OpenFlow/SDN tutorial
OFC/NFOEC
March, 2012
Srini Seetharaman
Deutsche Telekom
Silicon Valley Innovation Center
1
Why OpenFlow?
3
The Ossified Network
Routing, management, mobility management,
access control, VPNs, …
Feature
Feature
Operating
System
Specialized Packet
Forwarding Hardware
Million of lines
of source code
6000+ RFCs
Barrier to entry
Billions of gates
Bloated
Power Hungry
Many complex functions baked into the infrastructure
OSPF, BGP, multicast, differentiated services,
Traffic Engineering, NAT, firewalls, MPLS, redundant layers, …
An industry with a “mainframe-mentality”, reluctant to change
4
Open Systems
Performance Scale
Fidelity
Real User
Traffic?
Complexity
Open
Simulation
medium
medium
no
medium
yes
Emulation
medium
low
no
medium
yes
Software
Switches
poor
low
yes
medium
yes
NetFPGA
high
low
yes
high
yes
Network
Processors
high
medium
yes
high
yes
Vendor
Switches
high
high
yes
low
no
gap in the tool space
none have all the desired attributes!
5
Current Internet
Closed to Innovations in the Infrastructure
Closed
App
App
App
Operating
System
App
Specialized Packet
Forwarding Hardware
App
App
App
App
Operating
System
Specialized Packet
Forwarding Hardware
App
Operating
System
App
Specialized Packet
Forwarding Hardware
App
App
Operating
System
App
App
App
Specialized Packet
Forwarding Hardware
Operating
System
Specialized Packet
Forwarding Hardware
6
“Software Defined Networking” approach
to open it
App
App
App
Network Operating System
App
App
App
Operating
System
App
Specialized Packet
Forwarding Hardware
App
App
App
App
Operating
System
Specialized Packet
Forwarding Hardware
App
Operating
System
App
Specialized Packet
Forwarding Hardware
App
App
Operating
System
App
App
App
Operating
System
Specialized Packet
Forwarding Hardware
Specialized Packet
Forwarding Hardware
The “Software-defined Network”
2. At least one good operating system
Extensible, possibly open-source
3. Well-defined open API
App
App
App
Network Operating System
1. Open interface to hardware
Simple Packet
Forwarding
Hardware
Simple Packet
Forwarding
Hardware
Simple Packet
Forwarding
Hardware
Simple Packet
Forwarding
Hardware
Simple Packet
Forwarding
Hardware
How does OpenFlow work?
9
Ethernet Switch
10
Control Path (Software)
Data Path (Hardware)
11
OpenFlow Controller
OpenFlow Protocol (SSL/TCP)
Control Path
OpenFlow
Data Path (Hardware)
12
OpenFlow Example
Software
Layer
Controller
PC
OpenFlow Client
Flow Table
Hardware
Layer
MAC
src
MAC
dst
IP
Src
IP
Dst
TCP
TCP
Action
sport dport
*
*
*
5.6.7.8
*
port 1
5.6.7.8
port 2
*
port 3
port 1
port 4
1.2.3.4
13
OpenFlow usage
Controller
Alice’sSwitch
Rule
OpenFlow
Alice’s code
PC
Decision?
Alice’sSwitch
Rule
OpenFlow
OpenFlow
Protocol
Alice’sSwitch
Rule
OpenFlow
OpenFlow offloads control intelligence to a remote software
OpenFlow Basics
Flow Table Entries
Rule
Action
Stats
Packet + byte counters
1.
2.
3.
4.
5.
Switch VLAN
Port
ID
Forward packet to zero or more ports
Encapsulate and forward to controller
Send to normal processing pipeline
Modify Fields
Any extensions you add!
VLAN MAC
pcp src
MAC
dst
Eth
type
IP
Src
IP
Dst
IP
L4
IP
ToS Prot sport
L4
dport
+ mask what fields to match
15
Examples
Switching
Switch MAC
Port src
*
MAC Eth
dst
type
00:1f:.. *
*
VLAN IP
ID
Src
IP
Dst
IP
Prot
TCP
TCP
Action
sport dport
*
*
*
*
IP
Dst
IP
Prot
TCP
TCP
Action
sport dport
*
*
port6
Flow Switching
Switch MAC
Port src
MAC Eth
dst
type
port3 00:20.. 00:1f.. 0800
VLAN IP
ID
Src
vlan1 1.2.3.4 5.6.7.8
4
17264 80
port6
Firewall
Switch MAC
Port src
*
*
MAC Eth
dst
type
*
*
VLAN IP
ID
Src
IP
Dst
IP
Prot
TCP
TCP
Action
sport dport
*
*
*
*
*
22
drop
16
Examples
Routing
Switch MAC
Port src
*
*
MAC Eth
dst
type
*
*
VLAN IP
ID
Src
IP
Dst
*
5.6.7.8 *
*
VLAN IP
ID
Src
IP
Dst
IP
Prot
vlan1 *
*
*
TCP
TCP
Action
sport dport
port6,
port7,
*
*
port9
*
IP
Prot
TCP
TCP
Action
sport dport
*
port6
VLAN Switching
Switch MAC
Port src
*
*
MAC Eth
dst
type
00:1f.. *
17
OpenFlow: a pragmatic compromise
• + Speed, scale, fidelity of vendor hardware
• + Flexibility and control of software and
simulation
• Vendors don’t need to expose implementation
• Leverages hardware inside most switches
today (ACL tables)
18
Centralized vs Distributed Control
Both models are possible with OpenFlow
Centralized Control
Controller
OpenFlow
Switch
Distributed Control
Controller
OpenFlow
Switch
Controller
OpenFlow
Switch
OpenFlow
Switch
OpenFlow
Switch
Controller
OpenFlow
Switch
19
Flow Routing vs. Aggregation
Both models are possible with OpenFlow
Aggregated
Flow-Based
•
•
•
•
Every flow is individually
set up by controller
Exact-match flow entries
Flow table contains one
entry per flow
Good for fine grain
control, e.g. campus
networks
•
•
•
•
One flow entry covers large
groups of flows
Wildcard flow entries
Flow table contains one
entry per category of flows
Good for large number of
flows, e.g. backbone
20
Reactive vs. Proactive (pre-populated)
Both models are possible with OpenFlow
Reactive
Proactive
•
•
•
•
•
First packet of flow
triggers controller to insert
flow entries
Efficient use of flow table
Every flow incurs small
additional flow setup time
If control connection lost,
switch has limited utility
•
•
•
Controller pre-populates
flow table in switch
Zero additional flow setup
time
Loss of control connection
does not disrupt traffic
Essentially requires
aggregated (wildcard) rules
21
Usage examples
• Alice’s code:
– Simple learning switch
– Per Flow switching
– Network access
control/firewall
– Static “VLANs”
– Her own new routing protocol:
unicast, multicast, multipath
– Home network manager
– Packet processor (in
controller)
– IPvAlice
openflow.org/videos
–
–
–
–
–
VM migration
Server Load balancing
Mobility manager
Power management
Network monitoring
and visualization
– Network debugging
– Network slicing
… and much more you can create!
Topology discovery
• OpenFlow controller view is not always complete. For
instance, what does the controller see here?
OF
switch
X
OF
switch
Non-OF
switch
Y
Host
B
Host
A
Non-OF
switch
Internet
Host
C
Quiz Time
• How do I provide control connectivity? Is it really clean slate?
• Why aren’t users complaining about time to setup flows over
OpenFlow? (Hint: What is the predominant traffic today?)
• Considering switch CPU is the major limit, how can one take
down an OpenFlow network?
• How to perform topology discovery over OpenFlow-enabled
switches?
• What happens when you have a non-OpenFlow switch
inbetween?
• What if there are two islands connected to same controller?
• How scalable is OpenFlow? How does one scale deployments?
24
What can you not do with OpenFlow ver1.1
• Non-flow-based (per-packet) networking
– e.g., Handling pkt 1 differently from pkt 2 of same flow
– yes, this is a fundamental limitation
– BUT OpenFlow provides the plumbing to connect devices
• New forwarding primitives
– BUT provides a nice way to integrate them through extensions
• New packet formats/field definitions
– BUT a generalized OpenFlow (2.0) is on the horizon
• Optical Circuits
– BUT efforts underway to apply OpenFlow model to circuits
• Low-setup-time individual flows
– BUT can push down flows proactively to avoid delays
25
Where is it going?
The Open Networking Foundation:
Textbox Headline
The founding Consortium
Adopter Members (as of Feb 2012)
List of Members:











Promoter Members:
 Operators and service providers
 Make up the board of directors
 Have voting rights
 Representative of DTAG is
Bruno Orth (GTN S&A)








Big Switch Networks
Broadcom
Brocade
Ciena
Cisco
Citrix
Comcast
CompTIA
Cyan
Dell
Elbrys
Ericsson
ETRI
Extreme Networks
EZchip
Force10Networks
Fujitsu
















Hitachi
HP
Huawei
IBM
Infoblox
Intel
IP Infusion
Ixia
Juniper Networks
Korea Telecom
LineRate Systems
LSI
Marvell
Mellanox
Metaswitch Networks
Midokura
NEC
Netgear














Netronome
Nicira Networks
Nokia Siemens
Networks
Plexxi Inc.
Pronto Systems
Radware
Riverbed
Technology
Samsung
Spirent
Tencent
Texas
Instruments
Vello Systems
VMware
ZTE
Corporation
Where it’s going
• OF v1.1: Extensions for WAN
– multiple tables: leverage additional tables
– tags and tunnels
– multipath forwarding
• OF v1.2: Extensible Match structure
– Required fields includes IPv6
27
Where it’s going
• OF v2+
– generalized matching and actions: an “instruction set” for
networking
• Several other working groups have been created:
– Hybrid group: Specifies how OpenFlow can be included
into legacy switches without assuming clean-slate
– Config group: Will specify an independent protocol that
will help configure OpenFlow parameters out-of-band
– .... And more
28
OpenFlow Implementations
(Switch and Controller)
29
Current SDN hardware
Juniper MX-series
NEC IP8800
WiMax (NEC)
HP Procurve 5400
Netgear 7324
PC Engines
Pronto 3240/3290
Ciena Coredirector
More coming soon...
31
Commercial Switch Vendors
Model
Virtualize
Notes
HP Procurve 5400zl or
6600
1 OF
instance
per VLAN
-LACP, VLAN and STP processing
before OpenFlow
-Wildcard rules or non-IP pkts
processed in s/w
-Header rewriting in s/w
-CPU protects mgmt during loop
NEC IP8800
1 OF
instance
per VLAN
-OpenFlow takes precedence
-Most actions processed in
hardware
-MAC header rewriting in h/w
Pronto 3290 or 3780
with Pica8 or Indigo
firmware
1 OF
instance
per switch
-No legacy protocols (like VLAN
and STP)
-Most actions processed in
hardware
-MAC header rewriting in h/w
32
Open-source controllers
Vendor
Notes
Vendor
Notes
Nicira’s
NOX
•GPL
•C++ and Python
Stanford’s
Beacon
•BSD-like license
•Java-based
SNAC
•GPL
•Code based on NOX0.4
•Enterprise network
•C++, Python and Javascript
•Currently used by campuses
Maestro (from
Rice Univ)
•GPL
•Based on Java
NEC’s Trema
•Open-source
•Written in C and Ruby
•Included test harness
33
Virtualizing OpenFlow
34
Trend
App
App
App
Windows
Windows
Windows
(OS)
(OS)
(OS)
Linux
Linux
Linux
App
App
App
Mac
Mac
Mac
OS
OS
OS
Virtualization layer
x86
(Computer)
Computer Industry
Controller11
NOX
Controller
(Network OS)
Controller
Controller
Network
OS
22
Virtualization or “Slicing”
OpenFlow
Network Industry
Isolated “slices”
App
App
Network
Operating
System 1
Many operating systems, or
Many versions
App
App
Network
Operating
System 2
App
App
App
Network
Operating
System 3
App
Network
Operating
System 4
Open interface to hardware
Virtualization or “Slicing” Layer
Open interface to hardware
Simple Packet
Forwarding Hardware
Simple Packet
Forwarding Hardware
Simple Packet
Forwarding Hardware
Simple Packet
Forwarding Hardware
Simple Packet
Forwarding Hardware
36
FlowVisor-based Virtualization
Heidi’s
Controller
Aaron’s
Controller
Craig’s
Controller
Topology
discovery is
per slice
OpenFlow
Protocol
OpenFlow
Switch
OpenFlow FlowVisor
& Policy Control
OpenFlow
Protocol
OpenFlow
Switch
OpenFlow
Switch
38
FlowVisor-based Virtualization
Separation not only
by VLANs, but any
L1-L4 pattern
Multicast
Broadcast
OpenFlow
Protocol
dl_dst=FFFFFFFFFFFF
OpenFlow
Switch
http
Load-balancer
tp_src=80, or
tp_dst=80
OpenFlow
FlowVisor & Policy Control
OpenFlow
Protocol
OpenFlow
Switch
OpenFlow
Switch
39
Use Case: New CDN - Turbo Coral ++
Basic Idea: Build a CDN where you control the entire network
–
–
–
–
All traffic to or from Coral IP space controlled by Experimenter
All other traffic controlled by default routing
Topology is entire network
End hosts are automatically added (no opt-in)
Admin
Researcher
Switch MAC
Port src
MAC Eth
dst
type
VLAN IP
ID
Src
IP
Dst
IP
Prot
TCP
TCP
sport dport
*
*
*
*
*
*
*
*
84.65.* *
*
*
*
*
*
*
84.65.* *
*
*
*
*
*
*
*
*
*
*
*
*
42
OpenFlow/SDN for carriers
43
SDN is a hammer for what nail?
1. Packet and Circuit convergence
• Most service providers own and operate 2
independent networks : IP and Transport
– managed and operated independently
– minimal cross-layer awareness
– resulting in duplication of functions and resources
in multiple layers
– and significant capex and opex burdens
Convergence to reduce costs and provide value-added services.
The Flow Abstraction presents a unifying abstraction
OpenFlow-based unified control plane
• Packet flows
Switch MAC
Port src
MAC Eth
dst
type
VLAN IP
ID
Src
IP
Dst
IP
Prot
TCP
TCP
sport dport
Action
• Circuit flows
– using the cross-connect table in circuit switches
In
Port
VCG Starting Signal
In
Lambda
Time-Slot Type
Out
Port
VCG Starting Signal
Out
Lambda
Time-Slot Type
pac.c
Unified
Control
Plane
Controller
Interface: OpenFlow Protocol
Packet &
Circuit
Switches
Converged Network
Demonstration of pac.c
NOX
OpenFlow Protocol
NEW YORK
SAN
FRANCISCO
GE links
OC-48 links
(2.5 Gbps)
HOUSTON
48
2. Improving IP/MPLS control
• Basic Idea
– Retain MPLS data-plane operations
– Replace IP/MPLS control plane
• Demonstrate TE & its features
• All made simpler – some greatly (eg. AutoRoute)
• Some made possible only with SDN (eg. global-optimization)
TE 2.0
VPNs 2.0
Routing
Optimized
FRR/ AutoBw
Discovery
MPLS-TP
Control
Label
Distribution
NETWORK OPERATING SYSTEM
Multi-layer
Control
Recovery
Summary
• OpenFlow/SDN is evolving to facilitate an ecosystem
for innovation
• OpenFlow is being deployed in over 100
organizations world-wide
– GEC9 in Nov, 2010 showcased nation-wide OF
– Internet 2 and NLR starting to serve as the GENI Backbone
• OpenFlow is essential for Service Providers
– Custom control for Traffic Engineering
– Combined Packet/Circuit switched networks
Are you innovating in your network?
51