Forwarding options with Openflow

Ideal Openflow

Openflow started out with the concept that all communication in the network would have its own flow installed in hardware. This means if two end points are communicating, they would have one flow for each direction. This amount of flows could increase significantly especially with the nature of networks today running with east-west traffic (N*(N-1) problem).
This approach is great as it allows full control of the network traffic which collects statistics for any communication happening between any two stations and policies. The challenge we have today is that current hardware designs are very limited to scale with this level of granularity. The only viable work around to achieve this ideal behavior today would be using software based switches or NPU type hardware switches. In the ideal sense flows means ACLs in the hardware ASICs which is about 2000 in most merchant chips today.

Alternative Options

Most ASICs were designed for traditional networking and they have lots of tables that could be leveraged for SDN purposes. For example the MAC table in most switches can run from 32K to 124K easily. This amount of table entries can create lots of scale.  However, the goal of Openflow and SDN is to implement flexible policy across the network fabric. MAC table entries are very limited as they only track the destination MAC, VLAN and output port. Taking that into consideration, we could build a flexible L2 network just using the MAC table where two stations could communicate by installing the respective MAC entries. Now we come to the issue of L3 requirements as well as with the WAN. These ASICs also have L3 and MPLS tables that could be leveraged to perform these functions.

In summary then, we could combine MAC, L3 and other tables to provide basic flexible forwarding within the network fabric with the Openflow controller coordinating table programming. We are still not achieving the ideal goal yet as these tables would not by themselves allow for policies within the network.

Openflow 1.3.1 Promise

While lots of this started out in Openflow 1.1, the concept of pipe lining with the various hardware tables is the real solution to overcome current hardware designs plus lay the foundation for the future.
Lets say the controller would allow all stations to communicate with each other using basic L2 and L3 tables. The next step is now to have some control over whom can speak to whom. With pipe lining you could insert an ACL entry to block traffic between two subnets or in some cases apply QOS parameters to specific L4 flows. All these would work together to maximize resource usage.  The tables are processed in sequence as oppose to only one table per packet in Openflow 1.0.





Its very unlikely that you would have to block traffic within a given subnet but definitely you would need to consider differently between subnets. You have about 124K MAC entries and 4K L3 entries in most hardware and smartly using your ACLs and these other tables, you could easily scale out your Data Center network.

Next Steps

The next challenge are for both hardware and controller vendors to implement this standard approach to pipe lining tables and provide the real benefit of an SDN based fabric. While that is happening, we hope that ASIC vendors would deliver more ACL type table entries closer to 100K or more to allow even more scaling in the network.

---