Zhihui Sun , Fazhi Qi, Tao Cui sunzh@ihep.ac.cn 4-4-2019 Applications of SDN in IHEP network environment Zhihui Sun , Fazhi Qi, Tao Cui sunzh@ihep.ac.cn 4-4-2019 International Symposium on Grids & Clouds 2019 2019/6/24

Agenda IHEP campus network SDN @ network access control management in IHEP SDN @ network security in IHEP Summary 2019/6/24

IHEP campus network Network topology The wired network and wireless network are independent of each other, and they are connected by the interconnected switch, and it provides a clear physical and functional independence, so we can easily manage and monitor the network status and traffic Both the wired network and wireless network are IPv4/IPv6 supported Completed the configuration of LHCONE 2019/6/24

IHEP campus network- Wireless Network Access Control management We have designed a solution based on network access control system (http://network.ihep.ac.cn，Self-developed system) , AC（Access Controller）, DHCP, FreeRADIUS for our wireless network Works well, and users can easily access to our wireless network Implemented the unified access control management of wireless network across campuses by data sharing(Beijing campus, Dongguan campus) Developed a conference QR code function which users can scan to access to IHEP wireless network Beijing campus CSNS BEPCII Conference network access code Dongguan campus BESIII Wireless Network Access Control 2019/6/24 JUNO Cross-regional Wireless Network Access Control Management

IHEP campus network- Wired Network Access Control management Current architecture We are still using a static control strategy based on device MAC, device IP and corresponding switch IP, corresponding switch port, corresponding Vlan Id to manage our wired network access These strategies must be written into the access switch before users can use IHEP wired network Inconveniences Current strategy needs network admin to assign the IP address manually Needs users to configure the IP address in their network devices Inconvenient for users to access to our wired network Wired Network Access Control 2019/6/24 BESIII JUNO HEPS

IHEP campus network- Wired Network Access Control management Wanted architecture Want an automatic IP address allocation for wired network, so users can no longer pay attention to IP address Want to keep the control strategy of 5 key attributes including device MAC address, device IP address and corresponding switch IP, corresponding switch port, corresponding Vlan Id, so it can avoid confusing access to our wired network Need the whitelist users who can access to wired network using any port, and this function is just for network admin to use The final purpose is that we want to provide a user self-service and convenient wired network access service Need to design a new network access control architecture for wired network 2019/6/24 JUNO HEPS

SDN @ network access control management in IHEP 2019/6/24

SDN @ network access control management in IHEP New solution based on SDN architecture Use standard SDN architecture, which contains application Plane、Control Plane、Data Plane Northbound interface：REST API Southbound interface：OpenFlow / NETCONF 2019/6/24

SDN @ network access control management in IHEP New solution based on SDN architecture DHCP, Provides a dynamic address allocation for IPv4 or IPv6 SDN Controller (Agile controller, provided by HUAWEI) keeps our control strategy, 5 key attributes for access devices Device MAC, Device IP, Switch IP, Switch port, Vlan id Uses radius to provide an access authentication for devices provides more automatic network management User access control system (Self-developed system), provides the users and devices information management 2019/6/24

SDN @ network access control management in IHEP Device IP Device MAC Switch IP Switch port Vlan ID Network access process 1-2. When your device accesses to IHEP wired network, the DHCP server will assign IPv4 and IPv6 address to your device 3. And your network access request will be sent to SDN controller to verify, if matched, it will pass the authentication. 4. But if not matched, your request will be redirected to our user access control system, and ask you to register 5. Then you input your personal information 6-7. user access control system will get your device mac, corresponding switch ip, corresponding switch port and corresponding vlan Id from DHCP server 8. When you complete your registration, your IP, MAC, switch IP, switch port, and Vlan Id will be written to the controller, then your device will pass the network authentication Access control process We implement a wired network access control management based on DHCP server、User Access Control System and SDN Controller 2019/6/24

SDN @ network access control management in IHEP Test-bed and result We built a Test-bed last month SDN controller (HUAWEI Agile controller), DHCP(Infoblox) The access control test results are in line with our expectations The whitelist test results also satisfy our requirements REST API Device mac Switch ip Device ip Switch port Vlan Id 2019/6/24

SDN @ network access control management in IHEP Test-bed and result Northbound interface test Add an account to the SDN controller Added successfully 2019/6/24

SDN @ network access control management in IHEP Test-bed and result Northbound interface test Delete the account Deleted successfully 2019/6/24

SDN @ network access control management in IHEP Test-bed and result Northbound interface test Modify the binding port of an account modified successfully 2019/6/24

SDN @ network access control management in IHEP Future plan We will develop and upgrade our user access control system using the northbound interface We will also complete wired network access control management based on SDN architecture in the next 3 months We also plan to replace the old network equipment step by step 2019/6/24

SDN @ network security in IHEP 2019/6/24

SDN @ network security in IHEP Network security challenges in Computing/Data Center Network security devices may become the bottleneck of network data exchange Many network security devices need to be deployed at the network exit, such as IDP(Intrusion Detection& Prevention System), WAF(Web Application Firewall), VPN(Virtual Private Network)…and it makes very complex policies about network security Service chain adjustment is also complex, and most of the time we need to adjust the network topology and reconfigure the network 2019/6/24

SDN @ network security in IHEP Thoughts We want a simple security policy adjustment for network security devices, and we don’t want to adjust the network topology often We also want to reduce serial connection of network security devices, and most of them should be connected to the network by bypass We also want to reduce network traffic pressure on network security devices Plan Minimize the impact on the existing network Our plan is divided into two steps 2019/6/24

SDN @ network security in IHEP Step 1 We use SDN switch as a traffic aggregation node, and verify our thoughts about network security based on SDN architecture We set the filtering rules in the controller to make network traffic into the network security node which we defined before We also set the service chain rules in the controller to make network traffic into different network security nodes in order We built a test-bed, and use DELL devices to test. Stage 1 2019/6/24

SDN @ network security in IHEP Test-bed and result Create a rule 2 SDN switch 2019/6/24

SDN @ network security in IHEP Test-bed and result We create a rule to filter UDP traffic, and define the input port and output port The test results are in line with our expectations UDP Input port Output port 2019/6/24

SDN @ network security in IHEP Step 2 We want SDN switch as a gateway, and firewalls are the bypass connection to SDN switch Current status, we have designed the architecture Plan We plan to deploy the second step test-bed in the nearly two months Evaluate the function and performance of the bypass firewall solution Stage 2 2019/6/24

Summary Our wired network and wireless network are independent of each other, and they are connected by the interconnected switch We implemented the unified management of wireless network across campuses, and it works well We have designed the solution of the wired network access control management based on SDN architecture, and test-bed results show very successful The architecture of SDN @ network security in IHEP have been designed, and test-bed results are in line with our expectations 2019/6/24

Thanks for your attention ! 2019/6/24