SlideShare ist ein Scribd-Unternehmen logo
1 von 64
Downloaden Sie, um offline zu lesen
Next-gen Network Telemetry is
Within Your Packets: In-band OAM
Frank Brockners
Open Networking Summit 2017
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Let’s assume you’re interested in the
behavior of your live user-data traffic.
What is the best source of information?
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Well… probably the live user-data traffic itself.
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
In-band OAM (a.k.a. “in situ OAM”)
• OAM traffic embedded in the data traffic
but not part of the payload of the packet
• OAM “effected by data traffic”
• Example: IPv4 route recording
Out-of-band OAM
• OAM traffic is sent as dedicated traffic,
independent from the data traffic (“probe
traffic”)
• OAM “not effected by data traffic”
• Examples: Ethernet CFM (802.1ag), Ping,
Traceroute
How to send OAM information in packet networks?
“On-Board Unit” Speed control by police car
4
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Let’s add meta-data to all
interesting live user-data traffic.
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Remember RFC 791?
6
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
More recently: In-band Network Telemetry for P4
http://p4.org/wp-content/uploads/fixed/INT/INT-current-spec.pdf
7
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
In-Band OAM - Motivation
• Service/Quality Assurance
• Prove traffic SLAs, as opposed to probe-traffic SLAs;
Overlay/Underlay
• Service/Path Verification (Proof of Transit) –
prove that traffic follows a pre-defined path
• Micro-Service/NFV deployments
• Smart service selection based on network criteria
(intelligent Anycast server/service selection)
• Operations Support
• Network Fault Detection and Fault Isolation through efficient network
probing
• Path Tracing – debug ECMP, brown-outs, network delays
• Derive Traffic Matrix
• Custom/Service Level Telemetry
“Most large ISP's prioritize
Speedtest traffic and I would
even go as far to say they
probably route it faster as well
to keep ping times low.”
Source: https://www.reddit.com/r/AskTechnology/comments/2i1nxc/
can_i_trust_my_speedtestnet_results_when_my_isp/
8
AgendaIn-Band OAM Solution Ecosystem & Advanced Use-Cases
A Peek at the Implementation – IOS and OpenSource
In-Band OAM – Technology & Evolving Standards
Why In-Band OAM? – Use-Case Examples
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Example: SLA Verification
• Overlay Networks, Service chains /
path have associated SLA
• KPIs for overlay networks and service
chains are end-to-end delay, jitter and
packet drops
• For Overlay Networks and NFV service
chaining SLA-check is still very nacent
• Either no end-to-end service chain SLA
verification or SLA verification is based on
probes (IPSLA) which can be easily
cheated upon
• Common interpretation is service-chain:
Health = VM health
• Approach: In-band monitoring of
customer traffic
10
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 11BRKSDN-2901
Example: Proof of Transit
Consider TE, Service Chaining, Policy Based Routing, etc...
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 12BRKSDN-2901
Example: Proof of Transit
Consider TE, Service Chaining, Policy Based Routing, etc...
“How do you prove that traffic follows the suggested path?”
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
“… Willis says the first issue is connecting VNFs to the infrastructure.
OpenStack does this in a sequential manner, with the sequence serially
numbered in the VNF, but the difficulty comes when trying to verify that
the LAN has been connected to the correct LAN port, the WAN has been
connected to the correct WAN port and so on. "If we get this wrong for a
firewall function it could be the end of a CIO's career," says Willis.”
http://www.lightreading.com/nfv/nfv-specs-open-source/bt-threatens-to-ditch-openstack/d/d-id/718735
October 14, 2015
Light reading citing Peter Willis, Chief researcher for data networks, British Telecom
PSOSDN-2901 13
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Example: Proof-of-Transit
• Question: With TE/SFC/PBR: How
do you prove that traffic follows the
correct path?
• Approach: OAM Meta-data added
to all user traffic
• Based on “Share of a secret”
• Provisioned by controller over
secure channel
• Updated at every service hop
• Verifier checks whether
collected meta-data allows
retrieval of secret
• Path verified
Controller Secret
X
B
CA Verifier
14
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Example – Generic customer meta-data:
Geo-Location within your packets
15
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Example use-cases...
• Path Tracing for ECMP networks
• Service/Path Verification
• SLA proof: Delay, Jitter, Loss
• Custom data: Geo-Location,..
• Smart Service Selection
• Efficient Failure Detection/Isolation
Meta-data required...
• Node-ID, ingress i/f, egress i/f
• Proof of Transit (random, cumulative)
• Sequence numbers, Timestamps
• Custom meta-data
• Timestamps, custom meta-data
• Node-ID, Timestamps
What if you could collect operational meta-data
within your traffic?
16
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
In-Band OAM (IOAM) in a Nutshell
• Gather telemetry and OAM information along the path within the data packet,
(hence “in-band OAM”) as part of an existing/additional header
• No extra probe-traffic (as with ping, trace, IPSLA)
• Transport options
• IPv6: Native v6 HbyH extension header or double-encap
• VXLAN-GPE: Embedded telemetry protocol header
• NSH: Type-2 Meta-Data
... additional encapsulations being considered/WIP (incl. SRv6, GRE, MPLS)
• Deployment
• Domain-ingress, domain-egress, and select devices within
a domaininsert/remove/update the extension header
• Information export via IPFIX/Flexible-Netflow/publish into Kafka
• Fast-path implementation
Hdr OAM Payload
IOAM domain
* FD.io/VPP open source reference implementation available
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
IPFIX
1
3
4
5
6
2
A
C
B
D
Payload
Hdr
Payload
Hdr
Payload
Hdr
r=45/c=17
A 1
C 4
Payload
Hdr
r=45/c=39
B
A
6
1
C 4
Insert POT
meta-data
Payload
Hdr
r=45/c=0
A 1
POT meta-data
Path-tracing data
Update POT
meta-data
Update POT meta-data
Update POT meta-data
POT Verifier
18
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Latest IETF Drafts
• In-band OAM Authors: Cisco, Comcast, Facebook,
JPMC, Bell Canada, Mellanox, Marvell, Barefoot, rtBrick
• In-band OAM requirements: https://tools.ietf.org/html/draft-
brockners-inband-oam-requirements-03.txt
• In-band OAM data types: https://tools.ietf.org/html/draft-
brockners-inband-oam-data-04.txt
• In-band OAM transport: https://tools.ietf.org/html/draft-
brockners-inband-oam-transport-03.txt
• Proof-of-transit: https://tools.ietf.org/html/draft-brockners-proof-
of-transit-03.txt
• In-band OAM manageability – YANG models and
methods defined in IETF LIME WG
• draft-ietf-lime-yang-connectionless-oam-03
• draft-ietf-lime-yang-connectionless-oam-methods-00
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
• Per node scope
• Hop-by-Hop information processing
• Hop Limit
• Node_ID (long/short)
• Ingress Interface ID (long/short)
• Egress Interface ID (long/short)
• Timestamp
• Wall clock (seconds, nanoseconds)
• Transit delay
• Queue length
• Opaque data
• Application Data (long/short)
In-situ OAM Data Fields Overview
• Set of nodes scope
• Hop-by-Hop information processing
• Service Chain Validation
(Random, Cumulative)
• Edge to Edge scope
• Edge-to-Edge information processing
• Sequence Number
Two transport options:
• Pre-allocated array (SW friendly)
• Incrementally grown array (HW friendly)
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Pre-Allocated & Incremental
Trace Option Header (per-node info)
Hardware friendlySoftware friendly
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Trace Types
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
IOAM Data which in only updated by selected
nodes: Proof-of-Transit
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Proof of Transit:
Ensuring Path and/or Service Chain Integrity
• Meta-data added to all user traffic
• Based on “Share of a secret”
• Provisioned by controller over
secure channel
• Updated at every service hop
• Verifier checks whether
collected meta-data allows
retrieval of secret
• Path verified
Controller Secret
X
B
CA Verifier
28
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Solution Approach: Leveraging Shamir’s Secret Sharing
Polynomials 101
- Line: Min 2 points
- Parabola: Min 3 points
General: It takes k+1 points to defines a polynomial of degree k.
29
- Cubic function: Min 4 points
Adi Shamir
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Solution Approach: Leverage Shamir’s Secret Sharing
“A polynomial as secret”
• Each service is given a point
on the curve
• When the packet travels through
each service it collects these
points
• A verifier can reconstruct the curve
using the collected points
• Operations done over a finite field
(mod prime) to protect against
differential analysis
(3,46)
(2,28)
(1,16)
X
B
CA
“Secret”:
3𝑥2
+ 3𝑥 + 10
3𝑥2
+ 3𝑥 + 10
Verifier
30
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Operationalizing the Solution
• Leverage two polynomials:
• POLY-1 secret, constant: Each hop gets a point on POLY-1
Only the verifier knows POLY-1
• POLY-2 public, random and per packet.
Each hop generates a point on POLY-2 each time a packet
crosses it.
• Each service function calculates (Point on POLY-1 + Point on
POLY-2) to get (Point on POLY-3) and passes it to verifier by
adding it to each packet.
• The verifier constructs POLY-3 from the points given by all the
services and cross checks whether POLY-3 = POLY-1 + POLY-2
• Computationally efficient:
2 additons, 1 multiplication, mod prime per hop
POLY-1
Secret – Constant
POLY-2
Public – Per Packet
+
=
POLY-3
Secret – Per Packet
31
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Meta Data for Service/Path Verification
• Verification secret is the independent
coefficient of POLY-1
• Computation/retrieval through a cumulative
computation at every hop (“cumulative”)
• For POLY-2 the independent coefficient is
carried within the packet (typically a
combination of timestamp and random
number)
• n bits can service a maximum of 2n packets
• Verification secret and POLY-2 coefficient
(“random”) are of the same size
• Secret size is bound by prime number
Transfer
Rate
RND/
Secret
Size
Max # of packets
(assuming 64 byte
packets)
Time that “random” lasts at
maximum
1 Gbps 64
10 Gbps 64
100 Gbps 64
10 Gbps 56
10 Gbps 48
10 Gbps 40
1 Gbps 32 2200 seconds, 36 minutes
10 Gbps 32 220 seconds, 3.5 minutes
100 GBps 32 22 seconds
32
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Meta-Data Provisioning
• Meta-Data for Service Chain Verification
(POT) provisioned through a controller
(OpenDaylight App)
• Netconf/YANG based protocol
• Provisioned information from Controller to
Service Function / Verifier
• Service-Chain-Identifier
(to be mapped to service chaining technology
specific identifier by network element)
• Service count (number of services in the chain)
• 2 x POT-key-set (even and odd set)
• Secret (in case of communication to the verifier)
• Share of a secret, service index
• 2nd polynomial coefficients
• Prime number
Service Chain Verification App
S3 VerifierS2S1
POT-key-sets:
Prime
secret share
poly-2
POT-key-sets:
Prime
secret share
poly-2
POT-key-sets:
Prime
secret share
poly-2
POT-key-sets:
Secret
Prime
secret share
poly-2
Verification request for
a particular service chain
33
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
• 16* Bytes of Meta-Data for POT
• Random – Unique random number
(e.g. Timestamp or combination of
Timestamp and Sequence number)
• Cumulative (algorithm dependent)
• Transport options for different protocols
• Segment Routing: New TLV in SRH header
• Network Service Header: Type-2 Meta-Data
• In-band OAM for IPv6:
Proof-of-transit extension header
• VXLAN-GPE
Proof-of-transit embedded-telemetry header
• ... more to be added (incl. IPv4)
Proof of Transit: Meta-Data Transport Options
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Random |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Random (contd) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cumulative |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cumulative (contd) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*Note: Smaller numbers are feasible, but require a more
frequent renewal of the polynomials/secrets.
2nd Polynomial
Interative computation of secret
34
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
IOAM Data with E2E focus:
Sequence Numbers
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Transport Options – IPv6, VXLAN-GPE, SRv6, NSH...
• IPv6
• Native v6 HbyH extension header
• Double-encapsulation:
src=encap-node, dst=original
• VXLAN-GPE: Embedded
telemetry protocol header;
• NSH: Type-2 Meta-Data
• SRv6: In-band OAM TLV
in v6 SR-header SRH
... additional encaps are in the
works, incl. GRE,...
36
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Configuration And Data Export
37
• In-band OAM Configuration and
Data Exports included in IETF
LIME WG Connectionless OAM
YANG models
• draft-ietf-lime-yang-
connectionless-oam-03
• draft-ietf-lime-yang-
connectionless-oam-methods-00
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Implementation Approach
• In-band OAM mechanisms for IP (route recording) have been proposed in the
past, but were always received with skepticism
• Performance concerns
• Footprint for a new technology (incl. new packet header) vs. installed base:
“Is there a sufficiently large greenfield network to allow for the change?”
• Let’s stop arguing and go try…
39
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
In-Band OAM Implementation
• Dataplane Implementation:
• FD.io/VPP (see fd.io)
• IOS (ISR-G2) – PI31 (CCO: End of July/16)
– In-band OAM Config Guide for IOS
• IOSv/VIRL
• Controller Implementation:
• OpenDaylight (Carbon release)
• Supporting information for in-band OAM:
https://github.com/CiscoDevNet/iOAM
40
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Introducing Vector Packet Processor - VPP
• VPP is a rapid packet processing development platform for
highly performing network applications.
• It runs on commodity CPUs and leverages DPDK
• It creates a vector of packet indices and processes them
using a directed graph of nodes – resulting in a highly
performant solution.
• Runs as a Linux user-space application
• Ships as part of both embedded & server products, in
volume; Active development since 2002
• Base iOAM code already available in fd.io open
repositories (more coming soon)
• See also: FD.IO (The Fast Data Project) Network IO
Packet Processing: VPP
Management Agent
NC/Y REST ...
Some initial iOAM already in FD.IO:
https://gerrit.fd.io/r/gitweb?p=vpp.git;a=blob_plain;f=vnet/vnet/ip/ip6_hop_by_hop.c;hb=HEAD
BRKSDN-2901 41
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
IOAM in VPP (native IPv6 encap)
DPDK
eth-
input
VPP
Ip6-
input
Ip6-
lookup
Ip6-hop-
by-hop
Ip6-add-
hop-by-
hop
Ip6-pop-
hop-by-
hop
Ip6-
rewrite
error-
drop
int-
output
Tengigabitethernet
Tengigabitethernet
Tengigabitethernet
Tengigabitethernet
Management Agent
dpdk-
input
`
PacketVector
API
iOAM data
Collector
` `
Shared memory bus
BRKSDN-2901 42
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
In-Band OAM Test Drive
• Extended Ping
R5#ping
Protocol [ip]: ipv6
Target IPv6 address: ::b:1:0:0:8
Repeat count [5]: 1
Datagram size [100]:
Timeout in seconds [2]:
Extended commands? [no]: y
Source address or interface:
UDP protocol? [no]:
Verbose? [no]:
Precedence [0]:
DSCP [0]:
Include hop by hop Path Record option? [no]: y
Sweep range of sizes? [no]:
% Using size of 296 to accomodate extension headers
Type escape sequence to abort.
Sending 5, 296-byte ICMP Echos to ::B:1:0:0:8, timeout is 2 seconds:
5(5)----------(3)7(4)----------(3)8(5)----------(5)8(3)----------
(4)6(3)----------(5)5!
Success rate is 100 percent (1/1), round-trip min/avg/max = 4/6/10 ms
ingress i/f
node-id
egress i/f
R5
R7
R6
R8
::b:1:0:0:7
node-id 7
::b:1:0:0:6
node-id 6
::b:1:0:0:8
node-id 8
::b:1:0:0:5
node-id 5
ipv6 ioam path-record
ipv6 ioam node-id <node id>
43
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Performance Test Results (native IPv6 encap)
In-band OAM with no performance degradation
IXIA
(TX)
IXIA
(RX)
R1
ISR 3945
R2
ISR 3945
R3
ISR 3945
Encap Transit Decap
CPU Utilization in % at 600Mbps/no drops/IMIX traffic – 100 flows
44
Traffic
Bi Dir
Frame size
in Bytes
Traffic Load
in %
Loss
in %
RX
Throughput
in mbps
Latency
(ns)
AVG
Latency
(ns)
MIN
Latency
(ns)
MAX
CPU UTIL %
ENCAP NODE
(R1)
CPU UTIL %
Inter NODE
(R2)
CPU UTIL %
DECAP NODE
(R3)
CEF IPv6 imix 60 0 1131 187401 54260 921680 23 23 23
GRE+IPv6 imix 60 0.04 1138 186753 56060 923120 24 24 25
iOAM6 imix 60 0 1138 186671 40640 917780 27 24 26
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Network Operations and SLA diagnostics
In-Band OAM as part of a larger ecosystem
Examples of enhanced use-cases
• SLA verification
• Service chain verification
• Identifying the reason for path
verification failure (triggered OAM)
• SLA check in overlay networks
• Efficient fault detection and fault
isolaton
• Smart service-selection
45
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 46
Node A
Node B
Node C
Verifier
Node D
Host 1
Host 3
Host 2
VPP
VPP
VPP
VPP
pmacct
Apache Kafka
OpenDaylight
Elasticsearch
Logstash
Kafka
IOAM:
Decap
& Verify
IOAM:
Transit
IOAM:
encap
IOAM event control IOAM visualization
Payload
Hdr
Payload
Hdr
r=45/c=0
A 1
Payload
Hdr
r=45/c=17
A 1
D 3
1
3
42
Payload
Hdr
Data
Export
IPFIX,
kafka
Control
Telemetry/
OAM data
Path Verified
Visualization & Analytics
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Example: OAM Analytics / SLA check
Identifying network & service chain bottlenecks
48
Host 1
Host 3
Host 2
Observation: Suddenly connectivity issues
between Host 1 and Host 2 – SLA violated
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Delay A-B
Detailed path tracing to identify the reason
49
Service B
Host 1
Host 3
Host 2
Service A
Service C
Node Z
Delay B-C
Delay Z-CDelay A-Z
Observation
• Original path was
A-B-C and fast
• At time t0 a path
change happened:
Traffic rerouted to
A-Z-C
• Either Link A-Z is a
low bandwidth link
causing packet
drops and/or Node
Z is overloaded
t0
t0 t0
t0
! large
delay
! loss
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Per-link delay reveals root cause:
Route change to a low bandwidth link
Delay
1-2
Delay
2-3
Delay
1-4
Delay
4-3
50
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Overlay Networks:
Checking SLA Compliance on the real traffic
51
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Active Network Probing:
Objective: Fast Failure Detection and Isolation
Current situation:
• Failure detection takes 10s of seconds in large
networks
• Failure isolation (using ping and traceroute) takes
several minutes: Probing based on traceroute is
slow.
Objective & Approach
• Significantly improve failure detection and isolation
times.
• Active network probing using UDP probe with in-
band OAM
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Normal network operation
A
B
D
C
E
F A
B
D
C
E
F
Customer traffic Continous end point probing
using probes similar to customer traffic
(i.e. same ports)
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Network failure isolation
A
B
D
C
E
F
Observation from in-band OAM data:
Only subset of overall traffic arrives at F.
Detected either from live customer traffic
or probe traffic, or both.
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Network failure detection:
Probing with integrated loopback
A
B
D
C
E
F A
B C
E
F
Active network topology detected
through probing
1
2
3
4
5
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Network failure isolation:
Correlate detected forwarding topology with original
network topology
A
B
D
C
E
F A
B C
E
F
Failed link
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
iOAM Ping UDP-Probe and Loopback Flag
59Presentation ID
IPv6 Header
IPv6 IOAM HbyH Hdr
UDP Hdr
UDP Probe Hdr
https://tools.ietf.org/html/draft-lapukhov-dataplane-probe-01
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
 Highly redundant micro-services
(e.g. video-chunck servers)
hosted as containers in multiple
public clouds
 All Services have an IPv6 address.
All Services share the same
secondary anycast address.
 Performance characteristics of
individual service instances differ:
Access latencies, server load,
service load, service liveliness
 Client needs to choose an
appropriate service to connect to
Service Selection: Problem Statement
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
 Introduce M-Anycast Server
 Leverage Segment Routing to steer
traffic, in-band OAM for optimized
service selection
 M-Anycast Server:
 Hosts the Anycast address of
the services
 Intercepts TCP-SYN, replicates the
SYN and sends to a selected subset of
all services using SR
 Chooses an appropriate SYN-ACK
using embedded in-band OAM data and
forwards that SYN-ACK to the client
Service Selection: Solution Concept
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Service Selection: Solution Concept
VPP
Service S1
Service S2
Service S3
VPP
Service S4
Service S5
Service S6
VPP
Service S7
Service S8
Service S9
VPP
Service S10
Service S11
Service S12
Cloud 1
(e.g. AWS)
Cloud 2
(e.g. Azure)
Fast
Very Fast
Defunct
Defunct
Defunct
Very Fast
Very Fast
Very Fast
Fast
ok
Very Fast
ok
Provider Network (e.g. Comcast)
Client
Server 1
Server 2
Server 3
Server 4
VPP
M-Anycast Server
SYN
1
SYN
1
SYN
1
SYN1
SYN-ACK
2
SYN-ACK 2
SYN-ACK
2
ACK
3 4
Direct connection to
service – no proxy
Choose
Service 11
2
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 64BRKSDN-2901
M-
ANY
C1
S1
S2
S3
 Highly resilient video playout
combining IPv6 addressible video
services with M-anycast as an
efficient and fail safe service
selection and load-balancing
method
 6CN: IPv6 addressible video-
segments form the service
 M-Anycast solution implemented in
FD.io/VPP:
 M-Anycast server – Server selector with
IOAM and SRv6 spray functions
 VPP co-located with client and servers to
perform SRv6 and IOAM functions
Demo - Overview
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 65BRKSDN-2901
Demo Video: https://youtu.be/-jqww8ydWQk
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
In-Band OAM – Implementation Status
• Dataplane Implementation:
• IOS
• IOS (ISR-G2) – PI31 (CCO: End of July/16) –
In-band OAM Config Guide for IOS
• IOSv/VIRL
• OpenSource
• FD.io/VPP (see fd.io)
• OpenDaylight Control App (proof of transit / tracing)
• Supporting information for in-band OAM:
https://github.com/CiscoDevNet/iOAM
• Standardization IETF
• Authored by: Cisco, Comcast, Facebook, JPMC, Bell
Canada, Mellanox, Marvell, Barefoot, rtBrick
• Documents:
• In-band OAM requirements: https://tools.ietf.org/html/draft-brockners-
inband-oam-requirements-03.txt
• In-band OAM data types: https://tools.ietf.org/html/draft-brockners-
inband-oam-data-04.txt
• In-band OAM transport: https://tools.ietf.org/html/draft-brockners-
inband-oam-transport-03.txt
• Proof-of-transit: https://tools.ietf.org/html/draft-brockners-proof-of-
transit-03.txt
67
• Videos:
Google+ In-Band OAM group:
https://plus.google.com/u/0/b/112958873072003542518/1129588730720035
42518/videos?hl=en
Youtube In-Band OAM channel:
https://www.youtube.com/channel/UC0WJOAKBTrftyosP590RrXw
• Blogs:
blogs.cisco.com/getyourbuildon/a-trip-recorder-for-all-your-traffic
blogs.cisco.com/getyourbuildon/verify-my-service-chain
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
In-Band OAM: Summary
• Enhanced visibility for all your traffic:
New sources of data for SDN applications
• Network provided telemetry data gathered and added to live data
• Complement out-of-band OAM tools like ping and traceroute
• Path / Service chain verification
• Record the packet’s trip as meta-data within the packet
• Record path and node (i/f, time, app-data) specific data hop-by-hop and end to end
• Export telemetry data via Netflow/IPFIX/Kafka to Controller/Apps
• In-band OAM can be implemented without forwarding performance degradation
• IOS and OpenSource (FD.io/VPP, OpenDaylight) Implementations
68
Thank You

Weitere ähnliche Inhalte

Was ist angesagt?

APNIC Updates
APNIC UpdatesAPNIC Updates
APNIC UpdatesMyNOG
 
Multi-operator "IPC" VPN Slices: Applying RINA to Overlay Networking
Multi-operator "IPC" VPN Slices: Applying RINA to Overlay NetworkingMulti-operator "IPC" VPN Slices: Applying RINA to Overlay Networking
Multi-operator "IPC" VPN Slices: Applying RINA to Overlay NetworkingARCFIRE ICT
 
DIY Netflow Data Analytic with ELK Stack by CL Lee
DIY Netflow Data Analytic with ELK Stack by CL LeeDIY Netflow Data Analytic with ELK Stack by CL Lee
DIY Netflow Data Analytic with ELK Stack by CL LeeMyNOG
 
DDoS Mitigation using BGP Flowspec
DDoS Mitigation using BGP Flowspec DDoS Mitigation using BGP Flowspec
DDoS Mitigation using BGP Flowspec APNIC
 
Segment Routing: Prepare Your Network For New Business Models
Segment Routing:  Prepare Your Network For New Business ModelsSegment Routing:  Prepare Your Network For New Business Models
Segment Routing: Prepare Your Network For New Business ModelsCisco Service Provider
 
SP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail Ali
SP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail AliSP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail Ali
SP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail AliMyNOG
 
Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...
Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...
Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...Cloud Native Day Tel Aviv
 
Service Chaining overview (English) 2015/10/05
Service Chaining overview (English) 2015/10/05Service Chaining overview (English) 2015/10/05
Service Chaining overview (English) 2015/10/05Kentaro Ebisawa
 
Traffic Engineering for CDNs
Traffic Engineering for CDNsTraffic Engineering for CDNs
Traffic Engineering for CDNsMyNOG
 
Traffic Engineering Using Segment Routing
Traffic Engineering Using Segment Routing Traffic Engineering Using Segment Routing
Traffic Engineering Using Segment Routing Cisco Canada
 
MPLS SDN NFV WORLD'17 - SDN NFV deployment update
MPLS SDN NFV WORLD'17 - SDN NFV deployment updateMPLS SDN NFV WORLD'17 - SDN NFV deployment update
MPLS SDN NFV WORLD'17 - SDN NFV deployment updateStephane Litkowski
 
Internet Noise (A Story About Two Little Subnets - Tom Paseka
Internet Noise (A Story About Two Little Subnets - Tom PasekaInternet Noise (A Story About Two Little Subnets - Tom Paseka
Internet Noise (A Story About Two Little Subnets - Tom PasekaMyNOG
 
Building Business on Top of Open Source
Building Business on Top of Open SourceBuilding Business on Top of Open Source
Building Business on Top of Open SourceOpen Networking Summit
 

Was ist angesagt? (20)

Software Defined RAN
Software Defined RANSoftware Defined RAN
Software Defined RAN
 
APNIC Updates
APNIC UpdatesAPNIC Updates
APNIC Updates
 
Multi-operator "IPC" VPN Slices: Applying RINA to Overlay Networking
Multi-operator "IPC" VPN Slices: Applying RINA to Overlay NetworkingMulti-operator "IPC" VPN Slices: Applying RINA to Overlay Networking
Multi-operator "IPC" VPN Slices: Applying RINA to Overlay Networking
 
DIY Netflow Data Analytic with ELK Stack by CL Lee
DIY Netflow Data Analytic with ELK Stack by CL LeeDIY Netflow Data Analytic with ELK Stack by CL Lee
DIY Netflow Data Analytic with ELK Stack by CL Lee
 
Microservice Powered Orchestration
Microservice Powered OrchestrationMicroservice Powered Orchestration
Microservice Powered Orchestration
 
MENOG-Segment Routing Introduction
MENOG-Segment Routing IntroductionMENOG-Segment Routing Introduction
MENOG-Segment Routing Introduction
 
Building Hyperscale Networks
Building Hyperscale NetworksBuilding Hyperscale Networks
Building Hyperscale Networks
 
DDoS Mitigation using BGP Flowspec
DDoS Mitigation using BGP Flowspec DDoS Mitigation using BGP Flowspec
DDoS Mitigation using BGP Flowspec
 
Segment Routing: Prepare Your Network For New Business Models
Segment Routing:  Prepare Your Network For New Business ModelsSegment Routing:  Prepare Your Network For New Business Models
Segment Routing: Prepare Your Network For New Business Models
 
SP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail Ali
SP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail AliSP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail Ali
SP Routing Innovation with Segment Routing, VXLAN and EVPN - Ismail Ali
 
IETF 79 - Diameter Over SCTP
IETF 79 - Diameter Over SCTPIETF 79 - Diameter Over SCTP
IETF 79 - Diameter Over SCTP
 
Rina2020 michal
Rina2020 michalRina2020 michal
Rina2020 michal
 
Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...
Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...
Barak Perlman, ConteXtream - SFC (Service Function Chaining) Using Openstack ...
 
Service Chaining overview (English) 2015/10/05
Service Chaining overview (English) 2015/10/05Service Chaining overview (English) 2015/10/05
Service Chaining overview (English) 2015/10/05
 
Traffic Engineering for CDNs
Traffic Engineering for CDNsTraffic Engineering for CDNs
Traffic Engineering for CDNs
 
Container Service Chaining
Container Service ChainingContainer Service Chaining
Container Service Chaining
 
Traffic Engineering Using Segment Routing
Traffic Engineering Using Segment Routing Traffic Engineering Using Segment Routing
Traffic Engineering Using Segment Routing
 
MPLS SDN NFV WORLD'17 - SDN NFV deployment update
MPLS SDN NFV WORLD'17 - SDN NFV deployment updateMPLS SDN NFV WORLD'17 - SDN NFV deployment update
MPLS SDN NFV WORLD'17 - SDN NFV deployment update
 
Internet Noise (A Story About Two Little Subnets - Tom Paseka
Internet Noise (A Story About Two Little Subnets - Tom PasekaInternet Noise (A Story About Two Little Subnets - Tom Paseka
Internet Noise (A Story About Two Little Subnets - Tom Paseka
 
Building Business on Top of Open Source
Building Business on Top of Open SourceBuilding Business on Top of Open Source
Building Business on Top of Open Source
 

Ähnlich wie Next-gen Network Telemetry is Within Your Packets: In-band OAM

Design and Deployment of Enterprise WLANs
Design and Deployment of Enterprise WLANsDesign and Deployment of Enterprise WLANs
Design and Deployment of Enterprise WLANsFab Fusaro
 
Model-driven Telemetry: The Foundation of Big Data Analytics
Model-driven Telemetry: The Foundation of Big Data AnalyticsModel-driven Telemetry: The Foundation of Big Data Analytics
Model-driven Telemetry: The Foundation of Big Data AnalyticsCisco Canada
 
Cisco Connect Toronto 2017 - Model-driven Telemetry
Cisco Connect Toronto 2017 - Model-driven TelemetryCisco Connect Toronto 2017 - Model-driven Telemetry
Cisco Connect Toronto 2017 - Model-driven TelemetryCisco Canada
 
M1-C17-Armando una red.pptx
M1-C17-Armando una red.pptxM1-C17-Armando una red.pptx
M1-C17-Armando una red.pptxAngel Garcia
 
17 - Building small network.pdf
17 - Building small network.pdf17 - Building small network.pdf
17 - Building small network.pdfPhiliphaHaldline
 
F5 Solutions for Service Providers
F5 Solutions for Service ProvidersF5 Solutions for Service Providers
F5 Solutions for Service ProvidersBAKOTECH
 
ITN_Module_17.pptx
ITN_Module_17.pptxITN_Module_17.pptx
ITN_Module_17.pptxssuserf7cd2b
 
Dynamic Service Chaining
Dynamic Service Chaining Dynamic Service Chaining
Dynamic Service Chaining Tail-f Systems
 
Cisco connect winnipeg 2018 a look at network assurance in dna center
Cisco connect winnipeg 2018   a look at network assurance in dna centerCisco connect winnipeg 2018   a look at network assurance in dna center
Cisco connect winnipeg 2018 a look at network assurance in dna centerCisco Canada
 
Model driven telemetry
Model driven telemetryModel driven telemetry
Model driven telemetryCisco Canada
 
Exhibitor session: Ciena
Exhibitor session: CienaExhibitor session: Ciena
Exhibitor session: CienaJisc
 
Addressing Network Operator Challenges in YANG push Data Mesh Integration
Addressing Network Operator Challenges in YANG push Data Mesh IntegrationAddressing Network Operator Challenges in YANG push Data Mesh Integration
Addressing Network Operator Challenges in YANG push Data Mesh IntegrationThomasGraf42
 
DEVNET-1166 Open SDN Controller APIs
DEVNET-1166	Open SDN Controller APIsDEVNET-1166	Open SDN Controller APIs
DEVNET-1166 Open SDN Controller APIsCisco DevNet
 
A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...
A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...
A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...Luca Muscariello
 
Gain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC NetworkingGain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC NetworkingCisco Canada
 
Cisco DC Networking: Gain Insight and Programmability with
Cisco DC Networking: Gain Insight and Programmability with Cisco DC Networking: Gain Insight and Programmability with
Cisco DC Networking: Gain Insight and Programmability with Cisco Canada
 
Gain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC NetworkingGain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC NetworkingCisco Canada
 
Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...
Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...
Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...Positive Hack Days
 
Application Visibility and Experience through Flexible Netflow
Application Visibility and Experience through Flexible NetflowApplication Visibility and Experience through Flexible Netflow
Application Visibility and Experience through Flexible NetflowCisco DevNet
 

Ähnlich wie Next-gen Network Telemetry is Within Your Packets: In-band OAM (20)

Design and Deployment of Enterprise WLANs
Design and Deployment of Enterprise WLANsDesign and Deployment of Enterprise WLANs
Design and Deployment of Enterprise WLANs
 
Model-driven Telemetry: The Foundation of Big Data Analytics
Model-driven Telemetry: The Foundation of Big Data AnalyticsModel-driven Telemetry: The Foundation of Big Data Analytics
Model-driven Telemetry: The Foundation of Big Data Analytics
 
Cisco Connect Toronto 2017 - Model-driven Telemetry
Cisco Connect Toronto 2017 - Model-driven TelemetryCisco Connect Toronto 2017 - Model-driven Telemetry
Cisco Connect Toronto 2017 - Model-driven Telemetry
 
M1-C17-Armando una red.pptx
M1-C17-Armando una red.pptxM1-C17-Armando una red.pptx
M1-C17-Armando una red.pptx
 
17 - Building small network.pdf
17 - Building small network.pdf17 - Building small network.pdf
17 - Building small network.pdf
 
F5 Solutions for Service Providers
F5 Solutions for Service ProvidersF5 Solutions for Service Providers
F5 Solutions for Service Providers
 
CCNA part 1 osi
CCNA part 1 osiCCNA part 1 osi
CCNA part 1 osi
 
ITN_Module_17.pptx
ITN_Module_17.pptxITN_Module_17.pptx
ITN_Module_17.pptx
 
Dynamic Service Chaining
Dynamic Service Chaining Dynamic Service Chaining
Dynamic Service Chaining
 
Cisco connect winnipeg 2018 a look at network assurance in dna center
Cisco connect winnipeg 2018   a look at network assurance in dna centerCisco connect winnipeg 2018   a look at network assurance in dna center
Cisco connect winnipeg 2018 a look at network assurance in dna center
 
Model driven telemetry
Model driven telemetryModel driven telemetry
Model driven telemetry
 
Exhibitor session: Ciena
Exhibitor session: CienaExhibitor session: Ciena
Exhibitor session: Ciena
 
Addressing Network Operator Challenges in YANG push Data Mesh Integration
Addressing Network Operator Challenges in YANG push Data Mesh IntegrationAddressing Network Operator Challenges in YANG push Data Mesh Integration
Addressing Network Operator Challenges in YANG push Data Mesh Integration
 
DEVNET-1166 Open SDN Controller APIs
DEVNET-1166	Open SDN Controller APIsDEVNET-1166	Open SDN Controller APIs
DEVNET-1166 Open SDN Controller APIs
 
A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...
A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...
A Transport Layer and Socket API for (h)ICN: Design, Implementation and Perfo...
 
Gain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC NetworkingGain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC Networking
 
Cisco DC Networking: Gain Insight and Programmability with
Cisco DC Networking: Gain Insight and Programmability with Cisco DC Networking: Gain Insight and Programmability with
Cisco DC Networking: Gain Insight and Programmability with
 
Gain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC NetworkingGain Insight and Programmability with Cisco DC Networking
Gain Insight and Programmability with Cisco DC Networking
 
Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...
Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...
Обнаружение вредоносного кода в зашифрованном с помощью TLS трафике (без деши...
 
Application Visibility and Experience through Flexible Netflow
Application Visibility and Experience through Flexible NetflowApplication Visibility and Experience through Flexible Netflow
Application Visibility and Experience through Flexible Netflow
 

Mehr von Open Networking Summit

Considerations for Deploying Virtual Network Functions and Services
Considerations for Deploying Virtual Network Functions and ServicesConsiderations for Deploying Virtual Network Functions and Services
Considerations for Deploying Virtual Network Functions and ServicesOpen Networking Summit
 
Open Source Networking Solving Molecular Analysis of Cancer
Open Source Networking Solving Molecular Analysis of CancerOpen Source Networking Solving Molecular Analysis of Cancer
Open Source Networking Solving Molecular Analysis of CancerOpen Networking Summit
 
Five Trends Enabled by 5G that will Change Networking Forever
Five Trends Enabled by 5G that will Change Networking ForeverFive Trends Enabled by 5G that will Change Networking Forever
Five Trends Enabled by 5G that will Change Networking ForeverOpen Networking Summit
 
Networking Challenges for the Next Decade
Networking Challenges for the Next DecadeNetworking Challenges for the Next Decade
Networking Challenges for the Next DecadeOpen Networking Summit
 
A Centrally Orchestrated SD-WAN Building a Green Ecosystem
A Centrally Orchestrated SD-WAN Building a Green EcosystemA Centrally Orchestrated SD-WAN Building a Green Ecosystem
A Centrally Orchestrated SD-WAN Building a Green EcosystemOpen Networking Summit
 
SDN-Based Enterprise Connectivity Service
SDN-Based Enterprise Connectivity ServiceSDN-Based Enterprise Connectivity Service
SDN-Based Enterprise Connectivity ServiceOpen Networking Summit
 
Open and Disaggregated Transport SDN - from PoC to Field Trial
Open and Disaggregated Transport SDN - from PoC to Field TrialOpen and Disaggregated Transport SDN - from PoC to Field Trial
Open and Disaggregated Transport SDN - from PoC to Field TrialOpen Networking Summit
 
Disaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High AvailabilityDisaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High AvailabilityOpen Networking Summit
 
IoT in Action: Architecting, Securing, & Scaling Applications
IoT in Action: Architecting, Securing, & Scaling ApplicationsIoT in Action: Architecting, Securing, & Scaling Applications
IoT in Action: Architecting, Securing, & Scaling ApplicationsOpen Networking Summit
 
Open Source Approach to Design and Deployment of Microservices-based VNF
Open Source Approach to Design and Deployment of Microservices-based VNFOpen Source Approach to Design and Deployment of Microservices-based VNF
Open Source Approach to Design and Deployment of Microservices-based VNFOpen Networking Summit
 
OpenStack: Networking Roadmap, Collaboration and Contribution
OpenStack: Networking Roadmap, Collaboration and ContributionOpenStack: Networking Roadmap, Collaboration and Contribution
OpenStack: Networking Roadmap, Collaboration and ContributionOpen Networking Summit
 
Arachne: How does Uber check the health of its Network Infrastructure every 1...
Arachne: How does Uber check the health of its Network Infrastructure every 1...Arachne: How does Uber check the health of its Network Infrastructure every 1...
Arachne: How does Uber check the health of its Network Infrastructure every 1...Open Networking Summit
 
Troubleshooting for Intent-based Networking
Troubleshooting for Intent-based NetworkingTroubleshooting for Intent-based Networking
Troubleshooting for Intent-based NetworkingOpen Networking Summit
 
The Interoperability Challenge in Telecom and NFS Environments
The Interoperability Challenge in Telecom and NFS EnvironmentsThe Interoperability Challenge in Telecom and NFS Environments
The Interoperability Challenge in Telecom and NFS EnvironmentsOpen Networking Summit
 

Mehr von Open Networking Summit (20)

Considerations for Deploying Virtual Network Functions and Services
Considerations for Deploying Virtual Network Functions and ServicesConsiderations for Deploying Virtual Network Functions and Services
Considerations for Deploying Virtual Network Functions and Services
 
Design Principles for 5G
Design Principles for 5GDesign Principles for 5G
Design Principles for 5G
 
Disaggregation @Equinix
Disaggregation @EquinixDisaggregation @Equinix
Disaggregation @Equinix
 
Open Source Networking Solving Molecular Analysis of Cancer
Open Source Networking Solving Molecular Analysis of CancerOpen Source Networking Solving Molecular Analysis of Cancer
Open Source Networking Solving Molecular Analysis of Cancer
 
Harmonizing of Open Source Networking
Harmonizing of Open Source NetworkingHarmonizing of Open Source Networking
Harmonizing of Open Source Networking
 
Five Trends Enabled by 5G that will Change Networking Forever
Five Trends Enabled by 5G that will Change Networking ForeverFive Trends Enabled by 5G that will Change Networking Forever
Five Trends Enabled by 5G that will Change Networking Forever
 
Container Networking
Container NetworkingContainer Networking
Container Networking
 
Networking Challenges for the Next Decade
Networking Challenges for the Next DecadeNetworking Challenges for the Next Decade
Networking Challenges for the Next Decade
 
A Centrally Orchestrated SD-WAN Building a Green Ecosystem
A Centrally Orchestrated SD-WAN Building a Green EcosystemA Centrally Orchestrated SD-WAN Building a Green Ecosystem
A Centrally Orchestrated SD-WAN Building a Green Ecosystem
 
SDN-Based Enterprise Connectivity Service
SDN-Based Enterprise Connectivity ServiceSDN-Based Enterprise Connectivity Service
SDN-Based Enterprise Connectivity Service
 
Open and Disaggregated Transport SDN - from PoC to Field Trial
Open and Disaggregated Transport SDN - from PoC to Field TrialOpen and Disaggregated Transport SDN - from PoC to Field Trial
Open and Disaggregated Transport SDN - from PoC to Field Trial
 
Disaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High AvailabilityDisaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High Availability
 
IoT in Action: Architecting, Securing, & Scaling Applications
IoT in Action: Architecting, Securing, & Scaling ApplicationsIoT in Action: Architecting, Securing, & Scaling Applications
IoT in Action: Architecting, Securing, & Scaling Applications
 
Open Source Approach to Design and Deployment of Microservices-based VNF
Open Source Approach to Design and Deployment of Microservices-based VNFOpen Source Approach to Design and Deployment of Microservices-based VNF
Open Source Approach to Design and Deployment of Microservices-based VNF
 
OpenStack: Networking Roadmap, Collaboration and Contribution
OpenStack: Networking Roadmap, Collaboration and ContributionOpenStack: Networking Roadmap, Collaboration and Contribution
OpenStack: Networking Roadmap, Collaboration and Contribution
 
Arachne: How does Uber check the health of its Network Infrastructure every 1...
Arachne: How does Uber check the health of its Network Infrastructure every 1...Arachne: How does Uber check the health of its Network Infrastructure every 1...
Arachne: How does Uber check the health of its Network Infrastructure every 1...
 
What a difference 5 years make
What a difference 5 years makeWhat a difference 5 years make
What a difference 5 years make
 
Harmonizing of Open Source Networking
Harmonizing of Open Source NetworkingHarmonizing of Open Source Networking
Harmonizing of Open Source Networking
 
Troubleshooting for Intent-based Networking
Troubleshooting for Intent-based NetworkingTroubleshooting for Intent-based Networking
Troubleshooting for Intent-based Networking
 
The Interoperability Challenge in Telecom and NFS Environments
The Interoperability Challenge in Telecom and NFS EnvironmentsThe Interoperability Challenge in Telecom and NFS Environments
The Interoperability Challenge in Telecom and NFS Environments
 

Kürzlich hochgeladen

Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfOverkill Security
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamUiPathCommunity
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Zilliz
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Victor Rentea
 
Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024The Digital Insurer
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century educationjfdjdjcjdnsjd
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdfSandro Moreira
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistandanishmna97
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusZilliz
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...Zilliz
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...apidays
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...apidays
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native ApplicationsWSO2
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Orbitshub
 

Kürzlich hochgeladen (20)

Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistan
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
 

Next-gen Network Telemetry is Within Your Packets: In-band OAM

  • 1. Next-gen Network Telemetry is Within Your Packets: In-band OAM Frank Brockners Open Networking Summit 2017
  • 2. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Let’s assume you’re interested in the behavior of your live user-data traffic. What is the best source of information?
  • 3. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Well… probably the live user-data traffic itself.
  • 4. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public In-band OAM (a.k.a. “in situ OAM”) • OAM traffic embedded in the data traffic but not part of the payload of the packet • OAM “effected by data traffic” • Example: IPv4 route recording Out-of-band OAM • OAM traffic is sent as dedicated traffic, independent from the data traffic (“probe traffic”) • OAM “not effected by data traffic” • Examples: Ethernet CFM (802.1ag), Ping, Traceroute How to send OAM information in packet networks? “On-Board Unit” Speed control by police car 4
  • 5. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Let’s add meta-data to all interesting live user-data traffic.
  • 6. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Remember RFC 791? 6
  • 7. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public More recently: In-band Network Telemetry for P4 http://p4.org/wp-content/uploads/fixed/INT/INT-current-spec.pdf 7
  • 8. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public In-Band OAM - Motivation • Service/Quality Assurance • Prove traffic SLAs, as opposed to probe-traffic SLAs; Overlay/Underlay • Service/Path Verification (Proof of Transit) – prove that traffic follows a pre-defined path • Micro-Service/NFV deployments • Smart service selection based on network criteria (intelligent Anycast server/service selection) • Operations Support • Network Fault Detection and Fault Isolation through efficient network probing • Path Tracing – debug ECMP, brown-outs, network delays • Derive Traffic Matrix • Custom/Service Level Telemetry “Most large ISP's prioritize Speedtest traffic and I would even go as far to say they probably route it faster as well to keep ping times low.” Source: https://www.reddit.com/r/AskTechnology/comments/2i1nxc/ can_i_trust_my_speedtestnet_results_when_my_isp/ 8
  • 9. AgendaIn-Band OAM Solution Ecosystem & Advanced Use-Cases A Peek at the Implementation – IOS and OpenSource In-Band OAM – Technology & Evolving Standards Why In-Band OAM? – Use-Case Examples
  • 10. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Example: SLA Verification • Overlay Networks, Service chains / path have associated SLA • KPIs for overlay networks and service chains are end-to-end delay, jitter and packet drops • For Overlay Networks and NFV service chaining SLA-check is still very nacent • Either no end-to-end service chain SLA verification or SLA verification is based on probes (IPSLA) which can be easily cheated upon • Common interpretation is service-chain: Health = VM health • Approach: In-band monitoring of customer traffic 10
  • 11. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 11BRKSDN-2901 Example: Proof of Transit Consider TE, Service Chaining, Policy Based Routing, etc...
  • 12. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 12BRKSDN-2901 Example: Proof of Transit Consider TE, Service Chaining, Policy Based Routing, etc... “How do you prove that traffic follows the suggested path?”
  • 13. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public “… Willis says the first issue is connecting VNFs to the infrastructure. OpenStack does this in a sequential manner, with the sequence serially numbered in the VNF, but the difficulty comes when trying to verify that the LAN has been connected to the correct LAN port, the WAN has been connected to the correct WAN port and so on. "If we get this wrong for a firewall function it could be the end of a CIO's career," says Willis.” http://www.lightreading.com/nfv/nfv-specs-open-source/bt-threatens-to-ditch-openstack/d/d-id/718735 October 14, 2015 Light reading citing Peter Willis, Chief researcher for data networks, British Telecom PSOSDN-2901 13
  • 14. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Example: Proof-of-Transit • Question: With TE/SFC/PBR: How do you prove that traffic follows the correct path? • Approach: OAM Meta-data added to all user traffic • Based on “Share of a secret” • Provisioned by controller over secure channel • Updated at every service hop • Verifier checks whether collected meta-data allows retrieval of secret • Path verified Controller Secret X B CA Verifier 14
  • 15. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Example – Generic customer meta-data: Geo-Location within your packets 15
  • 16. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Example use-cases... • Path Tracing for ECMP networks • Service/Path Verification • SLA proof: Delay, Jitter, Loss • Custom data: Geo-Location,.. • Smart Service Selection • Efficient Failure Detection/Isolation Meta-data required... • Node-ID, ingress i/f, egress i/f • Proof of Transit (random, cumulative) • Sequence numbers, Timestamps • Custom meta-data • Timestamps, custom meta-data • Node-ID, Timestamps What if you could collect operational meta-data within your traffic? 16
  • 17. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public In-Band OAM (IOAM) in a Nutshell • Gather telemetry and OAM information along the path within the data packet, (hence “in-band OAM”) as part of an existing/additional header • No extra probe-traffic (as with ping, trace, IPSLA) • Transport options • IPv6: Native v6 HbyH extension header or double-encap • VXLAN-GPE: Embedded telemetry protocol header • NSH: Type-2 Meta-Data ... additional encapsulations being considered/WIP (incl. SRv6, GRE, MPLS) • Deployment • Domain-ingress, domain-egress, and select devices within a domaininsert/remove/update the extension header • Information export via IPFIX/Flexible-Netflow/publish into Kafka • Fast-path implementation Hdr OAM Payload IOAM domain * FD.io/VPP open source reference implementation available
  • 18. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public IPFIX 1 3 4 5 6 2 A C B D Payload Hdr Payload Hdr Payload Hdr r=45/c=17 A 1 C 4 Payload Hdr r=45/c=39 B A 6 1 C 4 Insert POT meta-data Payload Hdr r=45/c=0 A 1 POT meta-data Path-tracing data Update POT meta-data Update POT meta-data Update POT meta-data POT Verifier 18
  • 19. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Latest IETF Drafts • In-band OAM Authors: Cisco, Comcast, Facebook, JPMC, Bell Canada, Mellanox, Marvell, Barefoot, rtBrick • In-band OAM requirements: https://tools.ietf.org/html/draft- brockners-inband-oam-requirements-03.txt • In-band OAM data types: https://tools.ietf.org/html/draft- brockners-inband-oam-data-04.txt • In-band OAM transport: https://tools.ietf.org/html/draft- brockners-inband-oam-transport-03.txt • Proof-of-transit: https://tools.ietf.org/html/draft-brockners-proof- of-transit-03.txt • In-band OAM manageability – YANG models and methods defined in IETF LIME WG • draft-ietf-lime-yang-connectionless-oam-03 • draft-ietf-lime-yang-connectionless-oam-methods-00
  • 20. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public • Per node scope • Hop-by-Hop information processing • Hop Limit • Node_ID (long/short) • Ingress Interface ID (long/short) • Egress Interface ID (long/short) • Timestamp • Wall clock (seconds, nanoseconds) • Transit delay • Queue length • Opaque data • Application Data (long/short) In-situ OAM Data Fields Overview • Set of nodes scope • Hop-by-Hop information processing • Service Chain Validation (Random, Cumulative) • Edge to Edge scope • Edge-to-Edge information processing • Sequence Number Two transport options: • Pre-allocated array (SW friendly) • Incrementally grown array (HW friendly)
  • 21. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Pre-Allocated & Incremental Trace Option Header (per-node info) Hardware friendlySoftware friendly
  • 22. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Trace Types
  • 23. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public IOAM Data which in only updated by selected nodes: Proof-of-Transit
  • 24. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Proof of Transit: Ensuring Path and/or Service Chain Integrity • Meta-data added to all user traffic • Based on “Share of a secret” • Provisioned by controller over secure channel • Updated at every service hop • Verifier checks whether collected meta-data allows retrieval of secret • Path verified Controller Secret X B CA Verifier 28
  • 25. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Solution Approach: Leveraging Shamir’s Secret Sharing Polynomials 101 - Line: Min 2 points - Parabola: Min 3 points General: It takes k+1 points to defines a polynomial of degree k. 29 - Cubic function: Min 4 points Adi Shamir
  • 26. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Solution Approach: Leverage Shamir’s Secret Sharing “A polynomial as secret” • Each service is given a point on the curve • When the packet travels through each service it collects these points • A verifier can reconstruct the curve using the collected points • Operations done over a finite field (mod prime) to protect against differential analysis (3,46) (2,28) (1,16) X B CA “Secret”: 3𝑥2 + 3𝑥 + 10 3𝑥2 + 3𝑥 + 10 Verifier 30
  • 27. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Operationalizing the Solution • Leverage two polynomials: • POLY-1 secret, constant: Each hop gets a point on POLY-1 Only the verifier knows POLY-1 • POLY-2 public, random and per packet. Each hop generates a point on POLY-2 each time a packet crosses it. • Each service function calculates (Point on POLY-1 + Point on POLY-2) to get (Point on POLY-3) and passes it to verifier by adding it to each packet. • The verifier constructs POLY-3 from the points given by all the services and cross checks whether POLY-3 = POLY-1 + POLY-2 • Computationally efficient: 2 additons, 1 multiplication, mod prime per hop POLY-1 Secret – Constant POLY-2 Public – Per Packet + = POLY-3 Secret – Per Packet 31
  • 28. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Meta Data for Service/Path Verification • Verification secret is the independent coefficient of POLY-1 • Computation/retrieval through a cumulative computation at every hop (“cumulative”) • For POLY-2 the independent coefficient is carried within the packet (typically a combination of timestamp and random number) • n bits can service a maximum of 2n packets • Verification secret and POLY-2 coefficient (“random”) are of the same size • Secret size is bound by prime number Transfer Rate RND/ Secret Size Max # of packets (assuming 64 byte packets) Time that “random” lasts at maximum 1 Gbps 64 10 Gbps 64 100 Gbps 64 10 Gbps 56 10 Gbps 48 10 Gbps 40 1 Gbps 32 2200 seconds, 36 minutes 10 Gbps 32 220 seconds, 3.5 minutes 100 GBps 32 22 seconds 32
  • 29. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Meta-Data Provisioning • Meta-Data for Service Chain Verification (POT) provisioned through a controller (OpenDaylight App) • Netconf/YANG based protocol • Provisioned information from Controller to Service Function / Verifier • Service-Chain-Identifier (to be mapped to service chaining technology specific identifier by network element) • Service count (number of services in the chain) • 2 x POT-key-set (even and odd set) • Secret (in case of communication to the verifier) • Share of a secret, service index • 2nd polynomial coefficients • Prime number Service Chain Verification App S3 VerifierS2S1 POT-key-sets: Prime secret share poly-2 POT-key-sets: Prime secret share poly-2 POT-key-sets: Prime secret share poly-2 POT-key-sets: Secret Prime secret share poly-2 Verification request for a particular service chain 33
  • 30. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public • 16* Bytes of Meta-Data for POT • Random – Unique random number (e.g. Timestamp or combination of Timestamp and Sequence number) • Cumulative (algorithm dependent) • Transport options for different protocols • Segment Routing: New TLV in SRH header • Network Service Header: Type-2 Meta-Data • In-band OAM for IPv6: Proof-of-transit extension header • VXLAN-GPE Proof-of-transit embedded-telemetry header • ... more to be added (incl. IPv4) Proof of Transit: Meta-Data Transport Options +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Random | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Random (contd) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Cumulative | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Cumulative (contd) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ *Note: Smaller numbers are feasible, but require a more frequent renewal of the polynomials/secrets. 2nd Polynomial Interative computation of secret 34
  • 31. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public IOAM Data with E2E focus: Sequence Numbers
  • 32. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Transport Options – IPv6, VXLAN-GPE, SRv6, NSH... • IPv6 • Native v6 HbyH extension header • Double-encapsulation: src=encap-node, dst=original • VXLAN-GPE: Embedded telemetry protocol header; • NSH: Type-2 Meta-Data • SRv6: In-band OAM TLV in v6 SR-header SRH ... additional encaps are in the works, incl. GRE,... 36
  • 33. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Configuration And Data Export 37 • In-band OAM Configuration and Data Exports included in IETF LIME WG Connectionless OAM YANG models • draft-ietf-lime-yang- connectionless-oam-03 • draft-ietf-lime-yang- connectionless-oam-methods-00
  • 34.
  • 35. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Implementation Approach • In-band OAM mechanisms for IP (route recording) have been proposed in the past, but were always received with skepticism • Performance concerns • Footprint for a new technology (incl. new packet header) vs. installed base: “Is there a sufficiently large greenfield network to allow for the change?” • Let’s stop arguing and go try… 39
  • 36. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public In-Band OAM Implementation • Dataplane Implementation: • FD.io/VPP (see fd.io) • IOS (ISR-G2) – PI31 (CCO: End of July/16) – In-band OAM Config Guide for IOS • IOSv/VIRL • Controller Implementation: • OpenDaylight (Carbon release) • Supporting information for in-band OAM: https://github.com/CiscoDevNet/iOAM 40
  • 37. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Introducing Vector Packet Processor - VPP • VPP is a rapid packet processing development platform for highly performing network applications. • It runs on commodity CPUs and leverages DPDK • It creates a vector of packet indices and processes them using a directed graph of nodes – resulting in a highly performant solution. • Runs as a Linux user-space application • Ships as part of both embedded & server products, in volume; Active development since 2002 • Base iOAM code already available in fd.io open repositories (more coming soon) • See also: FD.IO (The Fast Data Project) Network IO Packet Processing: VPP Management Agent NC/Y REST ... Some initial iOAM already in FD.IO: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=blob_plain;f=vnet/vnet/ip/ip6_hop_by_hop.c;hb=HEAD BRKSDN-2901 41
  • 38. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public IOAM in VPP (native IPv6 encap) DPDK eth- input VPP Ip6- input Ip6- lookup Ip6-hop- by-hop Ip6-add- hop-by- hop Ip6-pop- hop-by- hop Ip6- rewrite error- drop int- output Tengigabitethernet Tengigabitethernet Tengigabitethernet Tengigabitethernet Management Agent dpdk- input ` PacketVector API iOAM data Collector ` ` Shared memory bus BRKSDN-2901 42
  • 39. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public In-Band OAM Test Drive • Extended Ping R5#ping Protocol [ip]: ipv6 Target IPv6 address: ::b:1:0:0:8 Repeat count [5]: 1 Datagram size [100]: Timeout in seconds [2]: Extended commands? [no]: y Source address or interface: UDP protocol? [no]: Verbose? [no]: Precedence [0]: DSCP [0]: Include hop by hop Path Record option? [no]: y Sweep range of sizes? [no]: % Using size of 296 to accomodate extension headers Type escape sequence to abort. Sending 5, 296-byte ICMP Echos to ::B:1:0:0:8, timeout is 2 seconds: 5(5)----------(3)7(4)----------(3)8(5)----------(5)8(3)---------- (4)6(3)----------(5)5! Success rate is 100 percent (1/1), round-trip min/avg/max = 4/6/10 ms ingress i/f node-id egress i/f R5 R7 R6 R8 ::b:1:0:0:7 node-id 7 ::b:1:0:0:6 node-id 6 ::b:1:0:0:8 node-id 8 ::b:1:0:0:5 node-id 5 ipv6 ioam path-record ipv6 ioam node-id <node id> 43
  • 40. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Performance Test Results (native IPv6 encap) In-band OAM with no performance degradation IXIA (TX) IXIA (RX) R1 ISR 3945 R2 ISR 3945 R3 ISR 3945 Encap Transit Decap CPU Utilization in % at 600Mbps/no drops/IMIX traffic – 100 flows 44 Traffic Bi Dir Frame size in Bytes Traffic Load in % Loss in % RX Throughput in mbps Latency (ns) AVG Latency (ns) MIN Latency (ns) MAX CPU UTIL % ENCAP NODE (R1) CPU UTIL % Inter NODE (R2) CPU UTIL % DECAP NODE (R3) CEF IPv6 imix 60 0 1131 187401 54260 921680 23 23 23 GRE+IPv6 imix 60 0.04 1138 186753 56060 923120 24 24 25 iOAM6 imix 60 0 1138 186671 40640 917780 27 24 26
  • 41. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Network Operations and SLA diagnostics In-Band OAM as part of a larger ecosystem Examples of enhanced use-cases • SLA verification • Service chain verification • Identifying the reason for path verification failure (triggered OAM) • SLA check in overlay networks • Efficient fault detection and fault isolaton • Smart service-selection 45
  • 42. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 46 Node A Node B Node C Verifier Node D Host 1 Host 3 Host 2 VPP VPP VPP VPP pmacct Apache Kafka OpenDaylight Elasticsearch Logstash Kafka IOAM: Decap & Verify IOAM: Transit IOAM: encap IOAM event control IOAM visualization Payload Hdr Payload Hdr r=45/c=0 A 1 Payload Hdr r=45/c=17 A 1 D 3 1 3 42 Payload Hdr Data Export IPFIX, kafka Control Telemetry/ OAM data Path Verified Visualization & Analytics
  • 43.
  • 44. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Example: OAM Analytics / SLA check Identifying network & service chain bottlenecks 48 Host 1 Host 3 Host 2 Observation: Suddenly connectivity issues between Host 1 and Host 2 – SLA violated
  • 45. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Delay A-B Detailed path tracing to identify the reason 49 Service B Host 1 Host 3 Host 2 Service A Service C Node Z Delay B-C Delay Z-CDelay A-Z Observation • Original path was A-B-C and fast • At time t0 a path change happened: Traffic rerouted to A-Z-C • Either Link A-Z is a low bandwidth link causing packet drops and/or Node Z is overloaded t0 t0 t0 t0 ! large delay ! loss
  • 46. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Per-link delay reveals root cause: Route change to a low bandwidth link Delay 1-2 Delay 2-3 Delay 1-4 Delay 4-3 50
  • 47. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Overlay Networks: Checking SLA Compliance on the real traffic 51
  • 48.
  • 49. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Active Network Probing: Objective: Fast Failure Detection and Isolation Current situation: • Failure detection takes 10s of seconds in large networks • Failure isolation (using ping and traceroute) takes several minutes: Probing based on traceroute is slow. Objective & Approach • Significantly improve failure detection and isolation times. • Active network probing using UDP probe with in- band OAM
  • 50. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Normal network operation A B D C E F A B D C E F Customer traffic Continous end point probing using probes similar to customer traffic (i.e. same ports)
  • 51. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Network failure isolation A B D C E F Observation from in-band OAM data: Only subset of overall traffic arrives at F. Detected either from live customer traffic or probe traffic, or both.
  • 52. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Network failure detection: Probing with integrated loopback A B D C E F A B C E F Active network topology detected through probing 1 2 3 4 5
  • 53. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Network failure isolation: Correlate detected forwarding topology with original network topology A B D C E F A B C E F Failed link
  • 54. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public iOAM Ping UDP-Probe and Loopback Flag 59Presentation ID IPv6 Header IPv6 IOAM HbyH Hdr UDP Hdr UDP Probe Hdr https://tools.ietf.org/html/draft-lapukhov-dataplane-probe-01
  • 55.
  • 56. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public  Highly redundant micro-services (e.g. video-chunck servers) hosted as containers in multiple public clouds  All Services have an IPv6 address. All Services share the same secondary anycast address.  Performance characteristics of individual service instances differ: Access latencies, server load, service load, service liveliness  Client needs to choose an appropriate service to connect to Service Selection: Problem Statement
  • 57. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public  Introduce M-Anycast Server  Leverage Segment Routing to steer traffic, in-band OAM for optimized service selection  M-Anycast Server:  Hosts the Anycast address of the services  Intercepts TCP-SYN, replicates the SYN and sends to a selected subset of all services using SR  Chooses an appropriate SYN-ACK using embedded in-band OAM data and forwards that SYN-ACK to the client Service Selection: Solution Concept
  • 58. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Service Selection: Solution Concept VPP Service S1 Service S2 Service S3 VPP Service S4 Service S5 Service S6 VPP Service S7 Service S8 Service S9 VPP Service S10 Service S11 Service S12 Cloud 1 (e.g. AWS) Cloud 2 (e.g. Azure) Fast Very Fast Defunct Defunct Defunct Very Fast Very Fast Very Fast Fast ok Very Fast ok Provider Network (e.g. Comcast) Client Server 1 Server 2 Server 3 Server 4 VPP M-Anycast Server SYN 1 SYN 1 SYN 1 SYN1 SYN-ACK 2 SYN-ACK 2 SYN-ACK 2 ACK 3 4 Direct connection to service – no proxy Choose Service 11 2
  • 59. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 64BRKSDN-2901 M- ANY C1 S1 S2 S3  Highly resilient video playout combining IPv6 addressible video services with M-anycast as an efficient and fail safe service selection and load-balancing method  6CN: IPv6 addressible video- segments form the service  M-Anycast solution implemented in FD.io/VPP:  M-Anycast server – Server selector with IOAM and SRv6 spray functions  VPP co-located with client and servers to perform SRv6 and IOAM functions Demo - Overview
  • 60. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 65BRKSDN-2901 Demo Video: https://youtu.be/-jqww8ydWQk
  • 61.
  • 62. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public In-Band OAM – Implementation Status • Dataplane Implementation: • IOS • IOS (ISR-G2) – PI31 (CCO: End of July/16) – In-band OAM Config Guide for IOS • IOSv/VIRL • OpenSource • FD.io/VPP (see fd.io) • OpenDaylight Control App (proof of transit / tracing) • Supporting information for in-band OAM: https://github.com/CiscoDevNet/iOAM • Standardization IETF • Authored by: Cisco, Comcast, Facebook, JPMC, Bell Canada, Mellanox, Marvell, Barefoot, rtBrick • Documents: • In-band OAM requirements: https://tools.ietf.org/html/draft-brockners- inband-oam-requirements-03.txt • In-band OAM data types: https://tools.ietf.org/html/draft-brockners- inband-oam-data-04.txt • In-band OAM transport: https://tools.ietf.org/html/draft-brockners- inband-oam-transport-03.txt • Proof-of-transit: https://tools.ietf.org/html/draft-brockners-proof-of- transit-03.txt 67 • Videos: Google+ In-Band OAM group: https://plus.google.com/u/0/b/112958873072003542518/1129588730720035 42518/videos?hl=en Youtube In-Band OAM channel: https://www.youtube.com/channel/UC0WJOAKBTrftyosP590RrXw • Blogs: blogs.cisco.com/getyourbuildon/a-trip-recorder-for-all-your-traffic blogs.cisco.com/getyourbuildon/verify-my-service-chain
  • 63. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public In-Band OAM: Summary • Enhanced visibility for all your traffic: New sources of data for SDN applications • Network provided telemetry data gathered and added to live data • Complement out-of-band OAM tools like ping and traceroute • Path / Service chain verification • Record the packet’s trip as meta-data within the packet • Record path and node (i/f, time, app-data) specific data hop-by-hop and end to end • Export telemetry data via Netflow/IPFIX/Kafka to Controller/Apps • In-band OAM can be implemented without forwarding performance degradation • IOS and OpenSource (FD.io/VPP, OpenDaylight) Implementations 68