1. connect communicate collaborate New GEANT network: BoD service migration & NSI v2.0 Guy Roberts 17 Sept 2012

2. connect communicate collaborate Topics Current BoD service New GÉANT network BoD in new network NSI v2.0 2

3. connect communicate collaborate Review of BoD in existing GÉANT network 3

4. connect communicate collaborate Old network: MCC delivers GÉANTplus and BoD services GÉANT 2 POP A To NREN A Primary IP Peering GÉANT 2 POP B IP Router Switch IP Backup Lambdas GÉANT+ To NREN B IP Router Switch Dark fibre/amplifier chain Primary IP Peering IP Backup LambdasGÉANT+

5. connect communicate collaborate Old network: GÉANT Dynamic Core Alcatel 1678MCC equipment using SDH timeslots (VCGs) Bandwidth is guaranteed as no capacity sharing Supports EPL (port-to-port circuits) and EVPL (VLAN-to- VLAN circuits) Due to be replaced as: Poor user experience due to lack of ingress buffering in EVPL mode No statistical multiplexing – so a high cost solution 5

6. connect communicate collaborate Dynamic Core Current NEXPReS infrastructure on GÉANT Dynamic Core

7. connect communicate collaborate Use of Iperf on EXPReS servers VC-4-48v path TCP throughput Zero path length Max. 100 flows – Iperf limit Throughput falls with large TCP window Bottleneck is managed with small buffers approx. 64kByte Attempts to fix this by Alcatel in later versions were only partially successful. Tuning TCP window very hard for single flow! MCC Buffer problem… Tuning TCP window very hard for single flow!

8. connect communicate collaborate Sharing dynamic core: vlans TP is able to accept connection requests from more than one Domain manager To share infrastructure for BoD and NSI demo we need to ensure that conflicts are not possible. NSI uses vlan range 1780 to 1800, BoD uses 2000- 2050. Alcatel TP should be modified to validate correct usage before forwarding to OMS. 8

9. connect communicate collaborate Future BoD infrastructure

10. connect communicate collaborate GÉANT Procurement 10 3 layers in the network being replaced: Dark fibre DWDM transmission equipment (Layer 1) Switching (Layer 2) Router equipment will initially remain unchanged Juniper T-series remain Later routing function will be migrated to new Juniper MX equipment

11. connect communicate collaborate DF procurement 11 Current lease on GÉANT DF expires in 2015 To support the migration we decided to re-procure dark fibre early – having a second pair of fibres during migration makes process easier and reduces customer outages. Contracts have been awarded 5 DF providers: Colt, Telia Sonera, Interoute, Level3, Pantel New lease runs to 2020

12. connect communicate collaborate New DF footprint: up to 2020 12

13. connect communicate collaborate Up to 8Tb/s capacity on ILS in initial release Up to 80 x 100G channels with ULH reach PIC-based 500Gb/s DWDM line cards 5Tb/s Bandwidth Virtualization in single bay Fully non-blocking OTN and P-OTN switching Multi-layer GMPLS, MPLS-TP Software intelligence for OTN & packet services New optical layer: Infinera Next-gen PIC-based DWDM GMPLS & MPLS-TP Control Plane Next Generation Integrated WDM Transport, OTN, & Packet Switching platform Bandwidth Virtualization Multi-Tb/s OTN & Packet Switch

14. connect communicate collaborate Digital ROADMs Separate WDM/ROADM & OTN switching layers Sub- grooming & muxing only with OXC Manual grooming complexity or extra cost for OXC Integrated WDM and OTN/packet bandwidth management Sub- grooming at every node End-end service management, PM and OAM OXC OOOO O OOO O O O O O O O O O-E-O ODU0 & packet bandwidth management OTN & packet services Conventional WDM Networks Infinera Digital Optical Network

15. connect communicate collaborate Switching layer: SDH to be replaced with MPLS 15 New switching platform uses Juniper MX equipment to deliver MPLS service Circuit services access using VLANs on a shared IP/GÉANT Plus interface. Capacity for GÉANT Plus up to 100Gbps. Based on MPLS technology GÉANT Plus will not be policed at ingress… some implications here…

16. connect communicate collaborate Day-1 connectivity used by MXs and extant routers (high level view) KEY 100G lambda Nx10GE lambda Nx10GE lambda (detail TBD) Nx10G leased lambdas RO FR IE PT LTLVEE BG GR HU Fink ES LU BE NLUKCZSK HR AT SI PLDK RU DE CH IT 16

17. connect communicate collaborate Planned new GÉANT architecture (principles) 100G trunks to accommodate GÉANT IP and GÉANT Plus from day-1 Where a POP has a router and MCC today, replace MCC with MX960 Where a POP has an MCC and no router then replace with two MX480 Sub-10G GÉANT Plus instances implemented as VLLs on MX platform Existing 10G GÉANT Lambdas will be migrated to Infinera platform Encourage new 10GE GÉANT “Lambdas” (now really higher capacity GEANT Plus instances) to be carried over new Lot 2 platform 17

18. connect communicate collaborate Generic lot 2 and extant IP architecture after migration (“day 1”) Router Lot 2 switch Router Lot 2 switch Router Lot 2 switch DF line Mx10G 100GE Mx10G Nx10G Logical link: Mx10G (bypassing Lot 2 box) Logical link: K Gbps (via Lot 2 box) GÉANT Plus GÉANT Lambda >10Gbps GÉANT Lambda >10Gbps 100GE Nx10G IP peers IP backup IP primary POP APOP BPOP C “IP Peers” = interconnects, commodity upstreams, real peers, etc 18

19. connect communicate collaborate Converged lot 2 and IP architecture at “day-2” (current vision) By this stage DF lines expected to be carrying multiple 40/100G lambdas so GÉANT IP backups (or dual-homed IP primaries) can be transported directly to other POPs avoiding the single Lot 2 switch Lot 2++ switch DF line 100GE GÉANT Plus GÉANT Lambda >10Gbps GÉANT Lambda >10Gbps 100GE IP peer IP backup IP primary POP APOP BPOP C 100GE But need to think a bit more about how to get from “day-1” to this “day-2” safely 19

20. connect communicate collaborate A bit about quality of the new GÉANT Plus service instances Two consequences of moving to the new “packet transport”: Absolute BW guarantee is no longer there Microscopic jitter performance will be “worse” BW “guarantee” will now done via a CAC process and traffic engineering DANTE is also investigating and will purchase commercial capacity planning/traffic management tool: GÉANT IP traffic and GÉANT Plus share trunk. 20

21. connect communicate collaborate AutoBAHN/BoD Tech Proxy AutoBAHN/BoD requires a unique ‘technology proxy’ for each technology/vendor combination DANTE Systems team have developed an Alcatel technology proxy that allows BoD to automatically create GÉANT Plus type circuits A similar Juniper technology proxy is being developed for BoD Target date for completion November 2012 Service migration date not set yet – expect early 2013 If successful the migration to the new system should be transparent to the user.

22. connect communicate collaborate Architecture for BoD tech proxy 22

23. connect communicate collaborate What should users expect from GÉANT platform migration? Migration from Alcatel to Juniper platform should be transparent to the user. New platform will allow users to create circuits with capacities >10Gbps Fixes current buffer bug in 1678MCC Juniper expected to have a more robust north-bound interface to AutoBAHN/BoD Statistical multiplexing uses bandwidth more efficiently, but responsibility on operator/policy to manage bandwidth utilization 23

24. connect communicate collaborate NSI v2.0 24

25. connect communicate collaborate NSI v2.0 WSDL, State-machine and topology are now stable Development has begun for a v2.0 plugfest in OGF36 in Chicago NSI Connection Service v2.0 documentation starts now – however beware, editing process is usually slow NSI v2.0 demo/plugest will happen at supercomputing 2012 in November. 25

26. connect communicate collaborate New in NSI v2.0: Primitives and SM The Reserve, Provision, Release, Terminate, ForcedEnd and Query messages are carried over from v1.0. The Modify message has been added to allow a connection end time to be modified. New concept of a Message Delivery Layer is introduced in v2.0. This layer supports confirmation of the delivery of message to all immediate children including uPA in the same NSA. A completely re-worked state machine is defined - supports modify command 26

27. connect communicate collaborate New in NSI v2.0: STPs and Pathfinding STPs are constituted of 3 parts: identifies a network resource managed by an NSA identifies a local resource in the network (eg a port) is a tuple identifying constraints on technology specific attributes. Eg, VVLAN=1037, Can also be expressed as lists: VLAN=1030-1050 Connections requests can now include Explicit Routing Objects (EROs) in the form of STPs. Better NML compatibility: Ids now OGF URN compliant Mechanism to associate NSAs with a topology 27

28. connect communicate collaborate New in NSI v2.0: Other NSA version discovery service. New web service in v2.0 allows queries to an NSA to find information such as the NSI version and associated SOAP endpoints. Security: In CS v2.0 the inter-domain transport layer security utilize TLS with client/server public key certificates. This enables: a. Confidentiality (using TLS) b.Integrity (implicit with point-to-point transport security) c.Mitigation of Third-Party Replay Attacks (implicit with point-to- point transport security) d. Mutual Authentication (client/server public key certificates ) Error handling – enhanced error reporting including hierarchical reporting of errors in reservation tree. 28

29. connect communicate collaborate Thank you! 29