Presentation is loading. Please wait.

Presentation is loading. Please wait.

Theophilus Benson, Aditya Akella, David Maltz University Of Wisconsin-Madison, Microsoft Research 1.

Similar presentations


Presentation on theme: "Theophilus Benson, Aditya Akella, David Maltz University Of Wisconsin-Madison, Microsoft Research 1."— Presentation transcript:

1 Theophilus Benson, Aditya Akella, David Maltz University Of Wisconsin-Madison, Microsoft Research 1

2  Access control policies ◦ Restrict communication between end-hosts  Secure network resources 2

3  Implementing policy ◦ Low level command set ◦ Different mechanisms  Global policy is difficult to discover ◦ No documentation access-list access-list 5 permit access-list 5 permit access-list 5 permit route-map I1-Only permit 10 description using access-list 125 match ip address 125 set ip next-hop ip prefix-list campus-routes seq 1 permit /16 ip prefix-list campus-routes seq 3 permit /16 ip prefix-list campus-routes seq 4 permit /16 ip prefix-list campus-routes seq 5 permit / HR Depart.IT Depart. Finance Depart. 3

4  Why discover a network’s policy? ◦ Debug network problems ◦ Guide network redesign 4

5  Manual inspection ◦ Time consuming ◦ Error prone  Extracting reachability sets ◦ Too fined grained ◦ Not human readable NetworksMean file size Univ Univ-2560 Univ Enet-1278 Enet A A B B C C D D E E R(D,C) R(B,C) R(C,C)

6  Solution: policy units ◦ Equivalence class on the reachability profile over the network Host 1Host 2Host 3 Host 4 Host 5 6

7  Background  Motivation  Extracting policy units  Empirical study on 5 networks  Conclusion 7

8  Simulate control plane protocols ◦ Discover shortest paths  Apply data plane restrictions  R 2 reachability sets H F I 8

9  Decompose each RRS into several subnet reachability set ◦ Apply egress and ingress filters  S 2 reachability sets SH SF SI H F I 9

10  Find largest group of addresses with identical reachability profile  Hash each subunit SF SH SI SH SF 10

11  Extract policy units ◦ Policy unit = subunit with same hash  4 policy units from 7 sub units SF SH SI SH SF 11

12 Name# Subnets# Policy Units Univ Univ Univ Enet-1981 Enet Policy units succinctly describe network Two classes of enterprises Policy-lite: simple with few Policy-heavy: complex with many 12

13  4 units cover 70% of end points  Policy-Heavy: Special cases exists ◦ E.g admins, networked appliances Name# Policy Units Univ-12 Univ-22 Univ-315 Enet-11 Enet

14  “Default open”: network ◦ Control plane filters  Verified units with operator 14

15  Dichotomy: ◦ Default-open: data plane filters ◦ Default-closed: data plane & control plane filters 15

16  Described a framework for extracting policy units  Analyzed policies of 5 enterprises  Most users experience the same policy  Network implement few policies 16

17  Questions? 17


Download ppt "Theophilus Benson, Aditya Akella, David Maltz University Of Wisconsin-Madison, Microsoft Research 1."

Similar presentations


Ads by Google