1. Containers as reference environment “Secure Network Bootstrapping Infrastructure” in OpenDaylight
Frank Brockners, Kannan Varadhan, Liming Wei, Y F Siu , Balaji B L, Vijay Anand R
Container Summit, June 5th, 2014

2. Objectives: Complementing “Existing” with “Open”
Agile development of new, customer-specific functionality Rapid customized innovation / integration (DC, IoT, SP, Enterprise) – Combine with existing functionality (integrate and co-host several components – Cisco and 3rd-party)
Ease to Develop and Run: Developer-friendly development and runtime environment for new network functions – leverage common tooling (OSS/Linux-style)
Evolution not Revolution: Build on top of / leverage world class Cisco control and forwarding plane – integrate new functions with existing infrastructure rather than move or replace existing functions
Deploy network functions where they run best (performance, scale, ease of use): On the devices, on a server, on a controller – distributed and/or centralized
Competitive Differentiation: Make Network functions (Cisco and 3rd-party) run better on Cisco-HW/SW than on any other HW/SW. Create a vNF  Control Point owned by Cisco

3. Virtual Network Components: Packaging Options
Orchestration
Management, Chaining
Orchestration
Management, Lifecycle, Chaining
Orchestration
Management, Lifecycle, Chaining NC NC NC NC NC NC NC NC NC
Operating System
Operating System
Operating System
HW/SW Forwarding
SW Forwarding
HW/SW Forwarding
ASIC, X86, ARM, ...
X86, ARM, Hypervisor, ...
ASIC, X86, ARM, Hypervisor, ...
Physical Network Appliance
Example for VNF: Virtual Route Reflector (based on XR-VR)
Virtual Network Function (VNF)
Network Components
Legend:
Packaging options of functionality; NC: Network Component

4. Virtual Network Components … hosted in a Network Container
Orchestration
Network Container
Network Container
Network Container NC NC NC NC NC
Network Control Plane Core Functions
Network Control Plane Core Functions
Controller Core Functions
Routing
Sessions
Security …
Routing
Sessions
Security …
Topology
Inventory
Security …
Operating System
Operating System
Operating System
Physical Router/Switch
Virtual Router/Switch
Server, Controller
Common Development and Runtime Experience for NC across Devices AND Controllers AND Servers
Cisco Confidential

5. Open Application Container: Developer Perspective
Common Environment for Network Functions
Physical Router/Switch - Virtual Router/Switch
Controller
Server/Application
Common Development Experience
Linux-style programming experience
Typical networking functions available to developer as integrated libraries
Distributed/Centralized/Combined NFs
Common Runtime Experience
Run network function at the most optimal place in the network (device, controller, application server), depending on NF’s needs (performance, scale, ease of use)
Open Ecosystem / Open-Source
Orchestration & Life-cycle management
Open Application Container
Portable Network Component … …
Logging
Load/ Unload HA
Scale
Storage
Update
Data-Plane API
Fwd’ing Control
Routing Control
Comms (NC-NC)
Topology …
Hooks into network functions (local/remote)
Operating System
Data-Plane (HW/SW)
Network Control Plane

6. Open Source Development Efforts Related To Network Functions
Orchestrate and Manage Life-Cycle
Evolved Services Platform (“Mozart”)
Integrate, Package, Manage
OpenNFV
Develop, Create
Abstract Hardware

7. Open Application Container Functionality
Orchestration/Life-cycle Management
System Operations
Life-cycle manage the network components in a network container and the network container
Support network functions operations
Package Management (rpm, yum,..)
Pull (rpm, yum…) Push (from Cloud (Meraki-style)
Config (e.g.. Chef, Puppet, …
Orchestration / Service Chaining (OpenStack Heat, Flynn, ..)
API framework (model driven)
Open Boot Loader (ONIE++)
Authentication
Container Security
Logging
Storage access
HA, checkpointing, ISSU
Portable Network Function
APIs
APIs
Starting point for open source project in OpenDaylight
Bootstrapping / Inter-Container Comms
Open DataPlane API (for HW and SW dataplane) ( Advanced Flow programming Data-Plane configuration)
SW-Dataplane
Bootstrapping / Inter-Container Comms
APIs
APIs
OpFlex
Netconf
Routing protocols & RIB access (I2RS)
Subscriber control (I2SS)
Inter-Container comms / “Message Bus”
DHCP, MDNS, Bonjour, … snooping/proxy
Discovery/Topology
Netflow …
POSIX functions
Linux-style Interfaces
Access to the data-plane – hardware/software; incl. software data plane
Hooks into the network control plane
Data-Plane
Control-Plane

8. Motivation: Secure Network Bootstrapping Infrastructure
How do devices get initial secure IP connectivity?
Several southbound protocols assume IP connectivity exist for the control protocol (e.g. OpenFlow, Netconf, ..)
How do we ensure devices associate with the “right” controller and get an appropriate IP address to do so? (Join a particular Domain)
How do we ensure connectivity to all the devices which have joined a particular domain ? (Reachability)
How do we ensure that devices once connected do not get silently swapped? (Security) C2 C1
FE2
FE4
FE1
FE6
FE3
FE5 9

9. Approach Zero touch secure connectivity establishment
Fully automatic: Incremental discovery and attachment of devices to a network domain
Manufacturer installed IEEE 802.1AR credentials for device identification
Automatic enrollment of certificates to devices to secure communication and device identity
Automatic assignment of IP-addresses
Virtual out-of-band channel (VOOBC) to connect devices – “hop-by-hop” tunneling
Scalable connectivity (e.g. no star topology overlay)
Routing over tunneled network ensures “always-on” reachability in case of topology changes. C2 X C1
FE2
FE4
FE1
FE6
FE3
FE5
Nice “side effects”:
Topology discovery
Virtual out-of-band channel can be used by other control protocols running between Controller and Forwarding Elements (e.g. Netconf, OpenFlow); i.e. we bootstrap the management network over which OpenFlow, Netconf, etc. can run

10. OpenDaylight Project: “Secure Network Bootstrapping Infrastructure (SNBI)”
Base Network Service Functions
Controller ….
Topo Mgr
SNBI Registrar
LISP Service
Affinity Mgr …
SAL
PCEP plugin
OF plugin
Netconf
plugin
OVSDB plugin
SNBI plugin
BGP plugin
LISP plugin
… plugin
Secure channel, automatic setup and addressing
Network OS NC NC NC
S N B I
S N B I NC NC NC
Portable Foundation
Portable Foundation (Container)
Linux
Linux
ASIC, X86, ARM, ..
X86, ARM, ..
Forwarding Element (Switch/Router)
Forwarding Element (Server)
For details see:

11. SNBI And Container In OpenDaylight
SNBI: Key Technologies Leveraged
Cisco’s Autonomic Networking
Containers: Option: Docker
Next technology candidates for addition to the “Portable Foundation” (i.e. Container)
OpFlex
Netconf (incl. I2RS, …) …

12. Competitive Considerations
Open Application Container
Evolve from tight ASIC <-> data-plane coupling to tight x86 <-> DP coupling through HW-specific accelerations in software data-plane (OVS enhancements for DPDK)
Network Container Data-Plane API offers enhanced experience over OVS, is DP-agnostic (SW/HW data-plane), offers superior performance on Cisco equipment
Similar open development experience offered PLUS: Existing world-class control plane accessible
Similar open development experience offered PLUS: Existing control plane leveraged, no need to rebuild existing functions
Similar open development experience offered PLUS: Enhanced data-plane API, security for container, on-box/off-box application support
Servers and network devices become the same: All control plane functions are available as standard Linux packages (all it takes is to apt-get the required networking packages)
“Linux”-friendly networking stack for white labeled boxes: Networking hardware looks like a server to the programmer/operator
Present a switch like a server with OVS wrt/ configuration/management, Linux-style scripting/runtime environment

13. References
OpenDaylight “Secure Network Bootstrapping Infrastructure (SNBI)”: