SDN basics and OpenFlow

SDN basics and OpenFlow

SDN basics and OpenFlow Review some related concepts SDN overview OpenFlow

Review of related concepts What are Control plane and data plane? Are they always together in a device historically? Why separate control? – Rapid innovation: control independent of hardware – Network wide view: possible to infer and reason about network behavior – More flexibility: introducing new services rapidly

Review of related concepts Is OpenFlow SDN? – No. OpenFlow is an API that is standardized between control plane and data plane. OpenFlow is one enabling technology for SDN. SDN may build over other enabling technology. – Another approach for SDN is Network Function Virtualization (NFV).

What is software defined networking? Software-defined networking (SDN) is an approach to computer networking that allows network administrators to manage network services through abstraction of lower-level functionality. – Abstractions for three problems: constrained forwarding model, distributed state, detailed configuration SDN is – Directly programmable: network control is programmable because it is decoupled from forwarding functions – Agile: administrator can dynamically adjust network-wide traffic flow to meet changing needs. – Centrally managed: network intelligence is logically centralized. – Programmatically configured – Open standards-based and vendor-neutral

Forwarding abstraction Control plane needs flexible forwarding model – With behavior specified by control program applications Use a generic “flow” concept that is inclusive and forward based on flows. Historically the hardware’s capability for forwarding is vendor dependent – e.g. forwarding based on L2 address, L3 address – This abstracts away forwarding hardware – Flexibility and vendor-neutrality are both valuable

State Distribution Abstraction Shield control mechanisms from state distribution while allowing access to the state – Split global consensus-based distributed algorithms into two independent components: a distributed (database) system and a centralized algorithm. We know how to deal with both. Natural abstraction: global network view Implemented with a network operating system. Control (configuration) mechanism is now abstracted as a function of the global view using API – Control is now based on a centralized graph algorithm instead of a distributed protocol.

Network Operating System(NOS) NOS: a distributed system that creates and maintains a network view Communicates with forwarding elements – Get state information from forwarding elements – Communicates control directives to forwarding elements Using forwarding abstraction NOS plus forwarding abstraction SDN (v1)

Configuration abstraction Application should not configure each individual network device. The NOS provides consistent global view of the network Configuration is a function of the global view NOS eases the implementation of functionality – Does not help specification of functionality Need a specification abstraction

Specification abstraction Give control programs an abstract view of network – Abstract view is a function of global view. The abstract view could be just a giant switch connecting all ports, or individual logical topology for each application. Control program is abstract mapping – Abstract configuration Function (abstract view) Abstraction models should have just enough detail to specify goals – Don’t provide information needed to implement goals.

Simple Example: Access Control Source: Scott Shenker, UC Berkeley What Abstract Network Model Global Network View How

Software Defined Networks Source: Scott Shenker, UC Berkeley Specifies behavior Control Program Compiles to topology Network Virtualization Transmits to switches Network OS Abstract Network Model Global Network View

What Does This Picture Mean? Source: Scott Shenker, UC Berkeley Write a simple program to configure a simple model – Configuration is merely a way to specify what you want Examples – ACLs: who can talk to who – Isolation: who can hear my broadcasts – Routing: only specify routing to the degree you care Some flows over satellite, others over landline – TE: specify in terms of quality of service, not routes Virtualization layer “compiles” these requirements – Produces suitable configuration of actual network devices NOS then transmits these settings to physical boxes

Openflow: Simplifying the control Routing, management, mobility management, access control, VPNs, Feature Feature Operating System Specialized Packet Forwarding Hardware Million of lines of source code 5400 RFCs Barrier to entry Billions of gates Bloated Power Hungry Many complex functions baked into the infrastructure OSPF, BGP, multicast, differentiated services, Traffic Engineering, NAT, firewalls, MPLS, redundant layers, Ossified networks today

OpenFlow: a pragmatic compromise Speed, scale, fidelity of vendor hardware Flexibility and control of software and simulation Vendors don’t need to expose implementation Leverages hardware inside most switches today (ACL tables)

How does OpenFlow work? 16

Ethernet switch What sets the forwarding Table in Ethernet? Forwarding table: 12:12:12:12:12:12 port 1 3f:13:33:ef:ff:ff port 2

OpenFlow Controller OpenFlow Protocol (SSL/TCP) Control Path OpenFlow Data Path (Hardware)

OpenFlow switch SSL software hardware OpenFlow Client Flow table Port 1 Port 2 Port 3 Port 4 OpenFlow controller

Openflow switch An Openflow switch (Ethernet switch) has an internal flow table. – If a packet matches an entry in the flow table, perform the actions (e.g. forward to port 10) according to the flow table. – If a packet does not match any entry in the flow table. Send it to the Openflow controller The controller will figure out what to do with such packet The controller will then respond to the switch, informing how to handle such a packet so that the switch would know how to deal with such packets next time. For each flow, ideally the controller will be queried once. Openflow defines the standard interface to add and remove flow entries in the table.

OpenFlow Example Software Layer Controller PC OpenFlow Client Flow Table Hardware Layer MAC src MAC dst IP Src IP Dst TCP TCP Action sport dport * * * 5.6.7.8 * port 1 5.6.7.8 port 2 * port 3 port 1 port 4 1.2.3.4

Flow switching and routing Layer 4 Each individual field meta data Wild Card aggregation – E.g. IP-subnet: 192.168.*/24

OpenFlow Basics Flow Table Entries Rule Action Stats Packet byte counters 1. 2. 3. 4. 5. Switch VLAN Port ID Forward packet to zero or more ports Encapsulate and forward to controller Send to normal processing pipeline Modify Fields Any extensions you add! VLAN MAC pcp src MAC dst mask what fields to match Eth type IP Src IP Dst IP L4 IP ToS Prot sport L4 dport

Examples Switching Switch MAC Port src * MAC Eth dst type 00:1f:. * * VLAN IP ID Src IP Dst IP Prot TCP TCP Action sport dport * * * * IP Dst IP Prot TCP TCP Action sport dport * * port6 Flow Switching Switch MAC Port src MAC Eth dst type port3 00:20. 00:1f. 0800 VLAN IP ID Src vlan1 1.2.3.4 5.6.7.8 4 17264 80 port6 Firewall Switch MAC Port src * * MAC Eth dst type * * VLAN IP ID Src IP Dst IP Prot TCP TCP Action sport dport * * * * * 22 drop

Examples Routing Switch MAC Port src * * MAC Eth dst type * * VLAN IP ID Src IP Dst * 5.6.7.8 * * VLAN IP ID Src IP Dst IP Prot vlan1 * * * TCP TCP Action sport dport port6, port7, * * port9 * IP Prot TCP TCP Action sport dport * port6 VLAN Switching Switch MAC Port src * * MAC Eth dst type 00:1f. *

Centralized vs Distributed Control Both models are possible with OpenFlow Centralized Control Controller OpenFlow Switch Distributed Control Controller OpenFlow Switch Controller OpenFlow Switch OpenFlow Switch OpenFlow Switch Controller OpenFlow Switch

Flow Routing vs. Aggregation Both models are possible with OpenFlow Flow-Based Every flow is individually set up by controller Exact-match flow entries Flow table contains one entry per flow Good for fine grain control, e.g. campus networks Aggregated One flow entry covers large groups of flows Wildcard flow entries Flow table contains one entry per category of flows Good for large number of flows, e.g. backbone

Reactive vs. Proactive (pre-populated) Both models are possible with OpenFlow Reactive Proactive First packet of flow Controller pre-populates triggers controller to insert flow entries Efficient use of flow table Every flow incurs small additional flow setup time If control connection lost, switch has limited utility flow table in switch Zero additional flow setup time Loss of control connection does not disrupt traffic Essentially requires aggregated (wildcard) rules

Openflow specifications From 1.0.0 to 1.5.0 (1.6 not public yet) Briefly introduce concepts in versions 1.0.0 to 1.2.0

Openflow 1.0 concepts Ports and Port queues Flow table Packet matching Actions and packet forwarding Messaging between controller and switch

Open Flow Protocol Messages Controller-to-switch: from the controller to manage or inspect the switch state – Features, config, modify state, read state, packet-out, etc Asynchronous: send from switch without controller soliciting – Packet-in, flow removed/expired, port status, error, etc Symmetric: symmetric messages without solicitation in either direction – Hello, Echo, etc.

Openflow 1.1 concepts Multiple flow tables Groups MPLS and VLAN tag support Virtual ports Controller connection failure

Pipeline processing (in 1.1) A switch can have multiple flow tables that are matched in a pipeline fashion.

Per table packet processing

Groups Group table: entries and actions – To refine flooding – Support multicast – As a base for rules that apply to multiple flows

1.2.0 concepts Extensible match support Extensible set field packet-rewrite support IPv6 Multiple controller enhancements Later versions of Openflow specification supports more necessary functions.

Going further Openflow is implemented in MiniNet (mininet.org), a simulation infrastructure. Related resources – Open Networking Foundation: https://www.opennetworking.org/ This lecture materials are based on various resources in the net, in particular this file https://www.clear.rice.edu/comp529/www/papers/tutorial 4.pdf And book “Software Defined Networks A Comprehensive Approach” by Paul Goransson and Chuck Black

Openflow controllers AppAppAppAppAppAppAppAppAppAppApp Northbound Interface SDN controller OpenFlow Network elements has two components: OpenFlow client, forwarding hardware with flow tables. The SDN controller must implement the network OS functionality – Provide abstraction to the upper layer – Provide control to the underlying hardware – Managing the resources

SDN controllers (NOS) .vs. OS OS Resources managed – CPU, memory, disk, IO devices, etc Applications: – User programs that use the resources OS functionality (abstraction): – – – – CPU virtualization Memory virtualization IO virtualization File systems Network OS Resources managed – Connected switches/routers/NICs Applications – Firewall, migration, network virtualization, NAT, TE, etc NOS functionality? – Network abstraction – this is a new thing that is not well understood.

NOS functionality From: “NOX: towards an Operating System to Networks” – NOS should present application programs with a centralized programming model – Programs should be written in terms of high level abstractions, not low-level parameters

Existing SDN controllers NOX/POX Ryu Floodlight Pyretic Frenetic Open Daylight And many more Some artificial differences: language More important differences: API Functionality

Openflow controller: NOX/POX Originally developed by Nirica NOX: C version; POX: python version – Nox for performance; Pox for rapid prototyping. POX comes with Mininet – the simulation infrastructure OpenFlow v.1.0 Programming model: – Controller registers for events (PacketIn, ConnectionUP, etc). – Programmer write event handler

NOX/POX Events FlowRemoved ConnectionUP PacketIn etc User write event handlers E.g. ConnectionUp: record in the database, PacketIn: compute the route, setup flow table along the path, etc Abstraction? Global view build from control program, fairly low level.

See lab3 controller.py for an example Pox controller 10.0.0.2 10.0.0.1 1 2 3 1 2 1 2 3 1 4 2 10.0.0.3

Openflow SDN current state AppAppAppAppAppAppAppAppAppAppApp Open Interface Net Windows or Net Linux or Open Interface 4. Firewall, virtual network, TE, IDS, etc Northbound API, not standardized yet Net Mac OS 3. SDN controllers (floodlight, nox, etc) 1. OpenFlow: standardized for Ethernet/IP/TCP 2. OpenFlow enabled switches/routers simple hardware doing forwarding only forwarding table can be set by other entity through OpenFlow