1. Virtualized Services Platform
Unconstrained Networking
for the Cloud Era
Wim Henderickx
Director Consulting Engineering/PLM EMEA
@WHenderickx
@nuagenetworks

2. What is all of this about?
Introduction
9/17/2018

3. WHO IS NUAGE NETWORKS
Software Defined Networking solution team of Nokia Networks
Based in Mountain View, California with R&D team focused on removing the network constraints of cloud based IT consumption
Solutions optimized for change but built with robust and well deployed technology foundations

4. Cumbersome, constrained
Dynamicly Automated Services Scorecard
Compute 
Virtualized,
instantly available,
easily consumable
Storage
Infrastructure
Datacenter 
Cumbersome, constrained
& inefficient
Network X ☐

5. For Highly Automated Networks
The Networking Shift
STATIC MANUAL NETWORKS
HIGHLY AUTOMATED NETWORKS ✓ ✓
COMPLEX
CUSTOM
ABSTRACTION
AUTOMATION
The SDN Framework
For Highly Automated Networks
COSTLY
CLOSED
CONTROL
VISIBILITY ✓ ✓

6. Nuage networks - Overlay for network abstraction
Tunnels between Endpoints provide L2 and L3 services
Fully decoupled from HW
Natural fit for Cloud and more
Tunnels “Overlay” the Physical network and provide isolation
Gateway Routers = Overlay Exit point

7. Nuage networks - comprehensive sdn solution
Virtualized Services Platform (VSP)
Virtualized Services Directory (VSD)
Network Policy Engine – abstracts complexity
Service templates and analytics
Virtualized Services Controller (VSC)
SDN Controller, programs the network
Rich routing feature set
Virtualized Cloud Services (VCS)
Virtualized Network Services (VNS)
Virtual Routing & Switching (VRS)
Distributed switch / router – L2-4 rules
Supports leading hypervisors and base metal assets
Virtual (VRS) and Physical (7850 VSG) form-factors
Network Services Gateway (NSG)
Network service platform for branches
L2-L4 Switching and routing with advanced network functions
Physical (7850 NSG) or Virtual form-factors

8. Policy templates and role-based workflow
New Application
Templates
Networking
Network Service Definition
Name: Finance Application
Network Zone 1: Datacenter MEL
Network Zone 2: WAN
App Tier 1: HTTP/Front End
App Tier 2: Oracle/Database
Branch Type: HQ, Regional
Security Profile: Critical
Network Service Definition
Name: Finance Application
Network Zone 1: Datacenter MEL
Network Zone 2: WAN
App Tier 1: HTTP/Front End
App Tier 2: Oracle/Database
Branch Type: HQ, Regional
Security Profile: Medium
Nuage Networks VSP
Network Service Definition
Name: Finance Application
Network Zone 1: Datacenter MEL
Network Zone 2: WAN
App Tier 1: HTTP/Front End
App Tier 2: Oracle/Database
Branch Type: HQ, Regional
Security Profile: Public
Security/ Compliance
00:01
Auto-instantiation
Compute Request completed in Minutes
Policy Instantiation
IP address 10.x.y.z
VLAN configuration
WAN configuration
Security / FW settings
QoS parameters …
IP address
Policy / Security Zones
WAN interconnect
Network Change
Completed automatically
00:01
L2 / L3 Service
Vancouver Datacenter
Service chaining
SERVICE VELOCITY IS NOT HINDERED BY MANUAL NETWORK PROCESS

9. SDN based Network Service
Virtualizing & automating the dc network
Nuage Networks Virtualized Services Platform (VSP)
Virtualized Services Directory (VSD)
Network Policy Engine – abstracts complexity
Service templates and analytics
Virtualized Services Controller (VSC)
SDN Controller, programs the network
Rich routing feature set
Private
Network
(IP-VPN)
SDN based Network Service
Public
Network
(Internet)
Virtual Routing & Switching (VRS)
Distributed switch / router – L2-4 rules
Integration of bare metal assets
Tokyo
Datacenter
Austin
Datacenter

10. Private Data Center - Tokyo Public Data Center - Austin
Seamless networking across datacenters
Virtualized
Services
Directory
Cloud
MANAGEMENT Plane
Virtualized
Services
Controller
Virtualized
Services
Controller
Datacenter
CONTROL Plane
Datacenter
CONTROL Plane
EXISTING NETWORK HARDWARE
WAN
EXISTING NETWORK HARDWARE
WAN
Router
WAN
Router
KVM
KVM
ESXi
ESXi
XEN
XEN
HYPER-V
Datacenter
DATA Plane
Private Data Center - Tokyo
Public Data Center - Austin
Datacenter
DATA Plane

11. Private Data Center - Tokyo Public Data Center - Austin
Seamless virtualized and non-virtualized
Virtualized
Services
Directory
Cloud
MANAGEMENT Plane
Virtualized
Services
Controller
Virtualized
Services
Controller
Datacenter
CONTROL Plane
Datacenter
CONTROL Plane
EXISTING NETWORK HARDWARE
WAN
EXISTING NETWORK HARDWARE
WAN
Router
WAN
Router
KVM
KVM
ESXi
ESXi
XEN
XEN
HYPER-V
(Non-Virtualized)
Datacenter
DATA Plane
Private Data Center - Tokyo
Public Data Center - Austin
Datacenter
DATA Plane

12. Seamless interworking datacenter to wan
Security Policies
Network Polices
Application Templates
Branch Templates
Virtualized
Services
Directory
Cloud Network
MANAGEMENT Plane
Virtualized
Services
Controller
Virtualized
Services
Controller
Virtualized
Services
Controller
Datacenter
CONTROL Plane
Wide Area
CONTROL Plane
IP Network
Ottawa
Singapore
(Non-Virtualized)
Vancouver
New York
Datacenter
DATA Plane
New York
San Francisco
Wide Area
DATA Plane

13. Current networking Architectures in OpenStack
What are we trying to address?
Current networking Architectures in OpenStack
9/17/2018

14. Neutron Datapath on Compute – SDN Insertion
OVS Extension vs. Nuage VRS (inserted on KVM Hypervisors)
TAP Device
Configured by Nova Compute
Linux Bridge
VM1
Tenant A
VM2
Tenant A
VM3
Tenant B
VM1
Tenant A
VM2
Tenant A
VM3
Tenant B
veth pair
eth0
eth0
eth0
eth0
eth0
eth0
Open vSwitch
vneta
ventb
vnetc
Policy Driven Configuration from Nuage VSP
PHY Port
qbra
qbrb
qbrc
qvba
qvbb
qvbc
Configured by Neutron L2 Agent
Tenants will be separated by internal assigned VLANS
VLANS will be mapped egress towards GRE tunnels which are unique by tunnel ID
qvoa
qvob
qvo
tapa
tapb
tapc
br-int
Port VLAN:10
Port VLAN:20
alubr0
patch-tun
br-tun
patch-int
gre
eth0
eth0
GRE Encapsulated
VXLAN Encapsulated
OVS Datapath (supports L2 only)
Nuage Datapath
(supports distributed L2, L3, Floating IP,…)
9/17/2018

15. Compare to Neutron + Nuage = Single Bridge
OVS Datapath
TAP Device
Linux Bridge
VM1
Tenant A
VM2
Tenant A
VM3
Tenant B
VM3
Tenant B
Single OVS Bridge
Is Flow-Based
Performs Firewalling, Switching, Routing, NAT, …
Processes ARP, DHCP LOCALLY
No Dedicated Network Node for
non-DVR case: Routing, DNAT, SNAT, DHCP
DVR case: SNAT, DHCP
veth pair IP IP IP IP
eth0
eth0
eth0
eth0
Open vSwitch
alubr0
VRS
(Single OVS bridge)
vneta
vnetb
vnetc
vnetd
PHY Port
qbra
qbrb
qbrc
qbrd
qvba
qvbb
qvbc
qvbd
qvoa
qvob
qvoc
qvod
br-int
Flow Table entry
int-br-ext
Internal Router
Namespace
qr-f
qr-g
Internal Router
Namespace
qr-h
qr-j
int-br-tun1 IP IP IP IP
DVR AGENT
(Enhanced L3 Agent)
qrouter-y
qrouter-z
qr-f
qr-n
qfloat-x
Floating IP
Namespace
qr-m
qf-n
Ext-IP
Flow Table entry
phy-br-ext
qf-x
int-br-tun1
br-ext
br-tun
eth0
eth1
Public Network
Private Network
9/17/2018

16. Neutron L3 Datapath Optimised with 3rd Party SDN ML2 OVS/Network Node
Compute Node
Compute Node
Compute Node
VM1
Tenant A
VM2
Tenant A
VM1
Tenant A
VM2
Tenant A
VM1
Tenant A
VM2
Tenant A A Q A B C D
Network Node B R
br-ext
router
dhcp
qbr..
qbr.. L K C S N P
alubr0
VXLAN
alubr0 D T M O
br-int
br-int
VXLAN
VXLAN
VXLAN E J
VRS-G Software GW
Hardware GW F I
br-tun
br-tun G H
alubr0
alubr0
ML2 OVS/Network Node
Nuage SDN
9/17/2018

17. Nuage 3rd Party SDN Architecture Differentiation
Neutron requires high Database read and write operations and Messaging (RabbitMQ)
Since there is NO separate control plane, Neutron server has to deal with every compute node without any offload
No database inquiry cache supported for the Database which tremendously increased Database read pressure
SQLAlchemy Database toolkit design in neutron code adds Database pressure and Metadata caching inefficiency
Network Node
L3 Agent
Compute Node
Keepalived
OVS Agent
OVS Agent
Neutron
Server
OVS
OVS
Rabbit MQ
Rabbit MQ
Metadata Proxy
Metadata Agent
My SQL
dnsmasq

18. Nuage Policy Plane The Policy Plane Consistent across HW/SW endpoints
Multicast
Policy Group, Domain, Zone, Subnet
Templates
The Policy Plane Consistent across HW/SW endpoints
Actions: Deny, Allow, Mirror, Redirect
Hierarchical Definitions
Analytics, Hit-Count
Stateful Policy Rules + IP anti-spoof
Route Leaking to underlay, between overlays, dFIP, dSNAT
9/17/2018

19. SDN for a diverse Application World
Its not just the VM and OpenStack anymore, or?
SDN for a diverse Application World
9/17/2018

20. Policy-Driven Virtualized Networking for all Environments
Windows Azure Pack Overview
9/17/2018
Policy-Driven Virtualized Networking for all Environments
Multiple diverse workloads with a common policy
Virtual Services Platform (VSP)
HW VTEP
Physical servers
Virtual Machines
Containers
Public Cloud
OVSDB SW
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. Use Cases: Open Framework VPNaaS FWaaS LBaaS
Cloud Infrastructure Framework
FWaaS
LBaaS
(X)aaS Integration Framework
Hybrid Cloud Connect
VPNaaS
Programmable DataPlane
Use Cases:
Open Framework
9/17/2018

22. Same Automation Workflow
Openstack with nuage networks
Same Automation Workflow

23. Nuage Networks + OpenStack - Vision
Extensive Networking
Distributed Switching, Routing, Firewalling
Local DHCP
Direct breakout options for FIP, SNAT, DHCP Relay, Exit-route
Extensive security policy framework
Granular Security Policy
Analytics through Security Insight
Support for Multicast
Support for BM connectivity through Ironic
Operation-ready
Stable and Scalable
BGP-based control plane, allowing scale-out and vendor inter-op
Simple to operate
Inventory + Dashboard
Single OVS at each HV
Granular Traffic Mirroring
Overlay-Underlay Correlation based on rich Assurance Planform
Open to interwork with other ML2 plugins
Build Hybrid Clouds
Manage all hypervisor types (KVM/HyperV/Xen)
Interop with PaaS and docker technologies
Integration with HW VTEPs, Legacy VLAN or DC Gateways
Connection to public cloud : AWS + Azure

24. THANK YOU
Summary
Nuage Networks is here, delivering real solutions for the Datacenter NOW.
SDVPN – a new type of VPN, optimized for the cloud era
9/17/2018