Contrail provides software defined networking and virtual network capabilities for OpenStack clouds. Key components of Contrail include the Contrail controller, vRouters running on hypervisors, and integration with OpenStack using Neutron and Nova. Virtual networks in Contrail can be created which provide isolation between groups of virtual machines and connectivity to physical networks.

1. OPENSTACK
WITH CONTRAIL
Software Defined Networking
And Cloud infrastructure
KOREA DATA CENTER ARCHITECT GROUP
KwonSun Bae as known as “BeBe”

2. FIRST,
WHAT IS THE SDN?
Why we want SDN?

3.  Software Defined Network
 소프트웨어 정의 네트워크
SDN?SDDC? OPENSTACK?
SDN이 무엇인가.
NetworkDefinedSoftware

4. 서버 자원 네트워크와 보안 설정
시간
가상화 이후
주
초
통신상의
지연
SOFTWARE DEFINED NETWORK
실질적인 네트워크 문제점

5.  Business의 변화
 유연하고 민첩한 Infra의 필요
 자동화.
SDN?
SDN은 왜 필요한가.
유연하고
빠르게
확장 가능한
Network

6. 네트워크 가상화의 진화
각 스위치별 VLAN 수동 설정
신규 서비스 확장이 복잡
성능관리 확장성 Scale -
4096 Tenant IDs
VLAN
기존 물리 네트워크 안에서
Tenant 지원
수동적. 비효율적. 낮은 확장성.

7. 네트워크 가상화의 진화
Reactive OpenFlow Approach
OpenFlow 를 지원하는
장비가 필요로함
OpenFlow는
flow에 대한
프로그래밍이 필요
각 Tenant 상태
정보는 각 장비가
관리함
높은 LATENCY. 낮은 확장성. FLOW관리의 복잡성. CONTROLLER 의존도 향상.
Centralized
Openflow
Controller
모든 Traffic flow의 첫
packet은 controller로
올라감

8.  How Does SDN or Software Defined Networking Work?
 Controller
 Southbound APIs
 Northbound APIs

 https://www.sdxcentral.com/resources/sdn/what-the-definition-of-software-defined-networking-sdn/
SOFTWARE DEFINED NETWORK
OpenFlow는 SDN 기술 중 하나이다.

9. 네트워크 가상화의 진화
Packet forwarding은
각 장비에서 처리
기존에 운영중인 Underlay
네트워크 이용
기존 네트워크 장비는 overlay
네트워크의 Tenant정보등을 몰라도 됨.
Controller는 가상 네트워크에 대한
프로그래밍만 사전에 수행
Proactive Overlay Networks
빠른 LATENCY. 높은 확장성. 낮은 리스크. CONTROLLER 부하 감소.

10.  SDN 의 장점
 Agility and Flexibility.
 https://www.sdxcentral.com/resources/sdn/why-sdn-software-defined-networking-or-nfv-network-functions-virtualization-now/
SOFTWARE DEFINED NETWORK
The Time for Changes in Networking is Now!

11. • HARDWARE CENTRIC
• DEDICATED HARDWARE
• LENGTHY SERVICE CHANGES
• MANUAL PROCESSES
• LIMITED EXPENSIVE SCALE & HA
• STATIC WORKLOADS/OPERATION
• SOFTWARE CENTRIC & VIRTUALIZED
• FLEXIBLE INFRASTRUCTURE
• DYNAMIC & AGILE ORCHESTRATION
• AUTOMATED IT WORKFLOWS
• INNATELY RESILIENT & SCALABLE
• DYNAMIC WORKLOAD MODELS
Cloud
• SOFTWARE CENTRIC CONTROL
• SOFTWARE OVERLAYS
• DYNAMIC & AGILE ORCHESTRATION
• AUTOMATED IT WORKFLOWS
• INNATELY RESILIENT & SCALABLE
• DYNAMIC CONFIG & OPERATION
SDN
SDN is an IMPERATIVE for CLOUD
CLOUD is an IMPERATIVE for ENTERPRISE

12. CONTRAIL – 가상화 및 자동화 네트워크
CONTROL PLANE, MANAGEMENT PLANE
NETWORK PROGRAMMABILITY
ENABLING NFV (NETWORK FUNCTION VIRTUALIZATION)
VIRTUALIZED NETWORK SERVICES
INTEROPERABILITY WITH PHYSICAL
NETWORK
NETWORK VIRTUALIZATION (PRIVATE, HYBRID)
CONVERGED NETWORK ORCHESTRATION
AUTOMATION, ANALYTICS

13. METAFABRIC END-TO-END NETWORKS
Multi-Data Center, Multi-Cloud, One Network
Internet
MX (USG)
Virtual & Physical
Security
QFX, EX, and QFabic Switching
Private Cloud
Hosted/
Managed
MX (USG)
Virtual & Physical
Security
QFX, EX, and QFabic Switching
Private Cloud
Public Cloud
(Hybrid)
Campus
and
Branch
Junos Space
Network Director
WAN

14. WAN
METAFABRIC END-TO-END NETWORKS
Internet
MX (USG)
Virtual & Physical
Security
QFX, EX, and QFabic Switching
Private Cloud
Hosted/
Managed
MX (USG)
Virtual & Physical
Security
QFX, EX, and QFabic Switching
Private Cloud
Public Cloud
(Hybrid)
Campus
and
Branch
P
End-to-end virtual networking
VLANs & EVPN
Application VPNs & Tenant VPNs
(L3VPN & EVPN)
VPC networks VPC networks
VPC networks
VPC networks
Junos Space
Network Director

15. Any IP* underlay physical network
NSX
Controller
NSX-MH
Controller
vSphere server
VM VM VM VM VM VM VM VM VM
DVS
vSphere ESXi
DVS
vSphere ESXi
DVS
vSphere ESXi
VN VN VN
VM VM VM VM VM VM VM VM VM
OVS, vSwitch
KVM, Xen, ESXi
OVS, vSwitch
KVM, Xen, ESXi
OVS, vSwitch
KVM, Xen, ESXi
VN VN VN
Optional vCD, vCAC Two editions of NSX
• NSX for Multi-hypervisor
• NSX for vSphere
• L2/L3 Virtual networking
• Add-ons: NAT, FW, LB, VPNs

16. NSX-MH
Controller
VM VM VM VM VM VM VM VM VM
OVS, vSwitch
KVM, Xen, ESXi
OVS, vSwitch
KVM, Xen, ESXi
OVS, vSwitch
KVM, Xen, ESXi
VN VN VN
NSX CROSS SELL OPPORTUNITY
QFX5100
IP, VC, VCF or QF fabric
MX/EX9200
USG features
Appliances
(eg SRX)
Bare Metal
(eg HPC)
VLAN
Junos Space Network Director
Virtual security portfolio is a cross-sell though not NSX-integrated

17. WAN
METAFABRIC END-TO-END NETWORKS
Internet
MX (USG)
Virtual & Physical
Security
QFX, EX, and QFabic Switching
Private Cloud
Hosted/
Managed
MX (USG)
Virtual & Physical
Security
QFX, EX, and QFabic Switching
Private Cloud
Public Cloud
(Hybrid)
Campus
and
Branch
P
Junos Space
Network Director

18. • Hardened OpenStack
• Contrail Networking
• Distributed storage
• Server management
BYO
VM FW VM VM VM VM VM VM VM
Contrail vRouter
KVM, Xen, ESXi, Docker
Contrail vRouter
KVM, Xen, ESXi, Docker
Contrail vRouter
KVM, Xen, ESXi, Docker
VN VN VN
MX
(or any PE router)
Appliances
(eg SRX)
Bare Metal
(eg HPC)
Bare Metal
(eg HPC)
Any IP underlay physical network
Contrail vRouter
Linux OS
VLAN
Virtual Appliance
(eg Firefly)
Contrail
Controller
DISTRIBUTION

19. SDN
JUNIPER CONTRAIL
Overview

20. CONTRAIL 요소
Physical Network
(no changes)
Analytics
CONTRAIL CONTROLLER
ControlConfiguration
Physical Host
with Hypervisor
vRouter
VM VM VM VM
Physical Host
with Hypervisor
vRouter
VM VM VM VM
WAN, Internet
Gateway
Orchestrator의 요청을 받아들여
VM 생성 및 네트워크 적용
실시간 트래픽, VM 분석 및
네트워크 요소들을 관리하고 분석
네트워크 요소들과 통신하며
Uptime 관리 및 Provisioning
vRouter: 가상화 라우팅 요소로써
Control Plan 과 Forwarding Plane
사이에서 트래픽을 전달
GateWay :
Juniper Router 혹은 타 벤더 라우터를
통한 GateWay 연동 지원
REST API
BGP
Clustering
BGP
XMPP XMPP

21. CONTRAIL & OPENSTACK COMPONENTS
Horizon UI
Contrail Web UI
Nova
(Compute Orchestration)
Neutron Plugin
Compute NodeStorage
Keystone
(Identity / Access
Mgmt)
Cinder
(Block Storage)
Swift
(Object Storage)
Nova Agent
Contrail Agent
Contrail Config
Contrail Control
vRouter
Operator
User Logs in, Create tenant
(projects), Create IPAM, Create
virtual network, Launch VMs
VM
Get VM Image to
spawn
API
Srvr
Scheduler …
Select Compute node
to spawn VM
Info to
spawn VM
Hypervisor
VM Spawned
Block Storage
Assignment
Xen
Bi-directional message bus
(XMPP interaction)
Launch VM
Network related interaction
Get virtual network info
DHCP
Plug (Tap interface, Instance ID, ..)
Glance
(Image Server)
Authentication, etc.

22. OPENSTACK INTEGRATION
Horizon
Nova API
Compute Driver
Virtual-IF
Driver
Nova Compute
Contrail Agent
vRouter (kernel)
Virtual Router
Nova Scheduler Neutron Driver
Neutron Plugin
Configuration
Node
Control
Node
1
Create an Instance (VM Info,
Network, IPAM, Policies, etc)
2 Schedule an Instance on the
Compute Node
3
VM Network
Properties
4 Create VM Interface 6 Publish VM
Intf on IFMap
5 Add Port
7
VM Interface Config
over XMPP
Scripts

23. 컴퓨트 노드 – 하이퍼바이저, VROUTER
Compute Node
Virtual
Machine
(Tenant B)
Virtual
Machine
(Tenant C)
Virtual
Machine
(Tenant C)
vRouter Forwarding Plane
Virtual
Machine
(Tenant A)
Routing
Instance
(Tenant A)
Routing
Instance
(Tenant B)
Routing
Instance
(Tenant C)
vRouter Agent
Flow Table
FIB
Flow Table
FIB
Flow Table
FIB
Overlay tunnels
MPLS over GRE or VXLAN
JUNOSV CONTRAIL CONTROLLER
JUNOSV CONTRAIL CONTROLLER
XMPP
Eth1Kernel
Tap Interfaces (vif)
pkt0
User
Eth0 EthN
Config
VRFs
Policy
Table
Top of Rack Switch
XMPP
• vRouter는 하이퍼바이저 커널 상에서 Linux
Bridge 또는 OVS 모듈을 대체 합니다.
• vRouter는 브리징(E-VPN) 및 라우팅(L3VPN)을
수행 합니다.
• vRouter는 보안 정책적용, NAT, 멀티캐스트,
미러링, 로드밸런싱등의 네트워킹 서비스를
제공합니다.
• 서비스 노드나 라우팅, 브로드캐스트, 멀티캐스트,
NAT를 위한 L2/L3 게이트웨이가 필요치 않음.

24. 컴퓨트 노드 – 포워딩/터널링
Overlay tunnels
MPLS over GRE or VXLAN
Compute Node
vRouter Forwarding Plane
Virtual
Machine
(VN-IP1)
Routing
Instance
Flow Table
FIB
Eth1 (Phy-IP1)
Tap Interfaces (vif)
Compute Node
vRouter Forwarding Plane
Virtual
Machine
(VN-IP2)
Routing
Instance
Flow Table
FIB
Eth1 (Phy-IP2)
Tap Interfaces (vif)
VIRTUAL
PHYSICAL
Virtual-IP2
Payload
Virtual-IP2
Payload
MPLS / VNI
Phy-IP2
Virtual-IP2
Payload
Virtual-IP2
Payload
MPLS / VNI
Phy-IP2
1. Guest OS는 ARP를 보낸다.
2. vRouter는 ARP를 받고 응답으로 VRRP
MAC을 보낸다.
3. Guest OS는 트래픽을 VRRP MAC으로
보내고, vRouter 는 패킷에 해당하는
MPLS/VNI 태그와 GRE헤더를 붙힌다.
4. 그 후 물리적인 라우터로 전송 하고,
받는다.
5. 응답 패킷을 MPLS/VNI 태그를 확인 하여
해당 라우팅 인스턴스로 전달한다.
6. vRouter는 태그를 제거하고 Guest OS로
전달 한다.

25. SDN
JUNIPER CONTRAIL
Let’s Virtual Networks

26. LOGICAL TOPOLOGY
VM
G1
VM
G2
VM
G3
VN G
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
Virtual Network
Tenant Virtual Machines
Virtual Firewall
Physical Gateway Router
Physical Network (Internet, L3VPN, ...)

27. PHYSICAL TOPOLOGY
OpenStack
Contrail
Controller
NeutronNova
Virtualized Server
Hypervisor with Contrail vRouter
Underlay Switches
Gateway Router to Internet or L3VPN

28. MAPPING OF LOGICAL TO VIRTUAL
TOPOLOGY
VM
G1
VM
G2
VM
G3
VN G
VM
R1
VM
R2
VM
R3
VN R
L3VPN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL

29. STARTING POINT
EMPTY LOGICAL TOPOLOGY
VM
G1
VM
G2
VM
G3
VN G
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL

30. CREATE GREEN TENANT
CREATE VIRTUAL NETWORK "GREEN"
VM
G1
VM
G2
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
Create VN G

31. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G1"
VM
G1
VM
G2
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
Create VM G1
Attach to VN G
Nova: Create VM
VM
G1

32. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G1"
VM
G1
VM
G2
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
Neutron:
Attach VM to VN
Create VM G1
Attach to VN G
XMPP:
Create routing-instance

33. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G2"
VM
G1
VM
G2
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
Create VM G2
Attach to VN G
VM
G1
Nova: Create VM
VM
G2

34. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G2"
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
Neutron:
Attach VM to VN
Create VM G2
Attach to VN G
VM
G2
XMPP:
Create routing-instance
VM
G2

35. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G2"
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
Create VM G2
Attach to VN G
VM
G2
XMPP:
Exchange routes
Create tunnels
VM
G2

36. CREATE GREEN TENANT
FORWARDING TABLES AND ENCAPSULATION
VM
G1
VM
G2
IP prefix Nexthop
VM G1
Virtual ethernet port
to VM G1
Green routing-instance IP FIB
VM G2
Push label L2 +
GRE encaps to server S2
MPLS label Nexthop
L1 Pop + Green routing-instance
Global MPLS FIB
IP prefix Nexthop
Server S2 Physical ethernet port
Global IP FIB
IP prefix Nexthop
VM G1
Push label L1
GRE encaps to server S1
Green routing-instance IP FIB
VM G2
Virtual ethernet port
to VM G2
MPLS label Nexthop
L2 Pop + Green routing-instance
Global MPLS FIB
IP prefix Nexthop
Server S1 Physical ethernet port
Global IP FIB
Inner IP header
Payload
VM G1
Source IP
VM G2
Dest IP
...
MPLS
L2
Label
GRE
...
Outer IP header
Server S1
Source IP
Server S2
Dest IP
Ethernet
Server S1
Source MAC
Server S2
Dest MAC
Packet
S1 S2

37. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G3"
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
Create VM G3
Attach to VN G
Nova: Create VM
VM
G3

38. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G3"
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
Create VM G3
Attach to VN G
VM
G3
Neutron:
Attach VM to VN
XMPP:
Create routing-instance

39. CREATE GREEN TENANT
CREATE VIRTUAL MACHINE "G3"
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
Create VM G3
Attach to VN G
VM
G3
XMPP:
Exchange routes
Create tunnels

40. CREATE GREEN TENANT
END STATE
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3

41. CREATE RED TENANT
SAME STEPS AS GREEN TENANT
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
VM
FW
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2

42. CONNECT GREEN TO RED TENANT VIA FIREWALL
CREATE VIRTUAL MACHINE FOR FIREWALL
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
Create VM FW
Attach to VN G
Attach to VN R
VM
FW
Nova: Create VM
VM
FW

43. CONNECT GREEN TO RED TENANT VIA FIREWALL
ATTACH FIREWALL TO RED AND GREEN VIRTUAL NETWORKS
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
PN
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
Create VM FW
Attach to VN G
Attach to VN R
VM
FW
VM
FW
Neutron:
Attach VM to VNs
XMPP: Create
routing-instance

44. CONNECT GREEN TO RED TENANT VIA FIREWALL
APPLY POLICY, EXCHANGE ROUTES, AND CREATE TUNNELS
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
L3VPN
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
VM
FW
VM
FW
Apply Policy
VN G ↔ VN R
XMPP:
Exchange routes
Create tunnels

45. CONNECT GREEN TO RED TENANT VIA FIREWALL
END STATE
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
L3VPN
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
VM
FW
VM
FW

46. CONNECT GREEN TO RED TENANT VIA FIREWALL
DATA PLANE: RED ↔ GREEN TRAFFIC FORCED THROUGH THE FIREWALL
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
L3VPN
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
VM
FW
VM
FW

47. CONNECT RED TENANT TO PHYSICAL L3VPN
CONFIGURE L3VPN ROUTING INSTANCE
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
VM
FW
VM
FW
L3VPN
Apply Policy
VN R ↔ L3VPN
Netconf:
Configure
routing-instance

48. CONNECT RED TENANT TO PHYSICAL L3VPN
EXCHANGE ROUTES WITH PHYSICAL ROUTER, CREATE TUNNELS
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
VM
FW
VM
FW
L3VPN
Apply Policy
VN R ↔ L3VPN
BGP:
Exchange routes
Create tunnels

49. CONNECT RED TENANT TO PHYSICAL L3VPN
EXCHANGE ROUTES WITH VROUTERS, CREATE TUNNELS
VM
G1
VM
G3
VM
R1
VM
R2
VM
R3
VN R
OpenStack
Contrail
Controller
NeutronNova
PHYSICAL LOGICAL
VN G
VM
G1
VM
G2 VM
G2
VM
G3
VM
R1
VM
R3
VM
R2
VM
FW
VM
FW
L3VPN
Apply Policy
VN R ↔ L3VPN
XMPP:
Exchange routes
Create tunnels

50. FLEXIBLE AND DYNAMIC
CHAINING OF SERVICES
Host + HypervisorHost + Hypervisor
VIRTUAL
NETWORK
GREEN
VIRTUAL
NETWORK
YELLOW
Service A Service B
IP fabric
(switch underlay)
A CB
G1 G2 G3
G1
G2
G3
Y1 Y2 Y3
Y2
Y3
Y1
VM and virtualized Network
function pool
VM and virtualized
Network function pool
… …
LOGICAL
PHYSICAL
Service C

51. WHY CONTRAIL?
Cloud Service node가 많지 않다면?

52.  L3 Gateway
 Load-Balancing
 Network Extension
WHY CONTRAIL?
Cloud Service node가 늘어난다면?
 Resource Mgmt
 Elastic Services
 Dynamic Config &
Operations