This presentation covers the basics about OpenvSwitch and its components. OpenvSwitch is a Open Source implementation of OpenFlow by the Nicira team.
It also also talks about OpenvSwitch and its role in OpenStack Networking
2. What is Open vSwitch
• Multi layer virtual Switch licensed under Apache 2.0
• Enables massive network automation through
programmatic extension
• Supports monitoring protocols like NetFlow, sFlow etc
• Supports distribution across multiple physical layers like
VMware ‘s vNetwork distributed vSwitch or Cisco’s
Nexus 1000V
• Included in Linux 3.3 Kernel by default
• Most users space utilities are available in Linux
distributions
• Ongoing efforts to port Open vSwitch to Windows
3. Features
• Visibility into inter-VM communication via
NetFlow, sFlow® etc
• Supports LACP - Link Aggregation Control
Protocol
• Supports VLAN
• Provides fine-grained QoS control
• Support for HFSC qdisc : QoS across traffic
Aggregate connections
• Per VM interface traffic policing
4. Supported Platforms
• Default Switch in
– Xen
– KVM
• Supported in ESXi
• Integrated in
– OpenStack, OpenNebula and vSphere
• Supports
– Ubuntu, Fedora, Debian and also FreeBSD
– Currently porting to Windows?
5. Why Open VSwitch
• Traffic between VMs and outside world
– In Linux Hypervisors, it is through a bridge
• Why then Open vSwitch?
– Multi-server virtualization deployments
– Dynamic end points
– Logical abstractions
– Integration or offloading with special purpose
hardware
6. Design Considerations
•
•
•
•
•
The mobility of state
Responding to network dynamics
Maintenance of Logical tags
Hardware Integration
Goals
– Keep in-kernel code as small as possible
– Re-use existing sub-systems
7. Mobility of State
• Network state associated with a network entity, which is a virtual
machine
– Should be easily identifiable
– Migrate between different hosts
• State
–
–
–
–
–
Soft state (Entry in L2 learning table)
L3 forwarding state
ACLs
QoS policy
Monitoring the configuration (Netflow, IPFIX, sFlow)
• Open vSwitch is backed by
– Real Data Model, allows development of structured automation systems
– Migrate SPAN Rules, ACLs, Qos and live state reconstruction
– Fast moving and slow network state between instances
8. Responding to Network
Dynamics
• Virtual environments are characterized by high-rates of
change
– VMs coming and going
– changes to the logical network environments
• Open vSwitch supports
– Simple accounting and visibility support such as NetFlow, IPFIX
and sFlow
– A Network database OVSDB supports remote triggers
– Supports OpenFlow as a method of exporting remote access
control to traffic
9. Maintenance of Logic tags
• Distributed Virtual Switches often maintain logical tags
for a network context by appending and manipulating
tags in the network packets
– Used for uniquely identifying a VM
– Efficiently and correctly manage these tags
• Open vSwitch supports
– Multiple methods of specifying and maintaining tagging rules
– Tagging rules are stored in an optimized form so they don't have
to be coupled with a heavyweight network device
– Supports GRE, STT and VXLAN
10. Hardware integration
• Virtualized hosting environments can be managed using the same
mechanism for automated network control
• Datapath in hardware instead of kernel
• Ongoing efforts to port Open vSwitch to hardware chipsets.
11. Centralized Control
• One OpenFlow connection per datapath
– Exports idealized view of switch’s datapath
•
•
•
•
Lookup based on L2-L4
Fill wildcarding and priorities
Actions: forward, drop, modify, and queue
Missed flows go to central controller
• One Management channel per system
– Switch-level configuration
– Resources
– Counters
16. ovs-ofctl
• Command Line for Managing the Open
Flow related tasks
show SWITCH
show OpenFlow information
dump-ports SWITCH [PORT] print port statistics
dump-flows SWITCH
print all flow entries
queue-stats SWITCH [PORT [QUEUE]] dump queue stats
add-flow SWITCH FLOW
add flow described by FLOW
add-flows SWITCH FILE
add flows from FILE
mod-flows SWITCH FLOW
modify actions of matching FLOWs
SWITCH
PORT
FLOW
17. ovs-dpctl
• Open vSwitch datapath management
utility
usage: ovs-dpctl [OPTIONS] COMMAND [ARG...]
add-dp DP [IFACE...] add new datapath DP(with IFACEs)
del-dp DP
delete local datapath DP
add-if DP IFACE...
add each IFACE as a port on DP
set-if DP IFACE...
reconfigure each IFACE within DP
del-if DP IFACE...
delete each IFACE from DP
dump-dps
display names of all datapaths
show
show basic info on all datapaths
show DP...
show basic info on each DP
dump-flows DP
display flows in DP
del-flows DP
delete all flows from DP
20. ovs-vsctl
– Bridge commands
: Manage the bridge
– Port commands
: Manage the Port
– Interface commands : Manages the
Interfaces
– Controller commands : Get controller details
– Manager commands : get manager
– SSL commands
: Configure SSL
– Switch commands
: Reset the Switch
– Database commands : Get table details of
ovsdb
21. OpenvSwitch Internals
ovs-dpctl - Monitor and Administer Switch, works with any OpenFlow
Switch
ovs-appctl – Utility for managing logging levels
ovs-vsctl manages the switch through ovsdb-server
ovs-dbclient – manipulate database entries directly without ovsdbserver
22. ovsdb-client
ovsdb-client: Open vSwitch database JSON-RPC client
usage: ovsdb-client [OPTIONS] COMMAND [ARG...]
Valid commands are:
list-dbs [SERVER]
list databases available on SERVER
get-schema [SERVER] [DATABASE]
retrieve schema for DATABASE from SERVER
get-schema-version [SERVER] [DATABASE]
retrieve schema for DATABASE from SERVER and report only its
version number on stdout
list-tables [SERVER] [DATABASE]
list tables for DATABASE on SERVER
23. OpenvSwitch Internals
ovsdb-server - Monitor and Administer Switch, works
with any OpenFlow Switch
ovsdb-tool – command line tool to manage database
ovsdb - persists the data across reboots; configures
ovs-vswitchd
24. OpenvSwitch Internals
Kernel module – Designed to be fast and simple;
Handles switching and tunneling
Knows nothing about openflow, if flow found, actions
are executed otherwise passed
to the user space;
Implements tunnels and caches flows
26. Forwarding Flows
• The first packet in the flow is sent to the controller
• The controller programs the data path's actions for
a flow
– Usually one, but may be a list
– Action include:
• Forward to port port or ports, mirror
• Encapsulate and forward to controller
• Drop
• Returns the packet to the data path
• Subsequent packets are handled by the data path
30. Example
• Mininet – Run a Simple Topology with One
Open vSwitch, 3 hosts
• Pox Controller
31. ovs-vsctl
Used to Manage bridges, ports,
Interfaces
• List Bridges for a Switch
• List Ports associated with s1
$ sudo ovs-vsctl list-br
s1
$ sudo ovs-vsctl list-ports s1
s1-eth1
s1-eth2
s1-eth3
32. ovs-vsctl
Manage bridges, ports,
Interfaces
• List of Interfaces for a
Switch
• Each port has a single
Interface in this case
$ sudo ovs-vsctl list-ifaces s1
s1-eth1
s1-eth2
s1-eth3
33. ovs-dpctl
Shows the data path
$ ovs-dpctl show
system@s1:
lookups: hit:0 missed:33 lost:0
flows: 0
port 0: s1 (internal)
port 1: s1-eth1
port 2: s1-eth2
port 3: s1-eth3
39. Summary
• OVS is an open source software switch
implementing Open Flow
• Is supported in most of the hypervisors
• Runs in the Kernel and User space of
Linux
40. Features
• NIC bonding
– with source-MAC load balancing (L2)
– Active backup
– L4 hashing – to achieve Load Balancing using TCP/UDP layers
• OpenFlow protocol support (including many extensions
for virtualization)
• IPv6 support
• Multiple tunneling protocols
–
–
–
–
GRE
VXLAN
IPsec
GRE and VXLAN over Ipsec
41. Features
• Remote configuration protocol with C and Python
bindings
• Kernel and user-space forwarding engine options
– Kernel space forwarding if there is a flow entry
– Else goes to User space in the switch and eventually to
controller
• Multi-table forwarding pipeline with flow-caching engine
– Standard requirement of OpenFlow 1.3
• Forwarding layer abstraction to ease porting to new
software and hardware platforms
Notas do Editor
NetFlow is a network protocol developed by Enterasys Networks (formerly Cabletron) and Cisco Systems for collecting IP traffic information. Switch port Analyzer (SPAN) is an efficient, high performance traffic monitoring system. It duplicated network traffic to one or more monitor interfaces as it transverse the switch. SPAN is used for troubleshooting connectivity issues and calculating network utilization and performance, among many others. There are three types of SPANs supported on Cisco products, which are illustrated in below diagram.Remote SPAN (RSPAN): An extension of SPAN called remote SPAN or RSPAN. RSPAN allows you to monitor traffic from source ports distributed over multiple switches,Supports SPAN, RSPAN, CLI, LACP, 802.1 tagsCLILACP: Link aggregation is a computer networking term to describe various methods of combining (aggregating) multiple network connections in parallel to increase throughput beyond what a single connection could sustain, and to provide redundancy in case one of the links fails.802.1 tags
STP (IEEE 802.1D-1998)Provides fine-grained QoS control : Dely in ms , No of bits per secLink aggregation is a computer networking term to describe various methods of combining (aggregating) multiple network connections in parallel to increase throughput beyond what a single connection could sustain, and to provide redundancy in case one of the links fails.Further umbrella terms used to describe the method include port trunking,[1]link bundling,[2] Ethernet/network/NIC bonding,[1] or NIC teaming. These umbrella terms not only encompass vendor-independent standards such as Link Aggregation Control Protocol (LACP) for Ethernet defined in IEEE 802.1ax or the previous IEEE 802.3ad, but also various proprietary solutions.
Core component of the system Communicates with outside world uisngopenFlowCommunicates with ovsdb-server using the management protocolCommunicates with the kernel module Supports multiple independent pathsPacket classifier supports efficient lookup with wildcards and explodes these wild card rulesImplements mirroring, bonding, and VLANS through modifications of the same flow table exposed through openFlowChecks datapath flow counters to handle flow expiration and stat requests
Core component of the systemCommunicates with outside world using OpenFlowCommunicates with ovsdb-server using the management protocolCommunicates with the kernel module Supports multiple independent pathsPacket classifier supports efficient lookup with wildcards and explodes these wild card rulesImplements mirroring, bonding, and VLANS through modifications of the same flow table exposed through OpenFlowChecks data-path flow counters to handle flow expiration and stat requests
Active- backup : Only one slave in the bond is active. A different slave becomes active if, and only if, the active slave fails
Forwarding layer abstraction to ease porting to new software and hardware platforms