Branching out with SDN Alastair JOHNSON Using SDN

Agenda 1. Introduction 2. Technology recap a. VXLAN b. EVPN 3. Putting it together

Introduction § Software Defined Networking has significantly changed the way that networking is deployed in some environments § Research facilities, datacenters, etc § Gaining traction in other parts of the network (core/edge, etc) § SDN is about abstraction and separation of control and forwarding functions, and the separation of hardware and software § It offers new ways of thinking about existing ways of working 3 Copyright 2015 Alcatel-Lucent. All rights reserved. 2/28/15

Software Defined Networking Management, Policy Controller OS Hardware § Decoupled architecture means each vendor can focus on his strengths § Decreased barrier to entry for startups provides multiple choices for customers § Feature stability, long hardware cycles do not affect software features Hardware 4 Copyright 2015 Alcatel-Lucent. All rights reserved. 28 -Feb-15

Introduction § The WAN space has been relatively unchanged for the better part of 15 years § IP-VPNs are fundamentally the same as they were in 2000 § RFC 2547 published March 1999 § L 2 VPNs are fundamentally the same as they were in 2007 § The CPE has remained unchanged for the same period of time § Basically still the same device: vertically integrated hardware and software, running routing protocols and a variety of LAN/WAN interfaces § Maybe a little bit faster than it used to be 5 Copyright 2015 Alcatel-Lucent. All rights reserved. 2/28/15

Software Defined VPN (SD-VPN) § What if there was a new way of thinking about VPN services which embraces the smart edge dumb core philosophy? § What if there was a way to change the CPE paradigm? § What if there was a way to transport L 2 services over any L 3 network? § What if there was a way to do this operationally efficiently? 6 Copyright 2015 Alcatel-Lucent. All rights reserved. 2/28/15

Technology recap: VXLAN § § § Runs over IPv 4 or IPv 6 Uses UDP, source port is a hash of MAC or IPs to provide load balancing entropy 8 byte VXLAN header provides 24 bit VXLAN Network Identifier (VNI) and flags Total encapsulation overhead is ~50 bytes VXLAN is routable with IP, so the underlay network may be any network that uses existing resiliency and load balancing mechanisms § § IP Network VXLAN encapsulates Ethernet in IP (IP FRR, ECMP, IGP) IP Network ECMP IGPs/BGP IP FRR VXLAN tunnel endpoints can be on network equipment or computing infrastructure § Deliver a VPN straight to a hypervisor IP Network Copyright 2015 Alcatel-Lucent. All rights reserved.

Technology Recap: EVPN Control Plane Data Plane EVPN MP-BGP draft-ietf-l 2 vpn-evpn Multiprotocol Label Switching (MPLS) draft-ietf-l 2 vpn-evpn Provider Backbone Bridges (PBB) draft-ietf-l 2 vpn-pbb-evpn Network Virtualization Overlay (NVO) draft-sd-l 2 vpn-evpn-overlay § EVPN over MPLS for VLL, VPLS § EVPN with PBB PE functionality § EVPN over NVO tunnels (VXLAN, and E-Tree services for scaling very large networks NVGRE, MPLSo. GRE) for data § All-active multihoming for VPWS over MPLS center fabric encapsulations § RSVP-TE or LDP MPLS protocols § All-active multihoming for PBB- § Provides Layer 2 and Layer 3 DCI VPLS Copyright 2015 Alcatel-Lucent. All rights reserved.

Technology Recap: EVPN § Brings proven and inherent BGP control plane scalability to MAC routes § § § BGP advertises MACs and IPs for next hop resolution with EVPN NLRI § § § AFI = 25 (L 2 VPN) and SAFI = 70 (EVPN) Fully supports IPv 4 and IPv 6 in the control and data plane Offers greater control over MAC learning § § Consistent signaled FDB in any size network instead of flooding Even more scalability and hierarchy with route reflectors What is signaled, from where and to whom Ability to apply MAC learning policies Maintains virtualization and isolation of EVPN instances Enables traffic load balancing for multihomed CEs with ECMP MAC routes Copyright 2015 Alcatel-Lucent. All rights reserved. Route Distinguisher (8 octets) Ethernet Segment Identifier (10 octets) Ethernet Tag ID (4 octets) MAC Address Length (1 octet) MAC Address (6 octets) IP Address Length (1 octet) IP Address (0 or 4 or 16 octets) MPLS Label 1 (3 octets) MPLS Label 2 (0 or 3 octets) MAC Advertisement Route (Light Green Fields are Optional)

Putting it together § EVPN delivers a control plane that can distribute MAC (L 2) and IP (L 3) reachability information § Scale is addressed: BGP has proven to scale well; federation becomes straightforward § Control is addressed: programmatic network topology, flexibility of routing policies § Efficiency is addressed: hybrid L 2/L 3 services over a single interface, redundancy and multi-homing included § VXLAN delivers a data plane that can deliver Ethernet frames over an L 3 transport § L 2 VPN, L 3 VPN, …the Internet 10 Copyright 2015 Alcatel-Lucent. All rights reserved. 2/28/15

A new way of delivering VPNs § Aware of all L 2/L 3 topology behind each CPE § Calculate once, program many Policy DB Site 2 SP Central Functions § CPE performs encapsulation of VPN traffic (VXLAN) § Traffic is carried encapsulated over underlay network Underlay LAN § Underlay network could be any infrastructure § Unaware of topology of VPN service LAN SDN Controllers Copyright 2015 Alcatel-Lucent. All rights reserved. CPE Site 1 LAN § Controller programs forwarding plane for all CPEs CPE Site 3

A new way of delivering VPNs § Open. Flow provides a mechanism to program the L 2/L 3 forwarding information base (FIB) and provide notifications to the controller § § § BGP EVPN Open. Flow OVSDB CPE Federation of topology between controllers via BGP-EVPN § § § MAC/IP address learning on LAN ports are alerted to the controller Controller determines whether the MAC/IP is to be programmed into FIB SDN Controller MAC and IP reachability signaled VXLAN VNI information combined with NEXT_HOP Redundancy of controllers is supported – CPE v. Switch registers and determines active/standby controllers 10. 0/24 10. 1. 0. 0/24 12 Copyright 2015 Alcatel-Lucent. All rights reserved. 3/2/15

A new way of delivering VPNs § CPE forward directly between each other using VXLAN as overlay § 10. 0/24 NEXT_HOP 192. 0. 2. 1 VNI xyz § 10. 1. 0. 0/24 NEXT_HOP 192. 0. 2. 3 VNI xyz § Underlay network sees VXLAN traffic between endpoints § Dataplane can be further encapsulated for confidentiality (e. g. IPsec) 192. 0. 2. 1 10. 0/24 192. 0. 2. 3 10. 1. 0. 0/24 13 Copyright 2015 Alcatel-Lucent. All rights reserved. 3/2/15

Routing Policy WAN ports Aggregation network BGP LAN ports Failover Redundancy RIB scale VPN Flexibility Many provisioning touch points § Overlays simplify network topology § SP network needs to know less about customer topology § Increases flexibility of delivery – L 2 services over L 3, On Net, Off Net, Internet, etc § Provisioning simplified VRF One-time Provisioning Dynamic Provisioning GRT § Reuse of activation processes from broadband networks 14 Copyright 2015 Alcatel-Lucent. All rights reserved. 3/2/15

Overlays enable service chaining § Centralized policy enforcement § Firewall § Between zones/subnets/branch types § Extranet applications § To Internet through central functions DC LAN CPE WAN LAN CPE § Content filtering § Selective content filtering (schools – teacher/student; public Wi. Fi in retail environments bypasses) § Network analytics and monitoring § Tap and mirror § IDS/IDP § DPI and DLP DC LAN CPE WAN LAN CPE 15 Copyright 2015 Alcatel-Lucent. All rights reserved. 3/2/15

Interworking How do I connect the new to the existing? 1. EVPN with VXLAN termination direct into existing MPLS PE routers § § § IP/MPLS GRT Overlay VPN Environment IWF Traditional VPN environment IP/MPLS VRF Break VXLAN services out to Ethernet VLANs at PE router Faster to deploy but less flexible VRF End-to-end network is BGP and VXLAN aware allowing for PE routers to act as VXLAN/MPLS interworking function Streamlined and simplified routing 2. Use CPE as gateway § Internet VRF Internet Overlay VPN Environment Traditional VPN environment 16 Copyright 2015 Alcatel-Lucent. All rights reserved. 3/2/15

Comparison Traditional VPN model Overlay VPN model • Well understood and widely deployed • Expensive to maintain and scale • Inflexible for “cloud scale” service consumption • Constrained by network reach • Service chaining challenging to deploy • • • New approach to networking that is being aggressively proven in datacenters Centralized control model reduces direct operational cost Scales to cloud: speed, flexibility Service providers can extend services out of network footprint and effectively use all network assets Natively enables service-chaining 17 Copyright 2015 Alcatel-Lucent. All rights reserved. 2/28/15

Conclusion § SDN as a technology has now found proven deployment usecases that make sense § Not just experiments or ‘doing the same thing but differently’ § Real service provider use-cases exist for leveraging the same technology as deployed in datacenters § Speed, flexibility, optimization of network service delivery points 18 Copyright 2015 Alcatel-Lucent. All rights reserved. 2/28/15