ODL Summit Bangalore - Nov 2016 IPv6 Design in OpenDaylight

Transcription

1 ODL Summit Bangalore - Nov 2016 IPv6 Design in OpenDaylight Sridhar Gaddam (sgaddam@redhat.com) Dayavanti Gopal Kamath (dayavanti.gopal.kamat@ericsson.com)

2 Agenda IPv6 Intro. IPv6 Neighbor Discovery. IPv6 IP Address Management. Stateless Address Auto-Configuration. Neutron IPv6 Support. IPv6 Subnets (Valid/In-Valid Combinations) Key Differences between IPv6 and IPv4 in Neutron. IPv6 Design in ODL Boron/Carbon. IPv6 Service and Control Path. IPv6 Forwarding. IPv6 Security Groups. Sample Flow on VM bootup. Sample VM to VM Communication. East-West routing support in IPv6 IPv6 and Stateful Security Groups. Roadmap

3 IPv6 Intro IPv6 Header: Version Traffic Class (8 bits) Flow Label (20 bits) Payload Length (16 bits) Next Header (8 bits) Source Address (128 bits) Destination Address (128 bits) Hop Limit (8 bits) Fixed header of 40 bytes. No checksum field and overall less number of fields compared to IPv4 header.. IPv6 supports Extension Headers. IPv6 Address Types: 1. Unicast Addresses: It is assigned to a single interface and packets sent to the unicast address are delivered to that interface. 2. Multicast Addresses: Identifies a group of interfaces usually on different nodes. Packets sent to a multicast address is received by all the members of that group. 3. Anycast Addresses: Identifies a group of interfaces usually on different nodes. Packets sent to an anycast address is delivered to the nearest host based on the routing table. Global Unicast Address/Anycast Address: Subnet Prefix Global Routing Prefix Subnet ID Interface ID 48 bits 16 bits 64 bits

4 IPv6 Neighbor Discovery Neighbor discovery is used for Address Resolution, Duplicate Address Detection, Router Discovery, Neighbor Unreachability Detection etc. 1. Router Solicitation (ICMPv6 type 133): As part of Address Auto-Configuration, host sends a Router Solicitation message to locate IPv6 routers on the link. 2. Router Advertisement (ICMPv6 type 134): Routers periodically send out Router Advertisement messages or respond to a Router Solicitation message from a host. A Router Advertisement carries the type of addressing that is used on the network, prefix info, prefix length, default gateway, MTU and other information. 3. Neighbor Solicitation (ICMPv6 type 135): Neighbor Solicitation messages are sent to request the link layer address of a target device while also providing its link layer address to the target. Neighbor Solicitation messages are typically sent to a multicast address for address resolution and are sent to the unicast address during Neighbor reachability detection. 4. Neighbor Advertisement (ICMPv6 type 136): Neighbor Advertisements are transmitted in response to Neighbor Solicitations. They are also sent as Unsolicited Neighbor Advertisements to inform other nodes of any changes in the link-layer address/other info. 5. Redirect (ICMPv6 type 137): A Redirect message is sent by an IPv6 Router to inform a host of a better first hop router for a specific destination.

5 IPv6 IPAM IPv6 SLAAC: It allows an IPv6 compliant node to autonomously generate an IPv6 globally unique address using a combination of locally available information and information advertised by routers. DHCPv6 Stateless Support: IPv6 addresses are auto discovered from the Router and additional info (like DNS) from DHCPv6 Server. DHCPv6 Stateful Support: IPv6 addresses along with additional information is discovered from DHCPv6 Server.

6 SLAAC IPv6 Stateless Address Autoconfiguration Process VM IPv6 Router 1 Generate a Link Local Address (LLA) using MAC + FE80::/10 prefix. Initially the address stays in tentative mode. 2 Duplicate Address Detection (DAD): Neighbor Solicitation From: Unspecified Source Address (::) To: Solicited Node Multicast Address of LLA. 3 NA not received, LLA moves to preferred state 4 6 Router Solicitation From: IPv6 LLA To: FF02::2 Use the prefix info, derive an IPv6 Global Unicast Address (GUA) using EUI-64 Router Advertisement From: Router LLA To: FF02::1 A, M, O flags, Prefix info. 5 7 Perform Duplicate Address Detection for GUA. Neighbor Solicitation From: Unspecified Source Address (::) To: Solicited Node Multicast Address of GUA.

7 Neutron IPv6 Support Openstack Neutron provides APIs to create IPv6 subnets and associate it with neutron routers which enables IPv6 functionality in the VMs attached to those subnets. Neutron Subnet API allows us to create an IPv6 subnet with various addressing modes like SLAAC, DHCPv6-Stateless and DHCPv6-Stateful subnets using the attributes ipv6-ra-mode and ipv6-address-mode. ipv6-ra-mode: This attribute is used to specify if networking service should transmit the Router Advertisements. ipv6-address-mode: This attribute is used to control how addressing is handled.

8 IPv6 Subnets ipv6_ra_mode ipv6_address_mode Description slaac slaac Guest Instance obtains IPv6 address from ODL IPv6Service using SLAAC. dhcpv6-stateful dhcpv6-stateful Guest Instance obtains IPv6 address and optional info from dnsmasq (i.e., Neutron dhcp-agent) using DHCPv6. dhcpv6-stateless dhcpv6-stateless Guest Instance obtains IPv6 address from IPv6Service and optional info from dnsmasq using DHCPv6. N/S slaac Guest Instance obtains IPv6 address from a non-openstack /external router using SLAAC. OpenStack (IPv6):

9 Key differences IPv6 Vs IPv4 (in Neutron) No NAT in IPv6. No floating-ip support in IPv6. IPv6 Subnets are expected to be created with GUA prefixes and externally routable. To avoid issues like Overlapping subnets, we can use the subnet-pool support/prefix-delegation from Neutron. A subnet pool manages a pool of addresses from which subnets can be allocated. It ensures that there is no overlap between any two subnets allocated from the same pool Neutron supports EUI-64 IP address assignment. When using auto-addressing subnets, one has to disable privacy extension in the guest VMs. Router interfaces would have more than one IPv6 address when multiple IPv6 subnets are created in the Network.

10 IPv6 Design in ODL Boron/Carbon. IPv6 use-cases can be broken down into three main categories. IPv6 Control path. IPv6 Routing. IPv6 Security Groups. Similar to other NetVirt components, IPv6 service would use MDSAL framework and use OVSDB + OpenFlow for southbound flow Programming.

11 IPv6 Service for Control Path. IPv6Service is a new Service that is added in NetVirt during the Boron cycle. It supports IPv6 IPAM and has to be used along with Neutron dhcp agent for DHCPv6 use-cases. Current Status: It supports Neighbor discovery for Router interfaces. Supports periodic unsolicited Router Advertisements (RAs) as well as sends out an RA when there is an explicit Router Solicitation from the VMs. Supports Multiple IPv6 subnets per network. Maintains Network Topology to program the necessary punt flows on the respective DPNs. Interfaces with GENIUS for Service Binding of IPv6 ports.

12 IPv6 Forwarding. IPv6 Forwarding: Changes required to support IPv6 East-West and North-South communication would be done in existing services like ELAN and L3 Service of NetVirt. Current Status: IPv6 VM to VM communication on same network as-well-as East-West Routing is supported. 2001:db8:cafe:1::2 2001:db8:cafe:2::2 2001:db8:cafe:1::3 2001:db8:cafe:2::3 VM1_1 VM2_1 VM1_2 VM2_2 Compute Node-1 OVS1 (br-int) Compute Node-2 OVS2 (br-int) Tenant Network (VxLAN/VLAN tunnel)

13 IPv6 Security Groups. IPv6 Security Groups: ACLService is updated to support IPV6 Security Groups. OpenStack Neutron Security Group API has support for both IPv4 and IPv6 ACLs. When port-security is enabled on a port, ACLService would program the IPv6 Security Group rules associated with the port. It also programs some anti-spoofing rules to prohibit a VM from using a non-neutron allocated IP/MAC. We only support Stateful Security Groups for IPv6 use-cases and it requires OVS (or above) and conntrack_ipv6 kernel module. Current Status: IPv6 Stateful Security Groups are supported along with allowed_address_pairs. Some minor changes are pending, mostly related to making the rules more restricted.

14 Flow on VM Bootup Router Solicitation Neighbor Solicitation DHCPv6 Solicit Router Advt / Neighbor Advt DHCPv6 Advertise ODL Controller VM VM DHCP Agent table=17, priority=3,metadata=0x /0xffffff actions=write_metadata:0x /0xfffffffffffffffe,goto_table:45 table=45, priority=50,icmp6,metadata=0x /0xffff000000,icmp_type=133,icmp_code=0 actions=controller:65535 table=45, priority=50,icmp6,metadata=0x /0xffff000000,icmp_type=135,icmp_code=0,nd_target=fe80::f816:3eff:febd:c9ae actions=controller:65535 table=45, priority=50,icmp6,metadata=0x /0xffff000000,icmp_type=135,icmp_code=0,nd_target=2001:db8:cafe:1::1 actions=controller:65535 table=45, priority=0 actions=resubmit(,17)

15 VM to VM Communication (Same Network) Ping6 from VM1_1 to VM1_2 GUA Ping6 from VM1_2 to VM1_1 LLA

16 IPv6 East-West Routing Support VM1_1 acquires both IPv4 and IPv6 addresses. Ping6 to VM2_1 Ping to VM2_1

17 IPv6 Stateful Security Groups Connection Tracking entries when VM1_1 is doing a ping6 to VM2_1

18 IPv6 Roadmap Support IPv6 North-South Forwarding. Via VLAN based connectivity. Via BGPVPNs using L3VPN Service. MTU info in Router Advertisements. Support IPv6 Provider Network use-case. IPv6 Underlay Support (i.e., infra on IPv6 network) IPv6 Prefix Delegation Support. Other advanced use-cases. IPv6 High level architecture, gap analysis, current status and roadmap activities are captured at the following document. Join NetVirt!!

19 Questions?