NFV and SDN Convergence Perspectives

A clean-slate perspective on where NFV and SDN meet Sylvia Ratnasamy In collaboration with the SPAN group at U.C. Berkeley

Clean slate throw everything out Does mean we start top down only keep what s needed Result is simpler, more streamlined systems vital for performance and extensibility

CDN from customer port FW QoS IDS Global Network View Router View Opt WAN opt Opt Router View Forwarding Forwarding IDS Router View Router View IDS IDS FW Forwarding IDS Firewall Forwarding Forwarding Slides from Nick McKeown, Stanford Univ.

C D N Q o S F W I D S Control Program Control Program Control Program FW Global Network View IDS Opt IDS Opt IDS Opt Opt Forwarding Forwarding IDS IDS FW Forwarding IDS Forwarding Forwarding

`SDN v2 C D N Q o S F W I D S Control Program Control Program Control Program Global Network Viewjasjdlasjd C D N C D N Q o S F W Q o S F W I D S Forwarding Forwarding Forwarding Forwarding Forwarding

NFV should do more than replace monolithic hardware with monolithic software Today: Custom per-app solutions to scaling, failover, etc. Custom management and configuration APIs Limited ability to compose or extend apps C D N Q o S F W I D S

Contrast / Inspiration Modern data analytics systems (Spark, Hadoop, etc.) a programming model (map-reduce) but also a runtime framework Framework takes care of routine tasks and end-to-end coordination placement, scheduling, elastic scaling, failover, Need a runtime framework for NFV Frees app developers to focus on app logic Automates/consolidates management for operators

Frameworks role 1) Provide general solutions for common tasks Fault tolerance Dynamic scaling Performance isolation Diagnostics, 2) Provide end-to-end management of NFs Placement Composition End-to-end performance QoS Energy management,

A framework for NFV C D N I D S Q o S F W WAN optmizr WAN opt IDS IDS Firewall FWall NF Control framework functions + software switching hardware interconnect rich(er) API software switching OF OF

Implications For NF vendor write core app logic provide some NF-specific information For operator write high-level policy pipeline select NFs provide some hardware information Framework automates pipeline execution automated response to load changes, failure, etc.

Remainder of this talk C D N Q o S F W I D S Details in ACM SOSP 2015 paper E2: A runtime framework for NFV

Questions How do we express NFV jobs? policy `pipelets How do we execute pipelets? Sizing: how many NF instances? Placement: where do we place NF instances? Composition: how do we steer traffic between NFs? Dynamic Scaling: adapting to traffic changes Fault Tolerance: how we recover from failures? SLAs: how do we provide latency/throughput guarantees? FTMB paper @ SIGCOMM 15 WIP 12

Outline Pipelets: how we express NFV jobs How we execute pipelets system architecture functions: sizing, placement, scaling, composition Results 13

Parental Control safe, URL=utube From customer ports Web Cache Traffic Shaper safe, tcp-port=80 IDS safe, tcp-port!=80 Logger Defined on packet header Defined on packet bytestream Defined on application semantics 14

E2: Operator Interface Pipelet: a traffic-class policy-graph statement traffic-class: defined on packet headers and ports policy-graph: defines how traffic is processed by NFs nodes are NFs edges annotated w/ a list of <attribute, value> pairs optional: estimate of the traffic load on an edge Declarative, extensible, and end-to-end 15

Outline Pipelets: how we express NFV jobs How we execute pipelets system architecture functions: sizing, placement, scaling, composition Results 16

E2 Cluster internal ports external ports Hardware switch Servers 17

E2 manager OpenStack ODL/ONOS p2 123.4.5.* NFs 19.4.5.*.* p7 87.98.65.* D flow table software switch Hardware switch Servers 18

NF NF NF Virtual ports (vports) Flow table API: add/rm match-action rules Physical ports (pports) Traditional virtual switch (e.g., OVS) 19

NF NF NF NF NF NF BESS: a modular SW switch (https://github.com/NetSys/bess) Traditional virtual switch (e.g., OVS) 20

NF NF NF vports `bytestream vports per-packet metadata rich API (add/remove modules) E2 modules for dynamic scaling, composition, etc. BESS: a modular SW switch (https://github.com/NetSys/bess) 21

E2 Operates on Three Inputs 1. Policy pipelets 2. Network Function (NF) description Attributes: which attributes an NF exports and how (attribute, value) method bindings Current methods: vports and metadata e.g., (is_safe, TRUE) vport#4 e.g., (URL, *) metadata#2 22

E2 Operates on Three Inputs 1. Policy pipelets 2. Network Function (NF) description Attributes: which attributes an NF exports and how Affinity: traffic aggregate an NF acts on e.g., per flow , per prefix , per port 23

E2 Operates on Three Inputs 1. Policy pipelets 2. Network Function (NF) description Attributes: which attributes an NF exports and how Affinity: traffic aggregate an NF acts on Performance profile (optional) e.g., per-core throughput 24

E2 Operates on Three Inputs 1. Policy pipelets 2. Network Function (NF) description 3. Hardware description capabilities of HW infrastructure e.g., #cores/server, #ports/switch, bandwidth/link, 25

E2 Operation NF descriptions Sizing Policy pipelets HW description instance graph policy graph 26

E2 Operation NF descriptions Sizing Placement Policy pipelets HW description Internal ports External ports Servers Switch fabric instance graph 27

E2 Operation NF descriptions Sizing Placement Policy pipelets HW description Goal: minimize switch traffic A graph partitioning problem E2 uses Kernighan-Lin algo. Initial placement: O(n2log n) Incremental placement: O(n) Internal ports External ports Servers Switch fabric

E2 Operation NF descriptions Sizing Composition Placement Policy pipelets HW description Internal ports External ports Servers Switch fabric 29

E2 Operation NF descriptions Sizing Composition Placement Policy pipelets HW description Involves appropriately configuring the HW and SW switches 30

Appropriate Composition What traffic should be sent to a NF based on pipelet s edge attributes with NF methods vports vs. metadata vs. header matching How traffic is sent packet vs. bytestream vports Which NF instance is traffic sent to affinity-aware traffic splitting through migration avoidance** eventually optimal load balance w/o complex state migration *Now an approved ETSI informative standard (#GS NFV-REL 002) 31

E2 Operation NF descriptions Sizing Composition Placement Policy pipelets HW description Load events 32

Outline Pipelets: how we express NFV jobs How we execute pipelets system architecture functions: sizing, placement, scaling, composition Results 33

What overheads does E2 add? Intel E5-2680 BESS runs on one core SW switch (BESS) Path Latency ( s) Gbps (1500B) Mpps (64B) NF BESS NF Baseline BESS (vport vport) 1.2 187.5 15.2 16% Header-Match 1.56 152.5 12.76 6% Metadata-Match 1.695 145.826 11.96 34

Do rich abstractions help performance? HTTP Logger URL extract metadata=X.com? URL=X.com? BESS BESS With metadata: GHz/Gb = 0.16 Without metadata: GHz/Gb = 0.27 41% reduction in cycles per packet 35

Do rich abstractions help performance? bytestream NFs URL filter Redundancy Eliminator IDS packet vports: GHz/Gb = 1.5 25% reduction in cycles per packet TCP assemblr URL filter Redundancy Eliminator IDS bytestream vports: GHz/Gb = 1.12 36

End-to-End Operation Nat NAT Firewall IDS VPN 40 Bandwidth (Gbps) 35 30 25 Input load (Gbps) 20 15 10 5 0 0 100 Time (s) Intel FM6000 switch : 48x 10Gbps ports, 2048 rule entries 4 servers (68 cores total): 1x Intel E5-2680 (2x10 cores), 3x Intel E5-2650 (2x8 cores) 37

End-to-End Operation Nat NAT Firewall IDS VPN 40 Bandwidth (Gbps) 35 Switch bandwidth consumed (16.4% higher than lower bound) 30 25 20 15 10 5 0 0 100 Time (s) Intel FM6000 switch : 48x 10Gbps ports, 2048 rule entries 4 servers (68 cores total): 1x Intel E5-2680 (2x10 cores), 3x Intel E5-2650 (2x8 cores) 38

End-to-End Operation Nat NAT Firewall IDS VPN 40 70 Bandwidth (Gbps) 35 Optimal CPU consumption 60 30 #Cores 50 25 40 20 30 15 20 10 10 5 0 0 0 100 Time (s) Intel FM6000 switch : 48x 10Gbps ports, 2048 rule entries 4 servers (68 cores total): 1x Intel E5-2680 (2x10 cores), 3x Intel E5-2650 (2x8 cores) 39

End-to-End Operation Nat NAT Firewall IDS VPN Actual CPU consumption; 22.7% above optimal #NF instances varies between 22-56 40 70 Bandwidth (Gbps) 35 60 30 #Cores 50 25 40 20 30 15 20 10 10 5 0 0 0 100 Time (s) Intel FM6000 switch : 48x 10Gbps ports, 2048 rule entries 4 servers (68 cores total): 1x Intel E5-2680 (2x10 cores), 3x Intel E5-2650 (2x8 cores) 40

Conclusion NFV needs a runtime framework simplifies NF development and management Interface: traffic-class NF-pipeline Design for a clean separation of concerns NFs implement app-specific processing Framework implements common functions Framework coordinates end-to-end execution 41

Thanks! 42