Recently Cisco released their Application Centered Infrastructure (ACI) product line so all of the vendors in the SDN industry started to criticize them sharply for delivering both an hardware centered designed as well as being proprietary. What is going in the SDN world in terms of following standards? First of all Cisco is part of all the major standard bodies and is quiet very active.
Lets put this another way; are there any standard solutions out there in the market today? People talk a lot about VMware NSX but that is not standard its based on VMware own APIs and implementation of protocols. Taking that into consideration, what Cisco is doing is not so far off from the rest of the SDN industry.
Openflow is suppose to represent what is considered pure SDN but only smaller players like Big Switch and larger Cloud operators like Google are really embracing it full on. In fact, it seems that the mainstream vendors are way behind in this space. Broadcom recently released the OF-DPA SDK libraries that would allow better implementation of Openflow in hardware and solve some of the main challenges faced by the standard. However, I think the bigger question is whether the larger network vendors would step up and release complete solutions around this standard.
The moral of the story is that no one today is really embracing open standards in their solutions. Having an ecosystem is not being open and this in fact a challenge for the industry going forward. We should continue to push for standard and open solutions which allows full inter-operability based entirely on standards.
Most networks today have not changed despite the fact that SDN has being around for the last few years. One major reason for this slow change is the issue of migration faced by SDN especially Openflow. The incumbent vendors are very slow to embrace open technologies and the non-traditional vendors do not seem to have the clout to drive changes. The good news is that service providers and larger data center operators are taking Openflow seriously.
Here are a few strategies that could be explored to overcome the limitations with migration;
1. Software Upgrade - Does the incumbent vendor already have an Openflow enabled firmware image for the devices in question? If the answer is yes, do we know what level of support available?
2. Strategic Replacement - While it maybe impractical to replace all devices in the network immediately, there maybe an opportunity to replace specific devices that could enable easy migration to SDN. This could work especially for edge switches.
3. Tunneling - Another option to consider would be using tunnels in the SDN switches between each other while using the existing network as a basic transport. This is also one of the reasons why overlay technologies such as VxLAN has gotten more traction than Openflow, due to the ability to leverage the existing network and still get the benefits of SDN.
4. Hybrid Controllers - Most SDN controllers are focused only on SDN and therefore not geared towards managing existing networks. It would be useful for these controllers to speak both languages so that customers can see some unified benefit today as they slowly migrate forward.
There are many strategies to consider and employ but the bottom line is to show customers the benefits of migrating to a proper SDN Network. Building better greenfield networks is one way to make that case.
Check out this paper from the ONF on migration - Openflow Migration Paper.
Openflow started out with the concept that all communication in the network would have its own flow installed in hardware. This means if two end points are communicating, they would have one flow for each direction. This amount of flows could increase significantly especially with the nature of networks today running with east-west traffic (N*(N-1) problem).
This approach is great as it allows full control of the network traffic which collects statistics for any communication happening between any two stations and policies. The challenge we have today is that current hardware designs are very limited to scale with this level of granularity. The only viable work around to achieve this ideal behavior today would be using software based switches or NPU type hardware switches. In the ideal sense flows means ACLs in the hardware ASICs which is about 2000 in most merchant chips today.
Most ASICs were designed for traditional networking and they have lots of tables that could be leveraged for SDN purposes. For example the MAC table in most switches can run from 32K to 124K easily. This amount of table entries can create lots of scale. However, the goal of Openflow and SDN is to implement flexible policy across the network fabric. MAC table entries are very limited as they only track the destination MAC, VLAN and output port. Taking that into consideration, we could build a flexible L2 network just using the MAC table where two stations could communicate by installing the respective MAC entries. Now we come to the issue of L3 requirements as well as with the WAN. These ASICs also have L3 and MPLS tables that could be leveraged to perform these functions.
In summary then, we could combine MAC, L3 and other tables to provide basic flexible forwarding within the network fabric with the Openflow controller coordinating table programming. We are still not achieving the ideal goal yet as these tables would not by themselves allow for policies within the network.
Openflow 1.3.1 Promise
While lots of this started out in Openflow 1.1, the concept of pipe lining with the various hardware tables is the real solution to overcome current hardware designs plus lay the foundation for the future.
Lets say the controller would allow all stations to communicate with each other using basic L2 and L3 tables. The next step is now to have some control over whom can speak to whom. With pipe lining you could insert an ACL entry to block traffic between two subnets or in some cases apply QOS parameters to specific L4 flows. All these would work together to maximize resource usage. The tables are processed in sequence as oppose to only one table per packet in Openflow 1.0.
Its very unlikely that you would have to block traffic within a given subnet but definitely you would need to consider differently between subnets. You have about 124K MAC entries and 4K L3 entries in most hardware and smartly using your ACLs and these other tables, you could easily scale out your Data Center network.
The next challenge are for both hardware and controller vendors to implement this standard approach to pipe lining tables and provide the real benefit of an SDN based fabric. While that is happening, we hope that ASIC vendors would deliver more ACL type table entries closer to 100K or more to allow even more scaling in the network.