1. OpenFlow/SDN tutorial OFC/NFOEC March, 2012 Srini Seetharaman Deutsche Telekom Silicon Valley Innovation Center 1

2. Goals of this Tutorial By the end, everyone should know: – why do we need OpenFlow/SDN? – what is it? – how it works? – where it is going? – how will it benefit carriers? 2

3. Why OpenFlow? 3

4. Million of lines of source code 6000+ RFCsBarrier to entry Billions of gates BloatedPower Hungry Many complex functions baked into the infrastructure OSPF, BGP, multicast, differentiated services, Traffic Engineering, NAT, firewalls, MPLS, redundant layers, … An industry with a “mainframe-mentality”, reluctant to change The Ossified Network Specialized Packet Forwarding Hardware Operating System Operating System Feature Routing, management, mobility management, access control, VPNs, … 4

5. Open Systems Performance Fidelity ScaleReal User Traffic? ComplexityOpen Simulationmedium nomediumyes Emulationmediumlownomediumyes Software Switches poorlowyesmediumyes NetFPGAhighlowyeshighyes Network Processors highmediumyeshighyes Vendor Switches high yeslowno gap in the tool space none have all the desired attributes! 5

6. Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware Operating System Operating System Operating System Operating System Operating System Operating System Operating System Operating System Operating System Operating System App 6 Current Internet Closed to Innovations in the Infrastructure Closed

7. Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware App Specialized Packet Forwarding Hardware Operating System Operating System Operating System Operating System Operating System Operating System Operating System Operating System Operating System Operating System App Network Operating System App “Software Defined Networking” approach to open it

8. App Simple Packet Forwarding Hardware App Simple Packet Forwarding Hardware Network Operating System 1. Open interface to hardware 3. Well-defined open API 2. At least one good operating system Extensible, possibly open-source The “Software-defined Network”

9. How does OpenFlow work? 9

10. Ethernet Switch 10

11. Data Path (Hardware) Control Path Control Path (Software) 11

12. Data Path (Hardware) Control Path OpenFlow OpenFlow Controller OpenFlow Protocol (SSL/TCP) 12

13. Controller PC Hardware Layer Software Layer Flow Table MAC src MAC dst IP Src IP Dst TCP sport TCP dport Action OpenFlow Client **5.6.7.8***port 1 port 4port 3 port 2 port 1 1.2.3.45.6.7.8 OpenFlow Example 13

14. Controller PC OpenFlow usage OpenFlow Switch Alice’s code Decision? OpenFlow Protocol Alice’s Rule OpenFlow offloads control intelligence to a remote software

15. OpenFlow Basics Flow Table Entries Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot L4 sport L4 dport RuleActionStats 1.Forward packet to zero or more ports 2.Encapsulate and forward to controller 3.Send to normal processing pipeline 4.Modify Fields 5.Any extensions you add! + mask what fields to match Packet + byte counters 15 VLAN pcp IP ToS

16. Examples Switching * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * 00:1f:.. *******port6 Flow Switching port3 Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action 00:20..00:1f..0800vlan11.2.3.45.6.7.841726480port6 Firewall * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action ********22drop 16

17. Examples Routing * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action *****5.6.7.8***port6 VLAN Switching * Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action ** vlan1 ***** port6, port7, port9 00:1f.. 17

18. OpenFlow: a pragmatic compromise + Speed, scale, fidelity of vendor hardware + Flexibility and control of software and simulation Vendors don’t need to expose implementation Leverages hardware inside most switches today (ACL tables) 18

19. Centralized vs Distributed Control Both models are possible with OpenFlow Centralized Control OpenFlow Switch OpenFlow Switch OpenFlow Switch Controller Distributed Control OpenFlow Switch OpenFlow Switch OpenFlow Switch Controller 19

20. Flow Routing vs. Aggregation Both models are possible with OpenFlow Flow-Based Every flow is individually set up by controller Exact-match flow entries Flow table contains one entry per flow Good for fine grain control, e.g. campus networks Aggregated One flow entry covers large groups of flows Wildcard flow entries Flow table contains one entry per category of flows Good for large number of flows, e.g. backbone 20

21. Reactive vs. Proactive (pre-populated) Both models are possible with OpenFlow Reactive First packet of flow triggers controller to insert flow entries Efficient use of flow table Every flow incurs small additional flow setup time If control connection lost, switch has limited utility Proactive Controller pre-populates flow table in switch Zero additional flow setup time Loss of control connection does not disrupt traffic Essentially requires aggregated (wildcard) rules 21

22. Usage examples Alice’s code: – Simple learning switch – Per Flow switching – Network access control/firewall – Static “VLANs” – Her own new routing protocol: unicast, multicast, multipath – Home network manager – Packet processor (in controller) – IPvAlice – VM migration – Server Load balancing – Mobility manager – Power management – Network monitoring and visualization – Network debugging – Network slicing … and much more you can create! openflow.org/videos

23. Topology discovery OpenFlow controller view is not always complete. For instance, what does the controller see here? Internet Host A X Y Non-OF switch OF switch Host B Host C

24. Quiz Time How do I provide control connectivity? Is it really clean slate? Why aren’t users complaining about time to setup flows over OpenFlow? (Hint: What is the predominant traffic today?) Considering switch CPU is the major limit, how can one take down an OpenFlow network? How to perform topology discovery over OpenFlow-enabled switches? What happens when you have a non-OpenFlow switch inbetween? What if there are two islands connected to same controller? How scalable is OpenFlow? How does one scale deployments? 24

25. What can you not do with OpenFlow ver1.1 Non-flow-based (per-packet) networking – e.g., Handling pkt 1 differently from pkt 2 of same flow – yes, this is a fundamental limitation – BUT OpenFlow provides the plumbing to connect devices New forwarding primitives – BUT provides a nice way to integrate them through extensions New packet formats/field definitions – BUT a generalized OpenFlow (2.0) is on the horizon Optical Circuits – BUT efforts underway to apply OpenFlow model to circuits Low-setup-time individual flows – BUT can push down flows proactively to avoid delays 25

26. Where is it going? The Open Networking Foundation: Textbox Headline The founding Consortium Promoter Members:  Operators and service providers  Make up the board of directors  Have voting rights  Representative of DTAG is Bruno Orth (GTN S&A) Adopter Members (as of Feb 2012) List of Members:  Big Switch Networks  Broadcom  Brocade  Ciena  Cisco  Citrix  Comcast  CompTIA  Cyan  Dell  Elbrys  Ericsson  ETRI  Extreme Networks  EZchip  Force10Network s  Fujitsu  Hitachi  HP  Huawei  IBM  Infoblox  Intel  IP Infusion  Ixia  Juniper Networks  Korea Telecom  LineRate Systems  LSI  Marvell  Mellanox  Metaswitch Networks  Midokura  NEC  Netgear  Netronom e  Nicira Networks  Nokia Siemens Networks  Plexxi Inc.  Pronto Systems  Radware  Riverbed Technolog y  Samsung  Spirent  Tencent  Texas Instrument s  Vello Systems  VMware  ZTE Corporatio n

27. Where it’s going OF v1.1: Extensions for WAN – multiple tables: leverage additional tables – tags and tunnels – multipath forwarding OF v1.2: Extensible Match structure – Required fields includes IPv6 27

28. Where it’s going OF v2+ – generalized matching and actions: an “instruction set” for networking Several other working groups have been created: – Hybrid group: Specifies how OpenFlow can be included into legacy switches without assuming clean-slate – Config group: Will specify an independent protocol that will help configure OpenFlow parameters out-of-band –.... And more 28

29. OpenFlow Implementations (Switch and Controller) 29

30. OpenFlow building blocks Controller NOX Slicing Software FlowVisor Expedient 30 Controller Applications LAVI ENVI (GUI) Aggregation n-Casting NetFPGA Software Ref. Switch Software Ref. Switch Broadcom Ref. Switch Broadcom Ref. Switch OpenWRT PCEngine WiFi AP Commercial Switches Stanford Provided OpenFlow Switches SNAC Stanford Provided Monitoring/ debugging tools oflops oftrace openseer OpenVSwitch HP, NEC, Pronto, Juniper.. and many more Beacon Helios Maestro

31. Ciena Coredirector NEC IP8800 Current SDN hardware More coming soon... Juniper MX-series HP Procurve 5400 Pronto 3240/3290 WiMax (NEC) PC Engines Netgear 7324 31

32. Commercial Switch Vendors ModelVirtualizeNotes HP Procurve 5400zl or 6600 1 OF instance per VLAN -LACP, VLAN and STP processing before OpenFlow -Wildcard rules or non-IP pkts processed in s/w -Header rewriting in s/w -CPU protects mgmt during loop NEC IP8800 1 OF instance per VLAN -OpenFlow takes precedence -Most actions processed in hardware -MAC header rewriting in h/w Pronto 3290 or 3780 with Pica8 or Indigo firmware 1 OF instance per switch -No legacy protocols (like VLAN and STP) -Most actions processed in hardware -MAC header rewriting in h/w 32

33. Open-source controllers VendorNotes Nicira’s NOX GPL C++ and Python SNAC GPL Code based on NOX0.4 Enterprise network C++, Python and Javascript Currently used by campuses VendorNotes Stanford’s Beacon BSD-like license Java-based Maestro (from Rice Univ) GPL Based on Java NEC’s Trema Open-source Written in C and Ruby Included test harness 33

34. Virtualizing OpenFlow 34

35. Windows (OS) Windows (OS) Windows (OS) Windows (OS) Linux Mac OS Mac OS x86 (Computer) x86 (Computer) Windows (OS) Windows (OS) App Linux Mac OS Mac OS Mac OS Mac OS Virtualization layer App Controller 1 App Controller 2 Controller 2 Virtualization or “Slicing” App OpenFlow Controller 1 NOX (Network OS) NOX (Network OS) Controller 2 Controller 2 Network OS Trend Computer IndustryNetwork Industry

36. Simple Packet Forwarding Hardware Network Operating System 1 Open interface to hardware Virtualization or “Slicing” Layer Network Operating System 2 Network Operating System 3 Network Operating System 4 App Many operating systems, or Many versions Open interface to hardware Isolated “slices” Simple Packet Forwarding Hardware 36

37. Switch Based Virtualization Exists for NEC, HP switches but not flexible enough Normal L2/L3 Processing Flow Table Production VLANs Research VLAN 1 Controller Research VLAN 2 Flow Table Controller 37

38. FlowVisor-based Virtualization OpenFlow Switch OpenFlow Protocol OpenFlow Protocol OpenFlow FlowVisor & Policy Control Craig’s Controller Heidi’s Controller Aaron’s Controller OpenFlow Protocol OpenFlow Protocol OpenFlow Switch OpenFlow Switch 38 Topology discovery is per slice

39. OpenFlow Protocol OpenFlow FlowVisor & Policy Control Broadcast Multicast OpenFlow Protocol http Load-balancer FlowVisor-based Virtualization OpenFlow Switch OpenFlow Switch OpenFlow Switch 39 Separation not only by VLANs, but any L1-L4 pattern dl_dst=FFFFFFFFFFFF tp_src=80, or tp_dst=80

40. FlowSpace: Maps Packets to Slices

41. FlowVisor Message Handling OpenFlow Firmware Data Path Alice Controller Bob Controller Cathy Controller FlowVisor OpenFlow Packet Exception Policy Check: Is this rule allowed? Policy Check: Who controls this packet? Full Line Rate Forwarding Rule Packet

42. Use Case: New CDN - Turbo Coral ++ Basic Idea: Build a CDN where you control the entire network – All traffic to or from Coral IP space controlled by Experimenter – All other traffic controlled by default routing – Topology is entire network – End hosts are automatically added (no opt-in) Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport ***** 84.65.* **** ****** *** ********** 42 Admin Researcher

43. OpenFlow/SDN for carriers 43

44. SDN is a hammer for what nail?

45. 1. Packet and Circuit convergence Most service providers own and operate 2 independent networks : IP and Transport – managed and operated independently – minimal cross-layer awareness – resulting in duplication of functions and resources in multiple layers – and significant capex and opex burdens Convergence to reduce costs and provide value-added services. The Flow Abstraction presents a unifying abstraction

46. OpenFlow-based unified control plane Packet flows Circuit flows – using the cross-connect table in circuit switches Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action Out Port Out Lambda Starting Time-Slot Signal Type VCG In Port In Lambda Starting Time-Slot Signal Type VCG

47. pac.c Controller Interface: OpenFlow Protocol Packet & Circuit Switches Converged Network Unified Control Plane

48. Demonstration of pac.c SAN FRANCISCO HOUSTON NEW YORK NOX OpenFlow Protocol 48 GE links OC-48 links (2.5 Gbps)

49. 2. Improving IP/MPLS control Basic Idea – Retain MPLS data-plane operations – Replace IP/MPLS control plane Demonstrate TE & its features All made simpler – some greatly (eg. AutoRoute) Some made possible only with SDN (eg. global-optimization) NETWORK OPERATING SYSTEM Routing Discovery Label Distribution Recovery TE 2.0 VPNs 2.0 Optimized FRR/ AutoBw MPLS-TP Control Multi-layer Control

50. Summary OpenFlow/SDN is evolving to facilitate an ecosystem for innovation OpenFlow is being deployed in over 100 organizations world-wide – GEC9 in Nov, 2010 showcased nation-wide OF – Internet 2 and NLR starting to serve as the GENI Backbone OpenFlow is essential for Service Providers – Custom control for Traffic Engineering – Combined Packet/Circuit switched networks

51. Are you innovating in your network? 51