The Middlebox Manifesto: Enabling Innovation in Middlebox Deployment 1 Vyas SekarSylvia RatnasamyMichael ReiterNorbert Egi Guangyu Shi

2 Growing literature on network innovation Build programmable elements using commodity hardware e.g., PacketShader, RouterBricks, ServerSwitch, SwitchBlade Centralized management with open interfaces e.g., 4D, NOX/OpenFlow, RCP

3 Type of applianceNumber Firewalls166 NIDS127 Media gateways110 Load balancers67 Proxies66 VPN gateways45 WAN Optimizers44 Voice gateways11 Total Middleboxes636 Total routers~900 Most innovation today: Middleboxes! Data from a large enterprise: >80K users across tens of sites Just network security ~ 6 billion $ (2010)  10 billion $ (2016)

4 Type of applianceNumber Firewalls166 NIDS127 Media gateways110 Load balancers67 Proxies66 VPN gateways45 WAN Optimizers44 Voice gateways11 Middleboxes are valuable, but have many painpoints 1. Device Sprawl, High CapEx 2. High OpEx e.g., separate management teams need manual tuning 3. Inflexible, difficult to extend  need for new boxes! ? “consumerization”

Most network innovation occurs via middleboxes – Not by changes to routers or switches Suffer similar, and maybe more, pain points – Significant capital and operating expenses – Narrow, closed management interfaces – Difficult to extend Surprisingly MIA in the innovation discussion 5 The Middlebox Manifesto

Most network innovation occurs via middleboxes – Not via routers or switches Suffer almost same, if not more, pain points – Too many of them – Narrow, closed interfaces & difficult to extend – Significant capital and operating expenses Surprisingly MIA in the innovation discussion 6 The Middlebox Manifesto How to build? How to manage?

Our vision: Enabling innovation in middlebox deployments 7 Network-Wide Management 1. Software-centric implementations 2. Consolidated physical platform 3. Logically centralized open management APIs Easy to deploy, extend Reduce sprawl Direct control, expressive

Our vision: Enabling innovation in middlebox deployments 8 Network-Wide Management 1. Software-centric implementations 2. Consolidated physical platform 3. Logically centralized open management APIs Easy to deploy, extend Reduce sprawl Direct control, expressive In a general context, ideas aren’t especially new! But, middleboxes raise new opportunities and challenges

New Efficiency Opportunities “Software-centric”, “extensible” sounds nice.. But, usually very resource inefficient – Compared to “specialized” solutions New efficiency avenues, at least for middleboxes – Multiplexing – Reuse – Spatial distribution 9

Opportunity 1: Multiplexing Benefits 10 Multiplexing benefit = 1 - Peak_Sum / Sum_Peak = 28%

Opportunity 2: Reusing Modules 11 Session Management Protocol Parsers VPN Web Mail IDS Proxy Firewall How much traffic overlap? > 60 % Contribution of reusable modules? 18 – 54 %

New Challenges 12 Network-wide Management Session Protocol Extensible functions Standalone functions Heterogeneity Complex processing Policy constraints

Challenges in Management 13 Network-wide Management Session Protocol Extensible functions Standalone functions Policy dependencies? e.g. IDS < Proxy What is a minimal interface? Is it tractable? e.g., reuse

Challenges in Single-box Design 14 Session Protocol Extensible functions Standalone functions Accelerators? Primitives? Performance, Isolation?

Most network innovation occurs via middleboxes – Little presence in the innovation discussion! Our vision: – Software-based, consolidated – Logically unified, open management APIs New opportunities – Multiplexing, reuse, and spatial distribution Practical challenges: Management + Platform 15 Conclusions

Vision: Enabling innovation in middlebox deployments 16 Network-Wide Management 1.Software-centric implementations e.g., Click 2. Consolidate multiple applications on same physical platform 3. Logically centralized Open management APIs e.g., OpenFlow Easy to deploy, extend Reduce sprawl Direct control, expressive In a general context, ideas aren’t especially new! But, middleboxes raise new opportunities and challenges

Our vision: Enabling innovation in middlebox deployments 17 Network-Wide Management 1. Software-centric implementations 2. Consolidated physical platform 3. Logically centralized open management APIs Easy to deploy, extend Reduce sprawl Direct control, expressive In a general context, ideas aren’t especially new! But, middleboxes raise new opportunities and challenges

Challenges in Management 18 Network-wide Management Session Protocol Extensible functions Standalone functions Policy dependencies? e.g. IDS < Proxy What is a minimal interface? Is it tractable? e.g., reuse

19 Growing literature on network innovation Build programmable elements using commodity hardware e.g., PacketShader, RouterBricks, ServerSwitch, SwitchBlade Centralized management with open interfaces e.g., 4D, NOX/OpenFlow, RCP

Challenges at every Layer 20 Network-wide Management Session Protocol Extensible functions Standalone functions Policy/reuse dependencies? What is the API? Accelerators? Primitives? Performance, isolation?

Outline Motivation High-level approach New opportunities New challenges 21

Pain Point #1: Device Sprawl 22 Inter-site WAN Internet Network Core LAN Mail Web VPN IDS Proxy Data Center DMZ Load Balancers Firewall LAN

Pain Point #2: CapEx/OpEx 23 Type of applianceNumber Firewalls166 NIDS127 Media gateways110 Load balancers67 Proxies66 VPN gateways45 WAN Optimizers44 Voice gateways11 Almost separate teams to manage

Pain Point #3: Lack of interfaces 24 Type of applianceNumber Firewalls166 NIDS127 Media gateways110 Load balancers67 Proxies66 VPN gateways45 WAN Optimizers44 Voice gateways11 Independent vendors Manual customization

Pain Point #4: “Consumerization” 25 Type of applianceNumber Firewalls166 NIDS127 …110 …67 WAN Optimizers44 ? ? ? Difficult to extend “Consumer” devices expected to increase need for in-network functions

Realities of Network Deployments: Innovation via Middleboxes! 26 Web Security +Acceleration WAN optimizer Layer3 Firewall Mail Security + Acceleration IDS/IP S VPN servers Gateway router Market for network security alone ~ 6 billion $ (2010)  10 billion $ (2016)

27 Growing literature on network innovation Build programmable elements using commodity hardware e.g., PacketShader, RouterBricks, ServerSwitch, SwitchBlade

28 Growing literature on network innovation Centralized management with open interfaces e.g., 4D, NOX/OpenFlow, RCP Network-wide Controller

Our vision to address “pain points” Device Sprawl 2. High CapEx, OpEx  separate management teams 3. Lack of high-level interfaces  need manual tuning 4. “Consumerization”  Inflexible, difficult to extend  increases need for new boxes! 1. Software-centric middlebox implementations e.g., Click 2. Consolidate multiple applications on hardware e.g., done in data centers 3. Logically centralized and open, unified management APIs e.g., OpenFlow

30 1. Device Sprawl 2. High CapEx, OpEx  separate management teams 3. Lack of high-level interfaces  need manual tuning 4. “Consumerization”  Inflexible, difficult to extend  increases need for new boxes! 1. Software-centric middlebox implementations e.g., Click 2. Consolidate multiple applications on hardware e.g., done in data centers 3. Logically centralized and open, unified management APIs e.g., OpenFlow In a general context, ideas aren’t especially new! But, middleboxes raise new opportunities and challenges Our proposal to address “pain points”

31 Type of applianceNumber Firewalls166 NIDS127 Media gateways110 Load balancers67 Proxies66 VPN gateways45 WAN Optimizers44 Voice gateways11 Total Middleboxes636 Total routers~900 Market for network security appliances alone ~ 6 billion $ (2010)  10 billion $ (2016) Most actual innovation happens via middleboxes! Reality Check: Middleboxes Galore! But, missing from the “how to innovate” themes

32 Type of applianceNumber Firewalls166 NIDS127 Media gateways110 Load balancers67 Proxies66 VPN gateways45 WAN Optimizers44 Voice gateways11 Total Middleboxes636 Total routers~900 Reality Check: Middleboxes Galore! Data from a large enterprise: >80K users across tens of sites Network security appliances alone: ~ 6 billion $ (2010)  10 billion $ (2016) Most actual innovation happens via middleboxes! ç

New Challenges Why are middleboxes different? – Heterogeneity – Complex processing – Policy constraints Challenges for: – For network management, and – Individual middlebox design 33

New Challenges Why are middleboxes different? – Heterogeneity – Complex processing – Policy constraints Challenges for: – For network management, and – Individual middlebox design 34