SDNopenflow在运营及大型网络中的挑战.pdf

The Challenges of SDN/OpenFlow in an Operational and Large-scale Network Jun Bi Tsinghua University/CERNET OPEN NETWORKING SUMMIT April 17 2012 Outline • Intra-AS (campus level) IPv6 source address validation using OpenFlow (with extension) – Good for introducing new IP services to network • Planning next step if we run SDN as a common infrastructure for new services and architectures – Some personal viewpoints and thoughts on design challenges – Forwarding abstraction for Post-IP architectures – Control abstraction for scalable NOS and programmable /manageable virtualization platform – Inter-AS policies negotiation abstraction Source Address Validation • Source address spoofing still a problem – Arbor annual net. sec. report, MIT spoofer project, NANOG discussions • False positive of uRPF due to generating filtering without global knowledge – e.g. asymmetric route, static route, fast reroute, ECMP • We proposed CPF (Calculated Path Filtering) – An intra-AS source address validation (campus level) – Calculating Path Filtering based global knowledge – Implemented with SNMP, xFlow and Telnet in IP network – Deployed in 100 IPv6 campus networks of CERNET2 – New version using Openflow CPF Overview Polling routing table by SNMP Receive sampling Deploy ACL packet by xFlow by telnet Calculate Generate Path Filter Src(inIf1)A1(inIf2)A2……(inIfn)Dst Src, Dst, inIF