Enterprise Document Management System - Qualityze Inc
SDN & NFV Introduction - Open Source Data Center Networking
1. SDN & NFV Introduction
Open Source Data Center Networking
Thomas Graf <tgraf@redhat.com>
Red Hat, Inc.
Spring, 2014
2. Agenda
● Problem Statement
– Networking Challenges
● Path to resolution
– Software Defined Networking, Network
Virtualization, NFV & Service Chaining
● What about Code?
– OpenDaylight, Open vSwitch, OpenStack
● Look Ahead
– Group Based Policy Abstraction
5. Managing Forwarding Elements
● Vendor specific management tools
● Little automation
● Slow and error prone
Developer
NetOps
Service Ticket
1d – 2 weeks
CLI
Vendor
UI
6. Change in Traffic Patterns
● Increased demand for bisectional traffic
● Limited room for additional costs
5%
95%
80% by 2014*
20%
* Gartner Synergy Report
7. Dynamic Workloads
● Virtualization (Live Migration)& Cloud
● Respond in real time
– Services are started/stopped dynamically, network
needs to adapt.
● Bring Your Own Device
Hypervisor Hypervisor
VMVM
Live Migration
10. Network Definition
● Collection of endpoints and forwarding
elements
● Responsible for moving packets between hosts
● Source hosts identify destination
● Forwarding elements direct traffic at each
intersection
13. Software Defined Networking
In the Software Defined Networking architecture, the
control and data planes are decoupled, network
intelligence and state are logically centralized, and the
underlying network infrastructure is abstracted from
the applications.
Software-Defined Networking:
The New Norm for Networks
ONF White Paper
April 13, 2012
14. SDN – Abstraction
Controller
App App AppSNMPVendor Specific Protocol
Control Plane
Data Plane
A logically centralized controller programs the network
based on a global view.
Control Plane
Data Plane
Control Plane
Data Plane
Console
Control Plane
Data Plane
Data Plane
Data Plane
Data Plane
Data Plane
15. “We've taken over the
network”
James Hamilton
VP, Amazon Web Services
Nov, 2013
16. What Really Matters
● Closed Source
● Network Engineer
● Vendor Lead
● CLIs
● Network Appliances
● Open Source
● Network Developer
● Community Driven
● APIs
● NFV (Software)
18. SDN Promises
● Highly automated & dynamically provisioned
● Enables innovation, experimentation &
optimizations
● Virtualizes network & abstracts the hardware
● Makes the network programmable
● Enables overlays with control at edges
19. OpenFlow
Match on bits in
packet header L2-
L4 plus meta data
Execute actions
● Forward to port
● Drop
● Send to
controller
● Mangle packet
2.2.
An Open Standard behind SDN
OpenFlow enables networks to evolve, by giving a remote
controller the power to modify the behavior of network
devices, through a well-defined "forwarding instruction
set". The growing OpenFlow ecosystem now includes
routers, switches, virtual switches, and access points
from a range of vendors.
ONF Website
11..
20. Programmable Flow Table
● Extensive flow matching capabilities:
– Layer 1 – Tunnel ID, In Port, QoS priority, skb mark
– Layer 2 – MAC address, VLAN ID, Ethernet type
– Layer 3 – IPv4/IPv6 fields, ARP
– Layer 4 – TCP/UDP, ICMP, ND
● One or more actions:
– Output to port (port range, flood, mirror)
– Discard, Resubmit to table x
– Packet Mangling (Push/Pop VLAN header, TOS, ...)
– Send to controller, Learn
23. Network Virtualization
What do we need?
1. Virtualize network topology on Layer 2-7
- Run previous workload without changes
2. Decouple logical from physical topology
- A virtual network should run anywhere
3. Allow for isolated tentant networks
- Multiple customers/applications per network
4. Provide APIs to manage network abstraction
- Orchestrate & automate
31. NFV
Problem Statement
● Non commodity hardware
● Physical install per appliance per site
● Large development barriers
● Innovation constraints & limited competition
32. NFV
What do we want?
1. Virtualization
– Run functions on scaleable commodity hardware
2. Abstraction
– Limited dependency on physical layer
3. Programmability
– APIs to implement automation
4. Orchestration
– Centralized orchestration
– Reduced maintenance
34. Who is behind NFV?
● Originally operator driven
– ETSI – European Telecommunications Standards
Institute
● Evolved into a generic concept
● Open to any company
35. Service Chaining
Moving network functions into software means that building a
service chain no longer requires acquiring hardware.
37. OpenDaylight’s mission is to facilitate a community-led,
industry-supported open source platform, including
code and architecture, to accelerate adoption of
Software-Defined Networking and Network Functions
Virtualization.
42. L2 Segregation (VLAN)
VM1
Host system
VM2 VM3
Open vSwitch
VLAN 1 VLAN 2
VLAN isolation enforces VLAN membership of
a VM without the knowledge of the guest itself.
vSwitchvSwitch
Virtual Machine
Remove
VLAN header
Add
VLAN header
# ovs-vsctl add-port ovsbr port2 tag=10
43. Overlay Networks
VM1
Compute Node 1
VM2 VM3
Open vSwitch
VM4
Compute Node 2
VM5 VM6
Open vSwitch
ControllerController
O
pen
Flow
O
VSD
B
O
pen
Flow
O
VSDBTunnel
VNET 1 VNET 1VNET 2 VNET 2
Tunneling provides isolation and reduces
dependencies on the physical network.
NetworkNetwork
44. Visibility
●
● NetFlow
● Port Mirroring
● SPAN
● RSPAN
● ERSPAN
Supports industry standard technology to
monitor the use of a network.
45. Feature
Quality of Service
● Uses existing Traffic Control Layer
● Policer (Ingress rate limiter)
● HTB, HFSC (Egress traffic classes)
● Controller (Open Flow) can select Traffic Class
VM1
Compute Node
VM2
ovsbr
VLAN 10
port1 port2
1mbit
# ovs-vsctl set Interface port2
ingress_policing_rate=1000
46. To produce the ubiquitous open source
cloud computing platform that will meet the
needs of public and private cloud providers
regardless of size, by being simple to
implement and massively scalable.
51. Network APIs are there.
Now what?
Applications do not care about
subnets, ports, or virtual networks.
52. Application Centric APIs
Allow application administrators to express
networking requirements using group and policy
abstraction.
Leave the technical implementation to the
network.
53. Terminology
Connectivity Group: Collection of endpoints (MAC/IP on vNIC)
with a common policy.
Policy: Set of Policy Rule objects describing policy. Policies may
be applied between groups, or alternatively, applied to a single
group using provide / consume relations.
Policy Rule: Specific <classifier, action> pair, part of a policy.
– Classifier: L4 ports + protocol
– Actions: Permit / Deny, QoS action, service chain redirection
54. Policy as a Service
● Group is providing service as
defined by policy
● Service mostly unaware of
consumer
55. Policy between Groups
● Policy defined between pair of groups
● Policy may apply to multiple relationships
● Producer is aware of consumer
58. References
Opendaylight
– http://www.opendaylight.org/
Open vSwitch
– http://www.openvswitch.org/
OpenFlow
– http://www.openflow.org/
Open Networking Foundation
– http://www.opennetworking.org/
Inter-Datacenter WAN with centralized
TE using SDN and OpenFlow [Google]
– http://bit.ly/18zgPE3
Red Hat OpenStack
– http://www.redhat.com/openstack/
OpenStack
– http://www.openstack.org/
61. Flow Table
VM
User space
Slow Path
Physical Interface
Kernel Fast Path
Controller programs flow table in the slow path that
feeds the flow table in the fast path upon request.
tap
VM VM VM
tap tap tap
Open vSwitch
OpenFlow
63. Flow Table Rules
● Flow matching capabilities
● Meta – Tunnel ID, In Port, QoS priority, skb mark
● Layer 2 – MAC address, VLAN ID, Ethernet type
● Layer 3 – IPv4/IPv6 fields, ARP
● Layer 4 – TCP/UDP, ICMP, ND
● Possible chain of actions
● Output to port (port range, flood, mirror)
● Discard, Resubmit to table x
● Packet Mangling (Push/Pop VLAN header, TTL,NAT, ...)
● Send to controller, Learn
64. Modifying the Flow Table
# ovs-ofctl add-flow ovsbr
dl_src=11:22:33:44:55:66,actions=strip_vlan,output:1
# ovs-ofctl dump-flows ovsbr
[...]
cookie=0x0, duration=36.24s, table=0, n_packets=0,
n_bytes=0, idle_age=36, dl_src=11:22:33:44:55:66
actions=strip_vlan,output:1
Strip VLAN header of all packets from MAC address
11:22:33:44:55:66 and forward packet to port 1.
65. Megaflows
● Fast path made capable of handling wildcard flows
● Transparent optimization
in_port=3
src_mac=02:80:37:ec:02:00,
dst_mac=0a:e0:5a:43:b6:a1,
vlan=10,
eth_type=0x0800
ip_src=10.10.1.1,
ip_dst=10.10.1.2,
tcp_src=80,
tcp_dst=32990,
...
in_port=3,
src_mac=02:80:37:ec:02:00,
dst_mac=0a:e0:5a:43:b6:a1,
vlan=10
66. Multi Threading
CPU
Core 1
NIC
CPU
Core 2
CPU
Core 3
ovs-vswitchd
CPU
Core 1
NIC
CPU
Core 2
CPU
Core 3
OVS OVS OVS
● Multiqueue NICs spread load across all cores
● Maps kernel NIC Queue => CPU core mapping to user space
● Allows slow path to scale across cores
72. Traffic Shaping
# ovs-vsctl set Interface port2
ingress_policing_rate=1000
Limit all traffic received from VM on
port port2 to 1Mbit/s VM1
Virtual Host
VM2
ovsbr
VLAN 10
port1 port2
1mbit