Optimising nfv service chains on open stack using docker
-
Upload
satya-sanjibani-routray -
Category
Technology
-
view
175 -
download
0
Transcript of Optimising nfv service chains on open stack using docker
Optimizing NFV Service Chains on OpenStack using DockerMeenakshi Sundaram Lakshmanan, Rahul Krishna Upadhyaya, CB Ananth Padmanabhan, Satya Routray.
28 Apr 2016
2© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Docker – What is it ?
Docker containers wrap up a piece of software in a complete filesystem that contains everything it needs to run: code, runtime, system tools, system libraries – anything you can install on a server. This guarantees that it will always run the same, regardless of the environment it is running in.
3© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Docker Instance vs Virtual Machine
4© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Better utilization of resources, hence higher density of workloads.
• Hyper-call overhead is reduced since there is no hypervisor layer. With SR-IOV/DPDK near metal perf
• Faster provisioning and easier Devops, easy to replicate, share.
Advantages
Challenges• Docker had issues with mutli-host networking. Solved using overlay since Docker
Version 1.9.
• Docker has security related challenges. VM generally termed as more secure given the isolation.
• Performance of network functions. Many of which have been addressed with DPDK/SR-IOV with some trade-offs
Docker Instance vs Virtual Machine
5© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• They are network appliances other than switches and routers.• Deployed for increasing security and performance• Very effective solution for ServiceAssurance, Traffic Analysis, Traffic filtering
etc.,
Drawbacks
• Hardware middle boxes are difficult to manage• Difficult to scale on demand• Virtual middle boxes (NFV) need an orchestrator to provision them• In a public cloud environment, placement of virtual components may not be
always under control
Middle Boxes
6© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
SDN (Software Defined Networking) : It is an approach to computer networking that allows network administrators to manage network services through abstraction of higher-level functionality.
NFV (Network Function Virtualization) :It is a network architecture concept that uses the technologies of IT virtualization to virtualize entire classes of network node functions into building blocks that may connect, or chain together, to create communication services.
SFC (Service Function Chaining) : It consists of a set of network functions, such as firewalls or application delivery controllers (ADCs) that are interconnected through the network to support an application.
SDN, NFV and SFC
7© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• SDN and NFV solve independent problems, and are even more effective when they work together.
• They simplify the service chaining process by reducing the number of devices a data packet needs to travel through
• Answers the questions of ‘who controls what’ from ‘what runs where’
• Allows a Service Provider to create service chains for each type of traffic and provide multitenancy through the cloud infrastructure
SDN or NFV?
8© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Open Networking FoundationAs SDN and NFV gained popularity, there was a need to create a standard way for SDN to control Network functions. Hence ONF was formed
OpenFlowWidely considered the first SDN standard. Defines a model for how traffic is organized into different flows and how it can be controlled centrally.
OpenDayLightAn Opensource SDN project hosted by the Linux Foundation, which supports many protocols including the OpenFlow protocol. Offers a complete functional SDN platform without the need for any other component.
OPNFVLinux Foundation introduced another platform, Open Platform for NFV, an integrated platform that brings together Enterprises, Service Providers, Cloud & Infrastructure vendors and customers to accelerate innovation & deployment of NFV
SDN & NFV today
9© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Firewalls
• Packet Filters
• Virtual Routers – quagga, openwrt
• Load Balancers
• WAN Optimizers
• Intrusion Detection
• Virtual CPE
Network Functions
10© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
NFV in Container and Docker World
• Consistent and quick way of deploying and re-deploying NFVs
• Very easy to scale on demand
• Low latency
• No Hypervisor overload
• Presence of established tools to deploy and manage containers
• There is lot of work underway in bringing NFV and Containers together
11© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Service chaining the network traffic locally.
• Having faster, re-useable, dynamic NF deployments with low overhead of NFs to the infrastructure.
• Avoiding the loss in performance of the network functions due to virtualization overhead.
What are we trying to achieve
12© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Solution Design – Deployment
k
Host1
Host2
Host3OpenStack Controller
Nova
Neutron
Glance
Cinder
…
Service Controller
Can make admin calls to OS services
Dockerd
Dockerd
Dockerd
Docker Registry
KVM
KVM
KVM
VM VM
VMVM
VMVM
VMVM
VMVM
VMVM
AGENT
AGENT
AGENT
SFC
SFC
SFC
SFC
SFC
SFC
Tenant1
Tenant2
Tenant3
13© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Design – Per Node
Docker Daemon
OVS
Agent
Each Host in OS Cloud
VM
VM
VM
DockerNetworkFunction Docker
NetworkFunction
DockerNetworkFunction
Service Function Chain
KVM
Exteranal Communication via Host NIC
Configures
Man
age
s
Controller
Connection to SDN Controller (Ex. ODL)
14© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
How it Flows
Docker Daemon
OVS
Agent
Each Host in OS Cloud
VM
VM
VM
VirtualFirewallDocker
InstancevRouterDocker
Instance
Service Function Chain
KVM
Exteranal Communication via Host NIC
Configures
Man
age
s
Controller
21
3
4
4
15© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
How it Service Chains – Routing between VNFs
Switch Match Action
local input port: 1, src ip: VM1 output port: 2
local input port: 2, src ip: VM1 output port: 3
local input port: 3, src ip: VM1 output port: 4
OpenVswitch (local)
VM1
1
2 3
4
FirewallVRouter
Flow Table
External Nic
Depending upon what the VNF needs to do, different kind of routing models could be used.
16© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Advantages of the DesignHigh Density – Better utilization of resources.
Performance – Near metal performance of network functions by using SR-IOV/DPDK. No hyper-call overhead due to usage of containers as Network Functions.
Low Latency – Service chaining completed locally. The packets don’t have to move through lengths of the cloud to get processed.
Docker native advantages – Taking advantage of native docker advantages like quicker build/ship model carried forward.
Public cloud model– Will work well with clouds deployments where you have no control over placement of infrastructure components.
17© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Implementation - Areas of Work
Running Docker and KVM on the same host machine - Changes on the compute-scheduler - Changes on the OVS agent side (Cleanup)
Configuring the OVS - Creating service chains using OVS-OpenFlow Rule Modification - Performance, HA and load-balancing. - Choose the best kind of routing of packets based on type of NFV
Docker Daemon Interactions - Creating network function containers on demand. - Tenant based visibility/segregation of the docker containers. - Storing of Stateful docker images for VNFs Implementation of the Controller & Agent.
18© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Q&A
OpenStack SummitAustin, Texas 2016