SDN in CloudStack Tuesday, October 15, 13 About me Hugo Trippaers - PowerPoint PPT Presentation

SDN in CloudStack Tuesday, October 15, 13

About me » Hugo Trippaers – Email: htrippaers@schubergphilis.com – Twitter: @Spark404 – Freenode: Spark404 – http://www.schubergphilis.com » Tuesday, October 15, 13

CloudStack networking - the fi ve minute version » CloudStack networking – Basic, isolation using security groups (L3) – Advanced, isolation using network isolation (L2) » SDN was introduced to create isolated networks in Advanced zones » By now it can do much more... (Routing, Firewall, NAT) 3 Tuesday, October 15, 13

Isolation with VLAN CloudStack takes care o ff the con fi guration of hypervisor switches. Who takes care of the networking gear? 4 Tuesday, October 15, 13

Isolation with VLAN CloudStack takes care o ff the con fi guration of hypervisor switches. Who takes care of the networking gear? He does... 5 Tuesday, October 15, 13

Isolation with Software De fi ned Networking CloudStack takes care o ff the con fi guration of hypervisor switches and L2 networking. Who takes care of the networking gear? 6 Tuesday, October 15, 13

Isolation with Software De fi ned Networking CloudStack takes care o ff the con fi guration of hypervisor switches and L2 networking. Who takes care of the networking gear? 7 Tuesday, October 15, 13

Software de fi ned networking - core concepts » Decouples the control plane (what data is going where) from the data plane (how to get data there) » Makes network management easier by abstracting low-level functionality into virtual services. – Independent of hardware and/or vendor » Provides a Northbound API – Allows administrators to use automated tooling to provision services » Scale? 8 Tuesday, October 15, 13

Software De fi ned Networking - advanced » Where can we go if we have a software based network infrastructure. – Distributed routing? – Integrated security framework? – Application controlled networking? » Endless possibilities, it’s all software anyway 9 Tuesday, October 15, 13

SDN in CloudStack » Where is it? 10 Tuesday, October 15, 13

SDN in CloudStack » Where is it? Implemented in the core of CloudStack. “Movable parts” con fi gured per plugin. Controlled by existing o ff ering model. 11 Tuesday, October 15, 13

SDN implementations Security Isolation DHCP Firewall NAT VPC Groups GRE isolation Pre ACS - - - - - 12 Tuesday, October 15, 13

SDN implementations - GRE isolation » Uses the existing implementation of OpenVSwitch in XenServer and XCP – Uses the OpenVSwitch GRE tunnels to “link” OpenVSwitch bridges between hypervisors – Entirely controlled by CloudStack – GSOC project to add KVM and OpenDaylight » Pros – Doesn’t require external components » Cons – Bandwidth is limited due to lack of o ffl oading – Large deployments require a lot of tunnels – Limited set of hypervisors supported (XenServer, KVM) 13 Tuesday, October 15, 13

SDN implementations Security Isolation DHCP Firewall NAT VPC Groups GRE isolation Pre ACS - - - - - Nicira NVP >= 4.0 - - - - - 14 Tuesday, October 15, 13

SDN implementations - Nicira NVP » A commercial SDN solution developed by Nicira. Uses both OpenVSwitch and OpenFlow to build overlay tunnels on an existing network. » Pros – STT tunnel protocol is optimized for high-bandwidth – Includes a gateway to link existing L3 or L2 networks to the virtual switch » Cons – Requires custom OpenVSwitch on hypervisors. 15 Tuesday, October 15, 13

SDN Implementations Security Isolation DHCP Firewall NAT VPC Groups GRE isolation Pre ACS - - - - - Nicira NVP >= 4.0 - >= 4.1 >= 4.1 - >= 4.1 Big Switch VNS >= 4.1 - - - - - 16 Tuesday, October 15, 13

SDN implementations - Nicira NVP (>= ACS 4.1) » Nicira NVP plugin is updated to support L3 functionality. With this functionality the existing VRouter can be replaced with a SDN based construct. » Several changes have been made to the VPC setup to support SDN based networks in VPCs. 17 Tuesday, October 15, 13

SDN implementations - BigSwitch VNS » The Big Switch Networks plugin is a CloudStack SDN plugin using the BigSwitch VNS platform. While BigSwitch VNS is a commercial solution, it is completely based on open standards like OpenFlow » Pros – Uses open standards » Cons – Requires hypervisors and switches to support OpenFlow 18 Tuesday, October 15, 13

SDN Implementations Security Isolation DHCP Firewall NAT VPC Groups GRE isolation Pre ACS - - - - - Nicira NVP >= 4.0 - >= 4.1 >= 4.1 - >= 4.1 Big Switch VNS >= 4.1 - - - - - Midokura >= 4.2 >=4.2 >= 4.2 >= 4.2 - >=4.2 Midonet Stratosphere SSP >=4.2 - - - - - - - - - - 19 Tuesday, October 15, 13

SDN implementations - Midokura Midonet » Midokura Midonet is implemented as a CloudStack plugin. It o ff ers a complete set of advanced features like DHCP, L3 Routing and various NAT options. » Pros – Complete solution for building standard networks including L3 functions. » Cons – Can only be used with the KVM hypervisor. 20 Tuesday, October 15, 13

SDN implementations - Stratosphere » Stratosphre SSP is an SDN controller that controls or brokers physical and or virtual network devices. Stratosphere SSP will build a vxlan backed overlay network. The plugin makes L2 connectivity service provided by SSP. » Not much information available yet. 21 Tuesday, October 15, 13

SDN Implementations Security Isolation DHCP Firewall NAT VPC Groups GRE isolation Pre ACS - - - - - Nicira NVP >= 4.0 - >= 4.1 >= 4.1 - >= 4.1 Big Switch VNS >= 4.1 - - - - - Midokura >= 4.2 >=4.2 >= 4.2 >= 4.2 - >=4.2 Midonet Stratosphere SSP >=4.2 - - - - - VXLAN - - - - - master 22 Tuesday, October 15, 13

SDN implementations - VXLAN » Announced at CCC 2013 by Toshiaki Hatano. » Not much information available yet, be sure to watch the recording of the talk. 23 Tuesday, October 15, 13

SDN Implementations Security Isolation DHCP Firewall NAT VPC Groups GRE isolation Pre ACS - - - - - Nicira NVP >= 4.0 - >= 4.1 >= 4.1 - >= 4.1 Big Switch VNS >= 4.1 - - - - - Midokura >= 4.2 >=4.2 >= 4.2 >= 4.2 - >=4.2 Midonet Stratosphere SSP >=4.2 - - - - - VXLAN - - - - - master 24 Tuesday, October 15, 13

SDN implementations - next steps? » Support for VPC – Including private gateways » Common con fi guration and setup » Security » Con fi gurable on-ramp/o ff -ramp » IPv6 25 Tuesday, October 15, 13

SDN in CloudStack - how does it work » Preparing a SDN solution for use requires some con fi guration work up front 26 Tuesday, October 15, 13

Preparation - Con fi gure physical network » The physical network de fi nes the type of L2 isolation used. 27 Tuesday, October 15, 13

Preparation - Setup Providers » The provider is the place to con fi gure the SDN controller » Not used by the GRE tunnels, that is con fi gured using con fi guration parameters. 28 Tuesday, October 15, 13

Preparation - Setup network o ff erings » Connectivity is key » Services de fi ne where and how SDN is used in the o ff ering 29 Tuesday, October 15, 13

SDN in CloudStack - how does it work » Preparing a SDN solution for use requires some con fi guration work up front » Using the SDN solution is as straight forward as any networking in CloudStack 30 Tuesday, October 15, 13

Usage - Creating a new network » The role of Network Gurus – each guru supports a speci fi c type of network – select based on a number of criteria, of which isolation type is only one » Selected guru is stored in the database for this particular network. 31 Tuesday, October 15, 13

Usage - Creating a new network » The role of Network Elements – triggered when ever a new NIC is attached to a network – con fi gure devices like fi rewall, routers, etc.. » Elements are selected based on the network o ff ering used to create the network. 32 Tuesday, October 15, 13

Usage - My fi rst VM » Multiple actions happen at the same time – network elements – hypervisor resources » The NIC is the linking pin between a VM and the SDN implementation » The hypervisor sets fl ags to allow the VIF to be found » The network element tells the SDN solution what to look for » Not a generic way of doing things, depends on the SDN in use. 33 Tuesday, October 15, 13

Usage - Ready 34 Tuesday, October 15, 13

Thats all there is to it » http://apache.cloudstack.org » http://www.nicira.com » http://www.bigswitch.com » http://www.midokura.com » http://www.iij.ad.jp/en/ – Email: htrippaers@schubergphilis.com – Twitter: @Spark404 – IRC Freenode: Spark404 35 Tuesday, October 15, 13