Enabling Active Flow Manipulation In Silicon-based Network - - PowerPoint PPT Presentation

▶
enabling active flow manipulation in silicon based
SMART_READER_LITE
LIVE PREVIEW

Enabling Active Flow Manipulation In Silicon-based Network - - PowerPoint PPT Presentation

Apr 06, 2024 605 likes •957 views

Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines Tal Lavian - tlavian@ieee.org Phil Wang, Ramesh Durairaj, Jennifer Rasimas, Doan Hoang, Franco Travostino. Nortel Networks, Advanced Technology Labs Open Source -

slide-1
SLIDE 1

May 28-29, 2002 1

DANCE Exposition

Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines

Tal Lavian - tlavian@ieee.org Phil Wang, Ramesh Durairaj, Jennifer Rasimas, Doan Hoang, Franco Travostino. Nortel Networks, Advanced Technology Labs Open Source - http://www.openetlab.org

slide-2
SLIDE 2

May 28-29, 2002 2

DANCE Exposition

Outline of the talk

  • AN technology Transfer
  • Issues in the realization of AN technologies
  • Main contributions of the paper.
  • Commercial Active Services Platform
  • Application Example 1 – SSL
  • Application Example 2 – ASF
  • A Demo Application
  • Next Generation Active Services Platform
  • Conclusion
slide-3
SLIDE 3

May 28-29, 2002 3

DANCE Exposition

AN Technology Transfer

Great Ideas

Usable/Realizable Mechanisms/Products

Active Nets Community Active Nets Ideas Active Nets Community Active Nets Ideas Real Active Services Products

Internet

Realistic Mechanisms

Scan the technology horizon

slide-4
SLIDE 4

May 28-29, 2002 4

DANCE Exposition

Any AN products?

Realistic Mechanisms Active Nets Community Active Nets Ideas Active Nets Community Active Nets Ideas

Experimental/Laboratory Platforms

Commercial Active Services Platform?

?

Nortel Networks Active Services Products

IDS IDS VPN VPN SSL SSL ASF ASF

Scan the technology horizon

slide-5
SLIDE 5

May 28-29, 2002 5

DANCE Exposition

Great Active Nets Community Solutions Great Active Nets Community Solutions

  • Active networks (AN) approach opens an exciting
  • pportunity for individual applications to define the

service provided by the network through programmability.

  • Active Networks technologies expose a novel approach that

allows customer value-added services to be introduced to the network “on-the-fly”.

  • Active Nets program has produced a new network platform

flexible and extensible at runtime to accommodate the rapid evolution and deployment of network technologies.

  • The exciting opportunity exists for network service providers

and third parties, not just the network device providers, to program the network infrastructure and services.

slide-6
SLIDE 6

May 28-29, 2002 6

DANCE Exposition

AN issues AN issues

  • AN requires substantial supports from a NOS
  • AN introduces substantial software component, hence

delay on the data path

  • AN lacks adequate measures to addressing integrity

and security of network devices.

Lack of industrial-strength Active Network devices that dispel major concerns:

slide-7
SLIDE 7

May 28-29, 2002 7

DANCE Exposition

Main contributions of the paper

  • Active Flow Manipulation Concept

— Flow abstraction — Actions on Flows — Control/Data separation

  • Openet Platform

— Commercial Network Devices — Runtime Environment — Active Services

  • Applications
slide-8
SLIDE 8

May 28-29, 2002 8

DANCE Exposition

Active Flow Manipulation

Forwarding Processor Forwarding Processor Packet

Policy Filters

AFM

Packet Filter Packet Action

  • A key enabling

technology of Openet

  • Two abstractions

— Primitive flows — Primitive actions

  • Customer network

services exercise active network control

— Identifying specific flows — Apply actions to alter network behavior in real- time

slide-9
SLIDE 9

May 28-29, 2002 9

DANCE Exposition

L2-L7 Filtering Capability

  • Source Address
  • Source Port
  • Destination Address
  • Destination Port
  • Protocol
  • VLAN
  • Diffserv Code Points
  • Content Filtering
  • Cookies Filtering
  • Flow redirection
  • Stop/Forward flow
  • Change DSCP field
  • Set VLAN priority
  • Adjust priority queue
  • Modify session table
  • Parsing request header
  • Parsing application

contents

Active Flow Manipulation

Dynamic L2-L7 Filtering

slide-10
SLIDE 10

May 28-29, 2002 10

DANCE Exposition

CPU

JVM

… MEM

JNI/Native Code ORE JFWD

Filtered packets New forwarding rules

Forwarding Engine

Monitor status

User Oplets OpletService, Shell, Logger Jcapture, HTTP, IpPacket Standard Services ANTS Firewall, DiffServ Application services Function Services

Control Plane Data Plane

Openet: An active service platform

slide-11
SLIDE 11

May 28-29, 2002 11

DANCE Exposition

Openet Alteon Active Services Platform = A Powerful Platform for AN Technologies Transfer

  • A powerful and

extensible control and computational plane

— Partitioning hardware/software resources — Active service enabling — Content filtering in real- time — Active services accommodation

Optical Wireless

router Content gateway Edge Device

Content Aware Computation Power Dynamic Service Enabling

Active Services

slide-12
SLIDE 12

May 28-29, 2002 12

DANCE Exposition

Nortel Networks’ contributions to Active Services

  • Practical Active Services Architecture on real network device.
  • First Commercial Active Services platform.

— ASF - Product — SSL – Product — Open Active Architecture for more product — Alteon+iSD as a research platform — L3 programmable routing switch PP8600 – used by research community — Photonic Switch – Early prototype

  • Identify Active applications (More than Ping )

— Active VPN – Carrier A — Active fault diagnostic – Carrier A — Active SLA reliability — Active Extranet on Demand – CeNTIE- Media post production industry — Early stages in disaster recovery and fault tolerant networks

slide-13
SLIDE 13

May 28-29, 2002 13

DANCE Exposition

Strong computation power inside network device.

Intercepts selected flows and performs intelligent processing based on L2-L7 filtering

The emphasis is on interception and processing transparently. Entities at both ends may not be aware of the existence of the Alteon in the path

Users Servers Active Services Platform Active Services Platform Active Services Platform Active Services Platform Active Services Platform Active Services Platform Active Services Platform Forwarding Computation

Up to 256 Linux based engines

slide-14
SLIDE 14

May 28-29, 2002 14

DANCE Exposition

Active Service – Example 1 ASF – Alteon Switched Firewall A Real Product

This slide is from the official product literature!!!

slide-15
SLIDE 15

May 28-29, 2002 15

DANCE Exposition

Alteon Switched Firewall (ASF) A Real Product

Servers

Runtime Environment For Active Services

AFM Action

  • n the data Flow

AFM Flow (Req.) Selection

data for the session

Active Services Download

1st pkt 1

Active Service: Policy Checking

Data 2

slide-16
SLIDE 16

May 28-29, 2002 16

DANCE Exposition 1st pkt 1 1 Add Conn. 1 Data for the session accelerated 2 Delete Conn. after UDP timeout if session is inactive 3

Servers

AFM Flow Selection

Active Service: Policy Checking

AFM Action

  • n the Flow

Active Services Download Runtime Environment For Active Services

Alteon Switched Firewall (ASF) A Real Product

slide-17
SLIDE 17

May 28-29, 2002 17

DANCE Exposition

Secure XL & NAAP in Action

TCP session

SYN 1 Policy Check 1 1 Add Conn. (F2F) 1 SYN/ACK 2 Update Conn. 3 TCP 3-way handshake complete, data for the session accelerated 4 FIN-1 5 Update Conn. 5 FIN-2 6 ACK 7 Update Conn. 6 Delete Conn. 7

Alteon Switched Firewall (ASF) Clients Servers

ACK 3

(TCP 3-way handshake complete)

slide-18
SLIDE 18

May 28-29, 2002 18

DANCE Exposition

AFS as an Active Service Technology

  • The Alteon selectively redirects new connection

requests to the Alteon Switched Firewall Director to perform policy checking.

  • The Director runs the Check Point FireWall-1

engine as an Active Service.

  • The Active Service manages the connection table,

specifies rules for handling packets in the session, passes the connection table to the Alteon Switched Accelerator.

  • 90% of traffic is accelerated, supporting a

throughput of 3.2 Gbps.

slide-19
SLIDE 19

May 28-29, 2002 19

DANCE Exposition

SSL Acceleration

How Does the iSD-SSL Accelerator work? How Does the iSD-SSL Accelerator work?

HTTPS, SMTP-S, POP3-S and IMAP-S services

  • Client sends an HTTPS request
  • Switch redirects request on port 443

to iSD-SSL

  • iSD-SSL completes SSL handshake
  • iSD-SSL initiates HTTP connection to

server on port 80

  • Switch selects real server based on

configured LB policy

  • Server responds to HTTP request

and replies to the iSD-SSL

  • iSD-SSL encrypts session and sends

HTTPS response to client

This slide is from the official product literature!!!

slide-20
SLIDE 20

May 28-29, 2002 20

DANCE Exposition

SSL Acceleration Cont

Servers

Policy Check Conn. Splice Encrypt Decrypt Server Selection AFM Action

  • n the data Flow

AFM Flow (Req.) Selection

data for the session accelerated

Active Services Download Runtime Environment For Active Services

Data Accelar

slide-21
SLIDE 21

May 28-29, 2002 21

DANCE Exposition

On the Horizon: Alteon Security Cluster

Acceleration and intelligent integration of security applications Security Appliance

Application Plane

NAAP

Control Plane Controller of accelerated sessions Single point of secure central management BBI, CLI, SSI, Plug and Play Management Plane IDS IDS IDS Fir Fi Firewall SSL SSL SSL

Security Accelerator

Data Plane Switch based acceleration of session data Nortel Appliance Acceleration Protocol

(Enables application control of switch sessions)

IDS IDS

URL Filtering

Fir Fi VPNs SSL SSL

Virus Scan

slide-22
SLIDE 22

May 28-29, 2002 22

DANCE Exposition

Security Cluster

Application Clusters Security Dashboard

Intelligent Flow Management SSL FW VPN IDS Virus

Scanning

URL

Filtering

SSL FW VPN IDS Virus

Scanning

URL

Filtering

SSL FW VPN IDS Virus

Scanning

URL

Filtering

SSL FW VPN IDS Virus

Scanning

URL

Filtering

SSL FW VPN IDS Virus

Scanning

URL

Filtering

SSL FW VPN IDS Virus

Scanning

URL

Filtering

slide-23
SLIDE 23

May 28-29, 2002 23

DANCE Exposition

Disaster Recovery Demonstration

  • Early Prototype
slide-24
SLIDE 24

May 28-29, 2002 24

DANCE Exposition

Control Mesg

Disaster Recovery concept Active Services on 10GE All-Optical Switch

8600 8600 Photonic Switch Prototype 8600 10G 10G 10G 1G 1G 1G A B C D X Y Z

B2 B3

Nortel’s Active Services

Alteon

NAS

Alteon

NAS

Alteon

NAS

EvaQ8 OG - 1 EvaQ8 OG -2 EvaQ8 OG - 3

1. Normal App flow : Client X -> Server Z 2. Disaster Strikes at Location Z 3. EvaQ8 OG 3 sends a signal to OG1 4. OG1 instructs Photonic Switch to connect B2 & B3 ; Server Z and Server Y data syncd 5. On successful sync, OG2 instructs Photonic switch to connect B1->B2. 6. Service Restored for Client X ->server Y

Disaster Event/

  • Environ. Sensor

B1

Control Mesg

NAS NAS NAS

slide-25
SLIDE 25

May 28-29, 2002 25

DANCE Exposition

A Disaster Discovery Application

Policy Check Service Oplet Management Action Connection Setup AFM Flow (Req.) Selection

data transfer between centers

Active Services Download Runtime Environment For Active Services

Event Request

Control Plane ATI Photonic Switch

slide-26
SLIDE 26

May 28-29, 2002 26

DANCE Exposition

What after next?

Service-centric Active Nets Platform

SERVICES

Manage Service Enabling Control Impedance Matching Intra-Service Comm Security
  • Service Enabling API
  • Control API
  • Impedance Matching API
  • Security API
  • Management API
  • Intra-service Communications API
slide-27
SLIDE 27

May 28-29, 2002 27

DANCE Exposition

AN Collaboration: CeNTIE – CSRIO- Nortel

Tele-Health Focus Group

  • Royal Australian College of Surgeons
  • Medic Vision
  • University of Sydney
  • NSW Health
  • Royal Prince Alfred
  • Interactive Virtual Environment Centre

(IVEC).

  • Centre for Medical and Surgical Skills

(CTEC).

Media Systems Focus Group

  • Fox Studios
  • Animal Logic
  • GMD
  • Ambience
  • Film Industry Broadband Resource

Enterprise (FIBRE)

  • WAM!NET
  • Australian Broadcasting Corporation (ABC)
  • ScreenWest

Center for Networking Technologies for Information Economy (CeNTIE) - a CSIRO-led consortium including Nortel Networks, Amcom Telecommunications, the UNSW, UTS and the WA Interactive Virtual Environments Centre (IVEC). www.centie.net

slide-28
SLIDE 28

May 28-29, 2002 28

DANCE Exposition

1st Expl: Collaboration with a Major Carrier

  • A major Carrier is interested in some aspects of the

research and technologies incubated by the AN community 

  • The main value is to role out new services – and fast

— Active VPN — Active Fault diagnostic

  • Unfortunately - the current market condition slowed

down the interest (great direction – but no money now)

slide-29
SLIDE 29

May 28-29, 2002 29

DANCE Exposition

Summary of Our Work

  • We have inspired ourselves to active networks concepts
  • Demonstrate Active Networks technology transfer through

Nortel Active Services platform.

  • We have implemented programmable Gigabit Routing

Switch (backplane 256 Gbs)

— New Active Services platform: Openet + Alteon + iSD

  • Active Services in the control plane (slows down in the data

plane)

— AFM abstraction

  • Capable of dynamic monitoring and modification of silicon

knobs

— The granularity is streams and not packets — Short time granularity (part of apps and not human intervention, keyboard, telnet, cli, snmp)

slide-30
SLIDE 30

May 28-29, 2002 30

DANCE Exposition

Summary of Our Our Work (cont.)

  • Enabling New Types of intelligence on

programmable network device to handle Infinite Bandwidth resources, Wire speed routing capability, and nontrivial Streaming media application.

  • Important next step is the development of a

Service-centric Active Services Platform.

slide-31
SLIDE 31

May 28-29, 2002 31

DANCE Exposition

Q&A Q&A

OpenetLab – Nortel Networks: http://www.openetlab.org/

slide-32
SLIDE 32

May 28-29, 2002 32

DANCE Exposition

Client And Server Authentication

User opens session

1 2

Sends server certificate Requests client certificate

3

Serves request/response

7

Send encrypted data to back end

6

Validates the client certificate info.

5

Private key Confidential Client sends the certificate with public key

4

Public key Published

slide-33
SLIDE 33

May 28-29, 2002 33

DANCE Exposition User connections Intelligent Processing such As Load Balancing, Optimizing Bandwidth, Specialized services Server Server Server Server Server Server Balancing servers Connections terminate at the Alteon

iSD iSD iSD iSD

Balancing iSDs Balancing can be based on

  • load, or
  • Functionality

Powerful generic processors do not have the filtering capability of the Alteon. That is if they have to do the same thing as the Alteons, they have to do filtering in software, hence slow.

  • An API is needed for exploring this filtering capacity

Strong computation power inside network device.

Load balance of iSDs (and servers)

slide-34
SLIDE 34

May 28-29, 2002 34

DANCE Exposition

Content Re-route

Optical Ring

Mirror Server Data Server

  • Resource optimization (route 2)

— Alternative lightpath

  • Route to mirror sites (route 3)

— Lightpath setup failed — Load balancing — Long response time – Congestion – Fault

Route 1 Route 2 Route 3