1. Practical and Incremental Convergence between SDN and Middleboxes 1 Zafar Qazi, Cheng-Chun Tu, Luis Chiang Vyas Sekar Rui Miao Minlan Yu

2. Type of applianceNumber Firewalls166 NIDS127 Media gateways110 Load balancers67 Proxies66 VPN gateways45 WAN Optimizers44 Voice gateways11 Total Middleboxes636 Total routers~900 Why middleboxes? Data from a large enterprise Survey across 57 network operators Critical piece of network infrastructure But painful to manage, hard to add new functions 2

3. Why should SDN community care? 3 Aug. 2012 ONF report – Integrate SDN into production networks – APIs for functions the market views as important Survey on SDN adoption [Metzler 2012] – use cases that justify deployment – “add a focus on Layer 4 through Layer 7 functionality … change in the perceived value of SDN.” Middleboxes: Necessity and Opportunity

4. 4 Goal: SDN + Middlebox integration Centralized Controller “ Flow ” FwdAction …… “ Flow ” FwdAction …… Can we achieve SDN-Middlebox integration: with existing SDN APIs? with unmodified middleboxes? Open APIs

5. S1 S2 S4 Src S3 FirewallIDSProxy Proxy1 IDS1 Challenge: Policy Composition Dst Firewall1 Pkt, S2—S4: IDS1 vs Dst ?? Policy routing Need more expressive data plane?

6. 2= Post Firewall Solution: Tag Packet Processing State 6 Firewall Proxy IDS 1=None 3=Post IDS 4 = Post Proxy S2 S4 Use “state” tags in addition to header, interface info

7. S1 S2 S4 Src S3 Proxy1 IDS1 = 50% Challenge: Resource Management Dst Firewall1 IDS2 = 50% How much TCAM does this load balancing need? Rules to “split” traffic

8. Solution: Joint Optimization 8 Resource Manager Topology Traffic Switch TCAM Middlebox Hardware Policy Spec Processing Distribution Forwarding Rules Theoretically hard, but we have practical decomposition

9. S1 S2 S4 Src S3 Proxy1 IDS1 = 50% Challenge: Traffic Modifications Dst Firewall1 IDS2 = 50% How can we set up the correct forwarding rules? Proxy may modify sessions

10. 10 Proxy Correlate flows Install rules p1 Collect first 2-3 packets Time window T p2 p3 p4 p1 p2 User 1 User 2 p1* p2* p3 p4* P1* P2* q1 q2 q3 q1 q2 f1: f1’: f2’: Solution: Infer flow correlations Payload similarity algorithms

11. Challenges in SDN-Middlebox integration Policy composition Resource management Traffic modification 11 Scalable joint optimization Infer flow correlations “Tag” processing state Tunnels for compact routing

12. Admin FW IDS Proxy Web Rule Generator Resource ManagerDynamics Handler NIMBLE System Overview Legacy Middleboxes OpenFlow-enabled Switches Using OpenFlow 1.0! FlowTag/TunnelAction …… FlowTag/TunnelAction …… Forward first k pkts

13. Evaluation TBD Say something about prototype Show one/two results 13

14. Broader Middlebox Research Agenda 14 High capital costs Management complexity Inflexible, not extensible Consolidated Architecture [NSDI ‘12] ONS Poster Cloud Outsourcing [SIGCOMM’12] SDN integration [ongoing]