Challenges of L2 NID Based Architecture for vCPE and NFV Deployment
âą
2 gostaramâą2,401 visualizaçÔes
Challenges of L2 NID Based Architecture for vCPE and NFV Deployment
Recomendados
Recomendados
Mais conteĂșdo relacionado
Mais procurados
Mais procurados (20)
Destaque
Destaque (20)
Semelhante a Challenges of L2 NID Based Architecture for vCPE and NFV Deployment
Semelhante a Challenges of L2 NID Based Architecture for vCPE and NFV Deployment (20)
Mais de Bangladesh Network Operators Group
Mais de Bangladesh Network Operators Group (20)
Ăltimo
Ăltimo (20)
Challenges of L2 NID Based Architecture for vCPE and NFV Deployment
- 1. Challenges of Layer 2 NID Based Architecture For vCPE/NFV Deployments Santanu Dasgupta Sr. Consulting Engineer â Global Service Provider Network Architecture BDNOG-3 May, 2015
- 2. 2© 2013-2014 Cisco and/or its affiliates. All rights reserved. Background and Context
- 3. 3© 2013-2014 Cisco and/or its affiliates. All rights reserved. âNetwork Functionsâ in SP Network Architecture Landscape LTE Smartphone Access xDSL WiFi Smartphone PC RNC2G 3G Ethernet CE NodeB eNodeB AP Small Cell FAP Gateways / Service Edge OSS/BSS Subsystems and Control Data Plane Voice Video Data Core Network Infrastructure IMS xDSLHFC PGWSGW 2/3G GGSN 2/3G SGSN MME ePDG eWAG PE Metro Network Infrastructure NAT FW IPSec DPICGNCaching Opt MSC-SMGW A-SBC I-SBC BGCF MGCF PS / RLS DRA Video ingestion DRM Video Network EMS Provisioning Analytics Billing Radius DNS DHCP S-CSCF P-CSCF I-CSCF Trans- coding Cache Control Policy Parental control HLR HSS ENUM TAS SMS-C Services OCS MMS-C HCSRMS xDSLDSLAM DSL/ FTTX BNG Core Routing Metro Ethernet Biz CPE Consumer CPE Cable Modem CMTS Capacity Planning WLC SecGW HNB-GW Policy SDN Controller BGP server Metro Ethernet Data CenterCore and Data Center Network Infrastructure
- 4. 4© 2013-2014 Cisco and/or its affiliates. All rights reserved. Virtualization of âNetwork Functionsâ Existing Hardware / Appliance based Network Functions (NFs) Virtualized NFs running as VM on x86 Server Platform Step 1: Decouple software from underlying hardware Step 2: Port it as a VM/ container on x86 Server platform running as a Network Function Data Center Switching Infrastructure Hypervisor vFW vCPE vDPI vLB Hypervisor
- 5. 5© 2013-2014 Cisco and/or its affiliates. All rights reserved. NFV, SDN & Orchestration Together Partial list, just a few main ones are mentioned here Ethernet Switching Network Underlay Hypervisor Hypervisor Hypervisor NAT Firewall DPI Orchestration and SDN Control Function Storage Server 1 Server 2 Server 3 Firewall DPI VM / VNF Lifecycle Management in End-to-end manner Network Plumbing to orchestrate dynamic topologies Configuration Management of the VNFs Integration with Other DC/POD And the WAN OAM, Assurance, Analytics Standard APIs NAT
- 6. 6© 2013-2014 Cisco and/or its affiliates. All rights reserved. Traditional Managed CPE with IP/MPLS L3VPN PE PE P CE CE Carrier Ethernet / Backhaul Carrier Ethernet / Backhaul §ï§âŻ There are multiple genuine and perceived issues in the traditional service delivery model â §ï§âŻ CPE provisioning and servicing often require truck roll (sending engineers) Ă ï high OPEX §ï§âŻ The amount of feature sets enabled on the on-premise CPE makes the solution complex to operate §ï§âŻ Service delivery is not agile, lacks automation, service turn-up / changes takes a lot of time §ï§âŻ On site CPEâs are often expensive and not an open platform §ï§âŻ The industry is expecting something that is more open, agile, fully automated, flexible to address different market segments and can help the operators to reduce their TCO §ï§âŻ This is where L2 NID on-premises + vCPE architecture discussion for business VPN started almost 2 years back in the industry MP-BGP Static / IGP / eBGPStatic / IGP / eBGP MPLS Core Branch Branch
- 7. 7© 2013-2014 Cisco and/or its affiliates. All rights reserved. What is âL2 NIDâ ? §ï§âŻ Layer 2 NID â Layer 2 Network Interface Device (example Cisco ME 1200) §ï§âŻ Some calls it Layer 2 Network Termination Device (NTD) Ă ï we will call it L2 NID for this presentation §ï§âŻ L2 NID is the device that Carrier Ethernet Operator drops at Customer Premises to terminate the Ethernet last mile §ï§âŻ It is managed by the operator §ï§âŻ It has user facing interfaces (UNI) and network facing interfaces (NNI) â typically all Ethernet §ï§âŻ It marks the demarcation point between the Operator and Customer Network §ï§âŻ The L2 NID is typically a 4 to 6 port FE/GE/10GE L2 switch with some other capabilities such as â §ï§âŻ Ethernet OAM (CFM, Y.1731) for fault & performance management, Service Activation (Y.1564), timing support (mobile b/h) etc. Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core Typical Carrier Ethernet Operation Domain Demarcation Customer Premises PE
- 8. 8© 2013-2014 Cisco and/or its affiliates. All rights reserved. L2 NID + vCPE Architecture Proposal for Managed CPE/VPN §ï§âŻ No need to have a Layer 3 CPE at Customer premises anymore §ï§âŻ Virtualize the L3 CPE and Put that at SPâs POP or Cloud / NFV Data Center §ï§âŻ Make the branch simplified with only one device, where complex features are running at SPâs Cloud making it easier to operate Ă ï may also help to reduce cost Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core One Device on Customer Prem vCPE vCPE Layer 2 Backhaul of Branch Traffic to vCPE PE-CE RoutingVery simple on-premises CPE L3 CPE Virtualized, Complex features running at SPâs premises PECPE Animated
- 9. 9© 2013-2014 Cisco and/or its affiliates. All rights reserved. L2 NID + vCPE Architecture Proposal for Managed CPE/VPN Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core One Device on Customer Prem vCPE vCPE Layer 2 Backhaul of Branch Traffic to vCPE PE-CE RoutingVery simple on-premises CPE L3 CPE Virtualized, Complex features running at SPâs premises PE §ï§âŻ No need to have a Layer 3 CPE at Customer premises anymore §ï§âŻ Virtualize the L3 CPE and Put that at SPâs POP or Cloud / NFV Data Center §ï§âŻ Make the branch simplified with only one device, where complex features are running at SPâs Cloud making it easier to operate Ă ï may also help to reduce cost
- 10. 10© 2013-2014 Cisco and/or its affiliates. All rights reserved. Why The L2 NID Based Alternate Looked Promising ? Carrier Ethernet AGG AGG NPE NPE L2 NID Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core CPE AGG Two Devices on Customer Prem One Device on Customer Prem MPLS Core vCPE vCPE PE-CE Routing over Carrier Ethernet Transport Layer 2 Backhaul of Branch Traffic to vCPE PE-CE Routing Traditional Model L2 NID+ vCPE Model Reduction of Customer Premise Devices from Two to One was Promising to Reduce Cost and Complexity PE PE
- 11. 11© 2013-2014 Cisco and/or its affiliates. All rights reserved. This Would Enable Agile Service Creation too Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core One Device on Customer Prem vCPE vFW vDPI NFV DC NFV and Cloud Orchestration §ï§âŻ NFV and Orchestration also enables agile service creation and turn-up §ï§âŻ vCPE can be chained with rich set of NFV, Cloud IaaS, PaaS and SaaS services (SP hosted or 3rd party) §ï§âŻ This is true irrespective of the on-premises CPE type â be in L2 NID or L3 CPE or whatever else PE PE Cloud DC (SP / 3rd Party) IaaS / PaaS / SaaS
- 12. 12© 2013-2014 Cisco and/or its affiliates. All rights reserved. Challenges with the L2 NID Based Architecture, where there is no L3 CPE at the Branch
- 13. 13© 2013-2014 Cisco and/or its affiliates. All rights reserved. MAC Address Scale Issues for the NFV DC . . . 250 MAC Address 250 MAC Address 250 MAC Address Carrier Ethernet AGG AGG AGG NPE NPE L2 NID L2 NID L2 NID L2 NID TOR Switch vCPE vCPE L2 Trunk / QinQ L3 VPN PE L3 Links 1 Million MAC Address!!! (4000 customers @250 MAC) §ï§âŻ NFV DCâs are built with a network switching underlay Ă ï servers arenât directly connected to the NPE §ï§âŻ With layer 2 backhaul of traffic from customer branches, the NFV DC switching layer will learn all customer MAC addresses §ï§âŻ An example site with 4000 customer sites and 250 MAC address per site means 1 Million MACs §ï§âŻ The switching underlay / TOR switches will now need to support and learn 1Million MAC addresses §ï§âŻ Impacting cost of the network, service scale, convergence time upon failure due to large table size §ï§âŻ This can be technically solved with end-to-end overlay (like GRE or MPLS PW) from branch to vCPE or NPE to vCPE Ă ï defeating the original simplicity of the proposed architecture to a major extent L2 NID L2 NID L2 NID
- 14. 14© 2013-2014 Cisco and/or its affiliates. All rights reserved. Security Exposure Due to Extension of the Broadcast Domain Carrier Ethernet AGG AGG AGG NPE vCPE L2 NID L2 NID L2 NID . . . vCPE vCPE vCPE TOR Switch Customerâs L2 Domain Extended to NFV DCâs delivering vCPE §ï§âŻ By not having a L3 CPE at branch, and vCPE at NFV DC, it extends customerâs Layer 2 domain all the way to the NFV DC §ï§âŻ For a POP with 4000 customers, it means extension of 4000 layer 2 domains hitting the NFV DC Ă ï SP typically has no control what assets are there at these branches and how secure they are §ï§âŻ This poses a significant security risk to SPâs infrastructure for various DDoS/other attacks NFV DC
- 15. 15© 2013-2014 Cisco and/or its affiliates. All rights reserved. Potential Risks Due to Layer 2 Loops Carrier Ethernet AGG AGG AGG NPE vCPEL2 NID L2 NID vCPE vCPE vCPE TOR Switch L2 NID L2 NID To Customer LAN To Customer LAN Customer LANâs STP Domain Operators domain Starts here onwards §ï§âŻ In a L2 NID only based architecture, it is critical to demarcate customerâs STP domains at the L2 NID §ï§âŻ There could be dual homing situations, where L2 NID may have to participate in Customerâs Spanning Tree domain, also may require some form of loop prevention mechanism on the NNI side too §ï§âŻ Such dual homed connectivity requirement pose risks. Operational errors may cause the SP infrastructure to get impacted due to layer 2 loops originated from a customer branch
- 16. 16© 2013-2014 Cisco and/or its affiliates. All rights reserved. High Availability Design Challenges Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core vCPE1 vCPE2 PE-CE Routing PE Layer 2 Backhaul of Branch Traffic to vCPE §ï§âŻ For situations with two vCPEâs for HA, the two vCPEâs need to run HSRP / VRRP (lets consider VRRP) §ï§âŻ There are multiple ways to run the VRRP traffic between the two vCPEâs that comes with different levels of complexity and different degree of reliability §ï§âŻ The âL2 NID ĂïĂ ï vCPEâ connectivity tracking becomes key for reliable bi-directional packet forwarding
- 17. 17© 2013-2014 Cisco and/or its affiliates. All rights reserved. High Availability Design Challenges VRRP on Directly Connected Links Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core vCPE1 vCPE2 PE-CE Routing PE Layer 2 Backhaul of Branch Traffic to vCPE §ï§âŻ Simplest way to run VRRP Ă ï but requires a L2 segment between two NFV DCs (typically two sites) §ï§âŻ Less reliable, since VRRP operation is blind to the connectivity failures from vCPE to L2 NID §ï§âŻ If vCPE1 is active on VRRP segment, and if vCPE1 to the L2 NID connectivity fails, vCPE1 may continue to remain active Ă ï will cause service outage VRRP
- 18. 18© 2013-2014 Cisco and/or its affiliates. All rights reserved. High Availability Design Challenges VRRP on Via the Carrier Ethernet Network Carrier Ethernet AGG AGG AGG NPE2 NPE1 L2 NID MPLS Core vCPE1 vCPE2 PE §ï§âŻ To address the reliability issue, VRRP may be carried across the Carrier Ethernet network §ï§âŻ vCPE1 â NPE1 â NPE2 â vCPE2 Ă ï need a L2 path, FRR enabled explicit path between NPEâs to force the path §ï§âŻ vCPE1 â NPE1 â AGG ⊠â AGG â NPE2 â vCPE2 §ï§âŻ More reliable now, since VRRP traffic will be dropped if the L2NID to vCPE connectivity fails, but â §ï§âŻ Carrier Ethernet network to ensure VRRP packets arenât dropped during congestion â that will trigger false failover §ï§âŻ VRRP delay timers may not be very aggressive, Carrier Ethernet network to ensure minimum delay §ï§âŻ This is more complex to provision and operate VRRP Potential Alternate Paths for VRRP Sessions
- 19. 19© 2013-2014 Cisco and/or its affiliates. All rights reserved. High Availability Design Challenges VRRP via the Carrier Ethernet Network + IEEE 802.1ag (CFM) Carrier Ethernet AGG AGG AGG NPE2 NPE1 L2 NID MPLS Core vCPE1 vCPE2 PE §ï§âŻ The previous solution is still not end-to-end, not covering the AGG to the L2 NID connectivity §ï§âŻ For an end-to-end reliable operations, that is a key requirement §ï§âŻ A way to address this challenge is to use VRRP and CFM (802.1ag) together §ï§âŻ CFM runs end-to-end from L2NID to vCPE. When due to any failure on the path, CFM session expires Ă ï interface of vCPE goes to line protocol âdownâ state Ă ï VRRP traffic cannot go out any more out of the interface Ă ï VRRP switchover takes place to the standby §ï§âŻ Solves this HA issue, but brings back a lot of complexities in the network §ï§âŻ Weâre trying to remove complexities by removing L3 CPE from branch Ă ï but we introduced different complexities now VRRP 802.1ag CFM Sessions VRRP CFM CFM
- 20. 20© 2013-2014 Cisco and/or its affiliates. All rights reserved. Carrier Ethernet AGG AGG AGG NPE2 NPE1 L2 NID MPLS Core vCPE1 vCPE2 PE VRRP 802.1ag CFM Sessions VRRP CFM CFM High Availability Design Challenges Upstream Routing from vCPE to the L3VPN PE PE-CE Routing with Conditional Advertisement depending on vCPE to L2 NID connectivity and VRRP status (typically will require eBGP) §ï§âŻ The vCPEâs need to run PE-CE routing with eBGP / IGP or Static routing §ï§âŻ The vCPEâs now need to perform conditional route advertisement to the L3 VPN PEâs depending on the reachability of vCPE to L2 NID and VRRP status §ï§âŻ If vCPE1 is the preferred path for the downstream traffic, but vCPE1 has lost connectivity to L2 NID, the vCPE1 needs to make L3VPN PE aware by advertising routes with less preferred attribute than vCPE2 §ï§âŻ Typically restrict the PE-CE routing protocol to eBGP and may add more complexity in the design
- 21. 21© 2013-2014 Cisco and/or its affiliates. All rights reserved. Lack of L3 Capability @Branch Will Limit Available Services Carrier Ethernet AGG AGG AGG NPE NPE L2 NID MPLS Core vCPE1 vCPE2 PEVRRP Branch §ï§âŻ Many customer may require capabilities at branch that requires Layer 3 devices §ï§âŻ Such as IPSec VPN or WAN Acceleration §ï§âŻ Many Service Providers are looking forward to use 3G or 4G LTE as backup connectivity §ï§âŻ Typical L2 NIDs do not have those interfaces Ă ï forcing another CPE for the backup §ï§âŻ If Hierarchical & granular QOS is a requirement at the branch, this could be challenging with L2 NID too
- 22. 22© 2013-2014 Cisco and/or its affiliates. All rights reserved. Conclusion of L2 NID + vCPE Architecture §ï§âŻ We were attempting to simplify the architecture by removing L3 CPE from the branch in the managed CPE / VPN architecture §ï§âŻ But in that process, complexities of other types got injected back into the network §ï§âŻ MAC address scaling issue impacting service scale, convergence, cost §ï§âŻ Security exposure of the vCPE / NFV DC and the SP infrastructure due to extension of L2 domains §ï§âŻ Possible chances of Layer 2 loops due to operational errors §ï§âŻ Complex design requirements to satisfy high availability Ă ï more difficult to operate §ï§âŻ It may create further limitations when it comes to service availability at the branch §ï§âŻ Layer 3 services such as IPSec, WAN Acceleration etc. are not possible from the branch anymore §ï§âŻ 3G / 4G LTE on the same device §ï§âŻ Hierarchical and Granular QOS from the branch
- 23. 23© 2013-2014 Cisco and/or its affiliates. All rights reserved. So What We May Do To Approach the Problem ? This is My Recommendation Jï Carrier Ethernet AGG AGG AGG NPE NPE L3 NID MPLS Core vFW vCPE* vDPI NFV DC NFV and Cloud Orchestration Cloud DC (SP / 3rd Party) PE PE §ï§âŻ Keep a L3 CPE at branch, may be physical or virtual Ă ï call it a L3 NID or L3 CPE or whatever you like §ï§âŻ We need to demarcate customerâs L2 network at the branch itself, thatâs how the networks scaled §ï§âŻ This helps avoid MAC address scale, security & L2 Loop issues. Also avoids additional issues with VRRP design §ï§âŻ Make the L3 CPE at branch Zero Touch Provisioning (ZTP) capable â to achieve automation and agility §ï§âŻ If required, try and make the L3 CPE at branch simplified by reducing the footprint of âenabled featuresâ §ï§âŻ Provision complex CPE features on NFV DC (may include advanced routing on a vCPE) §ï§âŻ Have the ability to service chain vCPE with other rich set of functions using NFV orchestration system Ă ï make it agile! L3 NID or L3 CPE Simple Routing like Static / IGP with vCPE, or PE-CE Routing from branchDemarcate Customer L2 Network Here vCPE* - May not be reqd. most of the time IaaS / PaaS / SaaS
- 24. Thank you.
- 25. 25© 2013-2014 Cisco and/or its affiliates. All rights reserved. NFV â How to build / Augment Operations skillsets âąâŻ Most existing technologies, protocols and associated skills are equally required âąâŻ On top of that, there are needs for acquisition of New Skills âąâŻ x86 Server Virtualization âąâŻ Virtualization on Linux (and KVM/QEMU) Environment âąâŻ Cloud Orchestration Systems â such as OpenStack âąâŻ Virtual Switches â OVS, Netmap/VALE, Snabbswitch, Vendor Specific etc âąâŻ SDN Controllers â OpenDayLight, Vendor Specific âąâŻ Device Programmability and APIs â NETCONF, Yang, RESTCONF, REST APIs, OFâŠ. âąâŻ Service Function Chaining â specially NSH (Network Service Header) âąâŻ Network based Virtual Overlay transport â VXLAN, MPLSoGRE/UDP, LISP, L2TPv3âŠ.. âąâŻ Automation Tools â puppet / chef etc. âąâŻ Management, Orchestration, OSS Fundamentals, âąâŻ âŠ..