Download to read offline
Uploaded byJa-seop Kwak
OpenFlow Tutorial
OpenFlow/Software-defined Networking aims to open up the network infrastructure through a "software-defined networking" approach. It proposes using simple packet forwarding hardware with an open interface and a network operating system that provides a well-defined open API. This allows multiple network operating systems or versions to run over the same underlying hardware, similar to how virtualization allows multiple operating systems to run on the same computer hardware. OpenFlow specifies the open interface and protocol to enable this new paradigm of network virtualization and programmability.
OpenFlow Tutorial
- 1. OpenFlow/Software-defined Networking Nov, 2011 Srini Seetharaman TechLead, SDN Deutsche Telekom Innovation Center 1
- 2. Million of lines ofsource code 6000+ RFCs Barrier to entry Billions of gates Bloated Power Hungry Many complex functions baked into the infrastructure OSPF, BGP, multicast, differentiated services, Traffic Engineering, NAT, firewalls, MPLS, redundant layers, … An industry with a “mainframe-mentality”, reluctant to change The Ossified Network Specialized Packet Forwarding Hardware Operating System Feature Feature Routing, management, mobility management, access control, VPNs, … 2
- 3. Open Systems Performance Fidelity Scale RealUser Traffic? Complexity Open Simulation medium medium no medium yes Emulation medium low no medium yes Software Switches poor low yes medium yes NetFPGA high low yes high yes Network Processors high medium yes high yes Vendor Switches high high yes low no gap in the tool space none have all the desired attributes! 3
- 4. Specialized Packet Forwarding Hardware AppApp App Specialized Packet Forwarding Hardware App App App Specialized Packet Forwarding Hardware App App App Specialized Packet Forwarding Hardware App App App Specialized Packet Forwarding Hardware Operating System Operating System Operating System Operating System Operating System App App App 4 Current Internet Closed to Innovations in the Infrastructure Closed
- 5. Specialized Packet Forwarding Hardware AppApp App Specialized Packet Forwarding Hardware App App App Specialized Packet Forwarding Hardware App App App Specialized Packet Forwarding Hardware App App App Specialized Packet Forwarding Hardware Operating System Operating System Operating System Operating System Operating System App App App Network Operating System App App App “Software Defined Networking” approach to open it
- 6. App Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware SimplePacket Forwarding Hardware App App Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Network Operating System 1. Open interface to hardware 3. Well-defined open API 2. At least one good operating system Extensible, possibly open-source The “Software-defined Network”
- 7. How does OpenFlowwork? 7
- 8.
- 9. Data Path (Hardware)DataPath (Hardware) Control PathControl PathControl Path (Software)Control Path (Software) 9
- 10. Data Path (Hardware)DataPath (Hardware) Control PathControl Path OpenFlowOpenFlow OpenFlow ControllerOpenFlow Controller OpenFlow Protocol (SSL/TCP) 10
- 11. Controller PC OpenFlow usage OpenFlow Switch OpenFlow Switch OpenFlow Switch Alice’s codeAlice’scode Decision? OpenFlow Protocol Alice’s Rule Alice’s Rule Alice’s Rule Alice’s Rule Alice’s Rule Alice’s Rule OpenFlow offloads control intelligence to a remote software
- 12. Controller PC Hardware Layer Software Layer Flow Table MAC src MAC dst IP Src IP Dst TCP sport TCP dport Action OpenFlow Client **5.6.7.8***port 1 port 4port 3port 2port 1 1.2.3.45.6.7.8 OpenFlow Example 12
- 13. OpenFlow Basics Flow TableEntries Switc h Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot L4 sport L4 dport Rule Action Stats 1. Forward packet to zero or more ports 2. Encapsulate and forward to controller 3. Send to normal processing pipeline 4. Modify Fields 5. Any extensions you add! + mask what fields to match Packet + byte counters 13 VLAN pcp IP ToS
- 14. OpenFlow: a pragmaticcompromise • + Speed, scale, fidelity of vendor hardware • + Flexibility and control of software and simulation • Vendors don’t need to expose implementation • Leverages hardware inside most switches today (ACL tables) 14
- 15. Examples Switching * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * 00:1f:.. ** * * * * * port6 Flow Switching port3 Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action 00:20.. 00:1f.. 0800 vlan1 1.2.3.4 5.6.7.8 4 17264 80 port6 Firewall * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * * * * * * * 22 drop 15
- 16. Examples Routing * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * ** * 5.6.7.8 * * * port6 VLAN Switching * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * vlan1 * * * * * port6, port7, port9 00:1f.. 16
- 17. Centralized vs DistributedControl Both models are possible with OpenFlow Centralized Control OpenFlow Switch OpenFlow Switch OpenFlow Switch Controller Distributed Control OpenFlow Switch OpenFlow Switch OpenFlow Switch Controller Controller Controller 17
- 18. Flow Routing vs.Aggregation Both models are possible with OpenFlow Flow-Based • Every flow is individually set up by controller • Exact-match flow entries • Flow table contains one entry per flow • Good for fine grain control, e.g. campus networks Aggregated •One flow entry covers large groups of flows •Wildcard flow entries •Flow table contains one entry per category of flows •Good for large number of flows, e.g. backbone 18
- 19. Reactive vs. Proactive(pre-populated) Both models are possible with OpenFlow Reactive • First packet of flow triggers controller to insert flow entries • Efficient use of flow table • Every flow incurs small additional flow setup time • If control connection lost, switch has limited utility Proactive •Controller pre-populates flow table in switch •Zero additional flow setup time •Loss of control connection does not disrupt traffic •Essentially requires aggregated (wildcard) rules 19
- 20. Usage examples • Alice’scode: – Simple learning switch – Per Flow switching – Network access control/firewall – Static “VLANs” – Her own new routing protocol: unicast, multicast, multipath – Home network manager – Packet processor (in controller) – IPvAlice Stanford demonstrated – VM migration – Server Load balancing – Mobility manager – Power management – Network monitoring and visualization – Network debugging – Network slicing … and much more you can create!
- 21. Quiz Time • Howdo I provide control connectivity? Is it really clean slate? • Why aren’t users complaining about time to setup flows over OpenFlow? (Hint: What is the predominant traffic today?) • Considering switch CPU is the major limit, how can one take down an OpenFlow network? • How to perform topology discovery over OpenFlow-enabled switches? • What happens when you have a non-OpenFlow switch inbetween? • What if there are two islands connected to same controller? • How scalable is OpenFlow? How does one scale deployments? 21
- 22. What can younot do with OpenFlow ver1.0 • Non-flow-based (per-packet) networking – e.g., Handling pkt 1 differently from pkt 2 of same flow – yes, this is a fundamental limitation – BUT OpenFlow provides the plumbing to connect devices • New forwarding primitives – BUT provides a nice way to integrate them through extensions • New packet formats/field definitions – BUT a generalized OpenFlow (2.0) is on the horizon • Optical Circuits – BUT efforts underway to apply OpenFlow model to circuits • Low-setup-time individual flows – BUT can push down flows proactively to avoid delays
- 23. Where it’s going •OF v1.1: Extensions for WAN, spring 2011 – multiple tables: leverage additional tables – tags and tunnels – multipath forwarding • OF v2+ – generalized matching and actions: an “instruction set” for networking 23
- 24. OpenFlow Implementations (Switch andController) 24
- 25. OpenFlow building blocks ControllerNOXNOX Slicing SoftwareFlowVisorFlowVisor FlowVisor Console 25 ApplicationsLAVILAVIENVI(GUI)ENVI (GUI) ExpedientExpedientn-Castingn-Casting NetFPGANetFPGASoftware Ref. Switch Software Ref. Switch Broadcom Ref. Switch Broadcom Ref. Switch OpenWRTOpenWRT PCEngine WiFi AP PCEngine WiFi AP Commercial Switches Stanford Provided OpenFlow Switches SNACSNAC Stanford Provided Monitoring/ debugging toolsoflopsoflopsoftraceoftrace openseeropenseer OpenVSwitchOpenVSwitch HP, NEC, Pronto, Juniper.. and many more HP, NEC, Pronto, Juniper.. and many more BeaconBeacon HeliosHelios MaestroMaestro
- 26. Ciena Coredirector NEC IP8800 CurrentSDN hardware More coming soon... Juniper MX-series HP Procurve 5400 Pronto 3240/3290 WiMax (NEC) PC EnginesNetgear 7324 26
- 27. Commercial Switch Vendors ModelVirtualize Notes HP Procurve 5400zl or 6600 1 OF instance per VLAN -LACP, VLAN and STP processing before OpenFlow -Wildcard rules or non-IP pkts processed in s/w -Header rewriting in s/w -CPU protects mgmt during loop NEC IP8800 1 OF instance per VLAN -OpenFlow takes precedence -Most actions processed in hardware -MAC header rewriting in h/w Pronto 3240 or 3290 with Pica8 or Indigo firmware 1 OF instance per switch -No legacy protocols (like VLAN and STP) -Most actions processed in hardware -MAC header rewriting in h/w 27
- 28. Controller Vendors Vendor Notes Nicira’s NOX •Open-sourceGPL •C++ and Python •Researcher friendly Nicira’s ONIX •Closed-source •Datacenter networks SNAC •Open-source GPL •Code based on NOX0.4 •Enterprise network •C++, Python and Javascript •Currently used by campuses Vendor Notes Stanford’s Beacon •Open-source •Researcher friendly •Java-based BigSwitch controller •Closed source •Based on Beacon •Enterprise network Maestro (from Rice Univ) •Open-source •Based on Java NEC’s Helios •Open-source •Written in C 28
- 29. Growing Community Vendors andstart-ups Providers and business-unit More... More... 29 Note: Level of interest varies
- 30.
- 31. Windows (OS) Windows (OS) Linux Mac OS x86 (Computer) Windows (OS) AppApp LinuxLinux Mac OS Mac OS Virtualization layer App Controller 1 AppApp Controller 2 Virtualizationor “Slicing” App OpenFlow Controller 1NOX (Network OS) Controller 2Network OS Trend Computer Industry Network Industry
- 32. Simple Packet Forwarding Hardware Network Operating System1 Open interface to hardware Virtualization or “Slicing” Layer Network Operating System 2 Network Operating System 3 Network Operating System 4 App App App App App App App App Many operating systems, or Many versions Open interface to hardware Isolated “slices” Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware 32
- 33. Switch Based Virtualization Existsfor NEC, HP switches but not flexible enough Normal L2/L3 Processing Flow Table Production VLANs Research VLAN 1 Controller Research VLAN 2 Flow Table Controller 33
- 34. FlowVisor-based Virtualization OpenFlow Switch OpenFlow Protocol OpenFlow FlowVisor &Policy Control Craig’s Controller Heidi’s ControllerAaron’s Controller OpenFlow Protocol OpenFlow Switch OpenFlow Switch 34 Topology discovery is per slice Topology discovery is per slice
- 35. OpenFlow Protocol OpenFlow FlowVisor & PolicyControl Broadcast Multicast OpenFlow Protocol http Load-balancer FlowVisor-based Virtualization OpenFlow Switch OpenFlow Switch OpenFlow Switch 35 Separation not only by VLANs, but any L1-L4 pattern Separation not only by VLANs, but any L1-L4 pattern dl_dst=FFFFFFFFFFFF tp_src=80, or tp_dst=80
- 36. FlowSpace: Maps Packetsto Slices
- 37. FlowVisor Message Handling OpenFlow Firmware DataPath Alice Controller Bob Controller Cathy Controller FlowVisor OpenFlow OpenFlow Packet Exception Policy Check: Is this rule allowed? Policy Check: Who controls this packet? Full Line Rate Forwarding Rule Packet
- 38. Use Case: NewCDN - Turbo Coral ++ Basic Idea: Build a CDN where you control the entire network – All traffic to or from Coral IP space controlled by Experimenter – All other traffic controlled by default routing – Topology is entire network – End hosts are automatically added (no opt-in) Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport * * * * * 84.65.* * * * * * * * * * * 84.65.* * * * * * * * * * * * * * 38
- 39.
- 40. Summary • Software-defined networkingis still evolving • OpenFlow is being deployed in over 100 organizations world-wide – GEC9 in Nov, 2010 showcased nation-wide OF – Internet 2 and NLR starting to serve as the GENI Backbone Are you innovating in your networks??
- 41. Credits • Thanks tofollowing for contributing content to the tutorial: – Nick McKeown – Guru Parulkar – Brandon Heller – Yiannis Yiakoumis – Guido Appenzeller – Rob Sherwood – Masa Kobayashi
Editor's Notes
- #5 The next 3 slides are a set of animation to show how we enable innovation: - Infrastructure is closed to innovation and only driven by vendors. Consumers have little say - Business model makes it hard for new features to be added
- #6 How do we redefine the architecture to open up networking infrastructure and the industry! By bring to the networking industry what we did to the computing world
- #7 Switches, routers and other middleboxes are dumbed down The key is to have a standardized control interface that speaks directly to hardware
- #12 How the actual protocol works
- #14 Now I’ll describe the API that tries to meet these goals.
- #21 What is possible in the controller? Anything that needs intelligent routing of a flow At Stanford, we have even shown how OpenFlow may be used for: VM migration Power management Load balancing Network monitoring and debugging Easier network visualization
- #26 There are components at different levels that work together in making it work The commercial switch details will follow in next slide There are a plethora of applications possible. I only list those available at Stanford
- #28 All support ver 1.0 All have approx 1500 flow table entry limit
- #32 Hidden slide (just for backup reasons) Shows how far along we can go in opening up the network
- #34 Experiments running on PRODUCTION infrastructure Key to get scale, key to get traffic on the network (e.g. can’t just do a reset...)