OpenFlow/SDN tutorial OFC/NFOEC March, 2012 Srini Seetharaman Deutsche Telekom Silicon Valley Innovation Center 1

Goals of this Tutorial By the end, everyone should know: why do we need OpenFlow/SDN? what is it? how it works? where it is going? how will it benefit carriers? What: protocol, 2 2

Why OpenFlow? 3

Specialized Packet Forwarding Hardware The Ossified Network Routing, management, mobility management, access control, VPNs, … Feature Feature Million of lines of source code 6000+ RFCs Barrier to entry Operating System Specialized Packet Forwarding Hardware Billions of gates Bloated Power Hungry Many complex functions baked into the infrastructure OSPF, BGP, multicast, differentiated services, Traffic Engineering, NAT, firewalls, MPLS, redundant layers, … An industry with a “mainframe-mentality”, reluctant to change 4 4

none have all the desired attributes! Open Systems Performance Fidelity Scale Real User Traffic? Complexity Open Simulation medium no yes Emulation low Software Switches poor NetFPGA high Network Processors Vendor Switches gap in the tool space none have all the desired attributes! 5

Current Internet Closed to Innovations in the Infrastructure Closed App Operating System App Specialized Packet Forwarding Hardware Operating System App Specialized Packet Forwarding Hardware Operating System The next 3 slides are a set of animation to show how we enable innovation: - Infrastructure is closed to innovation and only driven by vendors. Consumers have little say - Business model makes it hard for new features to be added App Specialized Packet Forwarding Hardware Operating System Specialized Packet Forwarding Hardware App Operating System Specialized Packet Forwarding Hardware 6

“Software Defined Networking” approach to open it Network Operating System App Operating System App Specialized Packet Forwarding Hardware Operating System App Specialized Packet Forwarding Hardware Operating System How do we redefine the architecture to open up networking infrastructure and the industry! By bring to the networking industry what we did to the computing world App Specialized Packet Forwarding Hardware Operating System Specialized Packet Forwarding Hardware App Operating System Specialized Packet Forwarding Hardware

The “Software-defined Network” 2. At least one good operating system Extensible, possibly open-source 3. Well-defined open API App App App Network Operating System 1. Open interface to hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Switches, routers and other middleboxes are dumbed down The key is to have a standardized control interface that speaks directly to hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware

How does OpenFlow work? 9

Ethernet Switch 10

Control Path (Software) Control Path Data Path (Hardware) 11

OpenFlow Controller Control Path OpenFlow Data Path (Hardware) OpenFlow Protocol (SSL/TCP) Control Path OpenFlow Data Path (Hardware) 12

OpenFlow Client Controller PC OpenFlow Example Software Layer MAC src Flow Table MAC src dst IP Src Dst TCP sport dport Action Hardware Layer * 5.6.7.8 port 1 port 1 port 2 port 3 port 4 5.6.7.8 1.2.3.4 13

OpenFlow usage Controller PC Alice’s Rule Alice’s code OpenFlow Switch Decision? OpenFlow Protocol OpenFlow Switch How the actual protocol works OpenFlow Switch OpenFlow offloads control intelligence to a remote software 14 14

OpenFlow Basics Flow Table Entries Rule Action Stats Packet + byte counters Forward packet to zero or more ports Encapsulate and forward to controller Send to normal processing pipeline Modify Fields Any extensions you add! Now I’ll describe the API that tries to meet these goals. Switch Port VLAN ID VLAN pcp MAC src MAC dst Eth type IP Src IP Dst IP ToS IP Prot L4 sport L4 dport + mask what fields to match 15 15

Examples Switching Flow Switching Firewall Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action * * 00:1f:.. * * * * * * * port6 Flow Switching Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action port3 00:20.. 00:1f.. 0800 vlan1 1.2.3.4 5.6.7.8 4 17264 80 port6 Firewall Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action * * * * * * * * * 22 drop 16

Examples Routing VLAN Switching Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action * * * * * * 5.6.7.8 * * * port6 VLAN Switching Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action port6, port7, port9 * * 00:1f.. * vlan1 * * * * * 17

OpenFlow: a pragmatic compromise + Speed, scale, fidelity of vendor hardware + Flexibility and control of software and simulation Vendors don’t need to expose implementation Leverages hardware inside most switches today (ACL tables) 18

Centralized vs Distributed Control Both models are possible with OpenFlow Centralized Control Distributed Control Controller Controller OpenFlow Switch OpenFlow Switch Controller OpenFlow Switch OpenFlow Switch Controller OpenFlow Switch OpenFlow Switch 19

Flow Routing vs. Aggregation Both models are possible with OpenFlow Flow-Based Every flow is individually set up by controller Exact-match flow entries Flow table contains one entry per flow Good for fine grain control, e.g. campus networks Aggregated One flow entry covers large groups of flows Wildcard flow entries Flow table contains one entry per category of flows Good for large number of flows, e.g. backbone 20

Reactive vs. Proactive (pre-populated) Both models are possible with OpenFlow First packet of flow triggers controller to insert flow entries Efficient use of flow table Every flow incurs small additional flow setup time If control connection lost, switch has limited utility Proactive Controller pre-populates flow table in switch Zero additional flow setup time Loss of control connection does not disrupt traffic Essentially requires aggregated (wildcard) rules 21

Usage examples openflow.org/videos Alice’s code: Simple learning switch Per Flow switching Network access control/firewall Static “VLANs” Her own new routing protocol: unicast, multicast, multipath Home network manager Packet processor (in controller) IPvAlice openflow.org/videos VM migration Server Load balancing Mobility manager Power management Network monitoring and visualization Network debugging Network slicing What is possible in the controller? Anything that needs intelligent routing of a flow At Stanford, we have even shown how OpenFlow may be used for: VM migration Power managem ent Load balancing Network monitorin g and debugging Easier network visualizati on … and much more you can create! 22 22

Topology discovery OpenFlow controller view is not always complete. For instance, what does the controller see here? OF switch OF switch Non-OF switch X Y Host B Host A Non-OF switch Internet Host C

Quiz Time How do I provide control connectivity? Is it really clean slate? Why aren’t users complaining about time to setup flows over OpenFlow? (Hint: What is the predominant traffic today?) Considering switch CPU is the major limit, how can one take down an OpenFlow network? How to perform topology discovery over OpenFlow-enabled switches? What happens when you have a non-OpenFlow switch inbetween? What if there are two islands connected to same controller? How scalable is OpenFlow? How does one scale deployments? 24

What can you not do with OpenFlow ver1.1 Non-flow-based (per-packet) networking e.g., Handling pkt 1 differently from pkt 2 of same flow yes, this is a fundamental limitation BUT OpenFlow provides the plumbing to connect devices New forwarding primitives BUT provides a nice way to integrate them through extensions New packet formats/field definitions BUT a generalized OpenFlow (2.0) is on the horizon Optical Circuits BUT efforts underway to apply OpenFlow model to circuits Low-setup-time individual flows BUT can push down flows proactively to avoid delays 25

Where is it going? The Open Networking Foundation: Textbox Headline The founding Consortium Adopter Members (as of Feb 2012) List of Members: Big Switch Networks Broadcom Brocade Ciena Cisco Citrix Comcast CompTIA Cyan Dell Elbrys Ericsson ETRI Extreme Networks EZchip Force10Network s Fujitsu Netronom e Nicira Networks Nokia Siemens Networks Plexxi Inc. Pronto Systems Radware Riverbed Technolog y Samsung Spirent Tencent Texas Instrument s Vello Systems VMware ZTE Corporatio n Hitachi HP Huawei IBM Infoblox Intel IP Infusion Ixia Juniper Networks Korea Telecom LineRate Systems LSI Marvell Mellanox Metaswitch Networks Midokura NEC Netgear Promoter Members: Operators and service providers Make up the board of directors Have voting rights Representative of DTAG is Bruno Orth (GTN S&A)

Where it’s going OF v1.1: Extensions for WAN multiple tables: leverage additional tables tags and tunnels multipath forwarding OF v1.2: Extensible Match structure Required fields includes IPv6 27

Where it’s going OF v2+ generalized matching and actions: an “instruction set” for networking Several other working groups have been created: Hybrid group: Specifies how OpenFlow can be included into legacy switches without assuming clean-slate Config group: Will specify an independent protocol that will help configure OpenFlow parameters out-of-band .... And more 28

OpenFlow Implementations (Switch and Controller) 29

OpenFlow building blocks Monitoring/ debugging tools oftrace oflops openseer Stanford Provided Controller Applications ENVI (GUI) LAVI n-Casting Aggregation NOX Beacon Helios Maestro SNAC Controller Slicing Software Expedient FlowVisor There are components at different levels that work together in making it work The commercial switch details will follow in next slide There are a plethora of applications possible. I only list those available at Stanford Commercial Switches Stanford Provided Software Ref. Switch NetFPGA Broadcom Ref. Switch HP, NEC, Pronto, Juniper.. and many more OpenFlow Switches OpenWRT PCEngine WiFi AP OpenVSwitch 30

Current SDN hardware More coming soon... Juniper MX-series NEC IP8800 WiMax (NEC) HP Procurve 5400 Netgear 7324 PC Engines Pronto 3240/3290 Ciena Coredirector More coming soon... 31

Commercial Switch Vendors Model Virtualize Notes HP Procurve 5400zl or 6600 1 OF instance per VLAN LACP, VLAN and STP processing before OpenFlow Wildcard rules or non-IP pkts processed in s/w Header rewriting in s/w CPU protects mgmt during loop NEC IP8800 OpenFlow takes precedence Most actions processed in hardware MAC header rewriting in h/w Pronto 3290 or 3780 with Pica8 or Indigo firmware 1 OF instance per switch No legacy protocols (like VLAN and STP) All support ver 1.0 All have approx 1500 flow table entry limit 32

Open-source controllers Vendor Notes Nicira’s NOX GPL C++ and Python SNAC Code based on NOX0.4 Enterprise network C++, Python and Javascript Currently used by campuses Vendor Notes Stanford’s Beacon BSD-like license Java-based Maestro (from Rice Univ) GPL Based on Java NEC’s Trema Open-source Written in C and Ruby Included test harness 33

Virtualizing OpenFlow 34

Virtualization or “Slicing” Trend Controller 1 App Controller 2 Virtualization or “Slicing” OpenFlow NOX (Network OS) Network OS App App App Windows (OS) Linux Mac OS Windows (OS) Linux Mac OS Windows (OS) Linux Mac OS Virtualization layer x86 (Computer) Hidden slide (just for backup reasons) Shows how far along we can go in opening up the network Computer Industry Network Industry 35

Virtualization or “Slicing” Layer Isolated “slices” Many operating systems, or Many versions App Network Operating System 1 Network Operating System 2 Network Operating System 3 Network Operating System 4 Open interface to hardware Virtualization or “Slicing” Layer Open interface to hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware Simple Packet Forwarding Hardware 36

Switch Based Virtualization Exists for NEC, HP switches but not flexible enough Controller Research VLAN 2 Flow Table Controller Research VLAN 1 Flow Table Production VLANs Normal L2/L3 Processing Experiments running on PRODUCTION infrastructure Key to get scale, key to get traffic on the network (e.g. can’t just do a reset...) 37

FlowVisor-based Virtualization Heidi’s Controller Craig’s Controller Aaron’s Controller Topology discovery is per slice OpenFlow Protocol OpenFlow FlowVisor & Policy Control OpenFlow Switch OpenFlow Protocol OpenFlow Switch OpenFlow Switch 38

FlowVisor-based Virtualization http Load-balancer Multicast Broadcast Separation not only by VLANs, but any L1-L4 pattern OpenFlow Protocol dl_dst=FFFFFFFFFFFF tp_src=80, or tp_dst=80 OpenFlow FlowVisor & Policy Control OpenFlow Switch OpenFlow Protocol OpenFlow Switch OpenFlow Switch 39

FlowSpace: Maps Packets to Slices

FlowVisor Message Handling OpenFlow Firmware Data Path Alice Controller Bob Cathy FlowVisor Rule Policy Check: Is this rule allowed? Policy Check: Who controls this packet? Full Line Rate Forwarding Exception Packet Packet

Use Case: New CDN - Turbo Coral ++ Basic Idea: Build a CDN where you control the entire network All traffic to or from Coral IP space controlled by Experimenter All other traffic controlled by default routing Topology is entire network End hosts are automatically added (no opt-in) Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport * 84.65.* Researcher * Admin 42

OpenFlow/SDN for carriers 43

SDN is a hammer for what nail?

1. Packet and Circuit convergence Most service providers own and operate 2 independent networks : IP and Transport managed and operated independently minimal cross-layer awareness resulting in duplication of functions and resources in multiple layers and significant capex and opex burdens Convergence to reduce costs and provide value-added services. The Flow Abstraction presents a unifying abstraction

OpenFlow-based unified control plane Packet flows Circuit flows using the cross-connect table in circuit switches Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action VCG Signal Type VCG Signal Type

pac.c Controller Converged Network Interface: OpenFlow Protocol Unified Control Plane Interface: OpenFlow Protocol Packet & Circuit Switches Converged Network

Demonstration of pac.c NOX OpenFlow Protocol GE links NEW YORK SAN FRANCISCO GE links OC-48 links (2.5 Gbps) HOUSTON 48

2. Improving IP/MPLS control Basic Idea Retain MPLS data-plane operations Replace IP/MPLS control plane Demonstrate TE & its features All made simpler – some greatly (eg. AutoRoute) Some made possible only with SDN (eg. global-optimization) TE 2.0 VPNs 2.0 Optimized FRR/ AutoBw MPLS-TP Control Multi-layer Control Routing Discovery Label Distribution Recovery NETWORK OPERATING SYSTEM

Summary OpenFlow/SDN is evolving to facilitate an ecosystem for innovation OpenFlow is being deployed in over 100 organizations world-wide GEC9 in Nov, 2010 showcased nation-wide OF Internet 2 and NLR starting to serve as the GENI Backbone OpenFlow is essential for Service Providers Custom control for Traffic Engineering Combined Packet/Circuit switched networks

Are you innovating in your network? 51