Floodlight tutorial - Clemson / Georgia Tech

9,516 views

Published on

An overview of SDN, OpenFlow and Floodlight given by Mike Cohen and Alex Reimers.

Published in: Technology
0 Comments
10 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
9,516
On SlideShare
0
From Embeds
0
Number of Embeds
10
Actions
Shares
0
Downloads
517
Comments
0
Likes
10
Embeds 0
No embeds

No notes for slide
  • Much of traditional networking was designed in the 1970’s. The protocols and standards have evolved and proved amazingly resilient – but they are non-ideal for the challenges of modern datacenters. First, they are based on merged hw and software solutions.Second, they are based on fully distributed protocols. This made tons of sense in the early days of the internet but in a world where a datacenter admin knows every piece of hw and how its connected, distributed protocols are less helpful.
  • SDN separates networking into 3 tiersA data plane tier responsible for fowarding packets.A controller thatmanagesconections to each forwarding element and acts as a network os.Applications which input control logic.
  • People often conflate SDN and openflow. They are very different. OpenFlow is a protocol for switches commnicating with a controller. Its often a piece of an sdn architecture but techically isn’t required. In fact, there is also work being done on northbound api as well.
  • Network virtualization is one of the most interesting examples of SDN in the real world. In involves slicing a physical network into multiple logical networks and offering isolation between. In the server world, this has shown huge operational efficiency gains and it offers similar promise in networking.Network services - Example – instead of inserting and configuring a firewall, you could just tell your controller to automatically provision rulesVM mobility and management – Virtual machines have greatly increased the complexity in the network. They get spun up and down and even can be moved around while running. SDN offers the flexibility to have the network respond quickly to changes in vm state and offers a lot of operational efficiency. CLOS – SDN and Openflow offer very flexible forwarding paradigms. One of the thing is allows is the creation of relatively low cost non-blocking clos networks for high performance environments. Data analysis – OpenFlow also makes it possible, in fact easy, to get lots of real time information about a running network. The switches and controller maintain a rich set of stats but also make it possible to direct traffic to montioring devices much the way tap or span ports would.Networkvirtualiztion - huge operational benefits - puts all policy in one place. Great for audit. - also manages p and v togetherVirtual machine management - makes it eaier to tie polcies to a vm because you can track a mac trhoughout the network - IP address is stored in the vm. Can’t change it. SDN makes it easier to alter the network around this.Vlans – still require administration
  • Lets look a little more deeply at the OpenFlow protocol. It has 3 main componentsA controller, which we’ll talk a lot more about in detail. The controller handles all the control logic for the network.A potentially encrypted control channel to a switch.An openflow client running on a switch. This handles controlling the openflowdatapath.
  • Many people ask us why OpenFlow is used so heavily in SDN. Essentially,OpenFlow is one of the simplest lowest level abstractions available. It allows very fine grained control over forwarding and separates control and data.
  • OpenFlow 1.0 was the initial openflow spec. Its largely what is supported today in hardware and vswitches. OpenFlow 1.1 introduced a new concept of multipe tables that could be processed sequentially. This solved some of the space explosion problems the intial spec had but introduced new problems in hw.1.2 – ipv6. Generalized match – TLV based
  • Tools – packetstreamer ,static flow pusher, mininet,
  • Our topology, device manager know about host attachment points and make it possible to deal with integrating openflow and non openflow networks.
  • Our topology, device manager know about host attachment points and make it possible to deal with integrating openflow and non openflow networks.
  • Pronto w/ indigo – 3240/3290HP: 3500, 5400, 8200 (procurves)IBM 8264NEC 5820 / 5240Pronto w/ indigoExtreme – Summit series(all based on broadcomasics)
  • How of works with non oF?Think through control network and data path. Have a separate network for controlUse vlans to separate control and data.Switches supported today:Stanford: - HP, nec,ibm, prontoWifi – meraki, othersWhat openflow provides that non-OF provides- Visibility- Managebility – scripts running along with OF controller to monitor packetin rates, flow mods, flow table size. Cpu usage, datapath throughput. Can monitor who is connected and how many users in network. With meraki, can know what type of devices in network, throughputHow reseasrchers can benefit?Primary reason for stanford. Enable sdn-based research. Link to internet2/geni. Migration process? Strategy?Understand traffic pattern first. Current hw has limitations on throughput (esp true of hp) on the control plane side. Flow set up rate, etc. HP offers only IP matching only in hw. Deploy from edge to core. We support switchclusters. Do it floor by floor essentially. Stanford runs two networks in parallelVoip and other key services is non-OF at least. Start with non-ciritcal traffic. Security?Highlight new visibility capabilitiesDenial of service on controller, etc.Encrypted control channels – no one does this todayInteropability of openflow and wifi? - mesh networks and host mobility create tricky situations.
  • Our topology, device manager know about host attachment points and make it possible to deal with integrating openflow and non openflow networks.
  • Floodlight tutorial - Clemson / Georgia Tech

    1. 1. OpenFlow Controllerhttp://floodlight.openflowhub.org
    2. 2. About UsBig Switch Networks Big Switch Networks builds and promotes Open Software Defined Networking Solutions We use and help support Floodlight and a number of other OpenFlow tools Yes, you can contact us about jobs and internships at careers@bigswitch.com ©2012 – Big Switch Networks Inc. 2
    3. 3. Introduction SDN and OpenFlow Real world use cases Floodlight Demo! (if time allows) ©2012 – Big Switch Networks Inc. 3
    4. 4. Limitations in Modern NetworkingAn Slowly Evolving Environment Operating System / Firmware Hardware / ASICs  Hardware focus  Fully distributed protocols  Hard to innovate, update  Independent components software  Interoperability and design  Vendor specific challenges components ©2012 – Big Switch Networks Inc. 4
    5. 5. Introduction to SDNSoftware-defined Networking Application Application Application Application Application Application tier SDN Controller Controller tier OF Switch OF Switch OF Switch Data plane tier OF Switch OF Switch Software Defined Networking decouples data, control, and application planes, creating a programmable network ©2012 – Big Switch Networks Inc. 5
    6. 6. OpenFlow and SDNA southbound SDN protocol Application Application Application Application Application Northbound API OpenFlow-based SDN Controller Southbound API - OpenFlow OF Switch OF Switch OF Switch OF Switch OF Switch ©2012 – Big Switch Networks Inc. 6
    7. 7. Advantages of SDN Innovation and speed to market  An “app store” for network programming Decoupled software and hardware development  Support for multi-vendor environments  Separate upgrade cycles, etc. Simplified network management / automation ©2012 – Big Switch Networks Inc. 7
    8. 8. Real World Examples1 2 Scalable isolation Alice Bob Cathy Inserting and managing domains and network network services such as slicing. load FlowVisor Isolation balancing, firewall, IDS/IPS Policy , QoS, etc. Example: Flowvisor Example: FlowScale Network Virtualization Platform for Network Services3 4 Flexible mobility of Lower cost, high virtual machines performance networks Example: Stanford WAN VM Migration Example: non- blocking CLOS architectures Virtual Machine Management CLOS Fabrics5 6 Simplified data Networks spanning vibility and traffic public / private DC’s monitoring Example: Amazon Example: TBD VPC 8 Data analysis / monitoring Hybrid clouds
    9. 9. OpenFlow
    10. 10. Introduction to OpenFlowController <-> Switch communication x86 style instruction set OpenFlow-based SDN Controller Based on Ethernet Switch with: TCP / SSL  OF software client  Hardware flow table Non-OF OpenFlow Client Control Path Control channel between switch and Flow table controller MAC MAC IP IP TCP TCP Action src dst Src Dst sport dport * * * 5.6.7.8 * * port 1 ©2012 – Big Switch Networks Inc. 10
    11. 11. OpenFlow in Action Application Application Application Application Application SDN Controller Rule Action Stats Rule Action Stats Rule Action Stats OF Switch OF Switch 01010 01010 OF Switch©2012 – Big Switch Networks Inc. 11
    12. 12. Why OpenFlow?Isn’t OpenFlow the same as XXX? ‘XXX’ = LISP, MPLS-TE, policy routing, etc. Broad answer:  OpenFlow is a very-low level abstraction/API  Could probably implement XXX using OpenFlow  Could not implement OpenFlow using XXX If XXX meets my needs, why use OpenFlow?  More holistic network view  Reduced complexity from feature interaction ©2012 – Big Switch Networks Inc. 12
    13. 13. OpenFlow Standards OF v1.0 (most popular), Dec 2009  Initial OpenFlow specification  match on 12-tuple OF v1a.1: Extensions for WAN, late 2010  multiple tables: dodge state space explosion  fast failover, interface bonding OF v1.2 :  IPv6 support, generalized match, vendor extensions ©2012 – Big Switch Networks Inc. 13
    14. 14. ©2012 – Big Switch Networks Inc. – Confidential and Proprietary Floodlight 14
    15. 15. Floodlight Overview Floodlight is a completely open, free, Apache-licensed Java-based OpenFlow controller.©2012 – Big Switch Networks Inc. 15
    16. 16. Floodlight ControllerA great platform for OpenFlow Research and Easy to build, run, and commercial friendly  develop Toolchain Rich set of build and Community of OpenFlow debugging tools experts, access to commercial upgrades, and frequent testing ©2012 – Big Switch Networks Inc. 16
    17. 17. Building FloodlightFast…an easy…Download from Github$ git clone git://github.com/floodlight/floodlight.git$ sudo apt-get install build-essential default-jdk ant python-dev$ cd floodlight; ant$ java –jar target/floodlight.jarGet the VM (includingmininet)$ wget http://floodlight.openflowhub.org/files/floodlight-vm.zip(login as “floodlight” user, no password) ©2012 – Big Switch Networks Inc. 17
    18. 18. Internals
    19. 19. Floodlight Architecture TopologyManager  Modules exporting “services” LinkDiscovery  All modules in Java, support for Jython as well Forwarding FloodlightProvider  Main module is DeviceManager FloodlightProvider  Manages I/O to switches StorageSource  Translates OF messages to Floodlight events  Multi-threaded via Netty library (all RestServer modules must be thread-safe) StaticFlowPusher  Rich, extensible REST API©2012 – Big Switch Networks Inc. 19
    20. 20. Module Descriptions  Computes shortest path using Dijsktra TopologyManager  Keeps switch to cluster mappings  Maintains state of links in network LinkDiscovery  Sends out LLDPs Forwarding  Installs flow mods for end-to-end routing FloodlightProvider  Handles island routing  Tracks hosts on the network DeviceManager  MAC -> switch,port, MAC->IP, IP->MAC  DB style storage (queries, etc) StorageSource  Modules can access all data and subscribe to changes  Implements via Restlets (restlet.org) RestServer  Modules must implement RestletRoutable  Supports the insertion and removal of static flows StaticFlowPusher  REST-based API©2012 – Big Switch Networks Inc. 20
    21. 21. Other Tools
    22. 22. OpenFlow ControllersOptions Beyond Floodlight Beacon: beaconcontroller.net (Java) NOX: noxrepo.org (C++ and Python) Trema: trema.github.com/trema/ (Ruby and C) Reference controller (C) ©2012 – Big Switch Networks Inc. 22
    23. 23. MininetOpenFlow network simulator Emulate OpenFlow network in a box Uses Linux Containers and IP namespace Runs your choice of software switch  Stanford’s reference OpenFlow switch  OpenVSwitch CLI allows interactive management of emulated virtual hosts Packaged in the Floodlight VM at:  http://floodlight.openflowhub.org/download ©2012 – Big Switch Networks Inc. 23
    24. 24. Switch Options
    25. 25. Switch EcosystemMajor vendors have upcoming products Controller Platform Southbound APIs Virtual Switches Physical Switches Available Announced Stanford Reference Switch ©2012 – Big Switch Networks Inc. * Supported platforms: Pronto w/ indigo – 3240/3290, HP: 3500, 5400, 8200 (procurves), IBM 8264, NEC PF 5820 / 5240, Extreme – Summit series
    26. 26. Demo
    27. 27. Getting Involved - OpenFlowHubA community of open source OpenFlow developersWhat it is: Get involved:1. A community of open source  Submit a project OpenFlow developers  Write a blog post2. An OpenFlow Blog (available for guest authors)  http://www.openflowhub.org3. Free hosting, tools, and marketing  Contact: for open source projects mike.cohen@openflowhub.org  Wiki, forums, bug tracking tools, logos, etc. Projects: ©2012 – Big Switch Networks Inc.
    28. 28. Interested in Learning More? Check out the website  http://floodlight.openflowhub.org Join the mailing list:  http://groups.google.com/a/openflowhub.org/group/floodli ght-dev/topics  Or just email floodlight-dev@openflowhub.org Get the code:  http://floodlight.openflowhub.org/download ©2012 – Big Switch Networks Inc.
    29. 29. Presenters Mike Cohen Product Manager mike.cohen@bigswitch.com Alex Reimers Member of Technical Staff alex@bigswitch.com©2012 – Big Switch Networks Inc. 29
    30. 30. End
    31. 31. OperationalConsiderations
    32. 32. Network considerations Why OpenFlow?  Lots of reasons we talked about already...  Simplest is network monitoring from a single location – packetin, flow modes, cpu usage, throughput, devices connected, etc. Control / Data networks  Offer critical services on non-OF network (ie. Voip)  Control / data path separation – vlans in most cases  Deploy OF from edge to core. Gain increased visibility over time.  Measure traffic patterns and make sure your switch hardware can support it. Some have limited control traffic throughput (flow set up rate, etc.). Security considerations  Do you need to protect against controller DoS attacks?  Do you want encrypted control traffic? Gotchas  Physical loops into the OpenFlow network  Wifi mesh networks ©2012 – Big Switch Networks Inc. 32
    33. 33. Backup
    34. 34. Network Virtualization: FlowvisorVirtualized Control Plane Customer Alice Customer Bob Customer CathyEach use case/demopresented here runs in anisolated slice of Stanford’s OpenFlowproduction network. Protocol OpenFlow OpenFlow Protocol Datapath FlowVisor Isolation Policy FlowVisor slices OpenFlow OpenFlow OpenFlow networks, creating multiple Datapath Datapath isolated and programmable logical networks on the same physical topology. ©2012 – Big Switch Networks Inc. 34
    35. 35. Load balancingFlowScale: Load balancing using Layer 2 OF switches Traffic load balancer using OpenFlow Implemented in OF ToR switches Deployed in IU IDS ©2012 – Big Switch Networks Inc. 35
    36. 36. VM Management: WAN Migration Moved a VM from Stanford to Japan without changing its IP. VM hosted a video game server with active network connections.©2012 – Big Switch Networks Inc. 36
    37. 37. OpenFlow Protocol (1) Match Fields Action(s) Stats Packet + byte counters 1. Forward packet to zero or more ports 2. Encapsulate and forward to controller 3. Modify Fields 4. Vendor specific extensions Switch VLAN VLAN MAC MAC Eth IP IP IP IP L4 L4 Port ID pcp src dst type Src Dst ToS Prot sport dport + mask what fields to match©2012 – Big Switch Networks Inc. 37
    38. 38. OpenFlow Protocol (2) Switch MAC MAC Eth VLAN IP Src IP Prot TCP TCP Action port src dst type ID sport dportSwitching * * 00:1f * * * * * * Port6 :..Flow Port3 00:20 00:1f 0800 Vlan1 1.2.3.4 5.6.7.8 4 17264 Port6switching .. ..Firewall * * * * * * * * 22 DropRouting * * * * * * 5.6.7.8 * * Port6VLAN * * 00:1f * Vlan1 * * * * Port6,pswitching .. ort7, port8©2012 – Big Switch Networks Inc. 38
    39. 39. Other Floodlight Highlights REST- Static 2 1 based Flow App Pusher  Java event APIs Jython App Active work in Java App defining  REST-based APIs standard “Northbound” APIs  Ability to push flows Floodlight Controller 3 Switch  Support for OF Switch integrating with non-OpenFlow OF Switch networks OF Switch OF Switch ©2012 – Big Switch Networks Inc. 39
    40. 40. IFloodlightModule Interface1. getModuleDependencies()Function Description  What services does this moduleWhat services does thisgetModuleDependencies() require? module require?2. getModuleServices(), getServiceImpls()  Services does this module provide and how?getModuleServices() Services does this module provide and how?3. init(FloodlightModuleContext context)  Internal, before dependencies have init()’dinit(FloodlightModuleContext context) Internal, before dependencies have init()’ed4. startup(FloodlightModuleContext context)  External, with dependencies initializationstartup(FloodlightModuleContext context) External, with dependencies initialization
    41. 41. OpenFlow Topologies vswitch Top of rack Need OpenFlow at last hop Agg / Core in the network  For vms:vswitch  For physical hosts: Tor VM VM VM VM VM VM VM VM Floodlight can manage multiple “islands” of VM VM Physical host OpenFlow switches Physical host VM VM … … Rack 1 Rack 2©2012 – Big Switch Networks Inc. 41
    42. 42. DemoProblem:Track the last N Packet-Ins seen by the controller andexpose it via a REST APIWhat you will see:1. Adding a new module2. Creating a REST API3. Running Floodlight ©2012 – Big Switch Networks Inc. 42

    ×