So#ware	
  Defined	
  Networks	
  using	
  
OpenContrail	
  
Kraków	
  2014	
  
Outline	
  
•  Why	
  
– Data-­‐center	
  architectures	
  
– Networking	
  challenges	
  
•  How	
  
– SDN	
  
– Cloud	
  orchestraDon	
  -­‐	
  OpenStack	
  
– OpenContrail	
  architecture	
  
•  Discussion	
  
Datacenter	
  architecture	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
Clos	
  network	
  
Rack,	
  servers,	
  VMs	
  
VM	
  VM	
  VM	
  VM	
  
hypervisor	
  
VM	
  VM	
  VM	
  VM	
  
hypervisor	
  
VM	
  VM	
  VM	
  VM	
  
hypervisor	
  
Server	
  rack	
  
To	
  spine	
  switch	
  
ObservaDons	
  
•  Majority	
  of	
  network	
  endpoints	
  are	
  virtual	
  
•  Network	
  isolaDon	
  between	
  them	
  has	
  to	
  
be	
  available	
  
•  While	
  using	
  the	
  same	
  physical	
  network	
  
VLANs	
  
•  VM’s	
  interfaces	
  placed	
  on	
  bridges	
  
– Each	
  bridge	
  for	
  a	
  virtual	
  network	
  
•  Difficult	
  to	
  manage	
  
•  4096	
  VLAN	
  tags	
  limit	
  
– Can	
  be	
  extended	
  using	
  Shortest	
  Path	
  Bridging	
  
•  Physical	
  switches	
  has	
  to	
  contain	
  the	
  VN	
  state	
  
VM	
  migraDon	
  example	
  
VM1	
   VM2	
  
Server	
  1	
  
VM3	
  
VM4	
   VM5	
  
Server	
  2	
  
VM6	
  
VM7	
   VM8	
  
Server	
  3	
  
VM9	
  
Physical	
  switch	
  
Virtual	
  networks:	
  
1	
   2	
  
3	
  
VM	
  migraDon	
  example	
  
VM1	
   VM2	
  
Server	
  1	
  
VM3	
  
VM4	
   VM5	
  
Server	
  2	
  
VM6	
  
VM7	
   VM8	
  
Server	
  3	
  
VM9	
  
Physical	
  switch	
  
Virtual	
  networks:	
  
1	
   2	
  
3	
  
VM9	
   Payload	
  
Eth	
  +	
  VLAN	
  tag	
  +	
  IP	
  
VM	
  migraDon	
  example	
  
VM1	
   VM2	
  
Server	
  1	
  
VM3	
  
VM4	
   VM5	
  
Server	
  2	
  
VM6	
  
VM7	
   VM8	
  
Server	
  3	
  
VM9	
  Physical	
  switch	
  
Virtual	
  networks:	
  
1	
   2	
  
3	
  
VM9	
   Payload	
  
Eth	
  +	
  VLAN	
  tag	
  +	
  IP	
  
Centralized	
  configuraDon	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
server	
  
Lot	
  of	
  switches	
  
Standardized	
  APIs	
  
•  Northbound	
  API	
  
– Orchestrator	
  
– Custom	
  applicaDons	
  
•  Southbound	
  API	
  
– Hardware	
  switches	
  
– Hypervisor	
  OS	
  bridges/virtual	
  switches	
  
SDN	
  
•  Centralized	
  configuraDon	
  
•  Standardized	
  APIs	
  
– North-­‐bound	
  
– South-­‐bound	
  
•  Flexible	
  
•  Scalable	
  
OpenFlow	
  
•  Defines	
  both	
  northbound	
  and	
  southbound	
  
APIS	
  
•  Assumes	
  “dummy”	
  cheap	
  switches	
  
– Only	
  forwarding	
  tables	
  
– Managed	
  via	
  API	
  by	
  the	
  controller	
  
•  Considered	
  the	
  enabler	
  of	
  SDN	
  
– Not	
  true	
  actually	
  
OpenFlow	
  
server	
   server	
   server	
  
OpenFlow	
  hardware	
  swithes	
  
VM	
  VM	
  VM	
  VM	
  
In-­‐hypervisor	
  so#ware	
  switch	
  
Overlay	
  networking	
  
•  “Old”	
  technology,	
  new	
  for	
  data-­‐centers	
  
•  Physical	
  underlay	
  network	
  
– IP	
  fabric	
  
– No	
  tenant	
  state	
  
•  Virtual	
  overlay	
  network	
  
– Tenant	
  state	
  
– Dynamic	
  tunnels	
  (MPLSoGRE,	
  VXLAN,	
  etc.)	
  
VM	
  migraDon	
  example	
  
VM1	
   VM2	
  
Server	
  1	
  
VM3	
  
VM4	
   VM5	
  
Server	
  2	
  
VM6	
  
VM7	
   VM8	
  
Server	
  3	
  
VM9	
  
Physical	
  switch	
  
Virtual	
  networks:	
  
1	
   2	
  
3	
  
S3	
   VM9	
   Payload	
  
Physical	
  network:	
  
VM	
  migraDon	
  example	
  
VM1	
   VM2	
  
Server	
  1	
  
VM3	
  
VM4	
   VM5	
  
Server	
  2	
  
VM6	
  
VM7	
   VM8	
  
Server	
  3	
  
VM9	
  Physical	
  switch	
  
Virtual	
  networks:	
  
1	
   2	
  
3	
  
S2	
   VM9	
   Payload	
  
Physical	
  network:	
  
OpenContrail	
  
•  www.opencontrail.org	
  
•  “Knowledge”	
  about	
  network	
  only	
  in	
  the	
  
so#ware	
  (vRouter)	
  
•  Any	
  switch	
  works	
  for	
  IP	
  fabric	
  network	
  
– No	
  configuraDon	
  
– Only	
  speed	
  majers	
  
– Low	
  price	
  
•  Standards-­‐based	
  (MPLS,	
  BGP,	
  VXLAN,	
  etc.)	
  
Cloud	
  orchestraDon	
  
•  OpenStack	
  
•  “Massively	
  scalable	
  cloud	
  operaDng	
  system”	
  
•  Aims	
  to	
  manage	
  
– Compute	
  (Nova)	
  
– Storage	
  (Swi#,	
  Cinder)	
  
– Network	
  (Neutron)	
  
•  Separates	
  configuraDon	
  and	
  compute	
  
nodes	
  
SDN	
  in	
  cloud	
  orchestraDon	
  
Source:	
  www.opencontrail.org	
  
Architecture	
  overview	
  
Source:	
  www.opencontrail.org	
  
Compute	
  node	
  
Source:	
  www.opencontrail.org	
  
vRouter	
  forwarding	
  plane	
  
Source:	
  www.opencontrail.org	
  
MPLSoGRE	
  example	
  
Source:	
  www.opencontrail.org	
  
Controller	
  node	
  
Source:	
  www.opencontrail.org	
  
ConfiguraDon	
  node	
  
Source:	
  www.opencontrail.org	
  
AnalyDcs	
  node	
  
Source:	
  www.opencontrail.org	
  
Network	
  FuncDons	
  VirtualizaDon	
  
•  Chaining	
  of	
  service	
  VM	
  
•  Load	
  balancer	
  VM,	
  DPI	
  VM,	
  Firewall,	
  etc.	
  
•  High	
  level	
  descripDon	
  (snort	
  lang)	
  
•  allow any src-vn -> dst-vn svc-1, svc-2
	
  
Source:	
  www.opencontrail.org	
  
OpenContrail	
  summary	
  
•  High-­‐level	
  descripDon	
  of	
  networks	
  
– allow	
  	
  any	
  	
  src-­‐vn	
  -­‐>	
  dst-­‐vn	
  	
  svc-­‐1,	
  svc-­‐2	
  
•  Horizontally	
  scalable	
  
•  Fault	
  tolerant	
  
•  Works	
  with	
  exisDng	
  equipment	
  
•  Open	
  sourced	
  
AcDve	
  development	
  
•  Juniper	
  
– New	
  virtual	
  service	
  offerings	
  (NFV)	
  
– Other	
  orchestrators	
  (CloudStack)	
  support	
  
– Performance	
  improvements	
  
– Etc.	
  
•  Semihalf	
  
– New	
  plaoorm	
  –	
  FreeBSD	
  
– vRouter	
  in	
  user-­‐space	
  
 
	
  
	
  
Any	
  quesDons?	
  

Software Defined Networks (SDN) na przykładzie rozwiązania OpenContrail.

  • 1.
    So#ware  Defined  Networks  using   OpenContrail   Kraków  2014  
  • 2.
    Outline   •  Why   – Data-­‐center  architectures   – Networking  challenges   •  How   – SDN   – Cloud  orchestraDon  -­‐  OpenStack   – OpenContrail  architecture   •  Discussion  
  • 3.
    Datacenter  architecture   server   server   server   server   server   server   server   server   server   server   server   server   Clos  network  
  • 4.
    Rack,  servers,  VMs   VM  VM  VM  VM   hypervisor   VM  VM  VM  VM   hypervisor   VM  VM  VM  VM   hypervisor   Server  rack   To  spine  switch  
  • 5.
    ObservaDons   •  Majority  of  network  endpoints  are  virtual   •  Network  isolaDon  between  them  has  to   be  available   •  While  using  the  same  physical  network  
  • 6.
    VLANs   •  VM’s  interfaces  placed  on  bridges   – Each  bridge  for  a  virtual  network   •  Difficult  to  manage   •  4096  VLAN  tags  limit   – Can  be  extended  using  Shortest  Path  Bridging   •  Physical  switches  has  to  contain  the  VN  state  
  • 7.
    VM  migraDon  example   VM1   VM2   Server  1   VM3   VM4   VM5   Server  2   VM6   VM7   VM8   Server  3   VM9   Physical  switch   Virtual  networks:   1   2   3  
  • 8.
    VM  migraDon  example   VM1   VM2   Server  1   VM3   VM4   VM5   Server  2   VM6   VM7   VM8   Server  3   VM9   Physical  switch   Virtual  networks:   1   2   3   VM9   Payload   Eth  +  VLAN  tag  +  IP  
  • 9.
    VM  migraDon  example   VM1   VM2   Server  1   VM3   VM4   VM5   Server  2   VM6   VM7   VM8   Server  3   VM9  Physical  switch   Virtual  networks:   1   2   3   VM9   Payload   Eth  +  VLAN  tag  +  IP  
  • 10.
    Centralized  configuraDon   server   server   server   server   server   server   server   server   server   server   server   server   Lot  of  switches  
  • 11.
    Standardized  APIs   • Northbound  API   – Orchestrator   – Custom  applicaDons   •  Southbound  API   – Hardware  switches   – Hypervisor  OS  bridges/virtual  switches  
  • 12.
    SDN   •  Centralized  configuraDon   •  Standardized  APIs   – North-­‐bound   – South-­‐bound   •  Flexible   •  Scalable  
  • 13.
    OpenFlow   •  Defines  both  northbound  and  southbound   APIS   •  Assumes  “dummy”  cheap  switches   – Only  forwarding  tables   – Managed  via  API  by  the  controller   •  Considered  the  enabler  of  SDN   – Not  true  actually  
  • 14.
    OpenFlow   server  server   server   OpenFlow  hardware  swithes   VM  VM  VM  VM   In-­‐hypervisor  so#ware  switch  
  • 15.
    Overlay  networking   • “Old”  technology,  new  for  data-­‐centers   •  Physical  underlay  network   – IP  fabric   – No  tenant  state   •  Virtual  overlay  network   – Tenant  state   – Dynamic  tunnels  (MPLSoGRE,  VXLAN,  etc.)  
  • 16.
    VM  migraDon  example   VM1   VM2   Server  1   VM3   VM4   VM5   Server  2   VM6   VM7   VM8   Server  3   VM9   Physical  switch   Virtual  networks:   1   2   3   S3   VM9   Payload   Physical  network:  
  • 17.
    VM  migraDon  example   VM1   VM2   Server  1   VM3   VM4   VM5   Server  2   VM6   VM7   VM8   Server  3   VM9  Physical  switch   Virtual  networks:   1   2   3   S2   VM9   Payload   Physical  network:  
  • 18.
    OpenContrail   •  www.opencontrail.org   •  “Knowledge”  about  network  only  in  the   so#ware  (vRouter)   •  Any  switch  works  for  IP  fabric  network   – No  configuraDon   – Only  speed  majers   – Low  price   •  Standards-­‐based  (MPLS,  BGP,  VXLAN,  etc.)  
  • 19.
    Cloud  orchestraDon   • OpenStack   •  “Massively  scalable  cloud  operaDng  system”   •  Aims  to  manage   – Compute  (Nova)   – Storage  (Swi#,  Cinder)   – Network  (Neutron)   •  Separates  configuraDon  and  compute   nodes  
  • 20.
    SDN  in  cloud  orchestraDon   Source:  www.opencontrail.org  
  • 21.
    Architecture  overview   Source:  www.opencontrail.org  
  • 22.
    Compute  node   Source:  www.opencontrail.org  
  • 23.
    vRouter  forwarding  plane   Source:  www.opencontrail.org  
  • 24.
    MPLSoGRE  example   Source:  www.opencontrail.org  
  • 25.
    Controller  node   Source:  www.opencontrail.org  
  • 26.
    ConfiguraDon  node   Source:  www.opencontrail.org  
  • 27.
    AnalyDcs  node   Source:  www.opencontrail.org  
  • 28.
    Network  FuncDons  VirtualizaDon   •  Chaining  of  service  VM   •  Load  balancer  VM,  DPI  VM,  Firewall,  etc.   •  High  level  descripDon  (snort  lang)   •  allow any src-vn -> dst-vn svc-1, svc-2   Source:  www.opencontrail.org  
  • 29.
    OpenContrail  summary   • High-­‐level  descripDon  of  networks   – allow    any    src-­‐vn  -­‐>  dst-­‐vn    svc-­‐1,  svc-­‐2   •  Horizontally  scalable   •  Fault  tolerant   •  Works  with  exisDng  equipment   •  Open  sourced  
  • 30.
    AcDve  development   • Juniper   – New  virtual  service  offerings  (NFV)   – Other  orchestrators  (CloudStack)  support   – Performance  improvements   – Etc.   •  Semihalf   – New  plaoorm  –  FreeBSD   – vRouter  in  user-­‐space  
  • 31.
          Any  quesDons?