<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px; font-family:Calibri,sans-serif">
<div>
<div style="font-family:Consolas">All,</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">As a VNF vendor we have been looking at ways to enable customers to simply</div>
<div style="font-family:Consolas">scale up (and down) VNF’s in complex virtual networks at scale. Our goal</div>
<div style="font-family:Consolas">is to help accelerate the deployment of SDN and VNF’s and more</div>
<div style="font-family:Consolas">specifically enable zero-trust security at scale for applications. This</div>
<div style="font-family:Consolas">requires the easy and fast deployment of Next Generation Firewalls (and</div>
<div style="font-family:Consolas">other VNF¹s) into the traffic path of any application.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Over the last several weeks we have created a prototype that implements</div>
<div style="font-family:Consolas">a simple VNF insertion approach. Before we do additional work we have a</div>
<div style="font-family:Consolas">couple of questions for the community:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Questions</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">1. This approach has the advantage of being very simple and works with</div>
<div style="font-family:Consolas">existing VNF¹s, does it make sense to the community?</div>
<div style="font-family:Consolas">2. If it is of interest how could it be improved and or enhanced to make</div>
<div style="font-family:Consolas">it more useful and consumable?</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Design Guidelines</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">At the start of the effort we created a set of design guidelines to</div>
<div style="font-family:Consolas">constrain the problem space.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* The goal is a Service Function Insertion (SFI) approach that is simpler</div>
<div style="font-family:Consolas">and easier to deploy than Service Function Chaining and is more applicable</div>
<div style="font-family:Consolas">to single function insertion or very short chains.</div>
<div style="font-family:Consolas">* The initial design target is DC/Enterprises where the requirements are</div>
<div style="font-family:Consolas">typically for insertion of a limited set of VNF¹s in specific network</div>
<div style="font-family:Consolas">locations to act on specific applications.</div>
<div style="font-family:Consolas">* Minimal changes to existing VNF, ours and others,</div>
<div style="font-family:Consolas">* Make the solution open to all VNF¹s.</div>
<div style="font-family:Consolas">* Leverage bump in the wire connectivity as this does not require L2 or L3</div>
<div style="font-family:Consolas">knowledge/configuration in the VNF.</div>
<div style="font-family:Consolas">* Firewalls want to inspect/classify all traffic on a link, so</div>
<div style="font-family:Consolas">pre-classifing traffic beyond ACL¹s is not necessary.</div>
<div style="font-family:Consolas">* Deploy on standard infrastructure; Openstack and Open vSwitch with</div>
<div style="font-family:Consolas">minimal changes</div>
<div style="font-family:Consolas">* Work with virtualization and containers and physical devices seamlessly.</div>
<div style="font-family:Consolas">* Insert and remove security is seconds, one of the drivers of the</div>
<div style="font-family:Consolas">requirement for speed is container deployment</div>
<div style="font-family:Consolas">* Simple to deploy and easy to debug is important - atomic insertion and</div>
<div style="font-family:Consolas">removal of VNF is an important aspect of this.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Approach</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">We have developed a prototype, roughly using the ovn4nfv model proposed by</div>
<div style="font-family:Consolas">Vikram Dham and others in OPNFV. The implemented prototype of ovn4nfv is</div>
<div style="font-family:Consolas">on OpenVSwitch 2.5 and Openstack Mitaka (development branch). I would like</div>
<div style="font-family:Consolas">to stress this is a prototype and not production code. My objective was to</div>
<div style="font-family:Consolas">prove to myself (and others) that the concept would work and then ask for</div>
<div style="font-family:Consolas">feedback from the community on level of interest and how best to design a</div>
<div style="font-family:Consolas">production implementation.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">I have called this effort service function insertion (SFI) to</div>
<div style="font-family:Consolas">differentiate from service function chaining (SFC). This approach is</div>
<div style="font-family:Consolas">simpler than SFC and requires minimal or no changes to existing VNF¹s that</div>
<div style="font-family:Consolas">act as a bump in the wire, but it will probably not handle long complex</div>
<div style="font-family:Consolas">chains or graphs. It can possibly handle chaining one or two VNF¹s in a</div>
<div style="font-family:Consolas">static manner, but not sure if it could go beyond that. I am open to</div>
<div style="font-family:Consolas">suggestions of how to extend/improve it.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The traffic steering is implemented by inserting 2 ingress and 2 egress</div>
<div style="font-family:Consolas">rules in the ovn-nb pipeline at ingress stage 3. These rules have a higher</div>
<div style="font-family:Consolas">priority than the default rules. The changes to OVN and rules are listed</div>
<div style="font-family:Consolas">in the implementation section.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The control plane is implemented in both Open vSwitch and in Openstack. In</div>
<div style="font-family:Consolas">Openstack there is a set of extension interfaces added to the</div>
<div style="font-family:Consolas">networking-ovn plugin. There are both CLI and REST API¹s provided for</div>
<div style="font-family:Consolas">Openstack and CLI for Open vSwitch.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The OVN model enables logical changes to the flow rules and Openstack</div>
<div style="font-family:Consolas">neutron plugin model allows separation of changes to extensions to the</div>
<div style="font-family:Consolas">networking-OVN plugin. I have however violated a few boundaries for</div>
<div style="font-family:Consolas">expediency that would need to be fixed before</div>
<div style="font-family:Consolas">this could be easily deployed.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">We are happy to contribute the code back to the community, but would like</div>
<div style="font-family:Consolas">to gauge the level on interest and solicit feedback on the approach. We</div>
<div style="font-family:Consolas">are open to any and all suggestions for improvements in both</div>
<div style="font-family:Consolas">implementation and approach.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Below I have given a rough overview of the implementation and the changes</div>
<div style="font-family:Consolas">I have made to the various code bases. Just to re-iterate this was done as</div>
<div style="font-family:Consolas">a quick prototype and was a learning experience in Openstack and Open</div>
<div style="font-family:Consolas">vSwitch on the way so the quality</div>
<div style="font-family:Consolas">of the code and architecture are not production ready. Links are provide</div>
<div style="font-family:Consolas">to my github repositories with the changes.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Implementation</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The approach atomically inserts rules into ovn-nb to intercept any traffic</div>
<div style="font-family:Consolas">going to or coming from a vm or a container, requires insertion of four</div>
<div style="font-family:Consolas">new rules. There are no other changes in Open vSwitch. While the prototype</div>
<div style="font-family:Consolas">is using a firewall as the VNF there is no requirement for that to be the</div>
<div style="font-family:Consolas">case any VNF that supports ³bump in the wire mode² should work.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">App-1 is the application that needs to be protected</div>
<div style="font-family:Consolas">FW-2 is the input port of the firewall</div>
<div style="font-family:Consolas">FW-1 is the egress port of the firewall</div>
<div style="font-family:Consolas">App-2 is an application talking to App-1</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The rules look like this:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Ingress Rules [App-1]</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* If dst-ip = app-1 and src-mac = fw-2-mac then dst = app-1 [Priority 250]</div>
<div style="font-family:Consolas">* If dst-ip = app-1 then dst = fw-2 [Priority 200]</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Egress Rules [App-1]</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* If src-ip = app-1 and src-mac = app-1 then dst = fw-1 [Priority 250]</div>
<div style="font-family:Consolas">* If src-ip = app-1 and src-mac = fw-1 then dst= app-2 [Priority 200] </div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">This enables the deployment of a zero trust model of security for any</div>
<div style="font-family:Consolas">application. We would envision that the deployment of an application would</div>
<div style="font-family:Consolas">be "wrapped" with security to ensure that security is consistently and</div>
<div style="font-family:Consolas">always deployed.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Open vSwitch Changes</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">In OVN the interface looks like:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">$ ovn-nbctl lservice-add LSWITCH, LAPP-PORT, LSERVICE-PORT-IN,</div>
<div style="font-family:Consolas">LSERVICE-PORT-OUT [NAME]</div>
<div style="font-family:Consolas">$ ovn-nbctl lservice-list LSWITCH</div>
<div style="font-family:Consolas">$ ovn-nbctl lservice-del NAME</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The prototype is tailored to inserting a Next Generation Firewall (such as</div>
<div style="font-family:Consolas">Palo Alto¹s implementation). However I have made no changes to our</div>
<div style="font-family:Consolas">Firewall to support ovn4nfv. The solution will work with any ³bump in the</div>
<div style="font-family:Consolas">wire² VNF. The prototype assumes that the</div>
<div style="font-family:Consolas">VNF has two data plane interfaces but the solution would work with a</div>
<div style="font-family:Consolas">single interface, if the ³add² operation only has one interface the rules</div>
<div style="font-family:Consolas">would be changed slightly internally to support an VNF with a single port.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The only changes I have made to OVN are as follows:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* ovn-nb.ovsschema: Added a new table to support lservice</div>
<div style="font-family:Consolas">* ovn-nb.xml: To document the schema</div>
<div style="font-family:Consolas">* ovn-nbctl.c: Added CLI commands for lservice</div>
<div style="font-family:Consolas">* ovn-northd.c: Added new rules into stage 3 of ingress pipeline with</div>
<div style="font-family:Consolas">higher priority than existing rules.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Personal github repo: <a href="https://github.com/doonhammer/ovs">https://github.com/doonhammer/ovs</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">I have done simple testing and can insert a firewall dynamically in front</div>
<div style="font-family:Consolas">of any application with no changes to application or infrastructure. This</div>
<div style="font-family:Consolas">enables the deployment of a L7 zero-trust security model with minimal</div>
<div style="font-family:Consolas">effort.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Openstack Changes</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">In Openstack the interface looks like:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">$ sfi-add LSWITCH, LAPP-PORT, LSERVICE-PORT-IN, LSERVICE-PORT-OUT [NAME]</div>
<div style="font-family:Consolas">$ sfi-list LSWITCH</div>
<div style="font-family:Consolas">$ sfi-del NAME</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">In Openstack I have had to make slightly more changes, but this is</div>
<div style="font-family:Consolas">probably due to my lack of familiarity with Openstack. I did try and</div>
<div style="font-family:Consolas">follow the neutron plugin/extension model, but with more on making it work</div>
<div style="font-family:Consolas">rather than pure modularity. The following are</div>
<div style="font-family:Consolas">the areas where I modified Openstack:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* networking-ovn: Added the extensions to support service function</div>
<div style="font-family:Consolas">insertion as an extension to the networking-ovn plugin.</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://github.com/doonhammer/networking-ovn">https://github.com/doonhammer/networking-ovn</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* python-neutronclient: Added the cli and REST interfaces to support</div>
<div style="font-family:Consolas">service function insertion.</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://github.com/doonhammer/python-neutronclient">https://github.com/doonhammer/python-neutronclient</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* neutron: Added new db table to support service function insertion</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://github.com/doonhammer/neutron">https://github.com/doonhammer/neutron</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* neutron and nova: Added changes to enable creation of L2 only ports</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://github.com/doonhammer/nova">https://github.com/doonhammer/nova</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Known Issues</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">1. To make the prototype work I had to manipulate the src and dst mac</div>
<div style="font-family:Consolas">addresses in the actions, if I could filter by switch ports this would not</div>
<div style="font-family:Consolas">be necessary.</div>
<div style="font-family:Consolas">2. Need to add the VNF mac addresses to application ports for port</div>
<div style="font-family:Consolas">security - if 1 could be fixed this would not be necessary.</div>
<div style="font-family:Consolas">3. Have not tested scale and performance so impact of adding new rules has</div>
<div style="font-family:Consolas">not been determined.</div>
</div>
<div><br>
</div>
<br>
<a href="http://go.paloaltonetworks.com/ignitereg"><img alt="Palo Alto Networks Ignite 2016" src="https://www.paloaltonetworks.com/content/dam/creative-assets/campaigns/corporate/ignite%202016/email%20signature/PAN_HP16_Email_signature_Mar_opB.jpg"></a>
</body>
</html>