: j NOTRACK NOTE: If the system is restarted before saving the iptables rule set, all rules are lost. In order to make them persistent, the rules have to be saved in the standard iptables file, which, by default is: /etc/sysconfig/iptables. Prepare for the installation In order to proceed with the IRP installation, the server s IP address(es) (public and private IP) must be provided to Noction Support Team in order to allow access to the required IRP YUM repositories and configure the required license(s). NOTE: This information is provided to the Noction Sales Manager, who will forwarded it to the right team for further processing. When access is confirmed, yum should be configured as described in section below. Yum configuration The first step is to create the file irp-lite.repo under /etc/yum.repos.d/ directory and paste the following: # wget -P /etc/yum.repos.d/ The next step is to import the GPG public key: # rpm --import SELinux configuration SELinux should be set to permissive state for proper IRP components operation. Enabling SELinux permissive state: # setenforce 0 Set SELINUX parameter must also be changed to permissive in /etc/sysconfig/selinux configuration file, by hand: SELINUX=permissive Self-Deployment Guide Page 8 of 14

9 or via a command in the shell, such as the following: # sed -i s/selinux=enforcing/selinux=permissive/ /etc/selinux/config YUM Repositories Before proceeding to the IRP packages installation, the engineer needs to ensure that all NON- Standard CentOS repositories, such as EPEL, are disabled, because of some IRP strict dependencies. The following command should be used in order to detect the enabled repositories: # yum repolist enabled IRP packages Installation In order to install the IRP product via yum tool, the following command must be used: # yum install irplite or, in order to ensure that only the required repos are used: # yum --disablerepo=\* --enablerepo=base,extras,updates,irp-lite install irplite NOTE: Please, be patient as the installation process may take up to 20 minutes or even more in case of low Internet connection. 4. IRP Configuration IRP is initially configured through a graphical wizard. After the initial configuration, all further manipulation and settings configurations are done via the Frontend IRP component. Before proceeding to initial configuration, the engineer needs to: Ensure that IPv6 support is enabled. In case it is disabled, the customer should perform the following steps in order to enable IPv6 support on a CentOS platform: 1. Add NETWORKING_IPV6=yes to the /etc/sysconfig/network file; 2. Ensure the IPV6INIT=yes in /etc/sysconfig/network-scripts/ifcfg-eth0; 3. Perform a network service restart; 4. Ensure IPv6 Support is enabled in the /etc/sysctl.conf configuration file: - net.ipv6.conf.all.disable_ipv6 = 0 - net.ipv6.conf.default.disable_ipv6 = 0 Ensure that the rp_filter is disabled in order to avoid any possible issue related to Flow processing. The rp_filter has to be disabled for each physical interface, by using a command similar to the following one: # sysctl -w net.ipv4.conf.$ethn.rp_filter=0 -- where $ethn is the interface name (e.g. eth0); or, in order to make the change/configuration permanent, it has to be set in the /etc/sysctl.conf file. NOTE: The rp_filter should NOT be disabled in case SPAN (port mirror) is used!!! Self-Deployment Guide Page 9 of 14

10 Ensure that DbCron service is started and running, using the command: # systemctl status dbcron dbcron.service - IRP Dbcron daemon Loaded: loaded (/usr/lib/systemd/system/dbcron.service; enabled; vendor preset: disabled) Active: active (running) since Mon :08:17 EDT; 4min 32s ago In case the service is stopped, it has to be started: # service dbcron start Initial IRP Setup In order to start the initial configuration process for the Noction product, the engineer needs to point the browser to the or and go through the wizard. At this point, the following default credentials have to be used: - Username: admin - Password: admin NOTE: If during the Initial Configuration Wizard an API connection error appear, then the engineer will have to connect to the server via SSH and execute the following command: # systemctl restart irpapid After the first start of the frontend management tool, it automatically starts the Initial setup, in which main parameters of the IRP configuration need to be set up: 1. Configure the Infrastructure IP addresses used by Explorer component to determine the current route for a specific prefix, and Analyzed networks list of prefixes to be analyzed and improved by IRP; 2. Configure Collector by setting up the method IRP will use to collect the network prefixes statistics. The collector can operate in the following modes, by enabling the required services in the wizard and by configured the specified parameters: a. FLOW (Irpflowd) - using NetFlow/sFlow and/or NetFlow/sFlow UDP Port - Udp ports on which traffic statistics will be provided. In case the Flow exporters are configured to use non-standard port numbers (2055 for NetFlow/ jflow and 6343 for sflow); Flow Sources - Flow exporters IP addresses. Flow data coming in from other IP addresses that are not listed in this parameter will be ignored. b. SPAN (IrpSpand) - collecting raw traffic from mirrored ports. Irpspand interfaces - The list of server s network interfaces that should receive mirrored traffic; min_delay status - Enable TCP Re-transmits analysis. 3. Configure the Improvement Mode in which IRP should function. IRP can operate in two modes: a. Performance mode - when only performance metrics like latency and packets loss are analyzed; while in b. Cost mode - the same metrics are analyzed as in the Performance mode with additional analysis of the traffic cost for each provider; Self-Deployment Guide Page 10 of 14

11 1. Configure Management Interface be used by IRP instance for management purpose (just cosmetic). The required physical interface and its IP address can be found in the system with ifconfig tool. 2. Configure Probing Interfaces that are just the aliases created for the management interface to be used for probing purpose. Routers Configuration After the initial setup is finalized, at least one edge router and at least two providers have to be configured in IRP, for further establishment of BGP session(s) and, as such, the Add a router option needs to be selected in the main screen and the following to be configured: 1. Router Name and AS where the router name (usually the hostname) and the AS number are set; 2. Router IP address where the Local IPv4 address (IRP main IP address) and the Remote IPv4 address (IP address of the Edge router) must be set; 3. ROUTER ANNOUNCING, where the required BGP attributes to be further used to manipulate the edge router s BGP table are set. Providers Configuration In the main screen of the Provider setup wizard, the Add a provider option needs to be used. This option is used for each provider and every time a new provider has to be added into IRP configuration. The Add a provider activity consists of several steps required to be set as described in the following: 1. Router Name and AS where the edge router, that should be already configured in the system is selected. In case there are multiple edge routers, the router that the provider is connected to has to be selected from a dropdown menu; 2. Provider name where the name of the provider and a short description has to be set; 3. Provider IP Addresses is the place where the following parameters have to be configured: Probing IPv4 address - usually it is the alias IP on the management/probing interface with configured PBR; IPv4 diagnostic hop - defines the diagnostic hop or subnet in CIDR format for the current provider; Router next hop address - the next-hop IPv4 address for BGP route injection. Usually, it is the IPv4 address of the BGP partner from the provider; Remote provider ASN - the provider s AS number. 4. Providers Monitoring setup where the monitoring options for the specific provider via SNMP are set for the edge router on which the provider is connected. The monitoring is performed for BGP session and interface statistics. In this step the following parameters need to be set: Provider SNMP IPv4 address - IP address of router from which IRP will collect statistics, usually it is the client edge router; Provider SNMP community - SNMP community (read only) used by IRP for data getting; Provider SNMP interface - network interface to provider from which the statistics will be collected. Self-Deployment Guide Page 11 of 14

12 5. External Monitor setup where the external monitor needs to be set up. At this stage the following parameters have to be configured: External monitor - external monitor will be set to state Enabled ; ICMP/UDP ping monitored IPv4 addresses - which defines the List of IPv4 addresses to be monitored by BGPd (usually the Google DNS/OpenDNS IPs). 6. Internal Monitor setup where the Internal monitor needs also to be configured and the following parameters must be set: Internal Monitor - which need to be set to the state Enabled ; BGP session monitoring IPv4 address - the ip address of ISP BGP router; BGP Internal Monitor SNMP Community - SNMP community; BGP Internal Monitor SNMP IPv4 address - IP address of the router from which the statistics will be collected (usually it is the edge router). 7. Provider pre-check where the required checks are performed in order to ensure that everything is correctly configured, including the aliases and PBR. IRP Launch After the Initial IRP Configuration has been finished, the engineer has to start the IRP services by running the command: # systemctl list-dependencies irp.target The output of the above command is very important as it provides the status/state of each component to be further considered in case of any required troubleshooting session. Also, the state of the IRP components as such as a lot of other useful data, provided by diverse graphs and reports, are available in the FrontEnd. IRP services could be started using the below command: # systemctl start irp.target IRP Documentation After the product (IRP) is deployed, the engineer will be able to access the IRP Documentation file that contains a lot of useful information about the product itself such as: components and features, optimization modes, configuration files and their structure, product implementation, troubleshooting, maintenance and usage. The file is available in the FrontEnd under Help menu, accessible via browser, also directly, at the following address: IRP Functional Modes Initially the IRP instance is configured in Non-intrusive mode, when the IRP server is gathering data for network prefixes and is identifying possible improvements for them and the information is presented in the Dashboard page. In this functional mode no improvements are announced to the border routers. Self-Deployment Guide Page 12 of 14

13 The Non-Intrusive mode allows the customer to have a real picture regarding the benefits IRP can bring into his network, without affecting in any way his network. When the customer is ready to switch the IRP instance to FULL Functional mode, called INTRUSIVE, he/ she has to configure the required BGP sessions and to perform the switching to Intrusive activities, based on a preliminary defined plan. NOTE: the template plan for the switching to Intrusive is available in the documentation described above (irp-documentation.pdf) under the IRP Operating modes section. Noction Support Should the customer has a question or in case any assistance from Noction Support team is required, a support ticket has to be created, by sending a mail to support@noction.com. Self-Deployment Guide Page 13 of 14

14 Noction Self-Deployment Guide Intelligent Routing Platform Lite Copyright 2018 Noction Holdings Ltd, All Rights Reserved. Noction logos, and trademarks or registered trademarks of Noction Holdings Ltd or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. Information regarding third party products is provided solely for educational purposes. Noction Holdings Ltd is not responsible for the performance or support of third party products and does not make any representations or warranties whatsoever regarding quality, reliability, functionality, or compatibility of these devices or products. Copyright 2018 Noction Holdings Ltd, All Rights Reserved.