Joon-Myung Kang and Mario A. Sánchez's presentation at the 2017 Open Networking Summit. Intent-based networking has gained a lot of interest in recent years with several different open source communities (including ONF, OpenDaylight and ONOS). However, network diagnosis and troubleshooting remain two essential aspects of network management that still require massive manual effort and extensive expert knowledge. So far, no approach has focused on troubleshooting the network at the intent level. We argue that providing reasoning capabilities about why an observed network state happens according to specified input policies can help simplify this complexity. In this talk, we present our work on network troubleshooting at the intent level. Our solution provides capabilities to enable posing what-if type questions at the policy level –e.g. when a new input policy is introduced– to help answer reachability questions both at the policy and infrastructure level.

1. Troubleshooting for
Intent-based Networking
Joon-Myung Kang and Mario A. Sánchez
Hewlett Packard Labs
Open Networking Summit 2017

2. Intent-based Networking
Policy Graph Abstraction and Demo
Troubleshooting and Demo
QnA
2

3. Software-Defined Networking
Application Plane
(SDN Apps)
Control Plane
(OpenDaylight, ONOS, etc.)
Infrastructure (Data) Plane
(Cloud/IT/SDN/NFV)
Open APIs
Program Languages
Abstraction
SDN Northbound Interfaces
Infrastructure Control Interfaces
Vendor specific
Low-level specifics
Manual operations
…
3

4. Software-Defined Networking
Application Plane
(SDN Apps)
Control Plane
(OpenDaylight, ONOS, etc.)
Infrastructure (Data) Plane
(Cloud/IT/SDN/NFV)
Open APIs
Program Languages
Abstraction
SDN Northbound Interfaces
Infrastructure Control Interfaces
Vendor specific
Low-level specifics
Manual operations
…
4

5. Intent-based Networking
Application Plane
(SDN Apps)
Control Plane
(OpenDaylight, ONOS, etc.)
Infrastructure (Data) Plane
(Cloud/IT/SDN/NFV)
INTENT North Bound Interface
Infrastructure Control Interfaces
− Application Plane says “What” (doesn’t care how)
− Control Plane reasons “How” (doesn’t care why)
Intent
− “what”, not “how” (non-prescriptive)
− Is portable
− Is universal
− Is compose-able
− Is invariant
− Is scale-able
Source: Dave Lenrow, “Intent As The Common Interface to Network Resources,” Intent Based Network Summit 2015 ONF Boulder: Intent NBI
Intent
“I want my headache
to stop”
Prescription
“Give me two
aspirins”
5

6. Intent-based Networking
Examples
WEB/Gold/Working Hour
No connect/Wireless
Configure new guest WiFi
6

7. Intent-based Networking
Examples
WEB/Gold/Working Hour
No connect/Wireless
INVISIBLE
Configure new guest WiFi
7

8. Intent-based Networking
Open Source Efforts
– ONF Open Source SDN Boulder
– Define Intent North Bound Interface (NBI)
– http://opensourcesdn.org/projects/project-boulder-intent-northbound-interface-nbi/
– https://community.opensourcesdn.org/wg/IntentNBI/dashboard
– OpenDaylight NIC
– Network Intent Composition
– Manage and direct network services and network resources based on
the given “Intent”
– https://wiki.opendaylight.org/view/Network_Intent_Composition:Main
– ONOS Intent Framework
– Allows applications to specify their network control desires in form
of policy rather than mechanism (Intent)
– https://wiki.onosproject.org/display/ONOS/Intent+Framework
ONF Intent NBI – Definition and Principles, Draft Version 6, Sep. 2016
https://wiki.opendaylight.org/view/Network_Intent_Composition:Graph
8

9. Policy Graph Abstraction (PGA)
PGA overview
Troubleshooting for Intent-based Networking
9

10. PGA is Real
Public resources
ACM SIGCOMM 2015
London, UK
Research Paper and Demo Running System and Open Source Contributions
OpenStack Summit
2015, 2016
OpenDaylight Summit
2015, 2016
10

11. Policy Management in Practice
11

12. Policy Graph Abstraction (PGA)
Mktg&Cmp-B
&Normal
Engg&Cmp-A
&Normal
HTTP Web&
Cloud
DNS
DB&
Cloud
Remedy
Service
Engg&Cmp-A
&Qn
Mktg&Cam-B
&Qn
Ping,SSH
HTTP
monitor
SQL, monitor
sync,
monitor
monitor
DNS DNS
*
*
BC
BC
BCLBFW
BCLBFW
DPIDPI
BC
BC
graph
composition
Quarantined
Remedy
Service
Policy sources Graph abstraction Unified, conflict-free policy graph Deploy
12

13. PGA Example
− Label namespace across cloud services and network, capturing overlap vs. disjoint relations between labels
13
CPU
Utilization
> 90% <= 90%

14. PGA Example
− Label namespace across cloud services and network, capturing overlap vs. disjoint relations between labels
− 4 individual input policies
(a) Departments admin
Engg. Mktg
Ping,SSH
Cloud
monitor
Quarantined
Remedy
Service
*
(b) Application admin
(d) Cloud operator(c) SDN app: HPE Net Protector
Campus Cloud
*
*
HTTP
Empl Web
SQL
sync
DBLB
Normal DNS
DNS
(a) Enterprise IT admin
DPI FW BC
BC
Cmp-AMktg
Empl App
Web CampusDB
Net
Protector
Status
Normal Qn
Tenant
Location
Engg: Campus-A
Mktg: Campus-B
Application: Cloud
Empl: Net protector
Engg
Label Namespace
Label Mappings
disjoint
Cloud
Cmp-B
14

15. PGA Example
− 4 individual input policies
− Label namespace across cloud services and network, capturing overlap vs. disjoint relations between labels
− Proactive, automatic composition
− Scalable algorithm: 13 mins to compose 20K ACL + service chain policies
(a) Departments admin
Engg. Mktg
Ping,SSH
Cloud
monitor
Quarantined
Remedy
Service
*
(b) Application admin
(d) Cloud operator(c) SDN app: HPE Net Protector
Campus Cloud
*
*
HTTP
Empl Web
SQL
sync
DBLB
Normal DNS
DNS
(a) Enterprise IT admin
DPI FW BC
BC
Mktg&Cmp-B
&Normal
Engg&Cmp-A
&Normal
HTTP
Web&
Cloud
DNS
DB&
Cloud
Remedy
Service
Engg&Cmp-A
&Qn
Mktg&Cam-B
&Qn
Ping,SSH
HTTP
monitor
SQL, monitor
sync,
monitor
monitor
DNS DNS
*
*
BC
BC
BCLBFW
BCLBFW
DPIDPI
BC
BC
compose
Cmp-AMktg
Empl App
Web CampusDB
Net
Protector
Status
Normal Qn
Tenant
Location
Engg: Campus-A
Mktg: Campus-B
Application: Cloud
Empl: Net protector
Engg
Label Namespace
Label Mappings
disjoint
Cloud
Cmp-B
15

16. PGA
Current status
PGA implementation and impact
− PGA model, composition, deployment, and tool to convert ACL policy configuration to PGA
intent specification
− PGA prototype for OpenStack (Juno ~ Newton)
− PGA Intent APIs and graph compiler contributed to ODL/NIC Beryllium release
− Troubleshooting for intent based policy management
− Conflict detection
− Composition correctness verification
− Intent addition/modification/deletion
16

17. Live Demo
PGA Basic
Operations
17

18. PGA Demo
18

19. Troubleshooting
With Intent-based Networking

20. Network debugging/troubleshooting a difficult task
Picture sources:
http://simplearchitectures.blogspot.com/2013/08/addressing-data-center-complexity.html
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Data_Center/ServerFarmSec_2-
1/ServSecDC/8_NIDS.html
WEB NO CONNECT
Picture source:
http://www.ntstn.com/category/troubleshooting/network-
troubleshooting
Policy
Network
ping
traceroute
tcpdump
SNMP
sflow

21. Systematic troubleshooting
–Know intent of the operator
–Check network behavior against operator intent
Intent-based networking
–Policy is a first-class citizen
–Intent explicitly expressed at policy layer
–Forwarding semantics explicitly defined
–Code compiles policy description into lower-level configuration
Difficult to achieve
in legacy networks
Opportunity to
rethink network
debugging

22. Intent-based Networking
Application Plane
(SDN Apps)
Controller Plane
(OpenDaylight, ONOS, etc.)
Infrastructure (Data) Plane
(Cloud/IT/SDN/NFV)
INTENT North Bound Interface
Infrastructure Control Interfaces
– Control Apps
– Specify routing/access control policies
– Logical view
– Simplified/abstract representation of network
– Physical view
– One-to-one correspondence with the physical network
– Controller’s job to configure the network devices
(OpenFlow)

23. Intent-based Networking
Application Plane
(SDN Apps)
Controller Plane
(OpenDaylight, ONOS, etc.)
Infrastructure (Data) Plane
(Cloud/IT/SDN/NFV)
INTENT North Bound Interface
Infrastructure Control Interfaces
– Control Apps
– Specify routing/access control policies
– Logical view
– Simplified/abstract representation of network
– Physical view
– One-to-one correspondence with the physical network
– Controller’s job to configure the network devices
(OpenFlow)
• Each layer performs one piece of translation process
• Every layer should correctly map to every other layer
• Most errors in SDN are mistranslations between layers

24. Checking network behavior against intent
–Early debugging tools for OpenFlow-enabled networks
–Ndb, OFRewind, NetSight, netwatch, netshark, nprof…
–Easier to discover the source of network problems
[Faulty device firmware, inconsistent flow rules, faulty routing…]
–Testing and verification complement network troubleshooting and debugging
[Loop freedom, black holes, performance of OpenFlow switches…]
Too low level!

25. Knowing the operator’s intent
Does the Actual Network Behavior Match the Policy?
–If NO…
Match the symptoms to responsible system component
–If YES…
The policy itself is the problem, a human must resolve the discrepancy
–If unwanted behavior persists & all state layers are equivalent:
–The configured policy must not match the operator’s intent

26. Troubleshooting System
Composed graph
User/App1 User/App2 User/Appn
User Intents
Input graphs
Infrastructure Controllers
PGA
Results
Metadata
GUI
Query
Query Examples
– Reachability/Connectivity checking
– Can A talk to B?
– Security vulnerability or Risk
assessment
– Addition/removal/edition correctnessTroubleshooting
System

27. Troubleshooting Examples
Reachability
–Can A talk to B?
–What EPG do nodes belong to?
–Is there an edge connecting both EPGs?
–What security groups should be checked?
–What middleboxes should be checked?

28. Troubleshooting example
Troubleshooting network connectivity (reachability)
(a) Departments
admin
Engg. Mktg
Ping,SSH
Cloud
monitor
Quarantined
Remedy
Service
*
(b) Application admin
(d) Cloud operator(c) SDN app: HP Net Protector
Campus Cloud
*
*
HTTP
Empl Web
SQL
sync
DBLB
Normal DNS
DNS
(a) Enterprise IT admin
DPI FW BC
BC
Mktg&Cmp-B
&Normal
Engg&Cmp-A
&Normal
HTTP
Web&
Cloud
DNS
DB&
Cloud
Remedy
Service
Engg&Cmp-A
&Qn
Mktg&Cam-B
&Qn
Ping,SSH
HTTP
monitor
SQL, monitor
sync,
monitor
monitor
DNS DNS
*
*
BC
BC
BCLBFW
BCLBFW
DPIDPI
BC
BC
compose
Cmp-
A
Status
Tenant
Empl App
Mktg
Web DB Campus Cloud Net
Protector
Normal Qn
Location
Engg: Campus-A
Mktg: Campus-B
Application: Cloud
Empl: Net protector
Cmp-
B
Eng
g
Label Namespace
Label Mappings
disjoint
web
Engg client HR site

29. Troubleshooting example
Intent addition/modification/removal
(a) Departments
admin
Engg. Mktg
Ping,SSH
Cloud
monitor
Quarantined
Remedy
Service
*
(b) Application admin
(d) Cloud operator(c) SDN app: HP Net Protector
Campus Cloud
*
*
HTTP
Empl Web
SQL
sync
DBLB
Normal DNS
DNS
(a) Enterprise IT admin
DPI FW BC
BC
Mktg&Cmp-B
&Normal
Engg&Cmp-A
&Normal
HTTP
Web&
Cloud
DNS
DB&
Cloud
Remedy
Service
Engg&Cmp-A
&Qn
Mktg&Cam-B
&Qn
Ping,SSH
HTTP
monitor
SQL, monitor
sync,
monitor
monitor
DNS DNS
*
*
BC
BC
BCLBFW
BCLBFW
DPIDPI
BC
BC
Cmp-
A
Status
Tenant
Empl App
Mktg
Web DB Campus Cloud Net
Protector
Normal Qn
Location
Engg: Campus-A
Mktg: Campus-B
Application: Cloud
Empl: Net protector
Cmp-
B
Eng
g
Label Namespace
Label Mappings
disjoint
compare
29

30. Troubleshooting example
Risk Assessment
Indicator may be composed using different data points:
e.g. # of compromised hops; # of network functions
traversed, etc.
What if a host from “Web&Cloud” is compromised?
What EPGs might be able to reach host ‘x’ (through intermediate host compromise)?

31. Troubleshooting Demo
Marketing
Employee
Campus Admin
10.10.20.1
Connectivity Problem
Intent edition
Remote desktop
connection

32. PGA and Troubleshooting Demo
32

33. Summary
–Intent-based Networking is beneficial to simplify network control & management
33

34. Summary
–Intent-based Networking is beneficial to simplify network control & management
–Policy Graph Abstraction (PGA) is one of the well-defined intent-based
management framework and we presented possible troubleshooting examples
34

35. Summary
–Intent-based Networking is beneficial to simplify network control & management
–Policy Graph Abstraction (PGA) is one of the well-defined intent-based
management framework and we presented possible troubleshooting examples
–Intent-level troubleshooting can help to easily do troubleshooting network
problems
35

36. Summary
–Intent-based Networking is beneficial to simplify network control & management
–Policy Graph Abstraction (PGA) is one of the well-defined intent-based
management framework and we presented possible troubleshooting examples
–Intent-level troubleshooting can help to easily identify network problems
–What’s next
– More More More practical experiences from network operators/administrators/developers…
36

37. Thank you
joon-myung.kang@hpe.com
mario.ant.sanchez@hpe.com
37