WIXLIB

Software Defined Networking(SDN) - Open Flow

Introduction Current Internet: egalitarian – routing/deliverybased on destination address, best effort. Future Internet: criteria based trafficmanagement, paths predetermined based ontraffic type.

IP Forwarding Paradigm All traffic from the same source to the samedestination, follows the same path. Datagram is routed independent on its content, orsource or destination. We have discussed possible variations on thismodel: IP ToS bits MPLS OSPF and different route maps

Traffic Engineering & Path SelectionMoving away from a paradigm of finding shortestpaths for datagrams to follow, to one where anetwork administrator can set paths for individualflows, where a flow is defined by a set of criteria –traffic classification.

Connection Oriented Networks andRouting Overlays Providing per-flow control in a network: Use a connection oriented networkor Impose routing overlays in a packet-switchedarchitecture.

Connection Oriented Each flow is set up independently Application cannot transmit data until theforwarding path has been set up Policies are applied at each switch to determineforwarding path and rules for accepting a flow. Switch uses these policies to determine whetherto accept a flow and what path to use. Once accepted, it updates its forwarding table. Each flow has to be terminated by the application.

Routing Overlays A forwarding system that imposes a virtualnetwork topology on top of an underlying packetswitched architecture. The virtual topology consists of tunnels that arepre-set to route specific traffic flows over. The tunnel is like a point to point connection. Therouting protocols (for the virtual topology) onlyfind path across the tunnels. MPLS is an example of this type of path flowcontrol.

Why a new approach Neither one of the two methods described areperfect. Connection oriented less flexible but higherspeeds. Routing overlays, more flexibility – softwaredefined, but hide underlying infrastructure socannot be optimized SO – why not combine both – a hybrid approach!

SDN: A hybrid Approach Can we combine the strengths of both to createthe PERFECT network? Some say YES!!! Perform classification in hardware Use high speed forwarding hardware Avoid dynamic routing protocols that optimize onshortest path and have managers set routing policiesthat conform to traffic flow needs To scale, allow network management software toconfigure and control the network devices, i.e., takethe human out of the day to day management

Separation of Data and Control NOT a new concept . X.25 was all about that! What does it mean? Divide the functionality of a network device, aka,a router/switch into two parts: A control part, called a control plane that allowsmanagers to configure and control the device A data part, called the data plane that only handlespacket processing and forwarding.

Control and Data PlanesThe control path has a much lower capacity than the data path as illustrated by thesize of the arrows being used in the diagram above.

SDN Architecture and ExternalControllersTo operate on any vendor switch, SDN uses an augmented approach: deactivates vendormanagement interface and uses an external system to configure the switch.

Why the Augmented Approach? SDN Module is very minimalistic – only used topass commands to the data plane. All the intelligence lies in the external controllerthat is completely under the control of the networkengineer. The controller bypasses the vendor control planeallowing more flexibility in defining networkcontrol strategies.

SDN: Multiple Network DevicesOverlay network controltraffic flows over samephysical networkThe management network, is really the control plane that spans across multiple controldevices and a manager’s computer that controls them all – downloads s/w and policies

OpenFlow – What is it? What is OpenFlow?It is a control protocol. It is used to communicate policies and trafficmanagement information between a controllerand a switch. In other words data plane related information for theswitch to use to set up its data paths. It operates like the SDN module shown in theswitch designs earlier. Translates the control messages to switch commands

OpenFlow Technology Specifies: Communication used between controller andswitch Set of items that an be configured andcontrolled in a switch Format of messages that a controller an switchuse to communicate with.

Communication TCP over SSL is specified as the mode ofcommunication over the regular productionnetwork (i.e., non SDN network) for controllers tocommunicate with a switch. Require a reliable connection Require a secure connection Using TCP means that a controller need not beco-located with switch, and can communicatewith switch over a network. Using SSL means that TCP connection is secure.

Configuration Items Minimum specification of OpenFlow (Type 0)requires that a switch have a Flow Table thatimplements classification and forwarding.1. Classification is based on a set of patterns that arematched against packets.2. Each entry in the Flow Table has an actionassociated with it – how to process the packet. Statistics are maintained for each action: count ofpackets, size of packets and timestamps. Usedfor traffic engineering.

Message FormatVers: specifies version type, e.g., 0x02 is vers 2Type: specifies type of message. There are 24 message types, e.g.: Controller to switch Asynchronous switch to controller – reporting an event Symmetric – response requiredTotal Length: includes payload and header measure in octetsTransaction ID: unique number that allows controlled to match requests with replies

OpenFlow Patterns Minimal requirements for a Type 0 Switch Must be able to match a specific list of fields. Cannot distinguish between ARP request andreply Cannot identify specific ICMP messages, e.g.,ping traffic. Because of Ethernet Type Field, it can allowexperimenters to use an unassigned EthernetType

Type 0 Switch OpenFlow

Actions of a Type 0 SwitchAction 1: Most common case: a switch will be pre-configured with rules and all thatneeds to be done is follow forwarding commands when pattern is matched.Action 2: Allows switch to handle packets that don’t match a pattern, i.e., no forwardingrule has been set up. Used to handle per flow forwarding. E.g., all TCP connectionrequests are encapsulated and sent to controller to set up a new classification for that flow.Packet then returned for further processing by switch based on new classification rule.Action 3: Allow handling of problem traffic such as DOS, or over active/excessive broadcasting.The controller can identify the source and set up a special rule to handle that traffic.

OpenFlow Extensions and Additions Additions can be classified into 5 categories: Multiple Flow Tables that are arranged in a pipeline Additional packet header fields for matching A field used to pass information along the pipeline New actions that provide significant functionality A Group table that allows a set of actions to beperformed

Pipeline of Flow Tables Several Flow Tables are linked by conditions. If you satisfy the first match you jump to anotherFlow Table. You can satisfy another match thattakes you to a next table or if not an action istaken at that point. This allows sub branching on matching rules.Initial table not very large. Pipelined tables allowextensions to one common classifier.

Additional Packet Header Fields

Matching Header Fields Current version 1 of OpenFLow only does fieldmatching. In newer versions, instead of matching theheader field, OpenFlow will specify:(bit offset, length, pattern) Why? To take advantage of underlying switchhardware that might be able to do bit matching forfaster packet processing.

Intra Pipeline Communications Metadata Field in the Fields available forOpenFlow, is used to communicate data betweenFlow Tables. OpenFlow does not specify the content of theMetadata field. Next stages of the pipeline needto know the contents and format of theinformation in the Metadata field. For example: at the first table, we may have tocompute the next hop IP address. It passes thatalong to the next FlowTable which knows what to dowith it, i.e., use it for pattern matching for next levelprocessing.

New Actions In new version, an action main not be performedimmediately when a pattern match occurs. Instead a set of actions are accumulated as the packetmoves along a pipeline. Actions can be added or removed at each stage, as apacket traverses the pipeline. When a packet arrives at a stage where there is noaction, basically the END of the pipeline, all the actionsare performed. The set of actions has to contain an output action, thatspecifies how to release the packet, e.g., exit portnumber.

Example of New Actions OpenFlow defines a list of required actions thathave to be supported, and a list of recommendedactions that are optional for implementation at aswitch. New actions: TTL manipulation Forward a packet to switch’s local protocol stack Several actions related to MPLS – Encapsulation andde encapsulation with an MPLS header Qos (priority) queueing

Group Table - Functionality Adds flexibility to the forwarding paradigm. An entry can specify how to forward a packet(i.e., specific port), and multiple patterns can pointto that entry. Or an entry can point to a group of exit portsbased on a pattern match. In other words, severaloutgoing links can be aggregated to support aparticular traffic flow (or set of flows if morepattern matches result in that exit action).

Group Table Entries A group table entry consists of 4 items: 32 bit identifier – uniquely identifies a group Type – see table next slide Counters – collect statistics Action Buckets – identify actions in an ordered listthat are used only if the previous action cannot becompleted. For example a failed link – Identify abackup port to send data to in that case. Can specifya set of backup links to be used. This is used with thefast fail over type of action

Action Types

Uses of OpenFlow Openflow allows a network administrator tomanage forwarding in a switch as a function ofcertain header field matchings. Some examples: Experimental protocol used between two hosts(identified in the Ethernet Type field) Source based IP forwarding On demand VPN set up between two sites (per TCPconnection)

Reality Check on OpenFlow Although OpenFlow gives us an environment torethink network management, it has someshortcomings. It does not extend the SDN functionality to allnetwork devices, most of the focus is onswitches. It is defined for use over Ethernet. Ignores WiFiand other framing types on digital circuits Currently IPv4 focused, emerging versionsextend its functionality to more protocol types,e.g., IPv6.

Sofware Defined Radio (SDR) In the same vein as SDN, there has emerged anew standard for use with radio devices – SDR It allows a network engineer to reconfigure thefrequencies being used by the device dynamicallybased on capacity need or interference. Limitation is the antenna design, has to be able tohandle the frequencies that can be chosen. Newantenna technology is emerging that addressesthis issue. E.g., Mutliple smaller antennas toadditively can achieve the required frequencyrange.

Minimum specification of OpenFlow (Type 0) requires that a switch have a Flow Table that implements classification and forwarding. 1. Classification is based on a set of patterns that are matched against packets. 2. Each entry in the Flow Table has an action associated with it