FRAMEWORKS MADHAVI RAVANAN Senior Manager, Technology, Aricent SARO VELRAJAN Director, Technology, Aricent 1 Realizing OpenFlow Switches with Aricent Frameworks Aricents Frameworks for OpenFlow Aricent ofers comprehensive and fully tested software frameworks for OpenFlow, which include: > OpenFlow Client A control plane implementation based on ONF OpenFlow Specication version 1.3.1 > Fast Path Accelerator A fast path processing implementation based on ONF OpenFlow Specication version 1.3.1 > Intelligent Switch Solution (ISS) Widely deployed, industry- leading L2-L3 switching and routing solution with support for OpenFlow for hybrid SDN architectures Infrastructure vendors looking to build equipment with pure or hybrid OpenFlow capabilities can leverage Aricents OpenFlow frameworks to save up to 80 percent in costs and 85 percent in time to market compared to ground-up development. Aricent aligns its software product roadmap to its customers needs and offers hassle-free product support with aggressive SLA commitments. Introduction The numerous benets of SDN and the emergence of OpenFlow as the leading protocol for communication between controller and switch have pushed equipment vendors to ofer support for OpenFlow protocol in their devices portfolio. In an efort to enable equipment vendors to gain a competitive edge in the fast growing OpenFlow/SDN market, Aricent ofers pre-integrated, platform agnostic, and completely tested software frameworks for OpenFlow. These frameworks can be leveraged by equipment vendors to build pure and hybrid OpenFlow switches and routers, under aggressive timelines, with production-ready quality. This whitepaper highlights the benets of Aricents OpenFlow frameworks, and explores how they can be leveraged to build pure or hybrid OpenFlow switches for various deployments across campus, datacenter, enterprise, and service-provider networks. REALIZING OPENFLOW SWITCHES WITH ARICENT FRAMEWORKS Software Dened Networking (SDN) presents limitless possibilities by ofering unprecedented OpEx and CapEx savings. Aricent is committed to the SDN revolution, providing comprehensive software frameworks for OpenFlow that enable equipment vendors to gain a competitive advantage in the soaring OpenFlow/SDN market. This paper explores how Aricents OpenFlow frameworks can be leveraged by equipment vendors to build pure or hybrid OpenFlow network equipment. 2 Realizing OpenFlow Switches with Aricent Frameworks ARICENTS OPENFLOW CLIENT Aricents OpenFlow client is a portable implementation of ONF OpenFlow specication version 1.3.1. It enables communication between the network equipment (switch/router) and the OpenFlow controller. OpenFlow client can be used to program the OpenFlow fast path through the network processor interface. The OpenFlow fast path can be realized either in the hardware ASIC, in software, or in a combination of both hardware ASIC and software. The software design of the OpenFlow client supports portability on a wide range of processor platforms, from monolithic architectures to distributed shared memory and message-passing architectures as in the multi-core processors. The OpenFlow client is available as a stand-alone package or as an enabled feature in Aricents ISS solution. The stand-alone OpenFlow client package can be used to both realize pure OpenFlow switches and enable OpenFlow on pre-existing platforms running custom control-plane software. Vendors looking to build hybrid OpenFlow network equipment can leverage Aricents ISS that comes with OpenFlow support. OpenFlow client is ofered as a source code license to customers. The benets of Aricents OpenFlow client include: > Pre-integrated into leading reference silicon platforms such as Broadcom Trident+ > Ease of porting to newer silicon platforms. OpenFlow client has well-dened abstraction layers for OS, HW, and management interfaces. > Support for OpenFlow Fast Path on multi-core platforms: Aricents OpenFlow Fast Path Accelerator (FPA) is built on Intels Data Plane Development Kit (DPDK) for multi-core platforms. Aricents OpenFlow client is pre-integrated with the Aricents FPA. FPA is easily portable to other multi-core platforms > Readily available and easily adaptable management interfaces: Aricents OpenFlow client supports multiple management interfaces like CLI, SNMP, and ConfD. OFConfig protocol support is planned in the roadmap > Support for upwards of a million ow entries in the software: Aricents OpenFlow client supports at least a million ow- table entries in the software, and the framework is further extensible > OpenFlow client supports up to 1,200 ow additions per second > Aricents OpenFlow client integrated with FPA has achieved 10 Gpbs of forwarding plane performance on Intels multi- core platform Socket Layer OpenFlow Client Connection Manager O S O S
A b s t r a c t i o n M a n a g e m e n t
C L I ,
C o n s o l e ,
T e l n e t ,
S S H , W e b U I ,
H T T P ,
S S L ,
S N M P v
3 Database (Flow, Group, Meter) Core (Timer, Queue, Event) Packet Tx/Rx Pipeline Process Interface Manager Hardware Abstraction Layer (Data Plane Processing) Silicon Driver/SDK Ethernet Switch Silicon (Broadcom, Marvell, Fulcrum) Server/Management Station(s) Hybrid OpenFlow Switch Pure OpenFlow Switch OpenFlow Controlled Parts Ports Not Controlled Through OpenFlow OpenFlow Controller Aricent OpenFlow Client Aricent Intelligent Switching Solution Traditional L2/L3/MPLS Control Plane+ Management Aricent Fast Path Accelerator Legacy NMS Figure 1: Aricents OpenFlow Frameworks Figure 2 : Aricents OpenFlow Client Architecture 3 Realizing OpenFlow Switches with Aricent Frameworks > Support for multi-threaded operations, enabling multiple instances of one or more functional blocks in the FPA > Support for traffic load balancing across various blocks, cores, and threads > Support for sending and receiving packets from control plane > Conforms to Aricent Network Processor API (NPAPI) and is pre-integrated with Aricent frameworks for OpenFlow, like Aricents OpenFlow client and ISS Aricents Fast Path Accelerator is designed to provide: > High performance and scalability tailored to multi-core environments > Ease of integration with third-party vendor control plane stacks > Ease of integration with accelerator functions provided by ASICs and FPGAs > Support for pluggable components in the fast path. Fast Path pipeline can be organized exibly by adding and removing components > Tailored to functioning in pipeline, run to completion, and in combination of the two > Easily portable across multiple processor architectures, like - Intel, Octeon (Cavium), XLP (Broadcom), etc. > Supported across multiple operating system platforms, including bare metal environment ARICENTS INTELLIGENT SWITCH SOLUTION Aricents industry leading and proven Layer-2 and Layer-3 switching and routing framework, Intelligent Switch Solution (ISS), is integrated with the OpenFlow framework to render a comprehensive framework for building hybrid OpenFlow network equipment. ARICENTS FAST PATH ACCELERATOR Aricents Fast Path Accelerator (FPA) is an implementation of OpenFlow pipeline processing requirements given in ONF OpenFlow specication version 1.3.1. FPA is implemented on Intels Data Plane Development Kit (DPDK) for multi-core platforms. FPAs architecture is modular, with flexible building blocks that can easily be extended to other multi-core platforms. Aricents OpenFlow FPA capabilities include: > Support for IPSec and IPv4 routing, L2 Access Control Lists (ACLs) for OpenFlow, and diagnostics for determining state of the internal data path > Support for run to completion, pipeline model, and a combination of these scheduling models for pipeline processing Ethernet Switch Silicon (Broadcom, Marvell, Fulcrum) Silicon Driver/SDK ISS Hardware Abstraction Layer O S
A b s t r a c t i o n O S M a n a g e m e n t C L I ,
C o n s o l e ,
T e l n e t ,
S S H , W e b U I ,
H T T P ,
S S L ,
S N M P v 3 System Management Cong Save/Restore, DHCP, RMON, Syslog Mirroring, s/w Upgrade Layer 3 - IPv4 Suite TCP/IP Stack, RIPv2, OSPFv2, ISIS, BGP4, PIM, DVMRP, VRRP, MSDP Layer 3 - IPv6 Suite TCP/IP Stack, RIP6, OSPFv3, ISIS, BGP4+, IPSecv6, v6-tunneling, MSDP Qos Diferv, 802.1p, Rate Limit, Storm Control, Queuing MPLS PWE3 L2VPN, MPLS-TP, LDP, RSVPTE, BFD, LSP-Ping, Y.1731 Basic Layer 2 Suite VLAN, RSTP, MSTP, GVRP, GMRP, MRP, Link Aggregation, IGMP(v3) Snooping Security 802.1x, SSL, SSH, Radius, ACL Advance Layer 2 Suite - Virtual Switch Contacts, E-OAM, ECFM, Provider Bridging, PBB, PBB-TE, G.8031, G.8032, IEEE 1588 PTP OpenFlow Client Chassis Management Hot Swap Mgmt, Redundancy Mgmt, Hitless Restart OpenFlow Fast Path Accelerator O p e n F l o w
C l i e n t Data Path Block NPAPI Hardware Accelerator Pipeline Load Balancer Block Figure 3 : Aricents Fast Path Accelerator Figure 4 : Aricents Intelligent Switch Solution 4 Realizing OpenFlow Switches with Aricent Frameworks PURE OPENFLOW SWITCHES Two possible cases for pure OpenFlow switch realization are: > Case 1: Software-only OpenFlow switch implementation on the system CPU > Case 2: A Combination of hardware- and software-based switches for pure OpenFlow Aricents OpenFlow client is pre-integrated with Aricents FPA. This pre-integrated solution can be leveraged to realize pure OpenFlow switches. Both the OpenFlow client and FPA provide the exibility for adding custom extensions. The FPA provides additional hooks for customizations to the data path block. Hence, extensions to the OpenFlow specication, such as OAM, BFD, etc. that are being proposed in the revisions of the specication, can be addressed on the data plane as well. Case 1: Software-Only Pure OpenFlow Switch on Intels ATCA Platform The gure below depicts an OpenFlow switch on an Intel ATCA platform using Aricents pre-integrated OpenFlow frameworks like OpenFlow client and FPA. The Aricents FPA runs on Intels DPDK on Linux OS in a multi-core processor environment. Aricents OpenFlow client runs on one of the cores while the remaining split cores run the Aricents FPA. An optional ofoad-processor can be used for any specialized processing, such as security pipeline, pattern matching, etc. The external OpenFlow controller can use the OpenFlow interface provided by the OpenFlow client to program the switching logic. The OpenFlow client internally programs the FPAs ow tables. Data trafc ow in and out of the switch is as depicted in Figure 5. Intelligent Switching Solution (ISS) is a comprehensive, feature- rich software product for developing a wide range of intelligent Ethernet switching applications, from entry-level, xed-port, fast Ethernet switches to module-based Gigabit stackable switches and Metro Ethernet-based carrier-class systems to data center, as well as industrial switching solutions. A eld-proven software product, ISS is an integral component to over 100 commercial products developed by leading telecom equipment manufacturers. ISS ofers Layer-2 switching, Layer-3 routing, MPLS transport, security, system software features, and multiple management interfaces. It is pre-integrated into a variety of silicon platforms and operating systems. ISS can also be leveraged to build hybrid OpenFlow network equipment. ISS supports enabling OpenFlow at the ports/VLAN level. Ports/ VLANs can be provisioned as either OpenFlow ports/VLANs or traditional ports/VLANs. Trafc coming in through physical and logical ports of an OpenFlow VLAN is processed at the OpenFlow pipeline, while those coming in through traditional VLAN ports are processed at the L2/L3 data plane. Realizing OpenFlow Switches with Aricent Frameworks Aricents OpenFlow frameworks can be leveraged to build both pure and hybrid OpenFlow switches and routers. This section describes how each can be achieved. Aricent Fast Path Accelerator Aricent OpenFlow Client Stack Aricent OpenFlow Controller and Congurator DPDK NIC Communication/Ofoad Processor: Cave Creek Multi-core Processor PMD Driver .ko Poll Mode Driver (PMD) Core 1 Core 2 Core 3 Core 4 Linux IP Stack OpenFlow Ports OF-Cong OpenFlow Kernel Space User Space Data Trafc Flow Table Programming Figure 5: OpenFlow Switch on Intel ATCA Platform 5 Realizing OpenFlow Switches with Aricent Frameworks > Case 1: Upgrading an existing equipment for hybrid OpenFlow capabilities > Case 2: Building a hybrid OpenFlow equipment from the ground up Both of the above cases can be achieved by leveraging the current ISS release with OpenFlow support. The Common Forwarding Agent (CFA) in ISS evaluates the data trafc at any given time and passes it on for either OpenFlow pipeline processing or for the traditional pipeline processing, depending which type of VLAN the trafc arrived. Data trafc from OpenFlow VLANs is processed at the OpenFlow pipeline, while data traffic from traditional VLANs is processed at the normal pipeline. The solution provides built-in control of resource partitioning across the two domains realized on the same merchant silicon. This can be customized further by the equipment vendors to diferentiate their solution. The hybrid solution supports the ow of OpenFlow traffic, traditional or legacy traffic, and traffic flow across the two domains. For equipment with customers own control planes, the pre- integrated OpenFlow client and FPA solution can be incorporated quickly to enable OpenFlow support for the equipment. Case 2: Merchant Silicon-Based Pure OpenFlow Switch The interfaces published by Aricents OpenFlow client can be programmed to use the merchant silicon for forwarding some or all of the ows. Support for a combination of software- and hardware-based forwarding enables equipment vendors to implement diferent ows in diferent devices. For example, the macro ows can be handled in hardware and the ne grained controlled ows can be handled on the FPA, both under the control of the OpenFlow client. Aricents OpenFlow client provides reference fast-path implementations on leading merchant silicon platform for OpenFlow pipeline processing. HYBRID OPENFLOW SWITCHES It is widely understood that it is not realistic to completely rip of the conventional networking devices present in todays networks and replace them with pure OpenFlow devices. It is critical to follow a gradual migration path by introducing OpenFlow support along with the traditional control planes in the existing network devices. Hence, hybrid OpenFlow solutions are currently in need. This section covers how hybrid OpenFlow equipment can be realized leveraging Aricents frameworks, including: Server/Management Station(s) Legacy NMS OpenFlow Controller Aricent Frameworks for OpenFlow Aricent Intelligent Switch Solution (ISS) Management - CLI, SNMP, WebUI Aricent OpenFlow Client (OFC) Aricent Fast Path Accelerator (FPA) System CPU Merchant Switching Silicon Hardware Layer Ports of OpenFlow VLAN Legend Ports of Conventional L2/L3 VLANs Aricent Frameworks System Functions, ACL, QoS, Mirroring, Chassis Management, System Monitoring, DHCP, etc. Traditional Control Plane Protocols for L2 Switching, L3 Routing, MPLS, DCB, CE Porting Layer for Switching Silicon Hardware Abstraction Layer Figure 6: Hybrid OpenFlow Switch 6 Realizing OpenFlow Switches with Aricent Frameworks SDN Solutions Enabled by Aricents OpenFlow Until now, innovations in networking were mostly around increasing the throughput or packet-forwarding capacity of network devices such as routers and switches. However, Software Dened Networks (SDN) changed the way networks were designed, developed, and deployed. SDN provides signicant opportunities for service providers to optimize their network architecture, launch newer services, and monetize better. Aricents OpenFlow frameworks enable a number of solutions for OEMs/ODMs, Network Service Providers (NSPs), and Cloud Service Providers (CSPs). This section outlines a few solutions that are enabled by Aricents OpenFlow frameworks. SDN-ENABLED WLAN SOLUTION Today, WLAN controllers use proprietary protocols to manage access points deployed in the network. While using proprietary protocols may be sufcient in an enterprise or campus deployment where access points are supplied by a single vendor, it may be inadequate for a multi-vendor deployment such as carrier Wi-Fi deployment, where service providers roll out thousands of hotspots. This brings the need for a standard protocol such as CAPWAP for the management of access points. With service providers adopting SDN, OEMs are looking for ways to integrate SDN and WLAN architectures. Aricents OpenFlow client can be integrated with WLAN Access Controller (AC) or Access Points (AP) to provide a complete SDN-enabled WLAN solution. Here are the benets of the solution: > Unied policies for wired and WLAN networks > Centralized management and monitoring of both wired and WLAN networks > Highly scalable architecture for enterprise and carrier Wi-Fi deployments > Increased programmability and ne-grained control of WLAN functions For deployments in which user data trafc is routed from access points to the access controllers, OpenFlow client functionality is implemented in the WLAN access controller. The possible deployments include thin AP, such as in enterprise and campus Wi-Fi networks. For deployments in which user data traffic is routed from APs directly to the outside network, OpenFlow client functionality is implemented in the WLAN APs. The possible deployments include fat AP, such as in carrier Wi-Fi networks. Aricents OpenFlow client framework can be integrated into OEMs existing WLAN access controller and WLAN AP products. Alternatively, OEMs can license Aricents OpenFlow enabled WLAN Switching Solutions (WSS), which include the complete WLAN access controller and AP framework integrated with OpenFlow client software. Figure 7: WLAN Controller in the SDN Architecture (Solution A) Figure 8: WLAN Controller in the SDN Architecture (Solution B) WLAN and Policy Management Apps OpenFlow (Flow Tables Management) WLAN Controller User Data Trafc Access Points (running CAPWAP Client) CAPWAP (Device Management) OpenFlow Client CAPWAP Server Existing L2/L3 function in WLAN Controller SDN Controller SDN Applications Integrated WLAN and SDN Controller OpenFlow (Flow Tables Management) CAPWAP (Device Management) User Data Trafc Access Points Radio Mgmt OpenFlow Client CAPWAP Client Roaming Policy Control QoS Analytics OpenFlow Client CAPWAP Client Existing L2/L3 Functions in WLAN Controller SDN Controller CAPWAP SDN-ENABLED BROADBAND ACCESS SOLUTION Service providers are discovering ways to optimize their network architecture to save on the CAPEX, to reduce OPEX, and to roll out innovative services quickly. OEMs can enable service providers to significantly cut down on costs and provide additional monetizable services to their customers by developing SDN- enabled solutions. One such solution for service providers is virtualizing network functions such as Customer Premise 7 Realizing OpenFlow Switches with Aricent Frameworks international private line. SDN architecture expects OSS solution to become more open > OSS architecture has to migrate from proprietary/non- standard network management technologies to standard SDN-based management technologies (e.g., OF Cong and OpenFlow protocols) > Network management interfaces have to be abstracted to simplify the management of networks in a multi-vendor deployment > Enabling programmability and dynamic provisioning of network services (e.g., dynamically varying bandwidth for applications instead of statically provisioning of bandwidth) OEMs can help service providers solve the above challenges by building products with Aricents OpenFlow client framework, which provides the following benets for a carrier network solution: > Standards-compliant OpenFlow implementation that interoperates with popular SDN controllers in the market such as Floodlight, Trema, and NOX > Supports multiple flow tables for service providers to congure policies such as QoS and rate-limiting > Scales up to 1 million ow entries in the software and is ideal for deployments in edge routing or switching products > Supports hybrid architecture for coexistence with legacy routers/switches in the core or on the edge Equipment (CPE) and Broadband Remote Access Servers (BRAS). Today, CPE provides a number of network functions such as rewall, access control, policy management, and discovering/ connecting devices at home using DLNA or UPnP. Service providers can cut cost, by embracing SDN and by virtualizing the CPE functions. In an SDN architecture, OpenFlow can be used for ow-table management in Residential Gateway (RG). Aricents OpenFlow client framework can be integrated into existing or new RG solutions. The following are some benefits of using Aricents Intelligent Switching Solutions (ISS) and OpenFlow client for virtualized applications: > Scalable for low CPU/memory footprint deployments such as RGs and CPEs > Supports hybrid architectures where the CPE is connected to both legacy and SDN-enabled networks > Licensable as a complete solution (i.e., OpenFlow-enabled residential gateway solution) or a standalone OpenFlow client-stack framework SDN-ENABLED CARRIER NETWORK SOLUTION Software Dened Networking (SDN) is forcing service providers to redene their network architecture. Some of the challenges faced by service providers in migrating to SDN architecture are: > OSS typically has point solutions designed to manage a range of services such as IP, VPN, VOIP, video conferencing, and Residential Gateways OF Cong (Device Mgmt) OF Cong OpenFlow (Flow Mgmt) RG Flow Tables NAPT Bindings Data Forwarding SDN Controller Route Calculation and Propagation Device Management Network Monitoring vCPE Access Functions (DHCP, PPP/oE, DLNA/UPnP, SNTP) Policy Management (Firewall, ACL, Rate-Limiting, etc.) OpenFlow Client Thin ISS Thin ISS OpenFlow Client Thin ISS SDN Controller Cloud Cloud Controller vCPE Internet > > > > > > > > Figure 9: Aricents vCPE Solution 8 Realizing OpenFlow Switches with Aricent Frameworks Conclusion Aricents OpenFlow frameworks enable equipment vendors to gain competitive edge in the fast-growing OpenFlow/SDN market. Aricents OpenFlow client is pre-integrated with our industry leading ISS solution, which can be leveraged to build hybrid OpenFlow switches and routers. The OpenFlow client is platform- agnostic and pre-integrated into leading silicon platforms. Aricents OpenFlow Fast Path Accelerator on Intels DPDK and reference porting layer implementation for leading silicon platform ofers compelling advantages to equipment vendors by oferingworld- class design, development, testing, and sustenance services to help customers bring innovative SDN and OpenFlow solutions to market. Coupled with Aricents deep domain expertise in data center, transport, and enterprise networks, we help deliver solutions across the SDN spectrum. For more information, visit aricent.com/software/software-dened-networking.html MADHAVI RAVANAN is a Senior Manager at Aricent, driving strategic technology initiatives in wireline across OpenFlow/SDN, NFV, WLAN and Cloud. madhavi.ravanan@aricent.com SARO VELRAJAN is a director of Technology at Aricent. He has 15 years of experience working for companies such as Cisco, Ericsson, and Juniper, specializing in broadband access, WLAN, content delivery, and software-dened networks. saravanan.velrajan@aricent.com Inventory & Audit Manager Accounting Server Analytics and Reporting Device Cong Manager Alarms & Events Manager Bandwidth Management Topology Manager OpenFlow Client Existing L2/L3 Functions Network Monitor Route Manager API for Integration with Northbound System (Service Provisioning/Activation, etc.) Network Operation and Control (NOC) Logs Collector Subscriber Database and Policy Server Network Monitoring Console SDN Controller Notherbound API Notherbound API Analytics and Statistics Traps or Events NMS Core Network OF Cong Based Device Conguration (OpenFlow Management and Conguration Protocol) OpenFlow (Route Provisioning Network Monitoring Topology Updates) Hybrid Edge Router OpenFlow Client Existing L2/L3 Functions OpenFlow Client Existing L2/L3 Functions Figure 10: SDN-Enabled Carrier Network 2014 Aricent. All rights reserved. All Aricent brand and product names are service marks, trademarks, or registered marks of Aricent in the United States and other countries. frog, the global leader in innovation and design, based in San Francisco is part of Aricent. The companys key investors are Kohlberg Kravis Roberts & Co. and Sequoia Capital. info@aricent.com Aricent is the worlds premier engineering services and software company. We specialize in inventing, developing and maintaining our clients most ambitious initiatives. Combining more than 20 years of engineering expertise with a force of more than 10,000 dedicated product engineers, Aricent is the only company in the world that list of global companies, bringing the next generation of breakthrough, innovative products to market.