[openstack-dev] [OVN] [networking-ovn] [networking-sfc] SFC and OVN

Ryan Moats rmoats at us.ibm.com
Tue May 24 04:06:52 UTC 2016

John McDowall <jmcdowall at paloaltonetworks.com> wrote on 05/18/2016 03:55:14

> From: John McDowall <jmcdowall at paloaltonetworks.com>
> To: Ryan Moats/Omaha/IBM at IBMUS
> Cc: "discuss at openvswitch.org" <discuss at openvswitch.org>, "OpenStack
> Development Mailing List" <openstack-dev at lists.openstack.org>
> Date: 05/18/2016 03:55 PM
> Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> Ryan,
> OK all three repos and now aligned with their masters. I have done
> some simple level system tests and I can steer traffic to a single
> VNF.  Note: some additional changes to networking-sfc to catch-up
> with their changes.
> https://github.com/doonhammer/networking-sfc
> https://github.com/doonhammer/networking-ovn
> https://github.com/doonhammer/ovs
> The next tasks I see are:
> 1. Decouple networking-sfc and networking-ovn. I am thinking that I
> will pass a nested port-chain dictionary holding port-pairs/port-
> pair-groups/flow-classifiers from networking-sfc to networking-ovn.
> 2. Align the interface between networking-ovn and ovs/ovn to match
> the nested dictionary in 1.
> 3. Modify the ovn-nb schema and ovn-northd.c to march the port-chain
> 4. Add ability to support chain of port-pairs
> 5. Think about flow-classifiers and how best to map them, today I
> just map the logical-port and ignore everything else.
> Any other suggestions/feedback?
> Regards
> John


(Sorry for sending this twice, but I forgot that text/html is not liked
by the mailing lists ...)

My apologies for not answering this sooner - I was giving a two day
training on Tues/Wed last week and came back to my son graduating
from HS the next day, so things have been a bit of a whirlwind here.

Looking at the github repos, I like the idea of passing a dictionary
from networking-sfc to networking-ovn. The flow classifiers should
be relatively straightforward to map to ovs match rules (famous last

I've probably missed an orbit here, but in the ovn-northd implementation,
I was expecting to find service chains in the egress and router pipelines
in addition to the ingress pipeline (see below for why I think a service
chain stage in the egress pipeline makes sense ...)

Also, in the ovn-northd implementation, I'm a little disturbed to see the
ingress side of the service chain sending packets to output ports - I
think that a more scalable (and more "ovs-like" approach) would be to
match the egress side of a port pair in the chaining stage of the
ingress pipeline, with an action that  set the input port register.
Then the egress pipeline would have a chaining stage where the output
port register would be set based on the ingress port of the next port
pair in the chain and the packet being punted to the proper output port
in the last table.  That should automagically build your function chain
and provide the basis for bucketizing multiple ingress ports for the
next port group to support hash based load balancing.

Does that make sense?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20160523/ac506ac5/attachment.html>

More information about the OpenStack-dev mailing list