<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Hi,</div>
<div>Thanks for posting this. This is very interesting. I think that there are a number of different things to take into account here:</div>
<ol>
<li>There is a service chaining project in Neutron <a href="https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining">https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining</a>. Is the API there sufficient or different?</li><li>I do not think that adding an extension to the OVN is the correct way to go here. That means that the community cannot share the common API (this is related to the point above). The plugin implementation details are specific to the networking solution.</li></ol>
<div>Thanks</div>
<div>Gary</div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE"></div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>OpenStack List <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Monday, March 21, 2016 at 11:18 PM<br>
<span style="font-weight:bold">To: </span>OpenStack List <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>[openstack-dev] [networking-ovn][ovn4nfv]<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px; font-family:Calibri,sans-serif">
<div>
<div style="font-family:Consolas">All,</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">As a VNF vendor we have been looking at ways to enable customers to simply</div>
<div style="font-family:Consolas">scale up (and down) VNF’s in complex virtual networks at scale. Our goal</div>
<div style="font-family:Consolas">is to help accelerate the deployment of SDN and VNF’s and more</div>
<div style="font-family:Consolas">specifically enable zero-trust security at scale for applications. This</div>
<div style="font-family:Consolas">requires the easy and fast deployment of Next Generation Firewalls (and</div>
<div style="font-family:Consolas">other VNF¹s) into the traffic path of any application.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Over the last several weeks we have created a prototype that implements</div>
<div style="font-family:Consolas">a simple VNF insertion approach. Before we do additional work we have a</div>
<div style="font-family:Consolas">couple of questions for the community:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Questions</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">1. This approach has the advantage of being very simple and works with</div>
<div style="font-family:Consolas">existing VNF¹s, does it make sense to the community?</div>
<div style="font-family:Consolas">2. If it is of interest how could it be improved and or enhanced to make</div>
<div style="font-family:Consolas">it more useful and consumable?</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Design Guidelines</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">At the start of the effort we created a set of design guidelines to</div>
<div style="font-family:Consolas">constrain the problem space.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* The goal is a Service Function Insertion (SFI) approach that is simpler</div>
<div style="font-family:Consolas">and easier to deploy than Service Function Chaining and is more applicable</div>
<div style="font-family:Consolas">to single function insertion or very short chains.</div>
<div style="font-family:Consolas">* The initial design target is DC/Enterprises where the requirements are</div>
<div style="font-family:Consolas">typically for insertion of a limited set of VNF¹s in specific network</div>
<div style="font-family:Consolas">locations to act on specific applications.</div>
<div style="font-family:Consolas">* Minimal changes to existing VNF, ours and others,</div>
<div style="font-family:Consolas">* Make the solution open to all VNF¹s.</div>
<div style="font-family:Consolas">* Leverage bump in the wire connectivity as this does not require L2 or L3</div>
<div style="font-family:Consolas">knowledge/configuration in the VNF.</div>
<div style="font-family:Consolas">* Firewalls want to inspect/classify all traffic on a link, so</div>
<div style="font-family:Consolas">pre-classifing traffic beyond ACL¹s is not necessary.</div>
<div style="font-family:Consolas">* Deploy on standard infrastructure; Openstack and Open vSwitch with</div>
<div style="font-family:Consolas">minimal changes</div>
<div style="font-family:Consolas">* Work with virtualization and containers and physical devices seamlessly.</div>
<div style="font-family:Consolas">* Insert and remove security is seconds, one of the drivers of the</div>
<div style="font-family:Consolas">requirement for speed is container deployment</div>
<div style="font-family:Consolas">* Simple to deploy and easy to debug is important - atomic insertion and</div>
<div style="font-family:Consolas">removal of VNF is an important aspect of this.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Approach</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">We have developed a prototype, roughly using the ovn4nfv model proposed by</div>
<div style="font-family:Consolas">Vikram Dham and others in OPNFV. The implemented prototype of ovn4nfv is</div>
<div style="font-family:Consolas">on OpenVSwitch 2.5 and Openstack Mitaka (development branch). I would like</div>
<div style="font-family:Consolas">to stress this is a prototype and not production code. My objective was to</div>
<div style="font-family:Consolas">prove to myself (and others) that the concept would work and then ask for</div>
<div style="font-family:Consolas">feedback from the community on level of interest and how best to design a</div>
<div style="font-family:Consolas">production implementation.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">I have called this effort service function insertion (SFI) to</div>
<div style="font-family:Consolas">differentiate from service function chaining (SFC). This approach is</div>
<div style="font-family:Consolas">simpler than SFC and requires minimal or no changes to existing VNF¹s that</div>
<div style="font-family:Consolas">act as a bump in the wire, but it will probably not handle long complex</div>
<div style="font-family:Consolas">chains or graphs. It can possibly handle chaining one or two VNF¹s in a</div>
<div style="font-family:Consolas">static manner, but not sure if it could go beyond that. I am open to</div>
<div style="font-family:Consolas">suggestions of how to extend/improve it.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The traffic steering is implemented by inserting 2 ingress and 2 egress</div>
<div style="font-family:Consolas">rules in the ovn-nb pipeline at ingress stage 3. These rules have a higher</div>
<div style="font-family:Consolas">priority than the default rules. The changes to OVN and rules are listed</div>
<div style="font-family:Consolas">in the implementation section.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The control plane is implemented in both Open vSwitch and in Openstack. In</div>
<div style="font-family:Consolas">Openstack there is a set of extension interfaces added to the</div>
<div style="font-family:Consolas">networking-ovn plugin. There are both CLI and REST API¹s provided for</div>
<div style="font-family:Consolas">Openstack and CLI for Open vSwitch.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The OVN model enables logical changes to the flow rules and Openstack</div>
<div style="font-family:Consolas">neutron plugin model allows separation of changes to extensions to the</div>
<div style="font-family:Consolas">networking-OVN plugin. I have however violated a few boundaries for</div>
<div style="font-family:Consolas">expediency that would need to be fixed before</div>
<div style="font-family:Consolas">this could be easily deployed.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">We are happy to contribute the code back to the community, but would like</div>
<div style="font-family:Consolas">to gauge the level on interest and solicit feedback on the approach. We</div>
<div style="font-family:Consolas">are open to any and all suggestions for improvements in both</div>
<div style="font-family:Consolas">implementation and approach.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Below I have given a rough overview of the implementation and the changes</div>
<div style="font-family:Consolas">I have made to the various code bases. Just to re-iterate this was done as</div>
<div style="font-family:Consolas">a quick prototype and was a learning experience in Openstack and Open</div>
<div style="font-family:Consolas">vSwitch on the way so the quality</div>
<div style="font-family:Consolas">of the code and architecture are not production ready. Links are provide</div>
<div style="font-family:Consolas">to my github repositories with the changes.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Implementation</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The approach atomically inserts rules into ovn-nb to intercept any traffic</div>
<div style="font-family:Consolas">going to or coming from a vm or a container, requires insertion of four</div>
<div style="font-family:Consolas">new rules. There are no other changes in Open vSwitch. While the prototype</div>
<div style="font-family:Consolas">is using a firewall as the VNF there is no requirement for that to be the</div>
<div style="font-family:Consolas">case any VNF that supports ³bump in the wire mode² should work.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">App-1 is the application that needs to be protected</div>
<div style="font-family:Consolas">FW-2 is the input port of the firewall</div>
<div style="font-family:Consolas">FW-1 is the egress port of the firewall</div>
<div style="font-family:Consolas">App-2 is an application talking to App-1</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The rules look like this:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Ingress Rules [App-1]</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* If dst-ip = app-1 and src-mac = fw-2-mac then dst = app-1 [Priority 250]</div>
<div style="font-family:Consolas">* If dst-ip = app-1 then dst = fw-2 [Priority 200]</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Egress Rules [App-1]</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* If src-ip = app-1 and src-mac = app-1 then dst = fw-1 [Priority 250]</div>
<div style="font-family:Consolas">* If src-ip = app-1 and src-mac = fw-1 then dst= app-2 [Priority 200] </div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">This enables the deployment of a zero trust model of security for any</div>
<div style="font-family:Consolas">application. We would envision that the deployment of an application would</div>
<div style="font-family:Consolas">be "wrapped" with security to ensure that security is consistently and</div>
<div style="font-family:Consolas">always deployed.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Open vSwitch Changes</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">In OVN the interface looks like:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">$ ovn-nbctl lservice-add LSWITCH, LAPP-PORT, LSERVICE-PORT-IN,</div>
<div style="font-family:Consolas">LSERVICE-PORT-OUT [NAME]</div>
<div style="font-family:Consolas">$ ovn-nbctl lservice-list LSWITCH</div>
<div style="font-family:Consolas">$ ovn-nbctl lservice-del NAME</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The prototype is tailored to inserting a Next Generation Firewall (such as</div>
<div style="font-family:Consolas">Palo Alto¹s implementation). However I have made no changes to our</div>
<div style="font-family:Consolas">Firewall to support ovn4nfv. The solution will work with any ³bump in the</div>
<div style="font-family:Consolas">wire² VNF. The prototype assumes that the</div>
<div style="font-family:Consolas">VNF has two data plane interfaces but the solution would work with a</div>
<div style="font-family:Consolas">single interface, if the ³add² operation only has one interface the rules</div>
<div style="font-family:Consolas">would be changed slightly internally to support an VNF with a single port.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">The only changes I have made to OVN are as follows:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* ovn-nb.ovsschema: Added a new table to support lservice</div>
<div style="font-family:Consolas">* ovn-nb.xml: To document the schema</div>
<div style="font-family:Consolas">* ovn-nbctl.c: Added CLI commands for lservice</div>
<div style="font-family:Consolas">* ovn-northd.c: Added new rules into stage 3 of ingress pipeline with</div>
<div style="font-family:Consolas">higher priority than existing rules.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Personal github repo: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_ovs&d=BQMGaQ&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=VlZxHpZBmzzkWT5jqz9JYBk8YTeq9N3-diTlNj4GyNc&m=kQigDYSmS0qPsRGWS-ZCVOvl2wUCAKmgBVI0i6IZbQg&s=Zy_RDBkxZg4kfsHgOeIvUFWcUHb2rpdLhETLAt94AM8&e=">https://github.com/doonhammer/ovs</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">I have done simple testing and can insert a firewall dynamically in front</div>
<div style="font-family:Consolas">of any application with no changes to application or infrastructure. This</div>
<div style="font-family:Consolas">enables the deployment of a L7 zero-trust security model with minimal</div>
<div style="font-family:Consolas">effort.</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Openstack Changes</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">In Openstack the interface looks like:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">$ sfi-add LSWITCH, LAPP-PORT, LSERVICE-PORT-IN, LSERVICE-PORT-OUT [NAME]</div>
<div style="font-family:Consolas">$ sfi-list LSWITCH</div>
<div style="font-family:Consolas">$ sfi-del NAME</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">In Openstack I have had to make slightly more changes, but this is</div>
<div style="font-family:Consolas">probably due to my lack of familiarity with Openstack. I did try and</div>
<div style="font-family:Consolas">follow the neutron plugin/extension model, but with more on making it work</div>
<div style="font-family:Consolas">rather than pure modularity. The following are</div>
<div style="font-family:Consolas">the areas where I modified Openstack:</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* networking-ovn: Added the extensions to support service function</div>
<div style="font-family:Consolas">insertion as an extension to the networking-ovn plugin.</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_networking-2Dovn&d=BQMGaQ&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=VlZxHpZBmzzkWT5jqz9JYBk8YTeq9N3-diTlNj4GyNc&m=kQigDYSmS0qPsRGWS-ZCVOvl2wUCAKmgBVI0i6IZbQg&s=xfR1LmO5rjuRefmsXs4TMWA4D9EG9HPx5CiqVyVj8So&e=">https://github.com/doonhammer/networking-ovn</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* python-neutronclient: Added the cli and REST interfaces to support</div>
<div style="font-family:Consolas">service function insertion.</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_python-2Dneutronclient&d=BQMGaQ&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=VlZxHpZBmzzkWT5jqz9JYBk8YTeq9N3-diTlNj4GyNc&m=kQigDYSmS0qPsRGWS-ZCVOvl2wUCAKmgBVI0i6IZbQg&s=tMYOalJ2aJbjn696fMOYWIiL3efmldMpwqvfYB0p2-g&e=">https://github.com/doonhammer/python-neutronclient</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* neutron: Added new db table to support service function insertion</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_neutron&d=BQMGaQ&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=VlZxHpZBmzzkWT5jqz9JYBk8YTeq9N3-diTlNj4GyNc&m=kQigDYSmS0qPsRGWS-ZCVOvl2wUCAKmgBVI0i6IZbQg&s=cgJaPbnhFjYW16IV2Vp0Zoo0CkXJ0lGo5o9DHn0PQKU&e=">https://github.com/doonhammer/neutron</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">* neutron and nova: Added changes to enable creation of L2 only ports</div>
<div style="font-family:Consolas"><span class="Apple-tab-span" style="white-space:pre"></span>Personal github repo: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_nova&d=BQMGaQ&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=VlZxHpZBmzzkWT5jqz9JYBk8YTeq9N3-diTlNj4GyNc&m=kQigDYSmS0qPsRGWS-ZCVOvl2wUCAKmgBVI0i6IZbQg&s=3jPYkkmcP9fQP6VFunBP3rVVzt64fVtGtgqbGNMmgJM&e=">https://github.com/doonhammer/nova</a></div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">Known Issues</div>
<div style="font-family:Consolas">‹‹‹‹‹‹‹‹‹‹‹‹</div>
<div style="font-family:Consolas"><br>
</div>
<div style="font-family:Consolas">1. To make the prototype work I had to manipulate the src and dst mac</div>
<div style="font-family:Consolas">addresses in the actions, if I could filter by switch ports this would not</div>
<div style="font-family:Consolas">be necessary.</div>
<div style="font-family:Consolas">2. Need to add the VNF mac addresses to application ports for port</div>
<div style="font-family:Consolas">security - if 1 could be fixed this would not be necessary.</div>
<div style="font-family:Consolas">3. Have not tested scale and performance so impact of adding new rules has</div>
<div style="font-family:Consolas">not been determined.</div>
</div>
<div><br>
</div>
<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__go.paloaltonetworks.com_ignitereg&d=BQMGaQ&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=VlZxHpZBmzzkWT5jqz9JYBk8YTeq9N3-diTlNj4GyNc&m=kQigDYSmS0qPsRGWS-ZCVOvl2wUCAKmgBVI0i6IZbQg&s=zrRMW45VDmQFJVqDKXebodenYItCLBBPKA3yTO9mgN0&e="><img alt="Palo Alto Networks Ignite 2016" src="https://www.paloaltonetworks.com/content/dam/creative-assets/campaigns/corporate/ignite%202016/email%20signature/PAN_HP16_Email_signature_Mar_opB.jpg"></a></div>
</div>
</span>
</body>
</html>