Troubleshooting for Intent-based Networking
2 likes1,321 views
The document discusses intent-based networking and its troubleshooting methodologies, focusing on policy graph abstraction (PGA) as a framework to enhance network management. It highlights the importance of explicitly defined policies and the relationship between the application, control, and infrastructure layers. Examples of troubleshooting applications and the benefits of intent-level troubleshooting for identifying network issues are also presented.
![Checking network behavior against intent
–Early debugging tools for OpenFlow-enabled networks
–Ndb, OFRewind, NetSight, netwatch, netshark, nprof…
–Easier to discover the source of network problems
[Faulty device firmware, inconsistent flow rules, faulty routing…]
–Testing and verification complement network troubleshooting and debugging
[Loop freedom, black holes, performance of OpenFlow switches…]
Too low level!](https://image.slidesharecdn.com/ons2017troubleshooting4ibnprint-170414181242/85/Troubleshooting-for-Intent-based-Networking-24-320.jpg)
Troubleshooting for Intent-based Networking
- 1. Troubleshooting for Intent-based Networking Joon-Myung Kang and Mario A. Sánchez Hewlett Packard Labs Open Networking Summit 2017
- 2. Intent-based Networking Policy Graph Abstraction and Demo Troubleshooting and Demo QnA 2
- 3. Software-Defined Networking Application Plane (SDN Apps) Control Plane (OpenDaylight, ONOS, etc.) Infrastructure (Data) Plane (Cloud/IT/SDN/NFV) Open APIs Program Languages Abstraction SDN Northbound Interfaces Infrastructure Control Interfaces Vendor specific Low-level specifics Manual operations … 3
- 4. Software-Defined Networking Application Plane (SDN Apps) Control Plane (OpenDaylight, ONOS, etc.) Infrastructure (Data) Plane (Cloud/IT/SDN/NFV) Open APIs Program Languages Abstraction SDN Northbound Interfaces Infrastructure Control Interfaces Vendor specific Low-level specifics Manual operations … 4
- 5. Intent-based Networking Application Plane (SDN Apps) Control Plane (OpenDaylight, ONOS, etc.) Infrastructure (Data) Plane (Cloud/IT/SDN/NFV) INTENT North Bound Interface Infrastructure Control Interfaces − Application Plane says “What” (doesn’t care how) − Control Plane reasons “How” (doesn’t care why) Intent − “what”, not “how” (non-prescriptive) − Is portable − Is universal − Is compose-able − Is invariant − Is scale-able Source: Dave Lenrow, “Intent As The Common Interface to Network Resources,” Intent Based Network Summit 2015 ONF Boulder: Intent NBI Intent “I want my headache to stop” Prescription “Give me two aspirins” 5
- 6. Intent-based Networking Examples WEB/Gold/Working Hour No connect/Wireless Configure new guest WiFi 6
- 7. Intent-based Networking Examples WEB/Gold/Working Hour No connect/Wireless INVISIBLE Configure new guest WiFi 7
- 8. Intent-based Networking Open Source Efforts – ONF Open Source SDN Boulder – Define Intent North Bound Interface (NBI) – http://opensourcesdn.org/projects/project-boulder-intent-northbound-interface-nbi/ – https://community.opensourcesdn.org/wg/IntentNBI/dashboard – OpenDaylight NIC – Network Intent Composition – Manage and direct network services and network resources based on the given “Intent” – https://wiki.opendaylight.org/view/Network_Intent_Composition:Main – ONOS Intent Framework – Allows applications to specify their network control desires in form of policy rather than mechanism (Intent) – https://wiki.onosproject.org/display/ONOS/Intent+Framework ONF Intent NBI – Definition and Principles, Draft Version 6, Sep. 2016 https://wiki.opendaylight.org/view/Network_Intent_Composition:Graph 8
- 9. Policy Graph Abstraction (PGA) PGA overview Troubleshooting for Intent-based Networking 9
- 10. PGA is Real Public resources ACM SIGCOMM 2015 London, UK Research Paper and Demo Running System and Open Source Contributions OpenStack Summit 2015, 2016 OpenDaylight Summit 2015, 2016 10
- 11. Policy Management in Practice 11
- 12. Policy Graph Abstraction (PGA) Mktg&Cmp-B &Normal Engg&Cmp-A &Normal HTTP Web& Cloud DNS DB& Cloud Remedy Service Engg&Cmp-A &Qn Mktg&Cam-B &Qn Ping,SSH HTTP monitor SQL, monitor sync, monitor monitor DNS DNS * * BC BC BCLBFW BCLBFW DPIDPI BC BC graph composition Quarantined Remedy Service Policy sources Graph abstraction Unified, conflict-free policy graph Deploy 12
- 13. PGA Example − Label namespace across cloud services and network, capturing overlap vs. disjoint relations between labels 13 CPU Utilization > 90% <= 90%
- 14. PGA Example − Label namespace across cloud services and network, capturing overlap vs. disjoint relations between labels − 4 individual input policies (a) Departments admin Engg. Mktg Ping,SSH Cloud monitor Quarantined Remedy Service * (b) Application admin (d) Cloud operator(c) SDN app: HPE Net Protector Campus Cloud * * HTTP Empl Web SQL sync DBLB Normal DNS DNS (a) Enterprise IT admin DPI FW BC BC Cmp-AMktg Empl App Web CampusDB Net Protector Status Normal Qn Tenant Location Engg: Campus-A Mktg: Campus-B Application: Cloud Empl: Net protector Engg Label Namespace Label Mappings disjoint Cloud Cmp-B 14
- 15. PGA Example − 4 individual input policies − Label namespace across cloud services and network, capturing overlap vs. disjoint relations between labels − Proactive, automatic composition − Scalable algorithm: 13 mins to compose 20K ACL + service chain policies (a) Departments admin Engg. Mktg Ping,SSH Cloud monitor Quarantined Remedy Service * (b) Application admin (d) Cloud operator(c) SDN app: HPE Net Protector Campus Cloud * * HTTP Empl Web SQL sync DBLB Normal DNS DNS (a) Enterprise IT admin DPI FW BC BC Mktg&Cmp-B &Normal Engg&Cmp-A &Normal HTTP Web& Cloud DNS DB& Cloud Remedy Service Engg&Cmp-A &Qn Mktg&Cam-B &Qn Ping,SSH HTTP monitor SQL, monitor sync, monitor monitor DNS DNS * * BC BC BCLBFW BCLBFW DPIDPI BC BC compose Cmp-AMktg Empl App Web CampusDB Net Protector Status Normal Qn Tenant Location Engg: Campus-A Mktg: Campus-B Application: Cloud Empl: Net protector Engg Label Namespace Label Mappings disjoint Cloud Cmp-B 15
- 16. PGA Current status PGA implementation and impact − PGA model, composition, deployment, and tool to convert ACL policy configuration to PGA intent specification − PGA prototype for OpenStack (Juno ~ Newton) − PGA Intent APIs and graph compiler contributed to ODL/NIC Beryllium release − Troubleshooting for intent based policy management − Conflict detection − Composition correctness verification − Intent addition/modification/deletion 16
- 18. PGA Demo 18
- 20. Network debugging/troubleshooting a difficult task Picture sources: http://simplearchitectures.blogspot.com/2013/08/addressing-data-center-complexity.html http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Data_Center/ServerFarmSec_2- 1/ServSecDC/8_NIDS.html WEB NO CONNECT Picture source: http://www.ntstn.com/category/troubleshooting/network- troubleshooting Policy Network ping traceroute tcpdump SNMP sflow
- 21. Systematic troubleshooting –Know intent of the operator –Check network behavior against operator intent Intent-based networking –Policy is a first-class citizen –Intent explicitly expressed at policy layer –Forwarding semantics explicitly defined –Code compiles policy description into lower-level configuration Difficult to achieve in legacy networks Opportunity to rethink network debugging
- 22. Intent-based Networking Application Plane (SDN Apps) Controller Plane (OpenDaylight, ONOS, etc.) Infrastructure (Data) Plane (Cloud/IT/SDN/NFV) INTENT North Bound Interface Infrastructure Control Interfaces – Control Apps – Specify routing/access control policies – Logical view – Simplified/abstract representation of network – Physical view – One-to-one correspondence with the physical network – Controller’s job to configure the network devices (OpenFlow)
- 23. Intent-based Networking Application Plane (SDN Apps) Controller Plane (OpenDaylight, ONOS, etc.) Infrastructure (Data) Plane (Cloud/IT/SDN/NFV) INTENT North Bound Interface Infrastructure Control Interfaces – Control Apps – Specify routing/access control policies – Logical view – Simplified/abstract representation of network – Physical view – One-to-one correspondence with the physical network – Controller’s job to configure the network devices (OpenFlow) • Each layer performs one piece of translation process • Every layer should correctly map to every other layer • Most errors in SDN are mistranslations between layers
- 24. Checking network behavior against intent –Early debugging tools for OpenFlow-enabled networks –Ndb, OFRewind, NetSight, netwatch, netshark, nprof… –Easier to discover the source of network problems [Faulty device firmware, inconsistent flow rules, faulty routing…] –Testing and verification complement network troubleshooting and debugging [Loop freedom, black holes, performance of OpenFlow switches…] Too low level!
- 25. Knowing the operator’s intent Does the Actual Network Behavior Match the Policy? –If NO… Match the symptoms to responsible system component –If YES… The policy itself is the problem, a human must resolve the discrepancy –If unwanted behavior persists & all state layers are equivalent: –The configured policy must not match the operator’s intent
- 26. Troubleshooting System Composed graph User/App1 User/App2 User/Appn User Intents Input graphs Infrastructure Controllers PGA Results Metadata GUI Query Query Examples – Reachability/Connectivity checking – Can A talk to B? – Security vulnerability or Risk assessment – Addition/removal/edition correctnessTroubleshooting System
- 27. Troubleshooting Examples Reachability –Can A talk to B? –What EPG do nodes belong to? –Is there an edge connecting both EPGs? –What security groups should be checked? –What middleboxes should be checked?
- 28. Troubleshooting example Troubleshooting network connectivity (reachability) (a) Departments admin Engg. Mktg Ping,SSH Cloud monitor Quarantined Remedy Service * (b) Application admin (d) Cloud operator(c) SDN app: HP Net Protector Campus Cloud * * HTTP Empl Web SQL sync DBLB Normal DNS DNS (a) Enterprise IT admin DPI FW BC BC Mktg&Cmp-B &Normal Engg&Cmp-A &Normal HTTP Web& Cloud DNS DB& Cloud Remedy Service Engg&Cmp-A &Qn Mktg&Cam-B &Qn Ping,SSH HTTP monitor SQL, monitor sync, monitor monitor DNS DNS * * BC BC BCLBFW BCLBFW DPIDPI BC BC compose Cmp- A Status Tenant Empl App Mktg Web DB Campus Cloud Net Protector Normal Qn Location Engg: Campus-A Mktg: Campus-B Application: Cloud Empl: Net protector Cmp- B Eng g Label Namespace Label Mappings disjoint web Engg client HR site
- 29. Troubleshooting example Intent addition/modification/removal (a) Departments admin Engg. Mktg Ping,SSH Cloud monitor Quarantined Remedy Service * (b) Application admin (d) Cloud operator(c) SDN app: HP Net Protector Campus Cloud * * HTTP Empl Web SQL sync DBLB Normal DNS DNS (a) Enterprise IT admin DPI FW BC BC Mktg&Cmp-B &Normal Engg&Cmp-A &Normal HTTP Web& Cloud DNS DB& Cloud Remedy Service Engg&Cmp-A &Qn Mktg&Cam-B &Qn Ping,SSH HTTP monitor SQL, monitor sync, monitor monitor DNS DNS * * BC BC BCLBFW BCLBFW DPIDPI BC BC Cmp- A Status Tenant Empl App Mktg Web DB Campus Cloud Net Protector Normal Qn Location Engg: Campus-A Mktg: Campus-B Application: Cloud Empl: Net protector Cmp- B Eng g Label Namespace Label Mappings disjoint compare 29
- 30. Troubleshooting example Risk Assessment Indicator may be composed using different data points: e.g. # of compromised hops; # of network functions traversed, etc. What if a host from “Web&Cloud” is compromised? What EPGs might be able to reach host ‘x’ (through intermediate host compromise)?
- 31. Troubleshooting Demo Marketing Employee Campus Admin 10.10.20.1 Connectivity Problem Intent edition Remote desktop connection
- 32. PGA and Troubleshooting Demo 32
- 33. Summary –Intent-based Networking is beneficial to simplify network control & management 33
- 34. Summary –Intent-based Networking is beneficial to simplify network control & management –Policy Graph Abstraction (PGA) is one of the well-defined intent-based management framework and we presented possible troubleshooting examples 34
- 35. Summary –Intent-based Networking is beneficial to simplify network control & management –Policy Graph Abstraction (PGA) is one of the well-defined intent-based management framework and we presented possible troubleshooting examples –Intent-level troubleshooting can help to easily do troubleshooting network problems 35
- 36. Summary –Intent-based Networking is beneficial to simplify network control & management –Policy Graph Abstraction (PGA) is one of the well-defined intent-based management framework and we presented possible troubleshooting examples –Intent-level troubleshooting can help to easily identify network problems –What’s next – More More More practical experiences from network operators/administrators/developers… 36