ONS2016

In the SDN Network environment, certificate-based authentication is mandatory for the SDN controller to be able to authorize and authenticate the network elements. However the certificate based authentication models we have today required changes and challenges to be adapted to the SDN environments.
I will present the current problem in the certificate based authentication models with SDN environment and the possible solution to overcome those problems:

-SelfSign certificate: key management and MITM attacks.

-Certificate Authority (local and public): generate and update certificate process during production environment. Compromised CA certificate will compromise all network elements that use CA Certificate.

-Distinguish between the secure channels over different network protocols (OpenFlow, Netconf, SNMP, .etc)

-The possible solutions from the academic and industry research

How to achieve an open networking framework has been discussed by the Open Networking community for several years. Progress has been made on many fronts to have each layer of the stack be independent (bare metal switch, NOS, controller, application). TTP has been touted as a means to drive abstraction at of ASIC functionality from the application developers. This vision requires ASIC vendors to work with NOS vendors so that different packet handling pipeline schemes in the ASIC can be leveraged and to date, only Broadcom ASICs have been discussed thus far.

Intent based networking changes the networking paradigm by describing what the network end-points need , rather than describing how to setup the network. In this model, and SDN controller becomes the intelligence that translates what is needed into specific protocols, interfaces, vendor-specific features, etc. This approach allows the description to be portable across multiple infrastructure implementations and makes "programming the network" available to millions of non-experts who need not be network engineers or software developers. In this panel, people building and deploying intent-based networks will talk about why they are doing so and what are the current challenges.

IBM recently showcased a system running 10,000 docker containers on a single IBM Power system. To network all those containers we need to create a virtual network that supports thousands of endpoints. How will virtual networks of this scale perform? How will they break?

We built virtual networks of varying scale and tested them as we would have tested physical networks, by measuring sustained throughput and latency. Physical networks are limited by I/O bandwidth. Container to container traffic within a host is bounded by available CPU resource. Available network bandwidth becomes a function of available CPU cycles, CPU cycles that must be shared with applications. This is a key factor when sizing large scale docker systems.

In this presentation I will describe how we performed this analysts, the problems we encountered and the approaches used to solve them.

The exponential growth in data traffic puts ever-increasing demands on the packet processing elements in the network, resulting in a need for high performance IP packet handling. This drives the emergence of a new generation of hardware-accelerated platforms as well as the creation of user space applications and libraries.
The drive towards scalable high-performance functions requires an open IP stack that is extendable and can enable great performance, ease of use and portability.

In the presentation Ulf Bragnell introduce OpenFastPath and show that it can provide up to 20x the performance of the native Linux Kernel for forwarding workloads. The presentation will also show how this stack will be needed for handling the growth of packet data in low latency networks like 5G, and many other applications.

While "intent" has been a buzz word during last few years, this presentation will discuss the practice of intent engine based on the insights gained in the NEMO project in OpenDaylight. NEMO abstracts a set of intent based language primitives for the declarative expression to simplify the service level network programming, and introduces automation for service deployment. It inspires the network application innovation by easily composing various network services.
This session will introduce the design on intent modelling, reusable template for service composition, and how the NEMO intent engine is implemented for the policy conflict resolution and network resource optimization. The progress of NEMO project in OpenDaylight will also be reported with different use case scenarios, one of which is jointly developed in the scope of the EU-FP7 NetIDE project.

The Northbound Interface (NBI) has been a topic of debate and confusion for years in the SDN controller and network operating system community. Primarily focused on making application development easier, the ONOS northbound provides multiple levels of abstraction to meet the requirements of different use cases. This talk will provide an overview of the northbound interfaces that are available in ONOS, as well as provide depth for select subsystems. For example, network control programs can use intents for network-centric policies, flow objectives for device-centric policies, and flow rules for per-table policies. This talk will also provide a discussion of the available mechanisms for NBI access (e.g. REST, Java interfaces, gRPC) and their merits.

To fully realize the potential of NFV/SDN technology, CSPs have to adjust their development and testing practices to address a number of unique requirements and challenges:
• Integrating multiple virtual appliances from different vendors
• Thoroughly testing virtualized network functions
• Ensuring coexistence between virtual networks and legacy network platforms, while enabling an efficient migration path to fully-virtualized networks that reuse operator OSS/BSS
• Managing and orchestrating numerous VNFs while protecting against attacks and misconfiguration
• Ensuring the appropriate level of resilience to HW and SW failures.

In this session, Trinh Vu will discuss practical solutions on how to tackle these challenges to successfully develop, test and implement NFV/SDN to enable NW teams to deliver more services to their customer and to respond quicker to market changes.

The NetIDE project has developed an SDN controller platform with a companion IDE that provides a true cross-platform development and deployment experience. The controller is based on a two-tier approach, with a layer of client controllers executing applications and a layer of server controllers driving the network elements which are orchestrated by a core module that included conflict resolution. The controller is available as an OpenDaylight project while the IDE can be installed on an Eclipse IDE through the Eclipse Market. In addition, our framework can also use ONOS as server controller. In our talk, we present the integrated framework and its workflow.

To achieve a dynamic and robust network control, one method is to add accommodated device control and network agility solutions coupled with existing systems. This can be achieved by OpenDaylight that constitutes a model-driven architecture. OpenDaylight’s service abstraction layer (SAL) design allows a clean separation of the application API from any southbound protocol plugins such as OpenFlow, NETCONF, OVSDB etc. Model-driven SAL (MD-SAL) is the OpenDaylight kernel that interfaces between different layers and modules using APIs to connect and bind requests and services for communication. This delivers a community of models of implemented services responsible for organized distribution and layering of functionality for both providers and consumers.
An overview of MD-SAL’s internals with an emphasis on creating MD-SAL based application for OpenDaylight will be provided.

We will present cutting-edge technologies for high-performance packet processing on general-purpose CPUs. We begin with Intel's Data Plane Development Kit (DPDK), a set of libraries and drivers that can be used to receive and send packets within the minimum number of CPU cycles, develop fast packet processing algorithms, and run third-party fast path stacks. We then turn to the Berkeley Extensible Software Switch (BESS) that picks up where DPDK leaves off: providing a modular framework for functions such as L2/L3 forwarding, IPsec, and firewalling. Developed jointly by UC Berkeley, Intel and AT&T, BESS offers both maximal extensibility and extremely high performance: outperforming current soft-switches for OPNFV usage models. This makes BESS ideal for custom applications---unlike monolithic software switches whose large baked-in feature sets consume resources and hamper extensibility.

It is recommended that attendees bring their laptops with them for this session.