Servizi di Grid e impatto sulla rete A. Cavalli – INFN-CNAF

Outline Introduction Location of the Grid services Examples of service interactions LCG port table Computing Element Storage Element Worker Node network-security concerns

Introduction After last few years of deployment of a production Grid on the existing network and computing infrastructures of INFN we see two main consequences: new requirements about network performances and features new concerns to the network administrators, and the need to understand the overall impact of the new services that are coming Here I just give some details of the main services that populate a Grid site, with examples of interaction between Grid elements, and Rimini - 7-10/05/2007

Location & list of services Rimini - 7-10/05/2007

Keep focus on Middleware Services Rimini - 7-10/05/2007

Example 1: BDII-TOP activity Rimini - 7-10/05/2007

Example 2: WMS (1)‏ Rimini - 7-10/05/2007

WMS (2)‏ Rimini - 7-10/05/2007

WMS (3)‏ Rimini - 7-10/05/2007

Example 3: FTS Rimini - 7-10/05/2007

LCG Port Table From the beginning of LCG project, a table of all the middleware ports has been kept up-to-date, with all the links between the intercommunicating services: https://twiki.cern.ch/twiki/bin/view/LCG/LCGPortTable Rimini - 7-10/05/2007

Computing Element The LCG Computing Element main component is the GRAM The most important “external” interaction is with Resource Brokers Rimini - 7-10/05/2007

Storage systems Here is an example of Storage system and the services/protocols that can be involved Other UIs, WNs and SEs need to talk with the local DPM specific services, the GSIFTP, and with the SRM interface Rimini - 7-10/05/2007

Worker Nodes The local-site activity, between WNs, and with the LRMS master and the CE, requires reliable and fast local networking According with the Workload Management architecture, on the WN the jobs have to communicate with the RB/WMS to send the output via GSIFTP (outbound) As “real” working part of the Grid, on the WNs we see operations that need outbound, and not necessarily inbound connections (e.g. Data Management operations on local or outside Storage systems) For these reasons connections to Worker Nodes from outside the LAN can be blocked, or WNs can be even on a masqeraded network (NAT) Rimini - 7-10/05/2007

Network Security concerns New kind of services create new needs for the network administrator, also in terms of: Different/new services to scan for vulnerabilities and for malicious network activity: some of the Grid services are based on standard/consolidated services or protocols, but the majority is made of new, not deeply tested software. Network scanners like Nessus or IDS like Snort have to be improved to know also the discovered awakenesses of Grid components New kind of services to monitor, e.g. new components for the existing monitoring tools (but here we see the help of native Grid monitoring) Rimini - 7-10/05/2007