SlideShare a Scribd company logo
“You can keep your firewall (if you
want to)”
Practical, simple and cost saving applications of OpenDaylight
you can implement today
John Sobanski, Engineer, Solers Inc.
July 2015
@OpenDaylightSDN #OpenSDN
What You Will Learn today (By Demonstration)
• 10,000 Foot Views of Software Defined Networking (SDN), OpenDaylight (ODL) and Service Function Chains
(SFC)
• Solve real world data center problems with ODL
• RESTCONF API
• ODL Service Function Chaining
• Feel free to contact me for any details I don't cover here
jsobanski@solers.com
https://ask.opendaylight.org/users/420/runamuck/
2
Top three emerging technologies of the decade?
• My take…
• Big Data
• DevOps
• Software Defined Networks
3
Any Others?
“Is SDN Hype?”
• “Big Data and DevOps have clear applications and use cases but Software Defined Networks appears to be a
solution in search of a problem.”
• “Most SDN activity is focused in Academia or dedicated ‘Network Function Virtualization (NFV)’ shops... not
relevant to us.”
• "SDN/ NFV only applies to Greenfield Architectures."
4
These slides will prove these opinions wrong
“Who cares about networks?”
• Answer: You Do! Network latency and/ or loss breaks services.
5
“Latency and Loss doesn’t apply to my Data Center”
• “Latency and Loss? I've got dozens of 10GbE ports!!!”
• Layer 2: Spanning tree protocol
• Blocks all but one path to prevent loops
• (Enable LACP/ LAG)
• Layer 3: Shortest path first
• Sends all traffic through a congested "one hop" path over a wide open "two hop" path
• (Try Traffic Engineering)
• Layer 4: Default TCP buffers
• Small buffers mean more round trips. Latency throttles throughput.
• (Tune the buffer)
6
You need to care about the network!
What are Network Services?
• Familiar Network Services
• Load Balancing
• Firewall
• Deep Packet Inspection (DPI)
• Access Control Lists
• Parental Control
• Other Network Services
• "Global State" (Routing)
• Broadcast Domain Scoping (VLAN)
• Resource Signaling
• Prioritization and Preemption
• Multicast
• N-Cast
7
10,000 Foot Overview
• 10,000 Foot view of SDN
• At any give time, use a centralized controller to move data through your network equipment as you see fit
• Doesn't seem like a big deal to non-network types but this is incredibly powerful!
• 10,000 Foot view of OpenDaylight
• Allows you to install network services as "Apps"
• Provides a single REST API to configure heterogeneous hardware
• This is a “no brainer” for developers but is HUGE for network engineers
• 10,000 Foot view of Service Function Chains
• “Service Overlay”
• Divorce Network Services From Topology
• For more detail see:
• https://www.opennetworking.org/sdn-resources/sdn-definition
• http://www.opendaylight.org/project/technical-overview
• https://wiki.opendaylight.org/view/Service_Function_Chaining:Main 8
A Little More Detail: SDN Layers
• Top Layer  Northbound
• Network Apps & Orchestration
• Business logic to monitor and control network behavior
• Thread services together
• Middle Layer  Controller Platform
• Exposes "Northbound" APIs to the Application layer
• Lower Layer  Southbound
• Command and control of hardware
• Network Devices (Physical or Virtual)
• Switches, Routers, Firewalls etc.
9
A Little More Detail: OpenDaylight
• OpenDaylight
• Open source project
• Modular/ Pluggable and flexible controller platform
• Java Virtual Machine (JVM)
• Dynamically Pluggable Modules for Network Tasks
• OSGi framework (local applications)/ bidirectional REST (local or remote) for the northbound API
• Network Apps
• House business logic and algorithms
• Gather network intelligence from the controler
• Run algorithms to perform analytics
• Orchestrate new rules (if any) via controller
• Southbound
• OpenFlow 1.3, OVSDB, SNMP, CLI
• Service Abstraction Layer links Northbound to Southbound
10
A Little More Detail: ODL
11
A Little More Detail: SFC
• SFC enables a “service topology”
• Overlay built “on top” of existing network topology
• Use any overlay or underlay technology to create service paths
• VLAN, ECMP, GRE, VXLAN, etc.
• SFC provides resources for consumption
• Service Topology connects those resources
• Quickly/ Easily add new service functions
• Requires no underlying network changes
12
One Caveat Before we begin
• WARNING: Software Defined Networking is incredibly powerful!
• You must protect your Southbound interfaces with the same regard as a firewall or any root privileges
• ODL accommodates TLS for Southbound interfaces
• The security, identity and bureaucratic planes are orthogonal to the technology plane we discuss here
• We do not discuss security, identity or policy but you must consider them when architecting your ODL
solution
13
One more Caveat
• WARNING: If you are not a hands-on network engineer, this presentation may "spoil" you.
• To provide the following two OPSCON using legacy protocols may be impossible and at the very least requires intense,
disciplined, meticulous network engineering.
14
DPI Bypass
Approach #1: RESTCONF API
15
OPSCON #1: Deep Packet Inspection Bypass
• This scenario investigates how to reduce latency
• You have a data center that performs deep packet inspection (DPI) for inter-network flows
• DPI injects latency into the end to end (E2E) flow and increases Round Trip Time (RTT)
16
Reminder: Network latency and loss breaks services!
Topology
• Network gateways in Firewall/ DPI appliance
• VLAN steer (bent pipe) traffic through DPI (via gateways) for inter-network flows
• Can we create logic to DPI only once?
17
One Approach
• Put logic (i.e. rules) in the DPI appliance to bypass certain flows
• This, however consumes resources and can saturate the backplane
18
Put logic here?
Better Approach
• Use the OpenDaylight controller and put logic in the switch!
19
Put logic here!
OPSCON #1 Detailed Topology
20
DPI Bypass Demo
Approach #1: RESTCONF API
Note: This section will be a live demonstration
21
Step 1: Start ODL Platform via Client
• Platform includes controller
• Install Network Apps via command line
22
Validate Topology
• Connect to controller and “pingall”
23
ODL Shows the Layer 2 Interfaces
24
Baseline: Two DPI = Severe Latency
• Ping from Client (h1) to Server (h3) shows 40+ ms latency
mininet> h1 ping h3 PING 10.0.3.101 (10.0.3.101) 56(84) bytes of data.
64 bytes from 10.0.3.101: icmp_seq=1 ttl=62 time=42.1 ms
64 bytes from 10.0.3.101: icmp_seq=2 ttl=62 time=41.3 ms
64 bytes from 10.0.3.101: icmp_seq=3 ttl=62 time=41.1 ms
^C
--- 10.0.3.101 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 41.119/41.546/42.143/0.465 ms
25
Baseline: End to End (E2E) Path
• Traceroute shows a path through the two DPI gateways, as expected
mininet> h1 traceroute -n h3
traceroute to 10.0.3.101 (10.0.3.101), 30 hops max, 60 byte packets
1 10.0.1.1 21.180 ms 21.028 ms 20.837 ms
2 10.0.2.1 42.565 ms 42.482 ms 42.418 ms
3 * * 10.0.3.101 43.144 ms
mininet>
26
Configure Switch via ODL Platform REST API
27
Configure Switch via ODL Platform REST API
• Use these headers:
Accept: application/xml
Authorization: Basic YWRtaW46YWRtaW4=
• Then post the following flows (next slide) to Switch 2's table zero:
PUT flow with ID 202 to
http://<controller_ip>:8181/restconf/config/opendaylight-
inventory:nodes/node/openflow:2/table/0/flow/202
PUT flow with ID 303 to
http://<controller_ip>:8181/restconf/config/opendaylight-
inventory:nodes/node/openflow:2/table/0/flow/303
28
RESTCONF Flows (XML)
29
The Switch Accepts the Flows
$ sudo ovs-ofctl -O OpenFlow13 dump-flows s2
cookie=0x0, duration=350.260s, table=0, n_packets=0, n_bytes=0,
priority=200,ip,nw_dst=10.0.3.101 actions=set_field:f6:2f:25:06:ab:27-
>eth_dst,output:4
cookie=0x1, duration=33.552s, table=0, n_packets=0, n_bytes=0,
priority=200,ip,nw_dst=10.0.1.101 actions=set_field:f2:3e:8d:a4:71:07-
>eth_dst,output:5
30
Latency Reduced
• Ping now shows that the second, slow DPI is no longer in the path:
mininet> h1 ping h3
PING 10.0.3.101 (10.0.3.101) 56(84) bytes of data.
64 bytes from 10.0.3.101: icmp_seq=1 ttl=63 time=21.3 ms
64 bytes from 10.0.3.101: icmp_seq=2 ttl=63 time=20.9 ms
64 bytes from 10.0.3.101: icmp_seq=3 ttl=63 time=20.7 ms
^C
--- 10.0.3.101 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 20.713/20.983/21.320/0.252 ms
31
Latency Reduced
• Traceroute Confirms that the flow bypasses the second DPI
mininet> h1 traceroute -n h3
traceroute to 10.0.3.101 (10.0.3.101), 30 hops max, 60 byte packets
1 10.0.1.1 21.117 ms 20.796 ms 20.423 ms
2 10.0.3.101 24.597 ms 24.477 ms *
32
DPI Bypass Demo
Approach #2: ODL SFC
33
A Little More Detail: ODL
ODL Provides a Northbound SFC “App”
34
SFC Approach: Create a “Service Overlay”
• 1. Register Firewalls in service pool
• “Service Functions”
• 2. Configure switches to forward
packets based on controller logic
• “Service Function Forwarders”
• 3. Configure SFC Logic
• … Next Slide
#ODSummit
1
2
3
SFC Workflow (Highly Abstracted!)
• Register (Previous Slide)
• Service Functions (Appliances) -- AKA Network Services
• Service Function Forwarders (ODL SFC Controlled Switches)
• Create Service Function “Chains”
• “Chain” of Network Services
• I.e. First Firewall, then Apply Parental Control, then Virus Scan etc.
• Create Service Function Paths and Rendered Service Paths
• Selects path through actual appliance (SF) instances e.g.
• RSP-1 = Firewall-1, Parental-Control-1, Virus-Scan-1
• RSP-7 = Firewall-3, Patental-Control-1, Virus-Scan-2
• Create “Classifier”
• Apply SFC to flows
#ODSummit
DPI Bypass Demo
Approach #2: ODL SFC
Note: This will be a live demo
37
Based on: https://lists.opendaylight.org/pipermail/sfc-dev/2015-July/001408.html
by Brady Johnson and Ricardo Noriega at Ericsson.com
Baseline
• No Flows in Switch, No Objects in GUI
#ODSummit
Configure via REST API
• Add SF, SFF, SFC, SFP and RSP
• GUI Populated
• Controller then injects logic into SFF via
flows
$ sudo ovs-ofctl dump-flows
sff1 -OOpenFlow13
#ODSummit
Test 1: Configure Classifier to Use RSP-1
tcpdump shows WGET goes
through both service functions
Total time: 0.341 seconds
#ODSummit
SFF-1 Traffic SFF-2 Traffic
Test 2: Configure Classifier to Use RSP-3
tcpdump shows WGET goes
through only one service
functions
Total time: 0.178 seconds
#ODSummit
SFF-1: No
Traffic
SFF-2 Traffic
Backup Slides
#ODSummit
#ODSummit
OPSCON #2:
Egress Bypass
OPSCON #2: Bypass DPI on Egress
• Scenario: You have a product distribution system where Egress throughput >> Ingress throughput.
• You perform Deep Packet Inspection on flows between External (EXT) hosts and your Demilitarized Zone
(DMZ) Proxies.
44
Topology
• You implement a DPI "router on a stick," to ensure Inter-network communications pass through the DPI.
• A switch bent pipes the traffic at layer 2
45
Scenario
• The Egress traffic will increase past the capacity of the DPI appliance
• You realize that there are cheaper methods of securing your egress flows then upgrading
to a bigger DPI appliance…
46
Egress Security
• With egress flows you want to ensure that return/ ACK traffic does not include exploits and that egress flows do not
facilitate zombies or phone home exploits.
• Some ideas:
• Ensure only approved ports
• Access Control Lists
• iptables
• Host firewalls
• Mitigate against malicious code over approved ports:
• HIDS on Servers
• Uni-directional bulk data push with Error Detection and Correction over one way fiber
• TLS with x509 certs
47
Trade Solutions
• END GOAL: You want to have DPI inspection on ingress flows, but not egress, since the other security
measures will cover the egress flows.
• One approach is to put logic on your DPI appliance to say "don't scan egress flows," but that wastes
capacity/ resources and could saturate the backplane
• An approach with legacy Network protocols is very difficult to implement and results in asymmetric
routes (will break things)
• Using OpenDaylight, we have a simple solution that only requires matches/ actions on six (6) flows
48
The Goal
• When EXT initiates, pass through DPI
• When DMZ initiates:
• Bypass DPI on PUT (Egress)
• Scan on GET (Ingress)
49
Detailed Diagram
1. ACL
2. Scan all EXT  DMZ
3. Bypass DMZ PUT
4. Scan DMZ GET
50
OpenFlow Logic
1. ACL only allows permitted flows
2. For Ingress ( EXT-> DMZ ) flows, allow normal path to virus scan via gateway
3. For Egress ( DMZ -> EXT ) PUT flows, intercept packet
1. Change destination MAC from Gateway to EXT
2. Change destination Port from Gateway to EXT
3. Decrement TTL by one
4. For Egress (DMZ -> EXT) GET flows (Treat as ingress)
1. DMZ uses dummy IP for EXT server
2. Switch intercepts packet
3. Switch changes source IP to dummy DMZ address
4. Switch changes dest IP to correct EXT IP
5. Packet continues on its way to gateway
6. Reverse logic for return traffic
51
OPSCON #2 Topology
52
OPSCON #2
Note: This will be a real time demo
53
Setup
• As before, start ODL, connect switch to controller and “pingall”
54
ODL Shows Connected L2 Interfaces
55
Baseline: Push a file from DMZ to EXT
mininet> dmz curl http://10.0.1.102 --upload-file test.txt
• EXT Server Shows Successful PUT
10.0.2.101 - - [10/Jul/2015 14:50:22] "PUT /test.txt HTTP/1.1"
• TCPDUMP on firewall shows egress scan traffic (as expected)
56
Install the Flows via RESTCONF API
• Either via POSTMAN or CURL
curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_404.xml" -u admin:admin
http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/404 2>&1 | grep HTTP/1.1
curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_505.xml" -u admin:admin
http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/505 2>&1 | grep HTTP/1.1
curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_606.xml" -u admin:admin
http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/606 2>&1 | grep HTTP/1.1
curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_707.xml" -u admin:admin
http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/707 2>&1 | grep HTTP/1.1
curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_808.xml" -u admin:admin
http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/808 2>&1 | grep HTTP/1.1
curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_909.xml" -u admin:admin
http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/909 2>&1 | grep HTTP/1.1
57
DMZ PUT a file to EXT
mininet> dmz curl http://10.0.1.102 --upload-file test.txt
• The EXT server shows this second, successful put
10.0.2.101 - - [10/Jul/2015 14:50:22] "PUT /test.txt HTTP/1.1" 200 -
10.0.2.101 - - [10/Jul/2015 14:53:05] "PUT /test.txt HTTP/1.1" 200 -
• The firewall TCPDUMP, however does not show additional traffic!
58
Plumb Statistics via API
• You can see a Match on the flow through the REST API:
• http://<controller_IP>:8181/restconf/operational/opendaylight-
inventory:nodes/node/openflow:3/table/0/flow/404/flow-statistics/
59
Test DMZ to EXT GET (Ingress)
• Use a Dummy IP to trigger a flow match.
• The egress port of the switch will NAT it back to the real destination IP.
• We see instant feedback on the Mininet Console
60
EXT Server Shows Successful Get
10.0.2.101 - - [10/Jul/2015 14:50:22] "PUT /test.txt
HTTP/1.1" 200 -
10.0.2.101 - - [10/Jul/2015 14:53:05] "PUT /test.txt
HTTP/1.1" 200 -
6.6.6.6 - - [10/Jul/2015 15:01:27] "GET / HTTP/1.1" 200 -
• Note Dummy IP
61
FW TCPDUMP Shows DMZ to EXT GET Scan
62
Verify All EXT  DMZ Traffic Scan
• Do PUT and GET
63
DMZ Server Log Shows Success for Both
64
TCPDUMP: All EXT to DMZ traffic scanned
65
Thank You
#ODSummit

More Related Content

What's hot

SDN Presentation
SDN PresentationSDN Presentation
SDN Presentation
Abderrahmane TEKFI
 
224698998 moshell-commands
224698998 moshell-commands224698998 moshell-commands
224698998 moshell-commands
Achmad Salsabil
 
Network layer
Network layerNetwork layer
Network layer
Hasib Shaikh
 
Lte x2-handover-sequence-diagram
Lte x2-handover-sequence-diagramLte x2-handover-sequence-diagram
Lte x2-handover-sequence-diagram
Prashant Sengar
 
Lte most used command rev1
Lte most used command rev1Lte most used command rev1
Lte most used command rev1
Christofer Dinamiko
 
Introduction of dmvpn
Introduction of dmvpnIntroduction of dmvpn
Introduction of dmvpn
E-Lins Technology Co. Ltd.
 
Optimisation guide line ver1.1
Optimisation guide line ver1.1Optimisation guide line ver1.1
Optimisation guide line ver1.1
Chandra Deria
 
Amos command
Amos commandAmos command
Amos command
Hossein Abbasi
 
Open vSwitch 패킷 처리 구조
Open vSwitch 패킷 처리 구조Open vSwitch 패킷 처리 구조
Open vSwitch 패킷 처리 구조
Seung-Hoon Baek
 
Tutoriel nat pat
Tutoriel nat patTutoriel nat pat
Tutoriel nat pat
Dimitri LEMBOKOLO
 
Chap.1 ethernet introduction
Chap.1 ethernet introductionChap.1 ethernet introduction
Chap.1 ethernet introduction
東原 李
 
TCP/IP
TCP/IPTCP/IP
TCP/IP
aibad ahmed
 
Ccna rse chp7 Access Control List (ACL)
Ccna rse chp7 Access Control List (ACL)Ccna rse chp7 Access Control List (ACL)
Ccna rse chp7 Access Control List (ACL)
newbie2019
 
Introduction to TCP
Introduction to TCPIntroduction to TCP
Introduction to TCP
Pradeep Kumar TS
 
Why sdn
Why sdnWhy sdn
Why sdn
lz1dsb
 
Power point network operator overview
Power point network operator overviewPower point network operator overview
Power point network operator overview
Joshua Cohen
 
Chapter 8 .vlan.pdf
Chapter 8 .vlan.pdfChapter 8 .vlan.pdf
Chapter 8 .vlan.pdf
manojkumar595505
 
RACH procedure in LTE
RACH procedure in LTERACH procedure in LTE
RACH procedure in LTE
debamoha
 
SDN Training - Open daylight installation + example with mininet
SDN Training - Open daylight installation + example with mininetSDN Training - Open daylight installation + example with mininet
SDN Training - Open daylight installation + example with mininet
SAMeh Zaghloul
 
TCP - Transmission Control Protocol
TCP - Transmission Control ProtocolTCP - Transmission Control Protocol
TCP - Transmission Control Protocol
Peter R. Egli
 

What's hot (20)

SDN Presentation
SDN PresentationSDN Presentation
SDN Presentation
 
224698998 moshell-commands
224698998 moshell-commands224698998 moshell-commands
224698998 moshell-commands
 
Network layer
Network layerNetwork layer
Network layer
 
Lte x2-handover-sequence-diagram
Lte x2-handover-sequence-diagramLte x2-handover-sequence-diagram
Lte x2-handover-sequence-diagram
 
Lte most used command rev1
Lte most used command rev1Lte most used command rev1
Lte most used command rev1
 
Introduction of dmvpn
Introduction of dmvpnIntroduction of dmvpn
Introduction of dmvpn
 
Optimisation guide line ver1.1
Optimisation guide line ver1.1Optimisation guide line ver1.1
Optimisation guide line ver1.1
 
Amos command
Amos commandAmos command
Amos command
 
Open vSwitch 패킷 처리 구조
Open vSwitch 패킷 처리 구조Open vSwitch 패킷 처리 구조
Open vSwitch 패킷 처리 구조
 
Tutoriel nat pat
Tutoriel nat patTutoriel nat pat
Tutoriel nat pat
 
Chap.1 ethernet introduction
Chap.1 ethernet introductionChap.1 ethernet introduction
Chap.1 ethernet introduction
 
TCP/IP
TCP/IPTCP/IP
TCP/IP
 
Ccna rse chp7 Access Control List (ACL)
Ccna rse chp7 Access Control List (ACL)Ccna rse chp7 Access Control List (ACL)
Ccna rse chp7 Access Control List (ACL)
 
Introduction to TCP
Introduction to TCPIntroduction to TCP
Introduction to TCP
 
Why sdn
Why sdnWhy sdn
Why sdn
 
Power point network operator overview
Power point network operator overviewPower point network operator overview
Power point network operator overview
 
Chapter 8 .vlan.pdf
Chapter 8 .vlan.pdfChapter 8 .vlan.pdf
Chapter 8 .vlan.pdf
 
RACH procedure in LTE
RACH procedure in LTERACH procedure in LTE
RACH procedure in LTE
 
SDN Training - Open daylight installation + example with mininet
SDN Training - Open daylight installation + example with mininetSDN Training - Open daylight installation + example with mininet
SDN Training - Open daylight installation + example with mininet
 
TCP - Transmission Control Protocol
TCP - Transmission Control ProtocolTCP - Transmission Control Protocol
TCP - Transmission Control Protocol
 

Similar to Sobanski odl summit_2015

FreeSWITCH as a Microservice
FreeSWITCH as a MicroserviceFreeSWITCH as a Microservice
FreeSWITCH as a Microservice
Evan McGee
 
Cis sem sdn
Cis sem sdnCis sem sdn
Cis sem sdn
Lino Quivén
 
OpenFlow Tutorial
OpenFlow TutorialOpenFlow Tutorial
OpenFlow Tutorial
Ja-seop Kwak
 
Introduction to SDN
Introduction to SDNIntroduction to SDN
Introduction to SDN
Muhammad Moinur Rahman
 
Sdn not just a buzzword
Sdn not just a buzzwordSdn not just a buzzword
Sdn not just a buzzword
Jorge Bonilla
 
Tech Tutorial by Vikram Dham: Let's build MPLS router using SDN
Tech Tutorial by Vikram Dham: Let's build MPLS router using SDNTech Tutorial by Vikram Dham: Let's build MPLS router using SDN
Tech Tutorial by Vikram Dham: Let's build MPLS router using SDN
nvirters
 
Introductionto SDN
Introductionto SDN Introductionto SDN
Introductionto SDN
Md. Shariful Islam Robin
 
Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)
Bangladesh Network Operators Group
 
IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...
IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...
IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...
Christian Esteve Rothenberg
 
Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...
Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...
Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...
Cloud Native Day Tel Aviv
 
OpenStack Discovery and Networking Assurance - Koren Lev - Meetup
OpenStack Discovery and Networking Assurance - Koren Lev - MeetupOpenStack Discovery and Networking Assurance - Koren Lev - Meetup
OpenStack Discovery and Networking Assurance - Koren Lev - Meetup
Cloud Native Day Tel Aviv
 
NCS: NEtwork Control System Hands-on Labs
NCS:  NEtwork Control System Hands-on Labs NCS:  NEtwork Control System Hands-on Labs
NCS: NEtwork Control System Hands-on Labs
Cisco Canada
 
Software Defined Networking: Primer
Software Defined Networking: Primer Software Defined Networking: Primer
Software Defined Networking: Primer
Bangladesh Network Operators Group
 
SDN Demystified, by Dean Pemberton [APNIC 38]
SDN Demystified, by Dean Pemberton [APNIC 38]SDN Demystified, by Dean Pemberton [APNIC 38]
SDN Demystified, by Dean Pemberton [APNIC 38]
APNIC
 
2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...
2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...
2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...
Ambassador Labs
 
Improving performance and efficiency with Network Virtualization Overlays
Improving performance and efficiency with Network Virtualization OverlaysImproving performance and efficiency with Network Virtualization Overlays
Improving performance and efficiency with Network Virtualization Overlays
Adam Johnson
 
Introduction to Software Defined Networking (SDN) presentation by Warren Finc...
Introduction to Software Defined Networking (SDN) presentation by Warren Finc...Introduction to Software Defined Networking (SDN) presentation by Warren Finc...
Introduction to Software Defined Networking (SDN) presentation by Warren Finc...
APNIC
 
Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)
Bangladesh Network Operators Group
 
Building the Internet of Things with Thingsquare and Contiki - day 1, part 3
Building the Internet of Things with Thingsquare and Contiki - day 1, part 3Building the Internet of Things with Thingsquare and Contiki - day 1, part 3
Building the Internet of Things with Thingsquare and Contiki - day 1, part 3
Adam Dunkels
 
SDN - a new security paradigm?
SDN - a new security paradigm?SDN - a new security paradigm?
SDN - a new security paradigm?
Sophos Benelux
 

Similar to Sobanski odl summit_2015 (20)

FreeSWITCH as a Microservice
FreeSWITCH as a MicroserviceFreeSWITCH as a Microservice
FreeSWITCH as a Microservice
 
Cis sem sdn
Cis sem sdnCis sem sdn
Cis sem sdn
 
OpenFlow Tutorial
OpenFlow TutorialOpenFlow Tutorial
OpenFlow Tutorial
 
Introduction to SDN
Introduction to SDNIntroduction to SDN
Introduction to SDN
 
Sdn not just a buzzword
Sdn not just a buzzwordSdn not just a buzzword
Sdn not just a buzzword
 
Tech Tutorial by Vikram Dham: Let's build MPLS router using SDN
Tech Tutorial by Vikram Dham: Let's build MPLS router using SDNTech Tutorial by Vikram Dham: Let's build MPLS router using SDN
Tech Tutorial by Vikram Dham: Let's build MPLS router using SDN
 
Introductionto SDN
Introductionto SDN Introductionto SDN
Introductionto SDN
 
Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)
 
IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...
IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...
IEEE HPSR 2017 Keynote: Softwarized Dataplanes and the P^3 trade-offs: Progra...
 
Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...
Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...
Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...
 
OpenStack Discovery and Networking Assurance - Koren Lev - Meetup
OpenStack Discovery and Networking Assurance - Koren Lev - MeetupOpenStack Discovery and Networking Assurance - Koren Lev - Meetup
OpenStack Discovery and Networking Assurance - Koren Lev - Meetup
 
NCS: NEtwork Control System Hands-on Labs
NCS:  NEtwork Control System Hands-on Labs NCS:  NEtwork Control System Hands-on Labs
NCS: NEtwork Control System Hands-on Labs
 
Software Defined Networking: Primer
Software Defined Networking: Primer Software Defined Networking: Primer
Software Defined Networking: Primer
 
SDN Demystified, by Dean Pemberton [APNIC 38]
SDN Demystified, by Dean Pemberton [APNIC 38]SDN Demystified, by Dean Pemberton [APNIC 38]
SDN Demystified, by Dean Pemberton [APNIC 38]
 
2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...
2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...
2017 Microservices Practitioner Virtual Summit: Microservices at Squarespace ...
 
Improving performance and efficiency with Network Virtualization Overlays
Improving performance and efficiency with Network Virtualization OverlaysImproving performance and efficiency with Network Virtualization Overlays
Improving performance and efficiency with Network Virtualization Overlays
 
Introduction to Software Defined Networking (SDN) presentation by Warren Finc...
Introduction to Software Defined Networking (SDN) presentation by Warren Finc...Introduction to Software Defined Networking (SDN) presentation by Warren Finc...
Introduction to Software Defined Networking (SDN) presentation by Warren Finc...
 
Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)Introduction to Software Defined Networking (SDN)
Introduction to Software Defined Networking (SDN)
 
Building the Internet of Things with Thingsquare and Contiki - day 1, part 3
Building the Internet of Things with Thingsquare and Contiki - day 1, part 3Building the Internet of Things with Thingsquare and Contiki - day 1, part 3
Building the Internet of Things with Thingsquare and Contiki - day 1, part 3
 
SDN - a new security paradigm?
SDN - a new security paradigm?SDN - a new security paradigm?
SDN - a new security paradigm?
 

Recently uploaded

Determination of Equivalent Circuit parameters and performance characteristic...
Determination of Equivalent Circuit parameters and performance characteristic...Determination of Equivalent Circuit parameters and performance characteristic...
Determination of Equivalent Circuit parameters and performance characteristic...
pvpriya2
 
An Introduction to the Compiler Designss
An Introduction to the Compiler DesignssAn Introduction to the Compiler Designss
An Introduction to the Compiler Designss
ElakkiaU
 
Presentation on Food Delivery Systems
Presentation on Food Delivery SystemsPresentation on Food Delivery Systems
Presentation on Food Delivery Systems
Abdullah Al Noman
 
FULL STACK PROGRAMMING - Both Front End and Back End
FULL STACK PROGRAMMING - Both Front End and Back EndFULL STACK PROGRAMMING - Both Front End and Back End
FULL STACK PROGRAMMING - Both Front End and Back End
PreethaV16
 
Null Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAMNull Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAM
Divyanshu
 
Object Oriented Analysis and Design - OOAD
Object Oriented Analysis and Design - OOADObject Oriented Analysis and Design - OOAD
Object Oriented Analysis and Design - OOAD
PreethaV16
 
Blood finder application project report (1).pdf
Blood finder application project report (1).pdfBlood finder application project report (1).pdf
Blood finder application project report (1).pdf
Kamal Acharya
 
一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理
一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理
一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理
nedcocy
 
DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...
DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...
DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...
OKORIE1
 
OOPS_Lab_Manual - programs using C++ programming language
OOPS_Lab_Manual - programs using C++ programming languageOOPS_Lab_Manual - programs using C++ programming language
OOPS_Lab_Manual - programs using C++ programming language
PreethaV16
 
一比一原版(USF毕业证)旧金山大学毕业证如何办理
一比一原版(USF毕业证)旧金山大学毕业证如何办理一比一原版(USF毕业证)旧金山大学毕业证如何办理
一比一原版(USF毕业证)旧金山大学毕业证如何办理
uqyfuc
 
AN INTRODUCTION OF AI & SEARCHING TECHIQUES
AN INTRODUCTION OF AI & SEARCHING TECHIQUESAN INTRODUCTION OF AI & SEARCHING TECHIQUES
AN INTRODUCTION OF AI & SEARCHING TECHIQUES
drshikhapandey2022
 
Open Channel Flow: fluid flow with a free surface
Open Channel Flow: fluid flow with a free surfaceOpen Channel Flow: fluid flow with a free surface
Open Channel Flow: fluid flow with a free surface
Indrajeet sahu
 
SCALING OF MOS CIRCUITS m .pptx
SCALING OF MOS CIRCUITS m                 .pptxSCALING OF MOS CIRCUITS m                 .pptx
SCALING OF MOS CIRCUITS m .pptx
harshapolam10
 
AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...
AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...
AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...
Paris Salesforce Developer Group
 
This study Examines the Effectiveness of Talent Procurement through the Imple...
This study Examines the Effectiveness of Talent Procurement through the Imple...This study Examines the Effectiveness of Talent Procurement through the Imple...
This study Examines the Effectiveness of Talent Procurement through the Imple...
DharmaBanothu
 
一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理
一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理
一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理
sydezfe
 
SELENIUM CONF -PALLAVI SHARMA - 2024.pdf
SELENIUM CONF -PALLAVI SHARMA - 2024.pdfSELENIUM CONF -PALLAVI SHARMA - 2024.pdf
SELENIUM CONF -PALLAVI SHARMA - 2024.pdf
Pallavi Sharma
 
Butterfly Valves Manufacturer (LBF Series).pdf
Butterfly Valves Manufacturer (LBF Series).pdfButterfly Valves Manufacturer (LBF Series).pdf
Butterfly Valves Manufacturer (LBF Series).pdf
Lubi Valves
 
Call Girls Chennai +91-8824825030 Vip Call Girls Chennai
Call Girls Chennai +91-8824825030 Vip Call Girls ChennaiCall Girls Chennai +91-8824825030 Vip Call Girls Chennai
Call Girls Chennai +91-8824825030 Vip Call Girls Chennai
paraasingh12 #V08
 

Recently uploaded (20)

Determination of Equivalent Circuit parameters and performance characteristic...
Determination of Equivalent Circuit parameters and performance characteristic...Determination of Equivalent Circuit parameters and performance characteristic...
Determination of Equivalent Circuit parameters and performance characteristic...
 
An Introduction to the Compiler Designss
An Introduction to the Compiler DesignssAn Introduction to the Compiler Designss
An Introduction to the Compiler Designss
 
Presentation on Food Delivery Systems
Presentation on Food Delivery SystemsPresentation on Food Delivery Systems
Presentation on Food Delivery Systems
 
FULL STACK PROGRAMMING - Both Front End and Back End
FULL STACK PROGRAMMING - Both Front End and Back EndFULL STACK PROGRAMMING - Both Front End and Back End
FULL STACK PROGRAMMING - Both Front End and Back End
 
Null Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAMNull Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAM
 
Object Oriented Analysis and Design - OOAD
Object Oriented Analysis and Design - OOADObject Oriented Analysis and Design - OOAD
Object Oriented Analysis and Design - OOAD
 
Blood finder application project report (1).pdf
Blood finder application project report (1).pdfBlood finder application project report (1).pdf
Blood finder application project report (1).pdf
 
一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理
一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理
一比一原版(爱大毕业证书)爱荷华大学毕业证如何办理
 
DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...
DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...
DESIGN AND MANUFACTURE OF CEILING BOARD USING SAWDUST AND WASTE CARTON MATERI...
 
OOPS_Lab_Manual - programs using C++ programming language
OOPS_Lab_Manual - programs using C++ programming languageOOPS_Lab_Manual - programs using C++ programming language
OOPS_Lab_Manual - programs using C++ programming language
 
一比一原版(USF毕业证)旧金山大学毕业证如何办理
一比一原版(USF毕业证)旧金山大学毕业证如何办理一比一原版(USF毕业证)旧金山大学毕业证如何办理
一比一原版(USF毕业证)旧金山大学毕业证如何办理
 
AN INTRODUCTION OF AI & SEARCHING TECHIQUES
AN INTRODUCTION OF AI & SEARCHING TECHIQUESAN INTRODUCTION OF AI & SEARCHING TECHIQUES
AN INTRODUCTION OF AI & SEARCHING TECHIQUES
 
Open Channel Flow: fluid flow with a free surface
Open Channel Flow: fluid flow with a free surfaceOpen Channel Flow: fluid flow with a free surface
Open Channel Flow: fluid flow with a free surface
 
SCALING OF MOS CIRCUITS m .pptx
SCALING OF MOS CIRCUITS m                 .pptxSCALING OF MOS CIRCUITS m                 .pptx
SCALING OF MOS CIRCUITS m .pptx
 
AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...
AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...
AI + Data Community Tour - Build the Next Generation of Apps with the Einstei...
 
This study Examines the Effectiveness of Talent Procurement through the Imple...
This study Examines the Effectiveness of Talent Procurement through the Imple...This study Examines the Effectiveness of Talent Procurement through the Imple...
This study Examines the Effectiveness of Talent Procurement through the Imple...
 
一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理
一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理
一比一原版(uoft毕业证书)加拿大多伦多大学毕业证如何办理
 
SELENIUM CONF -PALLAVI SHARMA - 2024.pdf
SELENIUM CONF -PALLAVI SHARMA - 2024.pdfSELENIUM CONF -PALLAVI SHARMA - 2024.pdf
SELENIUM CONF -PALLAVI SHARMA - 2024.pdf
 
Butterfly Valves Manufacturer (LBF Series).pdf
Butterfly Valves Manufacturer (LBF Series).pdfButterfly Valves Manufacturer (LBF Series).pdf
Butterfly Valves Manufacturer (LBF Series).pdf
 
Call Girls Chennai +91-8824825030 Vip Call Girls Chennai
Call Girls Chennai +91-8824825030 Vip Call Girls ChennaiCall Girls Chennai +91-8824825030 Vip Call Girls Chennai
Call Girls Chennai +91-8824825030 Vip Call Girls Chennai
 

Sobanski odl summit_2015

  • 1. “You can keep your firewall (if you want to)” Practical, simple and cost saving applications of OpenDaylight you can implement today John Sobanski, Engineer, Solers Inc. July 2015 @OpenDaylightSDN #OpenSDN
  • 2. What You Will Learn today (By Demonstration) • 10,000 Foot Views of Software Defined Networking (SDN), OpenDaylight (ODL) and Service Function Chains (SFC) • Solve real world data center problems with ODL • RESTCONF API • ODL Service Function Chaining • Feel free to contact me for any details I don't cover here jsobanski@solers.com https://ask.opendaylight.org/users/420/runamuck/ 2
  • 3. Top three emerging technologies of the decade? • My take… • Big Data • DevOps • Software Defined Networks 3 Any Others?
  • 4. “Is SDN Hype?” • “Big Data and DevOps have clear applications and use cases but Software Defined Networks appears to be a solution in search of a problem.” • “Most SDN activity is focused in Academia or dedicated ‘Network Function Virtualization (NFV)’ shops... not relevant to us.” • "SDN/ NFV only applies to Greenfield Architectures." 4 These slides will prove these opinions wrong
  • 5. “Who cares about networks?” • Answer: You Do! Network latency and/ or loss breaks services. 5
  • 6. “Latency and Loss doesn’t apply to my Data Center” • “Latency and Loss? I've got dozens of 10GbE ports!!!” • Layer 2: Spanning tree protocol • Blocks all but one path to prevent loops • (Enable LACP/ LAG) • Layer 3: Shortest path first • Sends all traffic through a congested "one hop" path over a wide open "two hop" path • (Try Traffic Engineering) • Layer 4: Default TCP buffers • Small buffers mean more round trips. Latency throttles throughput. • (Tune the buffer) 6 You need to care about the network!
  • 7. What are Network Services? • Familiar Network Services • Load Balancing • Firewall • Deep Packet Inspection (DPI) • Access Control Lists • Parental Control • Other Network Services • "Global State" (Routing) • Broadcast Domain Scoping (VLAN) • Resource Signaling • Prioritization and Preemption • Multicast • N-Cast 7
  • 8. 10,000 Foot Overview • 10,000 Foot view of SDN • At any give time, use a centralized controller to move data through your network equipment as you see fit • Doesn't seem like a big deal to non-network types but this is incredibly powerful! • 10,000 Foot view of OpenDaylight • Allows you to install network services as "Apps" • Provides a single REST API to configure heterogeneous hardware • This is a “no brainer” for developers but is HUGE for network engineers • 10,000 Foot view of Service Function Chains • “Service Overlay” • Divorce Network Services From Topology • For more detail see: • https://www.opennetworking.org/sdn-resources/sdn-definition • http://www.opendaylight.org/project/technical-overview • https://wiki.opendaylight.org/view/Service_Function_Chaining:Main 8
  • 9. A Little More Detail: SDN Layers • Top Layer  Northbound • Network Apps & Orchestration • Business logic to monitor and control network behavior • Thread services together • Middle Layer  Controller Platform • Exposes "Northbound" APIs to the Application layer • Lower Layer  Southbound • Command and control of hardware • Network Devices (Physical or Virtual) • Switches, Routers, Firewalls etc. 9
  • 10. A Little More Detail: OpenDaylight • OpenDaylight • Open source project • Modular/ Pluggable and flexible controller platform • Java Virtual Machine (JVM) • Dynamically Pluggable Modules for Network Tasks • OSGi framework (local applications)/ bidirectional REST (local or remote) for the northbound API • Network Apps • House business logic and algorithms • Gather network intelligence from the controler • Run algorithms to perform analytics • Orchestrate new rules (if any) via controller • Southbound • OpenFlow 1.3, OVSDB, SNMP, CLI • Service Abstraction Layer links Northbound to Southbound 10
  • 11. A Little More Detail: ODL 11
  • 12. A Little More Detail: SFC • SFC enables a “service topology” • Overlay built “on top” of existing network topology • Use any overlay or underlay technology to create service paths • VLAN, ECMP, GRE, VXLAN, etc. • SFC provides resources for consumption • Service Topology connects those resources • Quickly/ Easily add new service functions • Requires no underlying network changes 12
  • 13. One Caveat Before we begin • WARNING: Software Defined Networking is incredibly powerful! • You must protect your Southbound interfaces with the same regard as a firewall or any root privileges • ODL accommodates TLS for Southbound interfaces • The security, identity and bureaucratic planes are orthogonal to the technology plane we discuss here • We do not discuss security, identity or policy but you must consider them when architecting your ODL solution 13
  • 14. One more Caveat • WARNING: If you are not a hands-on network engineer, this presentation may "spoil" you. • To provide the following two OPSCON using legacy protocols may be impossible and at the very least requires intense, disciplined, meticulous network engineering. 14
  • 15. DPI Bypass Approach #1: RESTCONF API 15
  • 16. OPSCON #1: Deep Packet Inspection Bypass • This scenario investigates how to reduce latency • You have a data center that performs deep packet inspection (DPI) for inter-network flows • DPI injects latency into the end to end (E2E) flow and increases Round Trip Time (RTT) 16 Reminder: Network latency and loss breaks services!
  • 17. Topology • Network gateways in Firewall/ DPI appliance • VLAN steer (bent pipe) traffic through DPI (via gateways) for inter-network flows • Can we create logic to DPI only once? 17
  • 18. One Approach • Put logic (i.e. rules) in the DPI appliance to bypass certain flows • This, however consumes resources and can saturate the backplane 18 Put logic here?
  • 19. Better Approach • Use the OpenDaylight controller and put logic in the switch! 19 Put logic here!
  • 20. OPSCON #1 Detailed Topology 20
  • 21. DPI Bypass Demo Approach #1: RESTCONF API Note: This section will be a live demonstration 21
  • 22. Step 1: Start ODL Platform via Client • Platform includes controller • Install Network Apps via command line 22
  • 23. Validate Topology • Connect to controller and “pingall” 23
  • 24. ODL Shows the Layer 2 Interfaces 24
  • 25. Baseline: Two DPI = Severe Latency • Ping from Client (h1) to Server (h3) shows 40+ ms latency mininet> h1 ping h3 PING 10.0.3.101 (10.0.3.101) 56(84) bytes of data. 64 bytes from 10.0.3.101: icmp_seq=1 ttl=62 time=42.1 ms 64 bytes from 10.0.3.101: icmp_seq=2 ttl=62 time=41.3 ms 64 bytes from 10.0.3.101: icmp_seq=3 ttl=62 time=41.1 ms ^C --- 10.0.3.101 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 41.119/41.546/42.143/0.465 ms 25
  • 26. Baseline: End to End (E2E) Path • Traceroute shows a path through the two DPI gateways, as expected mininet> h1 traceroute -n h3 traceroute to 10.0.3.101 (10.0.3.101), 30 hops max, 60 byte packets 1 10.0.1.1 21.180 ms 21.028 ms 20.837 ms 2 10.0.2.1 42.565 ms 42.482 ms 42.418 ms 3 * * 10.0.3.101 43.144 ms mininet> 26
  • 27. Configure Switch via ODL Platform REST API 27
  • 28. Configure Switch via ODL Platform REST API • Use these headers: Accept: application/xml Authorization: Basic YWRtaW46YWRtaW4= • Then post the following flows (next slide) to Switch 2's table zero: PUT flow with ID 202 to http://<controller_ip>:8181/restconf/config/opendaylight- inventory:nodes/node/openflow:2/table/0/flow/202 PUT flow with ID 303 to http://<controller_ip>:8181/restconf/config/opendaylight- inventory:nodes/node/openflow:2/table/0/flow/303 28
  • 30. The Switch Accepts the Flows $ sudo ovs-ofctl -O OpenFlow13 dump-flows s2 cookie=0x0, duration=350.260s, table=0, n_packets=0, n_bytes=0, priority=200,ip,nw_dst=10.0.3.101 actions=set_field:f6:2f:25:06:ab:27- >eth_dst,output:4 cookie=0x1, duration=33.552s, table=0, n_packets=0, n_bytes=0, priority=200,ip,nw_dst=10.0.1.101 actions=set_field:f2:3e:8d:a4:71:07- >eth_dst,output:5 30
  • 31. Latency Reduced • Ping now shows that the second, slow DPI is no longer in the path: mininet> h1 ping h3 PING 10.0.3.101 (10.0.3.101) 56(84) bytes of data. 64 bytes from 10.0.3.101: icmp_seq=1 ttl=63 time=21.3 ms 64 bytes from 10.0.3.101: icmp_seq=2 ttl=63 time=20.9 ms 64 bytes from 10.0.3.101: icmp_seq=3 ttl=63 time=20.7 ms ^C --- 10.0.3.101 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2002ms rtt min/avg/max/mdev = 20.713/20.983/21.320/0.252 ms 31
  • 32. Latency Reduced • Traceroute Confirms that the flow bypasses the second DPI mininet> h1 traceroute -n h3 traceroute to 10.0.3.101 (10.0.3.101), 30 hops max, 60 byte packets 1 10.0.1.1 21.117 ms 20.796 ms 20.423 ms 2 10.0.3.101 24.597 ms 24.477 ms * 32
  • 33. DPI Bypass Demo Approach #2: ODL SFC 33
  • 34. A Little More Detail: ODL ODL Provides a Northbound SFC “App” 34
  • 35. SFC Approach: Create a “Service Overlay” • 1. Register Firewalls in service pool • “Service Functions” • 2. Configure switches to forward packets based on controller logic • “Service Function Forwarders” • 3. Configure SFC Logic • … Next Slide #ODSummit 1 2 3
  • 36. SFC Workflow (Highly Abstracted!) • Register (Previous Slide) • Service Functions (Appliances) -- AKA Network Services • Service Function Forwarders (ODL SFC Controlled Switches) • Create Service Function “Chains” • “Chain” of Network Services • I.e. First Firewall, then Apply Parental Control, then Virus Scan etc. • Create Service Function Paths and Rendered Service Paths • Selects path through actual appliance (SF) instances e.g. • RSP-1 = Firewall-1, Parental-Control-1, Virus-Scan-1 • RSP-7 = Firewall-3, Patental-Control-1, Virus-Scan-2 • Create “Classifier” • Apply SFC to flows #ODSummit
  • 37. DPI Bypass Demo Approach #2: ODL SFC Note: This will be a live demo 37 Based on: https://lists.opendaylight.org/pipermail/sfc-dev/2015-July/001408.html by Brady Johnson and Ricardo Noriega at Ericsson.com
  • 38. Baseline • No Flows in Switch, No Objects in GUI #ODSummit
  • 39. Configure via REST API • Add SF, SFF, SFC, SFP and RSP • GUI Populated • Controller then injects logic into SFF via flows $ sudo ovs-ofctl dump-flows sff1 -OOpenFlow13 #ODSummit
  • 40. Test 1: Configure Classifier to Use RSP-1 tcpdump shows WGET goes through both service functions Total time: 0.341 seconds #ODSummit SFF-1 Traffic SFF-2 Traffic
  • 41. Test 2: Configure Classifier to Use RSP-3 tcpdump shows WGET goes through only one service functions Total time: 0.178 seconds #ODSummit SFF-1: No Traffic SFF-2 Traffic
  • 44. OPSCON #2: Bypass DPI on Egress • Scenario: You have a product distribution system where Egress throughput >> Ingress throughput. • You perform Deep Packet Inspection on flows between External (EXT) hosts and your Demilitarized Zone (DMZ) Proxies. 44
  • 45. Topology • You implement a DPI "router on a stick," to ensure Inter-network communications pass through the DPI. • A switch bent pipes the traffic at layer 2 45
  • 46. Scenario • The Egress traffic will increase past the capacity of the DPI appliance • You realize that there are cheaper methods of securing your egress flows then upgrading to a bigger DPI appliance… 46
  • 47. Egress Security • With egress flows you want to ensure that return/ ACK traffic does not include exploits and that egress flows do not facilitate zombies or phone home exploits. • Some ideas: • Ensure only approved ports • Access Control Lists • iptables • Host firewalls • Mitigate against malicious code over approved ports: • HIDS on Servers • Uni-directional bulk data push with Error Detection and Correction over one way fiber • TLS with x509 certs 47
  • 48. Trade Solutions • END GOAL: You want to have DPI inspection on ingress flows, but not egress, since the other security measures will cover the egress flows. • One approach is to put logic on your DPI appliance to say "don't scan egress flows," but that wastes capacity/ resources and could saturate the backplane • An approach with legacy Network protocols is very difficult to implement and results in asymmetric routes (will break things) • Using OpenDaylight, we have a simple solution that only requires matches/ actions on six (6) flows 48
  • 49. The Goal • When EXT initiates, pass through DPI • When DMZ initiates: • Bypass DPI on PUT (Egress) • Scan on GET (Ingress) 49
  • 50. Detailed Diagram 1. ACL 2. Scan all EXT  DMZ 3. Bypass DMZ PUT 4. Scan DMZ GET 50
  • 51. OpenFlow Logic 1. ACL only allows permitted flows 2. For Ingress ( EXT-> DMZ ) flows, allow normal path to virus scan via gateway 3. For Egress ( DMZ -> EXT ) PUT flows, intercept packet 1. Change destination MAC from Gateway to EXT 2. Change destination Port from Gateway to EXT 3. Decrement TTL by one 4. For Egress (DMZ -> EXT) GET flows (Treat as ingress) 1. DMZ uses dummy IP for EXT server 2. Switch intercepts packet 3. Switch changes source IP to dummy DMZ address 4. Switch changes dest IP to correct EXT IP 5. Packet continues on its way to gateway 6. Reverse logic for return traffic 51
  • 53. OPSCON #2 Note: This will be a real time demo 53
  • 54. Setup • As before, start ODL, connect switch to controller and “pingall” 54
  • 55. ODL Shows Connected L2 Interfaces 55
  • 56. Baseline: Push a file from DMZ to EXT mininet> dmz curl http://10.0.1.102 --upload-file test.txt • EXT Server Shows Successful PUT 10.0.2.101 - - [10/Jul/2015 14:50:22] "PUT /test.txt HTTP/1.1" • TCPDUMP on firewall shows egress scan traffic (as expected) 56
  • 57. Install the Flows via RESTCONF API • Either via POSTMAN or CURL curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_404.xml" -u admin:admin http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/404 2>&1 | grep HTTP/1.1 curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_505.xml" -u admin:admin http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/505 2>&1 | grep HTTP/1.1 curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_606.xml" -u admin:admin http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/606 2>&1 | grep HTTP/1.1 curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_707.xml" -u admin:admin http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/707 2>&1 | grep HTTP/1.1 curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_808.xml" -u admin:admin http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/808 2>&1 | grep HTTP/1.1 curl -v -H "Content-Type: application/xml" -X PUT --data "@fw_demo_909.xml" -u admin:admin http://localhost:8181/restconf/config/opendaylight-inventory:nodes/node/openflow:3/table/0/flow/909 2>&1 | grep HTTP/1.1 57
  • 58. DMZ PUT a file to EXT mininet> dmz curl http://10.0.1.102 --upload-file test.txt • The EXT server shows this second, successful put 10.0.2.101 - - [10/Jul/2015 14:50:22] "PUT /test.txt HTTP/1.1" 200 - 10.0.2.101 - - [10/Jul/2015 14:53:05] "PUT /test.txt HTTP/1.1" 200 - • The firewall TCPDUMP, however does not show additional traffic! 58
  • 59. Plumb Statistics via API • You can see a Match on the flow through the REST API: • http://<controller_IP>:8181/restconf/operational/opendaylight- inventory:nodes/node/openflow:3/table/0/flow/404/flow-statistics/ 59
  • 60. Test DMZ to EXT GET (Ingress) • Use a Dummy IP to trigger a flow match. • The egress port of the switch will NAT it back to the real destination IP. • We see instant feedback on the Mininet Console 60
  • 61. EXT Server Shows Successful Get 10.0.2.101 - - [10/Jul/2015 14:50:22] "PUT /test.txt HTTP/1.1" 200 - 10.0.2.101 - - [10/Jul/2015 14:53:05] "PUT /test.txt HTTP/1.1" 200 - 6.6.6.6 - - [10/Jul/2015 15:01:27] "GET / HTTP/1.1" 200 - • Note Dummy IP 61
  • 62. FW TCPDUMP Shows DMZ to EXT GET Scan 62
  • 63. Verify All EXT  DMZ Traffic Scan • Do PUT and GET 63
  • 64. DMZ Server Log Shows Success for Both 64
  • 65. TCPDUMP: All EXT to DMZ traffic scanned 65