Openstack Neutron Advanced Services talk at the Openstack Boston Meetup on Nov 19, 2015. This is an introduction to the Openstack projects Neutron and Astara.

1. NEUTRON ADVANCED
SERVICES
ERIC LOPEZ
ERIC.LOPEZ @ AKANDA.IO
@ERICDLOPEZ

2. About Me
Sr. Solution Architect at Akanda Inc
Former Solution Architect @ VMware &
Nicira
Openstack Security Guide Co-Author

3. Where are we headed today?
Neutron Basics
Advance Services: LBaaS, VPNaaS, FWaaS
Akanda an Advanced Service Plugin
Neutron: Liberty and Beyond

4. NEUTRON BASICS

5. OSI Model
Physical Layer
Data Link Layer
Network Layer
Transport Layer
Session Layer
Presentation Layer
Application Layer
1
2
3
4
5
6
7
TCP, UDP
IPv4,IPv6, ICMP
HTTP, DNS, etc
ARP, Ethernet, VLAN

6. OpenStack

7. What does the user see?
Compute API
Network API
Storage APIGUI, CLI, API Libs
KVM
ML2 Plugin
Ceph

8. Abstractions
Net1
10.0.0.0/24
Nova
Neutron
L2 virtual network
virtual port
virtual server
virtual interface (VIF)
virtual subnet
VM1
10.0.0.2
VM2
10.0.0.2

9. Using the API…
VM1
10.0.0.2
VM2
10.0.0.2/172.16.
77.2
VM3
172.16.77.1
Tenant A Net1
192.168.0.0/24
Tenant A Net2
172.16.77.0/24
Public Net
10.0.0.0/8
VM1
10.0.0.2
VM2
10.0.0.2/172.16.
77.2
VM3
172.16.77.1
Tenant B Net1
192.168.0.0/24
Tenant B Net2
172.16.77.0/24
Router Router

10. Design Goals
Unified API
Small Core
Pluggable Open Architecture
Extensible

11. UNDER THE HOOD

12. OpenStack

15. Reference Neutron
neutron-server
L2 AgentL2 AgentL2 AgentL2 AgentL2 AgentL2 Agent
L3 AgentL3 Agent
L3 AgentL3 Agent
Databas
e
L3 Agent
DHCP Agent
L2 Agent
Messa
ge
Queu
e
Adv Services
neutron-server

16. neutron-server
REST API
SERVICE
RPC SERVICE
PLUGIN
Provides REST API Service
Manages Logical Models
Pluggable
Extensible

17. Plugin Extensions
Add logical resources to the REST API
Discovered by server at startup
REST: /v2.0/extensions
Common Extensions
Binding, DHCP, L3, Provider, Quota, Security Group
Other Extensions
Allowed Addresses, Extra Routes, Metering

18. BUILDING NETWORKS

19. Building Networks…
L2 vs L3
Tenant Isolation
GRE/VXLAN/GENEVE
VLAN
© Malcolm Leman | Dreamstime.com

20. Traditional L2
802.1Q
Aggregation tier must be HA
MLAG is vendor proprietary
Aggregate/Core Scalability
limited number available
MAC/ARP table limits
East/West Bottleneck

21. L3 Maximizes Connectivity
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV

22. Isolation via VXLAN
VXLAN
L2 encapsulated L3
IP Fabrics Scale
Reduces L2 size
ECMP (Equal Cost Multi-Path)
Each link active
Predictable latency
Better failure handling

23. What is BUM Traffic?
BROADCAST
UNKNOWN UNICAST
MULTICAST

24. Tunneling BUM Traffic
A
D
CB

25. Tunneling BUM with L2 Population
A
D
CB

26. WHEN IS FLAT A GOOD IDEA?

27. LOAD BALANCING AS A SERVICE

28. Load Balancer as a Service
Tenant Provisioned Load Balancer Instances
New API (v2) Released in Kilo
Updated Logical Model
TLS Support (requires Barbican)
Octavia Project
http://octavia.io

29. LBaaS History
Folsom Grizzly Havana Icehouse Juno Kilo
Working Group
Experimental API
API v2
Stability
Improvements
v2
Working
Group
API v2

30. LBaaS Data Model
Logical Model renders on service provider
Least Common Denominator
Extra feature require extensions
Load Balancer
Pool
Pool
Listener

31. Load Balancer Model
VIP Port
Provider
Load Balancer

32. Listener Model
Protocol
HTTP, HTTPS, TCP
Port
Default Pool
TLS Information
Load Balancer Listener

33. Pool Model
Session Persistence
Algorithm
Member Set
Health monitor Set
Load Balancer Listener
Pool
Pool

34. Member Model
Address
Port
Weight
Subnet
Load Balancer Listener
Pool
Pool

35. Health Monitor Model
Type
Timeout
Delay
For HTTP
Method
Response Code
Load Balancer Listener
Pool
Pool

36. Barbican
Provides secure storage, provisioning and management of secret data
Pluggable crypto components
KMIP
HSM

37. Load Balancer as a Service

38. NEUTRON ADVANCED
SERVICES

39. Firewall as a Service
Tenant Provisioned Edge Firewall
Logically at the edge
In reality maybe anywhere in data path
API still deprecated
Will be replaced in Mitaka

40. Security Groups
Logically Protect VIF
Allow East/West Filtering
Based on Whitelist
VMs with multiple groups per VIF
Ingress/Egress Rules
Different from AWS

41. LOOKING AHEAD

42. OpenStack’s Big Tent
Open Design
Open Development
Open Community
Open Source

43. The Neutron Stadium
Common Forum
Improved Consistency
Shared Governance

44. Neutron: Liberty
QoS Plugin Model - Extension and API
LBaaS v2
IPv6 Prefix Delegation
IPAM pluggable model framework
Network RBAC
Paying Down Technical Debt
Canadian2006 - Liberty, Saskatchewan (CC-by-sa-3.0)
commons.wikimedia.org/w/index.php?title=User:Canadian2006&action=edit&redlink=1

45. Service Function Chaining
Forwarding Graph of Functions
ie Firewall > Router > Load Balancer
Some SDNs support SFC today
Classification rules used to steer traffic
LB FW
Sourc
e
DestClassifier QoSCache

46. INTRODUCING ASTARA

47. Astara Core Developer Team
Mark McClain (IRC: markmcclain)
Co-Founder/CTO at Akanda Inc
OpenStack Technical Committee Member
Former OpenStack Networking PTL
Ryan Petrello (IRC: ryanpetrello)
Senior Developer at Dreamhost
Openstack Contributor since 2012
Adam Gandelman (IRC: adam_g)
Openstack Astara PTL
Senior Developer at Akanda Inc
Openstack Stable Branch Maintenance Team Member
Former Openstack Developer at Canonical and HP
David Lenwell (IRC: davidlenwell)
Senior Developer at Akanda Inc
Openstack refstack Technical Project Lead
Former Openstack Developer at Piston, HP, and
Bluebook

48. Core Astara Principles
Simple
Compatible
Open Development (Apache v2)

49. Reference Neutron
neutron-server
L2 AgentL2 AgentL2 AgentL2 AgentL2 AgentL2 Agent
L3 AgentL3 Agent
L3 AgentL3 Agent
Databas
e
L3 Agent
DHCP Agent
L2 Agent
Messa
ge
Queu
e
Adv Services
neutron-server

50. Neutron+Astara
neutron-server
L2 AgentL2 AgentL2 AgentL2 AgentL2 AgentL2 Agent
Databas
e
Astara
L2 Agent
Messa
ge
Queu
e
neutron-server

51. THE RUG
“REALLY TIED THE ROOM TOGETHER”

52. The Rug
Control Plane Orchestration
Logically Centralized
Pluggable Drivers
Multi-Process/Multi-Threaded
Utilizes standard APIs/interfaces for Neutron, Nova, Glance and
Ceilometer

53. Astara Architecture
Astara
Management/
Orchestration Physical Network (L2)
Nova
Neutron
Open:OVS/LinuxBridg
e
Proprietary
Astara L2 Agnostic Overlay Support
Astara Adv Services: Routing/LB/FW
OpenStack APIs

54. Neutron Reference
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
Network
Node
Network
Node

55. Astara
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV
HV

56. or with containers
HV
HV
HV
HV
HV
C
C
C
C
C
C
C
C
C
C
HV
HV
HV
HV
HV

57. Astara Project
Get the source: https://github.com/openstack/astara
Project status and tarballs: https://launchpad.net/astara
Documentation: http://docs.akanda.io
IRC - #openstack-astara on freenode.net

58. THANK YOU

59. Astara Liberty Feature Release
HA orchestration daemon
Service Appliance Pool Resourcing
LBaaS v2 support -

60. QUESTIONS?