NFVandSDNTutorial
Overview:
ThisisabasictutorialthatguidesyouthroughanexperimentusingOpenFlowandNetwork
FunctionVirtualization(NFV).ItisrecommendedthatyoufirstreadaboutOpenFlow
(http://archive.openflow.org/)andgooverbasicOpenFlowtutorialonGENI
(http://groups.geni.net/geni/wiki/GENIExperimenter/Tutorials/OpenFlowOVS).Thegoalofthis
tutorialistogiveyouhands-onexperiencewithOpenFlow,andhowitiscanbeusedforNFV
deployment.Usingabasictopology,whichcontainstwosources,adestination,twovirtual
networkfunctions(IDS),anOVSandaController,wewillshowhowdifferentOpenFlowrules
canbeusedforNFVmanagement.
Network Sliver
Controller Sliver
GENI tesbed
Figure1:Theimageabovedepictsthenetworktopologyusedinthistutorial.
1
Pre-requisites:
•
•
•
•
•
•
•
AGENIaccount,ifyoudon'thaveonesignup!
FamiliaritywithhowtoreserveGENIresources.(wewillbeusingGENIExperimenterPortal
asourtool).
FamiliaritywithloggingintoGENIcomputeresources.
BasicunderstandingofOpenFlow.OpenFlowtutorialhere!
FamiliaritywiththeUnixCommandline.
FamiliaritywiththePythonprogramminglanguage.Wewilluseacontroller(POX
Controller)writteninPythonforthistutorial.
Youwillneedtobeinaproject.
Tools:
•
•
OpenvSwitch.
POXcontroller.
Bothofthetoolsarealreadyinstalledonthemachineswheretheresourcesare
provided.Ifithappensnottobeinstalled,takealookatthefollowingtutorialsto
learnhowtoinstallthesetools:
OpenVswitch:clickherefortutorial.
POXcontroller:clickherefortutorial.
Wheretogethelp:
-POXWiki
-OpenVSwitch
-GENIWiki
2
TutorialInstructions
Part1:Design/Setup
•
•
•
Designtheexperiment
Establishtheenvironment
ObtainResources
Part2:Execute
•
•
•
LogintoVMs
Configureandinitializeservices
ExecuteExperiment
Part3:Finish
•
•
TeardownExperiment
ReleaseResources
3
1. DesigntheExperiment
Thebasictopologyofthetutorialisshownabove.Wehavetwosourcesthatwillcommunicate
with the destination connected via OVS. We have two VMs (VNF1 and VNF2) running Snort
IntrusionDetectionSystems(IDS),asVirtualNetworkFunctions(VNF).Inthistutorial,wewill
putforwardingrulesinOVSusingcontrollersuchthatwheneversourcewantstocommunicate
withdestination,thecopyofthepacketsgoestooneoftheIDS.
Iperf will be run as an application and we will see the impact of load balancing on the
performanceofthenetworkapplications.
WewillbeusingSnortIDSasanexampleforVNF.YoucanuseanyotherNetworkFunctions
insteadofIDSe.g.Firewall,CacheProxyServeretc.
4
2. EstablishtheEnvironment
2.1. Pre-work:
Skipthissectionifyouhavealreadyestablishedyourenvironmentforyourproject.
•
EnsureSSHkeysaresetup.IfyourSSHkeysarenotsetupbefore,dothefollowing
steps:
§ GenerateanSSHPrivateKeyontheProfilepageontheGENIportal
§ DownloadPrivateKeyto~/Downloads
§ Openterminalandexecute
$mv~/Downloads/id_geni_ssh_rsa~/.ssh/.
$chmod0600~/.ssh/id_geni_ssh_rsa
$ssh-add~/.ssh/id_geni_ssh_rsa
•
Ensureyouarepartofaproject.
3. ObtainResources
Forthistutorial,youcanuseresourcesformanyaggregateinGENI.Youmaychoosetheone
thatpleasesyoubetter.Theexperimentwillneedfollowing
1XenVMasOpenFlowcontrollerwithapublicIP(controller)
1XenVMtobetheOpenFlowswitch(OVS)
3XenVMs,twoSourcesandoneDestination(S1,S2anddestination)
2XenVMsasVirtualNetworkFunctions(VNF1andVNF2)
Wewillneedtwoslicesforthistutorial:
•
•
•
•
1.SliceforOpenFlowcontroller.
2.SliceforNetworkTopologyconsistingofsource,destination,IDSandOVS.
Toreserveresources,useGENIportal.
3.1. Controller:
• Opentheslicethatwillrunopenflowcontroller.ReserveaVMrunningthe
controllerusingtheRSpecthatisavailableintheportalcalledXENVMPOXCtrl.
Thisisshowninthepicturebelow.
5
•
Choseanyaggregateandreserveresourcesforcontroller.YouwillhavecontrollerVMas
shownbelow
6
3.2. NetworkTopology:
Createanewslice‘Network’forNetworkTopology.Thistopologywillconsistoftwosources,a
destination,anOVSandtwoVNFs.Usetherspecgivenbelowtoreserveresourcesfor
‘Network’slice.
http://cs-people.bu.edu/nabeel/files/Network_with_NFVimage.xml
ChoseanyaggregateandreserveresourcesforNetwork.YouwillhavenetworktopologyVM
asshownbelow
3.3. ConfigureandInitialize:
AlthoughOVSisinstalledonthehostandthatismeanttoactasasoftwareswitch,itstill
needstobeconfigured.Therearetwothingsthatneedtobeconfigured:
(1)configureyoursoftwareswitchwiththeinterfacesasportsand
(2)pointtheswitchtoanOpenFlowcontroller.
3.3.1.ConfiguretheSoftwareSwitch(OVSWindow):
1. LogintotheOVShost
2. CreateanEthernetbridgethatwillactasoursoftwareswitch:
sudoovs-vsctladd-brbr0
3. PreparetheinterfacestobeaddedasportstotheOVSswitch
YourOVSbridgewillbeaLayer2switchandyourportsdonotneedIPaddresses.
Beforeweremovethemlet'skeepsomeinformation
• Runifconfigonovsnode
• Writedowntheinterfacenamesthatcorrespondtotheconnectionstoyour
VNF1andVNF2hosts.Thecorrespondenceis
o InterfacewithIP10.10.1.13toVNF1-ethX
o InterfacewithIP10.10.1.14toVNF2–ethY
Makesureyouhavenotedthenamesofinterfacebeforeyouproceed.Wewill
needtheinterfacenamestorunexperiments.
7
4. PreparetheinterfacestobeaddedasportstotheOVSswitch.
o YourOVSbridgewillbeaLayer2switchandyourportsdonotneedIPaddresses.
RemovetheIPfromyourdatainterface.
sudoifconfigeth10
sudoifconfigeth20
sudoifconfigeth30
sudoifconfigeth40
sudoifconfigeth50
Becarefulnottobringdowneth0.Thisisthecontrolinterface,ifyoubringthat
interfacedownyouwon'tbeabletologintoyourhost.Forallinterfacesotherthan
eth0andl0,removetheIPfromtheinterfaces(yourinterfacenamesmayvary):
Addallthedatainterfacestoyourswitch(bridge):Becarefulnottoaddinterfaceeth0.Thisis
thecontrolinterface.Theotherfourinterfacesareyourdatainterfaces.(Usethesame
interfacesasyouusedinthepreviousstep).
sudoovs-vsctladd-portbr0eth1
sudoovs-vsctladd-portbr0eth2
sudoovs-vsctladd-portbr0eth3
sudoovs-vsctladd-portbr0eth4
sudoovs-vsctladd-portbr0eth5
Nowthesoftwareswitchisconfigured!Toverifythefourportsconfiguredrun:
sudoovs-vsctllist-portsbr0
3.3.2.Pointyourswitchtoacontroller
AnOpenFlowswitchwillnotforwardanypacketunlessinstructedbya
controller.Basicallytheforwardingtableisempty,untilanexternalcontroller
insertsforwardingrules.TheOpenFlowcontrollercommunicateswiththe
switchoverthecontrolnetworkanditcanbeanywhereintheInternetaslong
asitisreachablebytheOVShost.
1. Logintoyourcontroller
2. FindthecontrolinterfaceIPofyourcontroller,useifconfigandnotedowntheIP
addressofeth0.
3. InordertopointoursoftwareOpenFlowswitchtothecontroller,in
theovsterminalwindow,run:
sudoovs-vsctlset-controllerbr0tcp:<controller_ip>:6633
4. Setyourswitchtofail-safe-mode.Formoreinforeadthestandalonevssecuremode
section.Run:
sudoovs-vsctlset-fail-modebr0secure
5. Trustbutverify.YoucanverifyyourOVSsettingsbyissuingthefollowing:
sudoovs-vsctlshow
8
StandalonevsSecuremode
TheOpenFlowcontrollerisresponsibleforsettingupallflowsontheswitch,
whichmeansthatwhenthecontrollerisnotrunningthereshouldbenopacket
switchingatall.Dependingonthesetupofyournetwork,suchabehaviormightnotbedesired.
Itmightbebestthatwhenthecontrollerisdown,theswitchshoulddefaultbacktobeinga
learninglayer2switch.Inothercircumstanceshoweverthismightbeundesirable.InOVSthisis
atunableparameter,calledfail-safe-modewhichcanbesettothefollowingparameters:
•
standalone[default]:inthiscaseOVSwilltakeresponsibilityforforwardingthepackets
ifthecontrollerfails
•
secure:inthiscaseonlythecontrollerisresponsibleforforwardingpackets,andifthe
controllerisdownallpacketsaredropped.
InOVSwhentheparameterisnotsetitfallsbacktothestandalonemode.Forthepurposeof
thistutorialwewillsetthefail-safe-modetosecure,sincewewanttobetheonescontrolling
theforwarding.
9
First thing we are doing in the experiment is pinging the VMs. By now, our switch is already
configured, so we start working on the controller. As mentioned earlier, we are using POX
controlleranditisalreadyinstalledonthecontrollerhost.
1. Logintothehosts
Weneedtosshtoallourhosts.Again,ifyoudon’tknowhowtologinintoanode,clickhereto
learn.
Openthefollowingwindows:
onewindowwithsshintothecontroller
onewindowwithsshintoOVS
onewindowwithsshintos1
onewindowwithsshintoVNF1
onewindowwithsshintoVNF2
onewindowwithsshintodestination
2. ConfigureandInitializeservices
•
•
•
•
•
•
2.1. UseLearningSwitchController
Thisisaverysimpleexamplewherewearegoingtorunalearningswitchcontroltoforward
trafficfroms1toVNF1.
1. Firststartapingfroms1toVNF1,whichshouldtimeout,sincethereisno
controllerrunning.
pingvnf1-c10
2. ThePOXcontrollerisinstalledunder/tmp/poxonthecontrollerhost.POX
comeswithasetofexamplemodulesthatyoucanuse.Oneofthemodulesisa
learningswitch.Startthelearningswitchcontrollerwhichisalreadyavailableby
runningthefollowingtwocommands:
cd/tmp/pox
pythonpox.py--verboseforwarding.l2_learning
“l2”belowusestheletter‘l’asinlevelandisnotthenumberone.Inaddition,you
shouldwaitforthe'''INFO...connected'''linetoensurethattheswitchandthe
controllerarecommunicating.
10
Theoutputshouldlooklikethis:
3. Intheterminalofs1,pingVNF1:
Nowthepingshouldworkandtheoutputshouldlooklikethis
4. Gotoyourcontrollerhostandtakealookattheprintouts.Youshouldseethat
yourcontrollerinstalledflowsbasedonthemacaddressesofyourpackets.
2.2NFVOVScontroller
NowwearegoingtorunadifferentcontrollerwithopenflowrulestosupportNFV.Inthis
controller,thetrafficshallgofromsourcetodestination,andduplicatepacketsaresenttoIDS
nodes(VNF1orVNF2)forIntrusiondetection.Picturebelowshowstrafficbetweensource1
anddestinationisredline,andthegreenlineshowstheduplicatetrafficthatissendtoVNF1
forintrusiondetection.
11
3. ExecuteExperiments:
FirstweneedtoconfiguretheconfigurationfilesfortheNFVopenflowcontroller.
o Wewillfirstremovethedefaultfilesforcontrollerandreplacethemwithour
controllerfiles.Executefollowing
cd/tmp/pox/ext
sudochmod777../ext/
sudorm*
wgethttp://cs-people.bu.edu/nabeel/files/OVS_files.tar.gz
tar-xvfOVS_files.tar.gz
o NowyoushouldhavedifferentfilesforOVScontroller.Openport.configfile
toconfigurethesystemparameters.Youcanuseanyeditortoeditthefile.I
amusingnanohereasanexample.
nanoport.config
o Youwillseeawindowasshownbelow.Changethevalueofvnf1_interface
andvnf2_interfacetothevaluesthatyounoteddowninsection3.3.1in
Design/Setupsectionofthistutorial.Thesevalueswilltellcontrollerthe
interfacethatisconnectedwithVNF1andVNF2.Exampleisshownbelow
12
Experiment1:LoadBalancingusingRoundRobinloadbalancer
Inthefirstexperiment,wewilllookatRoundRobinloadbalancerforVNFSnortapplications.
SnortwillberunningasIDSonVNF1andVNF2andwewilltrytobalancetheloadacrossVNF
bydirectingeachnewflowrequesttooneofthetwoVNFinstancesinaroundrobinfashion.
WewilluseNetcatapplicationtogeneratetrafficbetweensourceanddestination.
Netcat is a useful application for network debugging and investigation. It is used for reading
fromandwritingtonetworkconnectionsusingTCPorUDP.Inotherwords,itisliketalkingon
thephone.Onetalks(anode)andanotherone,ontheotherside,listensandtalksback.Using
netcat,youcanseethecommunicationbetweensourceanddestination.
1. Opencontrollerwindowandexecute
cd/tmp/pox/ext
nanoport.config
Herechangethecontroller_typetoRRasshownbelow
2. RunNFVcontrollerincontrollerwindow
cd/tmp/pox/
pythonpox.py--verboseNFV_controller
3. OpenVNF1andVNF2windowsandrunSnortIDSoneachoftheVNFsasshownbelow
sudo/usr/local/bin/snort-Aconsole-v-c/-ieth1
YoushouldseethewindowasshownbelowonVNF1andVNF2windows
4. Inthedestinationwindow,runnetcatserver
nc-u-l5000
5. Inthes1window,runnetcatclienttosendtraffictodestinationnode
nc-udestination5000
6. Typesomethingons1windowandyoushouldseeitondestinationwindow.
NowifyoulookatVNF1andVNF2windowsrunningSnortIDS,youcouldsee
packetsarrivingatVNF1andVNF2nodeinRoundRobinfashion.Exampleofsuch
anoutputisshownbelowonVNFwindowrunningSnortIDS.
13
Inthecontrollerwindow,youcanseethatcontrollerchosesVNF1andVNF2is
RoundRobinfashionasshownbelow
OPTIONAL:ReviewOVScontrollerCode:
RoundRobincodeisbasedonfollowingalgorithm.
IfyouwanttoseethecodeforRoundRobinloadbalancer,youcanseeitbyexecuting
cd/tmp/pox/ext
catNFV_controller.py
YoucanseecodeforRoundRobinbelow
HereifVNFselectedforpreviousflowwasVNF1,VNF2isselectedasVNFfornextflowand
viceversa.OnceVNFisselected,packetsaresenttotheVNFbyfollowingcode
14
15
Experiment2:LoadBalancingusingProportionalIntegral(PI)loadbalancer
In this experiment, we will use control theoretic approach to do load balancing. System
overviewisshowninthefigure2.
VNF1
SNORT IDS
RINA Network
RINA App
RIB
controller
DAF
CDAP
RINA App
RIB
Load
Balancer
IDS load info
OVS
controller
OF rules
load balancing info
RIB
RINA App
VNF2
SNORT IDS
Figure2:Overviewofthesystem.
In the control theoretic approach, load on the VNF1 and VNF2 is monitored, and flowforwardingdecisionsaremadebasedontheloadinformationretrievedfromtheVMs.
We will run RINA distributed application to get the state of the VNFs to the controller VM.
Once controller has the IDS load information, it will use the Proportional Integral (PI) load
balancertobalancetheloadacrossVNFsbasedontheloadinformation.Thisloadbalancing
informationinthenfurtherprovidedtotheOVScontroller,whichupdatestheopenflowrules
ontheOVSswitchtobalancetheload.
16
RINADistributedApplication:
FirstwewillrunRINAdistributedapplicationtocollecttheVNFloadinformationonthe
controllernode.
WeneedjavainstalledonthenodestorunRINAapplication.InstalljavaonVNF1,
VNF2andcontrollernode.Toinstalljava,execute
sudoapt-getinstallopenjdk-7-jdk
1. Inthecontrollerwindow,downloadRINAcodeusingfollowingcommandtodownload
RINAcontrollercode.
cd~
wgethttp://cs-people.bu.edu/nabeel/files/Control.tar.gz
tar-xvfControl.tar.gz
2. TypeifconfigtogettheIPaddressonthecontroller.Savethisaddressaswewillneedthis
addresstodirectVNFRINAprocessestocontrollerRINAprocess.
3. InanewVNF1window,downloadRINAcodeusingfollowingcommandstogetRINAVNF1
code.
cd~
wgethttp://cs-people.bu.edu/nabeel/files/VNF1.tar.gz
tar-xvfVNF1.tar.gz
4. InanewVNF2window,downloadRINAcodeusingfollowingcommandstogetRINAVNF2
code.
cd~
wgethttp://cs-people.bu.edu/nabeel/files/VNF2.tar.gz
tar-xvfVNF2.tar.gz
5. NowwewillchangetheIPaddressintheconfigurationfilesonVNF1,VNF2andController
RINAapplications,sotheycantalktoeachother.
IntheVNF1window,execute
cd~/VNF1
nanoipcVNF1.properties
Atthebottomofthefile,changetherina.dns.nameandrina.idd.nametotheIPaddress
ofthecontroller.Followingisshownasanexample.
IntheVNF2window,execute
cd~/VNF2
nanoipcVNF2.properties
Atthebottomofthefile,againchangetherina.dns.nameandrina.idd.nametotheIP
addressofthecontroller.
Inthecontrollerwindow,execute
cd~/Control/RINA/
nanoipcControl.properties
Atthebottomofthefile,againchangetherina.dns.nameandrina.idd.nametotheIP
addressofthecontroller.
17
6. TorunRINAapplication,dofollowingsteps.
o Inthecontrollerwindow,executefollowingcommands
cd~/Control/RINA/
./run_controller.sh
o IntheVNF1window,executefollowingcommands
cd~/VNF1/
./run_VNF1.sh
o IntheVNF2window,executefollowingcommands
cd~/VNF2/
./run_VNF2.sh
Youshouldseeoutputonthecontrollerwindowasshownbelow
RINAapplicationonVNF1andVNF2shouldberunassoonaspossibleafter
ControllerRINAapplicationisstarted.Ifyouwaitfortoolong,youwillgetnull
valuesforCPUusages,asVNF’sRINAappisnotabletoregisterwithcontroller’s
RINAapp.
IfyouseeoutputoncontrollerRINAappwithnullvalues,itmeansthatVNFhasnotbeenable
tosuccessfullyregisterwithRINAapplication.YoushouldrestartallRINAprocesses.Sample
outputwhereVNF2isnotabletoregisterwithcontrollerRINAappisshownbelow
TostopallRINAprocessesrunningonaVM,runkillall-vjava
18
PIcontroller:
PI-controllergetstheloadinformationofNFV1andNFV2usingRINAdistributedapplication
andmakestheloadbalancingdecision.
TheblockdiagramoftheProportionalIntegral(PI)controlledNFVsystemisshowninFigure3.
Figure3:BlockdiagramofthePI-controllerNFVsystem.SystemloadLandtargetloadT(s)=T/sofVNF1isusedto
computeX,i.e.ratiooftrafficdivertedtoVNF2.K'=K/T.
TheRINA-baseddistributedmonitoringapplicationprovidestheVNF1state(averageCPUload)
informationL(t)tothePIcontroller.ThemaximumcapacityofaVNFinstanceisT.Iftheload
onVNF1exceedsT,newtrafficflowsareforwardedtoasecondVNFinstance,VNF2.Assuming
instantaneousfeedback/measuredloadL(t),thePIcontrolequationisgivenby:
CodeforPIcontrollerisbasedonfollowingalgorithm.InputIDSload.txtisthefilegeneratedby
RINAdistributedapplication.ThisfilehasloadinformationofVNF.
1. TorunPI-controller,openanewcontrollerwindowandexecute
cd~Control/PI_controller
pythonPI_controller.py~/Control/RINA/NFV1.txt
NotethatherewearedirectingPI_controller.pytotheNFV1.txtfilethatis
constantlyupdatedbytheRINAdistributedapplicationwiththeloadinformation
ofVNFs.
2. YoushouldseetheVNFstateinformationprintedonthescreen.Sampleoutputis
shownbelow.
19
Heretargetloadis30.0%ofCPUusagei.e.ifCPUloadonVNF1ismorethan30.0%,
trafficwillbedivertedonVNF2.
CurrentCPUloadshowstheloadonVNF1.
NextvalueshowsthepercentageofflowsthatwillbedirectedtoVNF2andlast
valueshowstheflowsthatwerebeingdirectedtoVNF2beforethecurrent
reading.
20
PI-basedOVScontroller:
NowwewillrunOVScontrollerthatwillgettheloadinformationfromthePI-controllerand
directtheflowsaccordingly.
1. Firstwewillupdatetheport.configfiletodirectcontrollertotheNFV_ratio_PI.txt
filegeneratedbythePI-controller,whichhastheloadbalancinginformation.Ina
newcontrollerwindow,execute
cd/tmp/pox/ext
nanoport.config
Changethevalueoffile_path_pito/tmp/pox/ext/NFV_ratio_PI.txtand
controller_typetoPIasshownbelow.
2. NowwecanruntheOVScontroller.Execute
cd/tmp/pox
pythonpox.py--verboseNFV_controller
RunSnortandGenerateTraffic:
1. FirstwewillrunSnortIDSonVNF1andVNF2.InseparatewindowsforVNF1and
VNF2,executefollowingcommand
sudo/usr/local/bin/snort-Aconsole-v-c/-ieth1
YoushouldseethewindowasshownbelowonVNF1andVNF2windows
2. Wewillusesnortapplicationtogenerateflowsbetweensourceanddestination.If
iperfisnotinstalledonyournodes,execute
sudoapt-getinstalliperf
3. Runiperfserverondestinationnode
iperf–s
4. Nowwewillgeneratetrafficfromsource(s1ands2)todestinationnodeusingiperf
andseehowiteffectstheCPUutilizationatVNF1andVNF2runningSnortIDS.
Notethatifwerunmultipleinstancesofiperf,wecangeneratesignificantloadon
VNFinstances.Toruniperfclientonsource,execute
iperf-cdestination-t500&
Notethatyoucanrunmultipleinstancesofiperfbyrunningiperf-c
destination-t500&multipletimeins1ands2nodes.Thisflowlastsfor500
seconds.Tokillalltheflowsgeneratedatanode,runkillall–viperf
21
5. Nowifyoulookatcontrollerwindow,whichisrunningPI-controller,youcansee
theloadonVNF1hassignificantlyincreased.Iftheloadismorethan30%,some
percentageoftrafficwillbedivertedtoVNF2.Sampleoutputisshownbelow
Optional:CodeReview:NFVControllergetstheloadbalancinginformationfrom
theoutputtextfilegeneratedbyPI-controller.Basedonvalueoffiles(variableX),it
sendseachnewflowtoeitherVNF1orVNF2.AlgorithmforPI-basedOVScontrollerisshown
below
Codesectioncanbefoundinthefile/tmp/pox/ext/NFV_controller.pyasshownbelow
22
TeardownExperimentandReleaseResources:
Afteryouaredonewiththisexperimentreleaseyourresources.IntheGENIPortalselectthe
sliceclickonthe"Delete"button.Ifyouhaveusedothertoolstorunthisexperimentthan
releaseresourcesasdescribedinthePrerequisitesforTutorialsonreservationtoolspages.
Nowyoucanstartdesigningandrunningyourownexperiments!
Sources:
SomepartsofthistutorialaretakenfromGENIOpenFlowTutorial:
http://groups.geni.net/geni/wiki/GENIExperimenter/Tutorials/OpenFlowOVS
Createdby:NabeelAkhtar
23