1. Workshop on Software Defined Networks Spring 2014

2. Groups group idgroup membersex1 last sub.project nameproject sel. date 1Liza Mash, Kostya Berestizhevsky, Idan Shaby17.4.14Firewall30.4 2 רועי לוי, רועי כהן, חוסאם אבו מערוף 3.5.14firewall4.5 3 שי פינסקר, בועז חמו, מוריה אהרון 13.4.14 4Or Keret, Ofir Shohet, Gal Bitensky17.4.14 5Nir Avnon, Chen Shoval, Roi Klien18.4.14 6Ori Lentzitzky, Guy Engel1.5.14 7 ירדן מרטון, בן שרפי 4.5.14 8Elad levi, Hanan Rofe Haim4.5.14 9Roy Moyal, Liraz Segal5.5.14Load Balancer5.5 10Michal Shagam, Dekel ?8.5.14

3. OpenFlow Switch Specification Flow-Table entry: Possible Actions: – Forward packet to a given port (or ports) – Encapsulate packet and forward to controller – Drop packet Packet Header Action Statistics

4. OpenFlow Switch Specification The header fields matched in OpenFlow switch (Type0): Support for normal traffic is achieved by: – A 4 th action; forward packet through normal pipeline – Dedicated VLANs

5. OpenFlow1.3 Specification A pipeline of forwarding tables: – Aggregated Action Set – Internal metadata – optional group classification

6. OpenFlow1.3 Specification Extended match header fields:

7. OpenFlow1.3 Specification Extended match header fields:

8. OpenFlow1.3 Specification Counters:

9. OpenFlow1.3 Specification Each packet carries an Action set. – Empty at the start – Updated while packet is processed – Executed at the end. Each Forwarding table entry is associated with an Instruction Set – Predefined (updated by controller) – Executed when entry is matched – Influences packet processing course and updates its action set. More actions: – Update TTL – Tag push – Tag pop – Set field – QoS

10. OpenFlow1.3 Groups Groups can be applied on a packet while processed Groups are defined in the group table Group ID Bucket Group ID Instruction Out port

11. OpenFlow1.3 and RYU http://osrg.github.io/ryu-book/en/html/index.html http://sdnhub.org/tutorials/openflow-1-3/

12. PROJECTS

13. Router User input: – Routers addresses – Subnets assignments MAC: A 10.0.0.* Port:1 VLAN: 3 192.168.*.* Port:2 VLAN: * MAC: B 10.0.0.* Port:1 VLAN: 3 MAC: D MAC: C MAC: E

14. Router Network input: – Links MAC: A 10.0.0.* Port:1 VLAN: 3 192.168.*.* Port:2 VLAN: * MAC: B 10.0.0.* Port:1 VLAN: 3 MAC: D MAC: C MAC: E Port:3 VLAN: 4 Port:2 VLAN: 4

15. Router Objective: – Shortest path routes MAC: A 10.0.0.* Port:1 VLAN: 3 192.168.*.* Port:2 VLAN: * MAC: B 10.0.0.* Port:1 VLAN: 3 MAC: D MAC: C MAC: E Port:3 VLAN: 4 Port:2 VLAN: 4

16. Load balancer Split clients to servers ActionEndStart Server r361.26.188.550.0.0.0 Server r161.37.255.061.26.188. 56 Server r293.2.100.5061.37.255.1 Drop127.0.64.4093.2.100.51 ……………….. Source IP Address replicas Internet …

17. Load balancer Avoid rule expansion ActionEndStart Server A125.37.255.0125.26.188. 56 Server B126.2.100.50125.37.255.1 ActionPattern Server A 125.26.188. [00111***] Server A 125.26.188. [*1******] Server A 125.26.188. [10******] Server A 125. [00011011].*.* Server A 125. [000111**].*.* Server A 125. [001000**].*.* Server A 125.[00100100].*.* Server A 125.[00100101]. 255.0 Server B 125.[00100101]. 255.* Server A 125.[00100101]. *.* Server B 125.[001*****].*.* Server B 126. 1.*.* Server B 126. 2. [00******].* Server B 126. 2. [010*****].* Server B 126. 2. [011000**].* Server B 126. 2. 100.[0010****] Server B 126. 2. 100.[00110001] Server B 126. 2. 100.[00110010]

18. Load balancer Add/remove servers when needed Source IP Address replicas Internet …

19. Firewall Manage sessions Internet Intranet DMZ ActionConstraints Allow Allow + Log

20. Firewall Consider rule expansion ActionEndStart Server A125.37.255.0125.26.188. 56 Server B126.2.100.50125.37.255.1 ActionPattern Server A 125.26.188. [00111***] Server A 125.26.188. [*1******] Server A 125.26.188. [10******] Server A 125. [00011011].*.* Server A 125. [000111**].*.* Server A 125. [001000**].*.* Server A 125.[00100100].*.* Server A 125.[00100101]. 255.0 Server B 125.[00100101]. 255.* Server A 125.[00100101]. *.* Server B 125.[001*****].*.* Server B 126. 1.*.* Server B 126. 2. [00******].* Server B 126. 2. [010*****].* Server B 126. 2. [011000**].* Server B 126. 2. 100.[0010****] Server B 126. 2. 100.[00110001] Server B 126. 2. 100.[00110010]

21. Firewall Manage sessions Features: – Actions are Allow, Allow+Log, Block, Block+Log – Statefull – Consistency models (per flow/packet) – FIN detection Internet Intranet DMZ

22. Multicast Traffic

23. Input – Routers – Links – User location and request – Link and server cost Objective – Route streams (optimally) – Assign servers (optimally)

24. Distributed controller

25. Controller state is saved in distributed storage. Handling an event is a transaction. Prevent dead-locks and live-locks. Use a simple application as an example. Based on paper “Towards an Elastic Distributed SDN Controller” by Dixit et. al. appeared in HotSDN2013.

26. Hierarchical controller controller Sub SDN controller

27. Hierarchical controller controller Sub SDN controller

28. Fault tolerant SDN Without the controller, an OpenFlow switch forwards packets according to: – Static configuration – Links status – Packet header – Input port We want to ensure that if the network is physically connected then any packet will reach its destination (eventually). We prefer one instance of the packet at all time (without broadcast).

29. Fault tolerant SDN Non Fault tolerant solutions: – Source and destination based rules – Port based rules Our approach: – Use packet header for storing state Algorithms: – Module (Naïve) – DFS – BFS (very complicated)

30. Module Algorithm

31. DFS Algorithm