Software Defined Internet Exchange

by Blog

Software Defined Internet Exchange

In today's digital era, where data is the lifeblood of every organization, the importance of a reliable and efficient internet connection cannot be overstated. As businesses increasingly rely on cloud-based applications and services, the demand for high-performance internet connectivity has skyrocketed. To meet this growing need, a revolutionary technology known as Software Defined Internet Exchange (SD-IX) has emerged as a game-changer in the networking world. In this blog post, we will delve into the concept of SD-IX, its benefits, and its potential to revolutionize how we connect to the internet.

Software Defined Internet Exchange, or SD-IX, allows organizations to dynamically connect to multiple Internet service providers (ISPs) through a centralized platform. Traditionally, internet traffic is exchanged through physical interconnections between ISPs, resulting in limited flexibility and control. SD-IX eliminates these limitations by virtualizing the interconnection process, enabling organizations to establish direct, secure, and scalable connections with multiple ISPs.

SD-IX Defined: Software Defined Internet Exchange, or SD-IX, is a cutting-edge technology that enables dynamic and automated interconnection between networks. Unlike traditional methods that rely on physical infrastructure, SD-IX leverages software-defined networking (SDN) principles to create virtualized interconnections, providing flexibility, scalability, and enhanced control.

Enhanced Performance: One of the prominent advantages of SD-IX is its ability to optimize network performance. By utilizing intelligent routing algorithms and traffic engineering techniques, SD-IX reduces latency, improves packet delivery, and enhances overall network efficiency. This translates into faster and more reliable connectivity for businesses and end-users alike.

Flexibility and Scalability: SD-IX offers unparalleled flexibility and scalability. With its virtualized nature, organizations can easily adjust their network connections, add or remove services, and scale their infrastructure as needed. This agility empowers businesses to adapt to changing demands, optimize their network resources, and accelerate their digital transformation initiatives.

Cost Efficiency: By leveraging SD-IX, organizations can significantly reduce their network costs. Traditional methods often require expensive physical interconnections and complex configurations. SD-IX eliminates the need for such costly infrastructure, replacing it with virtualized interconnections that can be provisioned and managed efficiently. This cost-saving aspect makes SD-IX an attractive option for businesses of all sizes.

Driving Innovation: SD-IX is poised to drive innovation in the networking landscape. Its ability to seamlessly connect disparate networks, whether cloud providers, content delivery networks, or internet service providers, opens up new possibilities for collaboration and integration. This interconnected ecosystem paves the way for novel services, improved user experiences, and accelerated digital innovation.

Enabling Edge Computing: As the demand for low-latency applications and services grows, SD-IX plays a crucial role in enabling edge computing. By bringing data centers closer to the edge, SD-IX reduces latency and enhances the performance of latency-sensitive applications. This empowers businesses to leverage emerging technologies like IoT, AI, and real-time analytics, unlocking new opportunities and use cases.

Software Defined Internet Exchange (SD-IX) represents a significant leap forward in the world of connectivity. With its virtualized interconnections, enhanced performance, flexibility, and cost efficiency, SD-IX is poised to reshape the networking landscape. As organizations strive to meet the ever-increasing demands of a digitally connected world, embracing SD-IX can unlock new realms of possibilities and propel them towards a future of seamless connectivity.

Matt Conran

Highlights: Software Defined Internet Exchange

Understanding Software-Defined Internet Exchange

a) SD-IX is a cutting-edge technology that enables dynamic and flexible interconnection between networks. Unlike traditional internet exchange points (IXPs), SD-IX leverages software-defined networking (SDN) principles to create virtualized exchange environments. By abstracting the physical infrastructure, SD-IX allows on-demand network connections, enhanced scalability, and simplified network management.

b) Internet exchanges are physical locations where multiple Internet service providers (ISPs), content delivery networks (CDNs), and network operators connect their networks to exchange Internet traffic. By establishing direct connections, IXPs enable efficient and cost-effective data transfer between various networks, enhancing internet performance and reducing latency.

**How Internet Exchanges Work**

Internet Exchanges typically consist of high-speed switches and routers deployed in data centers. These devices provide the necessary connectivity between participating networks, facilitating traffic exchange.

To join an Internet Exchange, networks must adhere to specific peering policies and agreements. These guidelines dictate the terms of traffic exchange, including technical requirements, traffic ratios, and network security measures.

**Internet Exchange Points Around the World**

1: – ) Numerous Internet Exchange Points (IXPs) are located worldwide, with some of the most prominent ones including DE-CIX in Frankfurt, AMS-IX in Amsterdam, and LINX in London. These IXPs are critical hubs for global internet connectivity, enabling networks from different regions to exchange traffic.

2: – ) major global IXPs, regional and national Internet Exchange Points cater to specific geographic areas. These local IXPs further improve network performance by facilitating regional traffic exchange and reducing the need for long-haul data transfer.

3: – ) the demand for high-performance and reliable internet connectivity continues to grow, SD-IX is poised to play a pivotal role in shaping the future of networking. By virtualizing the interconnection process and providing organizations with unprecedented control and flexibility over their network connections, SD-IX empowers businesses to optimize their network performance, enhance security, and reduce costs. With its ability to scale on-demand and seamlessly reroute traffic, SD-IX is well-suited for the evolving needs of cloud-based applications, IoT devices, and emerging technologies such as edge computing.

4: – ) Defined Internet Exchange represents a paradigm shift in how organizations connect to the Internet. By virtualizing the interconnection process and providing enhanced performance, reliability, cost efficiency, scalability, and security, SD-IX offers a compelling solution for businesses seeking to optimize their network infrastructure. As the digital landscape continues to evolve, SD-IX is set to revolutionize the way we connect to the internet, enabling organizations to stay ahead of the curve and unlock new possibilities in the digital era.

Key SD-IX Considerations:

– Enhanced Performance and Latency Reduction: SD-IX brings networks closer to end-users by establishing globally distributed points of presence (PoPs). This proximity reduces latency and improves application performance, resulting in a superior user experience.

– Seamless Network Scalability: With SD-IX, organizations can quickly scale their network resources up or down based on demand. This agility empowers businesses to adapt rapidly to changing network requirements, ensuring optimal performance and cost-efficiency.

– Simplified Network Management: Traditional IXPs often require complex physical infrastructure and manual configurations. SD-IX simplifies network management by providing a centralized control plane, allowing administrators to automate provisioning, traffic engineering, and policy enforcement.

– Cloud Service Providers: SD-IX enables providers to establish direct and secure customer connections. This direct access bypasses the public internet, ensuring better security, lower latency, and improved data transfer speeds.

– Content Delivery Networks (CDNs): CDNs can leverage SD-IX to optimize content delivery by strategically placing their PoPs closer to end-users. This reduces latency, minimizes bandwidth costs, and enhances content delivery performance.

– Enterprises and Multi-Cloud Connectivity: Enterprises can benefit from SD-IX by establishing private connections between their networks and multiple cloud service providers. This enables secure, high-performance multi-cloud connectivity, facilitating seamless data transfer and workload migration.

Understanding SD-IX

At its core, SD-IX is an architectural framework enabling the dynamic and automated internet traffic exchange between networks. Unlike traditional methods that rely on physical infrastructure, SD-IX leverages software-defined networking (SDN) principles to create a virtualized exchange ecosystem. By decoupling the control plane from the data plane, SD-IX brings flexibility, agility, and scalability to internet exchange.

One of SD-IX’s critical advantages is its ability to provide enhanced performance through optimized routing. By leveraging intelligent algorithms and real-time analytics, SD-IX can intelligently direct traffic along the most efficient paths, reducing latency and improving overall network performance. Moreover, SD-IX offers improved scalability, allowing networks to dynamically adjust their capacity based on demand, ensuring seamless connectivity even during peak usage.

Security and Privacy Advancements

SD-IX brings significant advancements in an era where data security and privacy are of the utmost concern. With the ability to implement granular access control policies and encryption mechanisms, SD-IX ensures secure data transmission across networks. SD-IX’s centralized management and monitoring capabilities enable network administrators to detect and mitigate potential security threats in real-time, bolstering overall network security.

Software-defined networks

A software-defined network (SDN) optimizes and simplifies network operations by closely tying applications and network services, whether real or virtual. By establishing a logically centralized network control point (typically an SDN controller), the control point orchestrates, mediates, and facilitates communication between applications that wish to interact with network elements and network elements that want to communicate information with those applications. The controller exposes and abstracts network functions and operations through modern, application-friendly, bidirectional programmatic interfaces.

As a result, software-defined, software-driven, and programmable networks have a rich and complex history and various challenges and solutions to those challenges. Because of the success of technologies that preceded them, software-defined, software-driven, and programmable networks are now possible.IP, BGP, MPLS, and Ethernet are the fundamental elements of most networks worldwide.

Control and Data Plane Separation

SDN’s early proponents advocated separating a network device’s control and data planes as a potential advantage. Network operators benefit from this separation regarding centralized or semi-centralized programmatic control. As well as being economically advantageous, it can consolidate into a few places, usually a complex piece of software to configure and control, onto less expensive, so-called commodity hardware.

One of SDN’s most controversial tenets is separating control and data planes. It’s not a new concept, but the contemporary way of thinking puts a twist on it: how far should the control plane be from the data plane, how many instances are needed for resiliency and high availability, and if 100% of the control plane can be moved beyond a few inches are all intensely debated. There are many possible control planes, ranging from the simplest, the fully distributed, to the semi- and logically centralized, to the strictly centralized.

OpenFlow Matching

With OpenFlow, the forwarding path is determined more precisely (matching fields in the packet) than traditional routing protocols because the tables OpenFlow supports more than just the destination address. Using the source address to determine the next routing hop is similar to the granularity offered by PBR.

In the same way that OpenFlow would do many years later, PBR permits network administrators to forward traffic based on “nontraditional” attributes, such as the source address of a packet. However, PBR-forwarded traffic took quite some time for network vendors to offer equivalent performance, and the final result was very vendor-specific.

Example Technology: Policy Based Routing

**The Role of SDN Solutions**

Most existing SDN solutions are aimed at cellular core networks, enterprises, and the data center. However, at the WAN edge, SD-WAN and WAN SDN are leading a solid path, with many companies offering a BGP SDN solution augmenting natural Border Gateway Protocol (BGP) IP forwarding behavior with a controller architecture, optimizing both inbound and outbound Internet-bound traffic. So, how can we use these existing SDN mechanisms to enhance BGP for interdomain routing at Internet Exchange Points (IXP)?

**The Role of IXPs**

IXPs are location points where networks from multiple providers meet to exchange traffic with BGP routing. Each participating AS exchanges BGP routes by peering eBGP with a BGP route server, which directs traffic to another network ASes over a shared Layer 2 fabric. The shared Layer 2 fabric provides the data plane forwarding of packets. The actual BGP route server is the control plane to exchange routing information.

For additional pre-information, you may find the following posts helpful:

  1. Ansible Variables
  2. Open Networking
  3. Software Defined Perimeter Solutions
  4. Distributed Solutions
  5. Full Proxy

Software Defined Internet Exchange

An Internet exchange point (IXP) is a physical location through which Internet infrastructure companies such as Internet Service Providers (ISPs) and CDNs connect. These locations exist on the “edge” of different networks and allow network providers to share transit outside their network.

IXPs will run BGP.  Also, it is essential to understand that Internet exchange point participants often require that the BGP NEXT_HOP specified in UPDATE messages be that of the peer’s IP address, as a matter of policy.

Route Server

A route server provides an alternative to full eBGP peering between participating AS members, enabling network traffic engineering. It’s a control plane device and does not participate in data plane forwarding. There are currently around 300 IXPs worldwide. Because of their simple architecture and flat networks, IXPs are good locations to deploy SDN.

There is no routing for forwarding, so there is a huge need for innovation. They usually consist of small teams, making innovation easy to introduce. Fear is one of the primary emotions that prohibit innovation, and one thing that creates fear is Loss of Service.

This is significant for IXP networks, as they may have over 5 Terabytes of traffic per second. IXPs are major connecting points, and a slight outage can have a significant ripple effect.

  • A key point. Internet Exchange Design

SDX, a software-defined internet exchange, is an SDN solution based on the combined efforts of Princeton and UC Berkeley. It aims to address IXP pain points (listed below) by deploying additional SDN controllers and OpenFlow-enabled switches. It doesn’t try to replace the entire classical IXP architecture with something new but rather augments existing designs with a controller-based solution, enhancing IXP traffic engineering capabilities. However, the risks associated with open-source dependencies shouldn’t be ignored.

Challenges: Software Defined Internet Exchange: IXP Pain Points

BGP is great for scalability and reducing complexity but severely limits how networks deliver traffic over the Internet. One tricky thing to do with BGP is good inbound TE. The issue is that IP routing is destination-based, so your neighbor decides where traffic enters the network. It’s not your decision.

The forwarding mechanism is based on the destination IP prefix. A device forwards all packets with the same destination address to the same next hop, and the connected neighbor decides.

The main pain points for IXP networks:

As already mentioned, routing is based on the destination IP prefix. BGP selects and exports routes for destination prefixes only. It doesn’t match other criteria in the packet header, such as source IP address or port number. Therefore, it cannot help with application steering, which would be helpful in IXP networks.

Secondly, you can only influence direct neighbors. There is no end-to-end control, and it’s hard to influence neighbors that you are not peering. Some BGP attributes don’t carry across multiple ASes; others may be recognized differently among vendors. We also use a lot of de-aggregation to TE. Everyone is doing this, which is why we have the problem of 540,000 prefixes on the Internet. De-aggregation and multihoming create lots of scalability challenges.

Finally, there is an indirect expression of policy. Local Preference (LP) and Multiple Exit Discriminator (MED) are ineffective mechanisms influencing traffic engineering. We should have better inbound and outbound TE capabilities. MED, AS Path, pretending, and Local Preference are widely used attributes for TE, but they are not the ultimate solution.

They are inflexible because they can only influence routing decisions based on destination prefixes. You can not do source IP or application type. They are very complex, involving intense configuration on multiple network devices. All these solutions involve influencing the remote party to decide how it enters your AS, and if the remote party does not apply them correctly, TE becomes unpredictable.

SDX: Software-Defined Internet Exchange

The SDX solution proposed by Laurent is a Software-Defined Internet Exchange. As previously mentioned, it consists of a controller-based architecture with OpenFlow 1.3-enabled physical switches. It aims to solve the pain points of BGP at the edge using SDN.

Transport SDN offers direct control over packet-processing rules that match on multiple header fields (not just destination prefixes) and perform various actions (not just forwarding), offering direct control over the data path. SDN enables the network to execute a broader range of decisions concerning end-to-end traffic delivery.

How does it work?

What is OpenFlow? Is the IXP fabric replaced with OpenFlow-enabled switches? Now, network traffic engineering is based on granular OpenFlow rules. It’s more predictable as it does not rely on third-party neighbors to decide the entry. OpenFlow rules can be based on any packet header field, so they’re much more flexible than existing TE mechanisms. An SDN-enabled data plane enables networks to have optimal WAN traffic with application steering capabilities. 

The existing route server has not been modified, but now we can push SDN rules into the fabric without requiring classical BGP tricks (local preference, MED, AS prepend). The solution matches the destination MAC address, not the destination IP prefix, and uses an ARP proxy to convert the IP prefixes to MAC addresses.

The participants define the forwarding policies, and the controller’s role is to compile the forwarding entries into the fabric. The SDX controller implementation has two main pipelines: a policy compiler based on Pyretic and a route server based on ExaBGP. The policy compiler accepts input policies (custom route advertisements) written in Pyretic from individual participants and BGP routes from the route server. This produces forwarding rules that implement the policies.

SDX Controller

The SDX controller combines the policies from multiple member ASes into one policy for the physical switch implementation. The controller is like an optimized compiler, compiling down the policy and optimizing the code in the forwarding by using a virtual next hop. There are other potential design alternatives to SDX, such as BGP FlowSpec. But in this case, BGP FlowSpec would have to be supported by all participating member AS edge devices.

 

Summary: Software Defined Internet Exchange

In today’s fast-paced digital world, seamless connectivity is necessary for businesses and individuals. As technology advances, traditional Internet exchange models face scalability, flexibility, and cost-effectiveness limitations. However, a groundbreaking solution has emerged – software-defined internet exchange (SD-IX). In this blog post, we will delve into the world of SD-IX, exploring its benefits, functionalities, and potential to revolutionize how we connect online.

Understanding SD-IX

SD-IX, at its core, is a virtualized network infrastructure that enables the dynamic and efficient exchange of internet traffic between multiple parties. Unlike traditional physical exchange points, SD-IX leverages software-defined networking (SDN) principles to provide a more agile and scalable solution. By separating the control and data planes, SD-IX empowers organizations to manage their network traffic with enhanced flexibility and control.

The Benefits of SD-IX

Enhanced Performance and Latency Reduction: SD-IX brings the exchange points closer to end-users, reducing the distance data travels. This proximity results in lower latency and improved network performance, enabling faster application response times and better user experience.

Scalability and Agility: Traditional exchange models often struggle to keep up with the ever-increasing demands for bandwidth and connectivity. SD-IX addresses this challenge by providing a scalable architecture that can adapt to changing network requirements. Organizations can easily add or remove connections, adjust bandwidth, and optimize network resources on-demand, all through a centralized interface.

Cost-Effectiveness: With SD-IX, organizations can avoid the costly investments in building and maintaining physical infrastructure. By leveraging virtualized network components, businesses can save costs while benefiting from enhanced connectivity and performance.

Use Cases and Applications

  • Multi-Cloud Connectivity

SD-IX facilitates seamless connectivity between multiple cloud environments, allowing organizations to distribute workloads and resources efficiently. By leveraging SD-IX, businesses can build a robust and resilient multi-cloud architecture, ensuring high availability and optimized data transfer between cloud platforms.

  • Hybrid Network Integration

For enterprises with a mix of on-premises infrastructure and cloud services, SD-IX serves as a bridge, seamlessly integrating these environments. SD-IX enables secure and efficient communication between different network domains, empowering organizations to leverage the advantages of both on-premises and cloud-based resources.

Conclusion:

In conclusion, software-defined Internet exchange (SD-IX) presents a transformative solution to the challenges faced by traditional exchange models. With its enhanced performance, scalability, and cost-effectiveness, SD-IX is poised to revolutionize how we connect and exchange data in the digital age. As businesses continue to embrace the power of SD-IX, we can expect a new era of connectivity that empowers innovation, collaboration, and seamless digital experiences.

BGP FlowSpec

by Blog

BGP FlowSpec

Network operators face various challenges in managing and securing their networks in today's interconnected world. BGP FlowSpec, a powerful extension to the Border Gateway Protocol (BGP), has emerged as a valuable tool for mitigating network threats and improving traffic management. This blog post aims to provide a comprehensive overview of BGP FlowSpec, its benefits, and its role in enhancing network security and traffic management.

BGP FlowSpec, short for BGP Flow Specification, is an extension of the BGP protocol that allows network operators to define and distribute traffic filtering rules across their networks. Unlike traditional BGP routing, which focuses on forwarding packets based on destination IP addresses, BGP FlowSpec enables operators to control traffic based on various attributes, including source IP addresses, destination ports, protocols, and more.

BGP FlowSpec is an extension to the traditional BGP protocol that allows for fine-grained control of network traffic. It enables network operators to define traffic filtering rules based on various criteria such as source and destination IP addresses, port numbers, packet attributes, and more. These rules are then distributed across the network, ensuring consistent traffic control and management.

Traffic Filtering: BGP FlowSpec enables administrators to define specific traffic filtering rules, allowing them to drop, redirect, or rate-limit traffic based on various criteria.

DDoS Mitigation: By leveraging BGP FlowSpec, network operators can swiftly respond to DDoS attacks by deploying traffic filtering rules in real-time, mitigating the impact and ensuring the stability of their network.

Service Differentiation: BGP FlowSpec enables the creation of differentiated services by allowing administrators to prioritize, shape, or redirect traffic based on specific requirements or customer agreements.

Increased Network Security: BGP FlowSpec allows for rapid response to security threats by deploying traffic filtering rules, providing enhanced protection against malicious traffic and reducing the attack surface.

Improved Network Performance: With the ability to fine-tune traffic management, BGP FlowSpec enables better utilization of network resources, optimizing performance and ensuring efficient traffic flow.

Flexibility and Scalability: BGP FlowSpec is highly flexible, allowing administrators to easily adapt traffic filtering rules as per evolving network requirements. Additionally, it scales seamlessly to accommodate growing network demands.

Data Centers: BGP FlowSpec is utilized in data centers to enforce traffic engineering policies, prioritize critical applications, and protect against DDoS attacks.

Internet Service Providers (ISPs): ISPs leverage BGP FlowSpec to enhance network security, offer differentiated services, and efficiently manage traffic across their infrastructure.

Cloud Service Providers: BGP FlowSpec enables cloud service providers to dynamically manage and prioritize traffic flows, ensuring optimal performance and meeting service level agreements (SLAs).

BGP FlowSpec is a game-changer in the realm of network control. Its powerful features, combined with the ability to fine-tune traffic management, provide network operators with unprecedented control and flexibility. By adopting BGP FlowSpec, organizations can enhance security, optimize performance, and unleash the true potential of their networks.

Matt Conran

Highlights: BGP FlowSpec

Traffic Filtering Policies

BGP (Border Gateway Protocol) Flow Spec is an extension of BGP that enables the distribution and enforcement of traffic filtering policies throughout a network. It provides granular control over network traffic by allowing operators to define and propagate specific traffic flow characteristics.

Within the realm of BGP Flow Spec, several important components work together to achieve effective traffic filtering. These include Match Fields, Actions, and Communities. Match Fields define the criteria for traffic identification, Actions determine how the matched traffic should be treated, and Communities facilitate the distribution of Flow Spec rules.

BGP Flow Spec offers a wide range of use cases in network security. One such application is DDoS mitigation, where Flow Spec rules can be deployed at the edge of a network to quickly identify and drop malicious traffic. Additionally, BGP Flow Spec can be used for implementing fine-grained traffic engineering policies, enabling network operators to optimize network resources and ensure optimal traffic flow.

While BGP Flow Spec presents numerous benefits, it also comes with its fair share of challenges. Interoperability among different vendors’ implementations can be a concern, as not all vendors support the same set of match fields and actions. Furthermore, the potential for misconfigurations and unintended consequences should be carefully addressed to prevent disruptions in network operations.

What is BGP FlowSpec?

BGP FlowSpec is an extension to BGP that allows for the distribution of traffic filtering rules across network devices. It enables network administrators to define fine-grained traffic policies based on various criteria, such as source/destination IP addresses, port numbers, protocols, etc. By leveraging BGP FlowSpec, network operators can quickly disseminate and enforce traffic filtering rules throughout their networks.

1. DDoS Mitigation:

One key application of BGP FlowSpec is mitigating Distributed Denial of Service (DDoS) attacks. By utilizing BGP FlowSpec, network operators can dynamically distribute traffic filtering rules to divert and reduce malicious traffic at the edge of their networks, preventing them from reaching the targeted resources.

2. Traffic Engineering:

BGP FlowSpec also enables advanced traffic engineering capabilities. By manipulating traffic flows based on specific criteria, network administrators can optimize network performance, allocate resources efficiently, and ensure a smooth user experience.

3. Firewalling and Access Control:

With BGP FlowSpec, network operators can implement granular firewalling and access control policies. By defining filtering rules at the edge routers, they can selectively allow or deny traffic based on specific attributes, enhancing network security and protecting critical assets.

4. Enhanced Network Security:

BGP FlowSpec enables the rapid deployment of traffic filtering rules to mitigate Distributed Denial of Service (DDoS) attacks, preventing malicious traffic from reaching critical network infrastructure. Its ability to filter traffic based on source and destination addresses, protocols, and port numbers provides a powerful first line of defense against various attack vectors.

5. Improved Network Flexibility:

With BGP FlowSpec, network administrators can dynamically manipulate traffic flows within their networks. This flexibility allows for implementing traffic engineering strategies, such as diverting traffic to optimize performance, balancing loads across multiple paths, or redirecting traffic during maintenance operations. BGP FlowSpec enables network operators to adapt quickly to changing network conditions and optimize resource utilization.

Flowspec

With Flowspec (Flow Specification), you can filter and limit traffic based on specific flow characteristics, such as source and destination IPv4 and IPv6 addresses, IP protocol, and source and destination ports. By distributing traffic filtering and rate-limiting rules across their networks using BGP, flowspec can help mitigate the impact of DDoS attacks and other unwanted traffic patterns.

For Flowspec to work, the router receives specially formatted BGP Network Layer Reachability Information (NLRI) messages that contain the flow characteristics and the desired actions to be applied to the matching traffic. Using this information, the router dynamically creates and applies traffic filtering and rate-limiting policies.

Flowspec & Cisco IOS

1) – Flowspec can be configured on Cisco IOS routers by enabling BGP, configuring a BGP session with a neighbor, and configuring BGP policy templates with the desired traffic filtering and rate-limiting actions. In addition, you may need to enable Flowspec client functionality and configure the router to accept and install Flowspec routes.

2) – In addition to forwarding traffic based on IP prefixes, modern IP routers can classify, shape, rate limit, filter, or redirect packets based on administratively defined policies. These traffic policy mechanisms allow routers to define match rules based on multiple fields of packet headers. Actions such as those described above can be associated with each rule.

3) – The n-tuple containing the matching criteria defines an aggregate traffic flow specification.IP protocols, transport protocol port numbers, and source and destination address prefixes can also be used as matching criteria. An aggregated traffic flow’s flow specification rules are encoded using the BGP [RFC4271] NLRIs.

4) – Flow specifications are more specific entries in unicast prefixes and depend on existing unicast data. Before flow specifications can be accepted from external autonomous systems, they must be validated against unicast routing. When the aggregate traffic flow defined by the unicast destination prefix is forwarded to a BGP peer, the local system can safely install more specific flow rules.

BGP FlowSpec

Dealing with FlowSpec

BGP Flowspec

In RFC 5575, Dissemination of Flow Specification Rules, the BGP Flow Specification (Flowspec) describes a mechanism for distributing network layer reachability information (NLRI) for aggregated traffic flows. According to the RFC, a flow specification is an n-tuple with several matching criteria. An IP packet matches a defined flow if all the requirements are met. Flowspecs are n-tuples because they can define multiple match criteria, which must all be met. Traffic does not match the flowspec entry if all the tuples are not matched.

Network operators use BGP flowspec primarily to distribute traffic filtering actions to mitigate DDoS attacks.

The focus should first be on detecting DDOS attacks, such as invalid or malicious incoming requests, and then on mitigation. To mitigate DDOS attacks, two steps must be taken:

Step 1. Diversion: Route traffic to a specialized device that removes invalid or malicious packets from the traffic stream while retaining legitimate packets.

Step 2. Return: Redirect the clean and legitimate traffic back to the server.

**Dealing with DDoS Attacks**

To deal with DDoS attacks, as standard IP routing is destination-based, we can use routing to route the packets toward a null destination. If BGP is involved, we can use a remote-triggered blackhole (RTBH) to remotely signal our upstream router to route the particular destination into a NULL route.

This is quite a simplistic way to mitigate a DDoS attack. On the other hand, BGP FlowSpec can be used as a BGP SDN DDoS solution. And can influence behavior based on a much broader set of criteria with the DDoS BGP redirect criteria?

**FlowSpec DDoS**

For example, with FlowSpec DDoS, we can match up more fields supported by BGP Flowspec (source and destination, IP protocol, source and destination port, ICMP code, and TCP Flags) and more dynamic actions such as dropped packet test or rate limit.

For pre-information, you may find the following helpful post before you proceed:

  1. IPFIX Big Data
  2.  OpenFlow Protocol
  3. Data Center Site Selection
  4. DDoS Attacks
  5. OVS Bridge
  6. Segment Routing

BGP FlowSpec

BGP Security

BGP is one protocol that makes the Internet work. Unfortunately, because of its criticality, BGP has been the target protocol. The main focus of any attacker is to find a vulnerability in a system, in this case, BGP, and then exploit it. RFC 4272, BGP Security Vulnerabilities Analysis, presents various weak areas in BGP that every enterprise or service provider should consider when implementing BGP.

Like most protocols were designed in the past, BGP provides no confidentiality and only limited integrity and authentication services. Furthermore, BGP messages can be replayed; if a bad actor intercepts a BGP UPDATE message that adds a route, the hacker can resend that message after the route has been withdrawn, causing an inconsistent and invalid route to be present in the routing information base (RIB).

Enhancing Network Security:

One of BGP FlowSpec’s critical benefits is its ability to enhance network security. By leveraging FlowSpec, network operators can quickly respond to security threats and implement granular traffic filtering policies. For example, in the event of a distributed denial-of-service (DDoS) attack, operators can use BGP FlowSpec to instantly distribute traffic filters across their network, effectively mitigating the attack at its source. This real-time mitigation capability significantly reduces the impact of security incidents and improves network resilience.

Traffic Engineering and Quality of Service:

BGP FlowSpec also plays a crucial role in traffic engineering and quality of service (QoS) management. Network operators can use FlowSpec to shape and redirect traffic based on specific criteria. For instance, by employing BGP FlowSpec, operators can prioritize certain traffic types, such as video or voice traffic, over others, ensuring better QoS for critical applications. Furthermore, FlowSpec enables operators to dynamically reroute traffic in response to network congestion or link failures, optimizing network performance and user experience.

Implementing BGP FlowSpec:

Implementing BGP FlowSpec requires compatible routers and appropriate configuration. Network operators must ensure that their routers support the BGP FlowSpec extension and have the necessary software updates. Additionally, operators must carefully define traffic filtering rules using the BGP FlowSpec syntax, specifying each rule’s desired attributes and actions. It is crucial to thoroughly test and validate the FlowSpec configurations to avoid unintended consequences and ensure the desired outcomes.

Challenges and Considerations:

While BGP FlowSpec offers significant advantages, some challenges and considerations must be considered. FlowSpec configurations can be complex, requiring a deep understanding of network protocols and traffic patterns. Additionally, incorrect or overly aggressive FlowSpec rules can unintentionally disrupt legitimate traffic. Therefore, operators must balance security and network accessibility while regularly reviewing and fine-tuning their FlowSpec policies.

Recap on BGP FlowSpec

BGP FlowSpec is a BGP SDN mechanism that distributes flow-based policies to other BGP speakers. It enables the dynamic distribution of security profiles and corrective actions using a signaling mechanism based on BGP. No other protocols (OpenFlow, NETCONF, etc.) are used to disseminate the policies. The solution is based entirely on BGP and consists of a new Border Gateway Protocol Network Layer Reachability Information (BGP NLRI—AFI=1, SAFI=133) encoding format.

It reuses BGP protocol algorithms and inherits all the operational experience from existing BGP designs. It’s simple to extend by adding a new NLRI – MP_REACH_NLRI / MP_UNREACH_NLRI. It’s also a well-known protocol for many other technologies, including IPv6, VPN, labels, and multicast.

All existing BGP high availability and scalability features can be used with BGP FlowSpec; for example, route reflection is possible for point-to-multipoint connections. In addition, BGP provides the following:

  • Inter-domain support.
  • Meaning you are not tied down to one AS.
  • You are enabling your BGP FlowSpec domain to span multiple administrative domains.

BGP FlowSpec Operations

BGP FlowSpec separates BGP networks’ control and data plane and distributes traffic flow specifications. Within the infrastructure, we have a Flowspec controller, the server, one or more Flowspec clients, and optionally a route-reflector for scalability. Rules that contain matching criteria and actions are created on the server and redistributed to clients via MP-BGP. 

The central controller programs forward decisions and inject rules remotely into BGP clients. Cisco, Juniper, and Alcatel-Lucent support BGP FS controllers. It may also run on an x86 server with ExaBGP or Arbor PeakFlow SP Collector Platform.

The client receives the rules from the controller and programs, including rules for a) traffic descriptions and b) actions to apply to traffic. Then, the client, a BGP speaker, makes the necessary changes to TCAM. An additional optional route reflector component can receive rules from the controller and distribute them to clients.

Traffic classification

It classes traffic with Layer 3 and 4 information and offers similar granularity to ACLs. Still, one significant added benefit is that it is distributed, and a central controller controls flow entries. It can match the destination IP, source IP, IP protocol, port, destination port, source port, ICMP type and code, TCP flags, packet length, DCSP, and fragments. Once traffic is identified, it is matched, and specific actions are applied. In some cases, multiple actions are applied.

For example, FlowSpec can remotely program QoS – policers and markers, PBR – leak traffic to a Virtual Routing and Forwarding (VRF) or a new next hop, and replicate the traffic to, for example, a sniffer – all the configuration is carried out on the controller.

A key point: Scalability restrictions.

However, scalability restrictions exist as BGP FlowSpec entries share the TCAM with ACL and QoS. Complex rules using multi-value ranges consume more TCAM than simple matching rules. Cisco provides general guidance of 3000 simple rules per line card.

bgp flowsepc
Diagram: BGP FlowSpec.

BGP DDoS and DDoS Mitigation

FlowSpec was initially proposed with RFC 5575 as a DDoS mitigation tool, but its use cases expand to other areas, such as BGP unequal cost load balancing. It’s tough to balance unequally based on your destination. With FlowSpec, it’s possible to identify groups of users based on the source address and then use FlowSpec to traffic engineer on ALL core nodes, not just at network edges.

DDoS mitigation operations

BGP Flowspec resembles access lists created with class maps and policy maps that provide matching criteria and traffic filtering actions. They are injected into BGP and propagated to BGP peers. As a result, there are many more criteria to use that destination IP address that can be used to mitigate the DDoS attack.

For example, with the DDoS BGP redirect, we can use criteria such as the source, destination, and L4 parameters and packet specifics such as length.

These are sent in a BGP UPDATE message to BGP border routers within FLOW_SPEC_NLRI along with the action criteria. Once received, several actions can be carried out, and these actions are carried in the extended communities’ Path attributes. So you can drop the policy or redirect it to another VRF.

DDoS BGP redirects The volumetric attack.

The primary type of DDoS attack FlowSpec protects against is a volumetric attack – long-lived large flows along with the DNS reflection attack. Volumetric attacks are best mitigated as close as possible to the Internet border. The closer you drop the packet to the source, the better. You don’t want the traffic to arrive at its destination or to have the firewall process and drop it.

For example, a TCP SYN attack could be 1000 million packets per second; not many firewall states can address that. It is much better to drop volumetric-type attacks at network borders as they cannot be mitigated within the data center; it’s simply too late.

FlowSpec is also suitable for dropping amplification-type attacks. These attacks do not need to be sent to scrubbing systems and can be handled by FlowSpec by matching the traffic pattern and filtering at the edge.

With BGP Flowspec for DDoS BGP redirects, we have a more granular approach to mitigating DDoS attacks than old-school methods. This is accomplished by a specific definition of flows based on Layer 3 and 4 matching criteria and actions configured on the FlowSpec server. The rules are automatically redistributed to FlowSpec clients using MP-BGP (SAFI 133) so the clients can take action defined in the flow rules.

BGP FlowSpec has become an essential tool for network operators seeking to enhance network security and traffic management. Its ability to distribute traffic filtering rules in real time and its flexibility in defining granular policies make it a valuable asset in today’s dynamic network environments. By leveraging BGP FlowSpec, operators can effectively respond to security threats, optimize traffic engineering, and deliver better QoS. However, careful planning, implementation, and continuous monitoring are crucial to maximize the benefits of BGP FlowSpec while mitigating potential risks.

Summary: BGP FlowSpec

The demand for highly flexible and secure networks continues to grow in today’s interconnected world. Among the many protocols that enable this, BGP Flowspec stands out as a powerful tool for network administrators. In this blog post, we will explore its key features, use cases, and benefits.

What is BGP Flowspec?

BGP Flowspec, or Border Gateway Protocol Flowspec, is an extension of BGP that enables network operators to define traffic filtering rules at the edge of their networks. Unlike traditional BGP routing, which focuses on forwarding packets based on destination IP addresses, BGP Flowspec allows for more granular control by filtering traffic based on various packet fields, including source and destination IP addresses, protocols, port numbers, and more.

Use Cases of BGP Flowspec

1. DDoS Mitigation: BGP Flowspec provides a powerful mechanism to detect and mitigate Distributed Denial of Service (DDoS) attacks in real time. Network administrators can swiftly drop or redirect malicious traffic by dynamically updating routers’ access control lists (ACLs), ensuring that critical resources remain available.

2. Traffic Engineering: BGP Flowspec enables network operators to shape and optimize network traffic flows. Administrators can achieve efficient resource utilization and improve overall network performance by manipulating traffic based on specific criteria, such as particular application types or geographic regions.

3. Policy Enforcement: BGP Flowspec allows network administrators to enforce specific policies at the edge of their networks. This could include blocking or redirecting traffic that violates particular security policies or regulatory requirements, ensuring compliance, and protecting sensitive data.

Benefits of BGP Flowspec

1. Flexibility: BGP Flowspec provides fine-grained control over traffic, allowing network operators to adapt quickly to evolving network requirements. This flexibility empowers administrators to respond to security threats, optimize network performance, and enforce policies with minimal disruption.

2. Real-time Response: With BGP Flowspec, network operators can quickly respond to security incidents and traffic anomalies. Administrators can effectively mitigate threats and protect network resources without manual intervention by dynamically updating filtering rules across routers.

3. Scalability: BGP Flowspec leverages the existing BGP infrastructure, making it highly scalable and suitable for large-scale networks. As networks grow and evolve, BGP Flowspec can seamlessly adapt to accommodate increased traffic and changing filtering requirements.

Conclusion:

In conclusion, BGP Flowspec is a powerful addition to the network administrator’s toolkit, offering enhanced flexibility, real-time response capabilities, and scalable traffic filtering. By leveraging BGP Flowspec’s capabilities, network operators can better address security threats, optimize network performance, and enforce policies tailored to their needs. As the demand for secure and highly adaptable networks continues to rise, understanding and harnessing the power of BGP Flowspec becomes increasingly essential.

What does SDN mean

BGP has a new friend – BGP-Based SDN

by Blog

BGP-Based SDN

The world of networking continues to evolve rapidly, with new technologies and approaches emerging to meet the growing demands of modern communication. Two such technologies, BGP (Border Gateway Protocol) and SDN (Software-Defined Networking), have gained significant attention for their impact on network flexibility and management. In this blog post, we will delve into the fascinating intersection of BGP and SDN, exploring how they work together to empower network administrators and optimize network operations.

Border Gateway Protocol (BGP) serves as the backbone of the internet, facilitating the exchange of routing information between networks. BGP enables dynamic routing, allowing routers to determine the best paths for data transmission based on various factors such as network policies, path preferences, and traffic conditions. It plays a crucial role in inter-domain routing, where multiple networks connect and exchange data.

Software-Defined Networking (SDN) introduces a paradigm shift in network management by decoupling the control plane from the data plane. In traditional networks, network devices such as switches and routers possess both control and data plane functionalities. SDN separates these functions, with a centralized controller managing the network's behavior and forwarding decisions. The data plane, consisting of switches and routers, simply follows the instructions provided by the controller.

When BGP and SDN converge, we unlock a new realm of network possibilities. SDN's centralized control and programmability complement BGP's routing capabilities, offering enhanced flexibility and control over network operations. By leveraging SDN controllers, network administrators can dynamically adjust BGP routing policies, optimize traffic flows, and respond to changing network conditions in real-time. This dynamic interaction between BGP and SDN empowers organizations to adapt their networks to ever-evolving requirements efficiently.

The combination of BGP and SDN brings forth several advantages and opens up exciting use cases. Network operators can implement traffic engineering techniques to optimize network paths, improve performance, and minimize congestion. They can also utilize SDN's programmability to automate BGP configuration and provisioning, reducing human errors and accelerating network deployment. Additionally, BGP-SDN integration facilitates the implementation of policies for traffic prioritization, security, and load balancing.

The convergence of BGP and SDN represents a powerful synergy that empowers network administrators to achieve unprecedented levels of flexibility, control, and efficiency. By combining BGP's robust routing capabilities with SDN's programmability and centralized management, organizations can adapt their networks swiftly to meet evolving demands. As the networking landscape continues to evolve, the BGP-SDN combination will undoubtedly play a pivotal role in shaping the future of network architecture.

Matt Conran

Highlights: BGP-Based SDN

Understanding BGP and SDN

1- BGP (Border Gateway Protocol) is a routing protocol used to exchange routing information between different networks on the internet. On the other hand, SDN is an architectural approach that separates the control plane from the data plane, allowing network administrators to centrally manage and configure networks through software.

2- BGP-based SDN combines the power of BGP routing with the flexibility and programmability of SDN. Network operators gain enhanced control, scalability, and agility in managing their networks by leveraging BGP as the control plane protocol in an SDN architecture. This marriage of BGP and SDN opens up new possibilities for network automation, policy-driven routing, and dynamic traffic engineering.

3- One critical advantage of BGP-based SDN is its ability to simplify network management. With centralized control and programmability, network operators can define policies and rules that govern their networks’ behavior.

4- This paves the way for efficient traffic engineering and the ability to respond dynamically to changing network conditions. Additionally, BGP-based SDN provides better scalability, allowing for the distribution of control plane functions across multiple controllers.

BGP SDN Challenges:

While BGP-based SDN holds immense potential, it also poses certain challenges. One of the primary concerns is the complexity of implementation and migration. Integrating BGP with SDN requires careful planning and coordination to ensure a smooth transition. Moreover, security and privacy considerations must be considered when deploying BGP-based SDN, as centralized control introduces new attack vectors that must be mitigated.

Critical Components of BGP SDN:

a. BGP Routing: BGP SDN leverages the BGP protocol to manage the routing decisions between different networks. This enables efficient and optimized routing and seamless communication across various domains.

b. SDN Controller: The SDN controller acts as the centralized brain of the network, providing a single point of control and management. It enables network administrators to define and enforce network policies, configure routing paths, and allocate network resources dynamically.

c. OpenFlow Protocol: BGP SDN uses the OpenFlow protocol to communicate between the SDN controller and the network switches. OpenFlow enables the controller to programmatically control the forwarding behavior of switches, resulting in greater flexibility and agility.

Benefits of BGP SDN:

a. Enhanced Flexibility: BGP SDN allows network administrators to tailor their network infrastructure to meet specific requirements. With centralized control, network policies can be easily modified or updated, enabling rapid adaptation to changing business needs.

b. Improved Scalability: Traditional network architectures often struggle to handle the growing demands of modern applications. BGP SDN provides a scalable solution by enabling dynamic allocation of network resources, optimizing traffic flow, and ensuring efficient bandwidth utilization.

c. Simplified Network Management: BGP SDN’s centralized management simplifies network operations. Network administrators can configure, monitor, and manage the entire network from a single interface, reducing complexity and improving overall efficiency.

Use Cases for BGP SDN:

a. Data Centers: BGP SDN is well-suited for data center environments, where rapid provisioning, scalability, and efficient workload distribution are critical. By leveraging BGP SDN, data centers can seamlessly integrate physical and virtual networks, enabling efficient resource allocation and workload migration.

b. Service Providers: BGP SDN allows service providers to offer their customers flexible and customizable network services. It enables the creation of virtual private networks, traffic engineering, and service chaining, resulting in improved service delivery and customer satisfaction.

BGP Technologies in BGP SDN

Understanding BGP Route Reflection

A – 🙂 BGP route reflection is a technique used to alleviate the burden of full-mesh connectivity in BGP networks. Traditionally, in a fully meshed BGP configuration, all routers must establish a direct peer-to-peer connection with every other router, resulting in complex and resource-intensive setups. Route reflection introduces a hierarchical approach that reduces the number of required connections, providing a more scalable alternative.

B – 🙂 Route reflectors act as centralized points within a BGP network and reflect and propagate routing information to other routers. They collect BGP updates from their clients and reflect them to other clients, ensuring a simplified and efficient distribution of routing information. Route reflectors maintain the overall consistency of the BGP network while reducing the number of required peer connections.

C- 🙂 To implement BGP route reflection, one or more routers within the network need to be configured as route reflectors. These route reflectors should be strategically placed to ensure efficient routing information dissemination. Clients, also known as non-route reflectors, establish peering sessions with the route reflectors and send their BGP updates to be reflected. Route reflector clusters can also be formed to provide redundancy and load balancing.

Understanding BGP Multipath

BGP multipath, short for Border Gateway Protocol multipath, is a feature that enables the use of multiple paths for traffic forwarding in a network. Traditionally, BGP selects a single best path based on attributes like AS path length, origin type, and MED (Multi-Exit Discriminator) value. However, with BGP multipath, multiple paths can be utilized simultaneously, distributing traffic across multiple links.

Enhanced Network Performance: BGP multipath optimizes network performance by load-balancing traffic using multiple paths. This helps avoid congestion on specific links and ensures efficient utilization of available bandwidth, resulting in faster and more reliable data transmission.

Improved Resilience: BGP multipath enhances network resilience by providing redundancy. In case of link failures or congestion, traffic can be automatically rerouted through alternative paths, minimizing downtime and ensuring continuous connectivity. This dramatically improves the overall reliability of the network infrastructure.

Prefer EBGP over iBGP

Understanding BGP Basics

As a path-vector protocol, BGP differs from other routing protocols in its ability to make routing decisions based on multiple criteria. It establishes connections between autonomous systems (AS) and exchanges routing information to determine the best path for data to follow. By grasping the fundamentals of BGP, we can better comprehend the path selection process.

BGP considers a range of attributes when selecting the most optimal routing path. These attributes include but are not limited to the AS path length, the route’s origin, the next-hop IP address, and various other metrics. Understanding these factors allows network engineers to fine-tune BGP path selection and optimize the data flow.

SDN and BGP

BGP SDN, or Border Gateway Protocol Software-Defined Networking, combines two powerful technologies: the Border Gateway Protocol (BGP) and Software-Defined Networking (SDN). BGP, a routing protocol, facilitates inter-domain routing, while SDN provides centralized control and programmability of the network. Together, they offer a dynamic and adaptable networking environment.

While Border Gateway Protocol (BGP) was initially designed to connect networks operated by different companies, such as transit service providers, providers of large-scale data centers discovered that it could be used for spine and leaf fabrics.

BGP can also be used as an SDN because it already runs on all routers. According to the diagram below, each router in the fabric is connected to an iBGP controller.

Augmented Model

After the iBGP sessions are established, the controller can read the entire topology to determine which path the flow should be pinned to and which flows should avoid the path over which the flow is passing.

An augmented model uses a centralized control plane that interacts directly with a distributed control plane (eBGP). Interestingly, the same protocol used to push policy (the southbound interface) is also used to discover and distribute topology and reachability information in this hybrid model implementation.

The Role of SDN

Before we start our journey on BGP SDN, let us first address what SDN means. The Software-Defined Networking (SDN) framework has a large and varied context. Multiple components, including the OpenFlow protocol, may or may not be used. Some evolving SDN use cases leverage the capabilities of the OpenFlow protocol, while others do not require it.

OpenFlow is only one of those protocols within the SDN architecture. This post addresses using the Border Gateway Protocol (BGP) as the transfer protocol between the SDN controller and forwarding devices, enabling BGP-based SDN, also known as BGP SDN.

BGP and OpenFlow

– BGP and OpenFlow are monolithic, meaning they are not used simultaneously. Integrating BGP to SDN offers several use cases, such as DDoS mitigation, exception routing, forwarding optimizations, graceful shutdown, and integration with legacy networks.

– Some of these use cases are available using OpenFlow Traffic Engineering; others, like graceful shutdown and integration with the legacy network, are easier to accomplish with BGP SDN. 

– When BGP and OpenFlow are combined, they create a powerful synergy that enhances network control and performance. BGP provides the foundation for inter-domain routing and connectivity, while OpenFlow facilitates granular traffic engineering within a domain.

– Together, they enable network administrators to fine-tune routing decisions, balance traffic across multiple paths, and enforce quality of service (QoS) policies.

BGP Add Path Feature

The BGP Add Path feature is designed to address the limitations of traditional BGP routing, where only the best path to a destination is advertised. With Add Path, BGP routers can advertise multiple paths to a destination network, providing increased routing options and allowing for more efficient traffic engineering. 

Introducing the Add Path feature brings several benefits to network administrators and service providers. Firstly, it enables better load balancing and traffic distribution across multiple paths, leading to optimized network utilization. Additionally, it enhances network resiliency by providing alternative paths in case of link failures or congestion. 

Before you proceed, you may find the following post helpful:

  1. BGP Explained
  2. Transport SDN
  3. What is OpenFlow
  4. Software Defined Perimeter Solutions
  5. WAN SDN
  6. OpenFlow And SDN Adoption
  7. HP SDN Controller

BGP-Based SDN

What is BGP?

What is the BGP protocol in networking? Border Gateway Protocol (BGP) is the routing protocol under the Exterior Gateway Protocol (EGP) category. In addition, we have separate protocols, which are Interior Gateway Protocols (IGPs). However, IGP can have some disadvantages.

Firstly, policies are challenging to implement with an IGP because of the need for more flexibility. Usually, a tag is the only tool available that can be problematic to manage and execute on a large-scale basis. In the age of increasingly complex networks in both architecture and services, BGP presents a comprehensive suite of knobs to deal with complex policies, such as the following:

• Communities

• AS_PATH filters

• Local preference

• Multiple exit discriminator (MED

Highlighting BGP-based SDN 

BGP-based SDN involves two main solution components that may be integrated into several existing BGP technologies. First, we have an SDN controller component that speaks BGP and decides what needs to be done. Second, we have a BGP originator component that sends BGP updates to the SDN controller and other BGP peers. For example, the controller could be a BGP software package running on Open Daylight. BGP originators are Linux daemons or traditional proprietary vendor devices running the BGP stack.

What does SDN mean
Diagram: What does SDN mean with BGP SDN?

Creating an SDN architecture

To create the SDN architecture, these components are integrated with existing BGP technologies, such as BGP FlowSpec (RFC 5575), L3VPN (RFC4364), EVPN (RFC 7432), and BGP-LS. BGP FlowSpec distributes forwarding entries, such as ACL and PBR, to devices’ TCAMs. L3VPN and EVPN offer the mechanism to integrate with legacy networks and service insertion. BGP-LS extracts IGP network topology information and passes it to the SDN controller via BGP updates.

**Central policy, visibility, and control**

Introducing BGP into the SDN framework does not mean a centralized control plane. We still have a central policy, visibility, and control, but this is not a centralized control plane. A centralized control plane would involve local control plane protocols establishing adjacencies or other ties to the controller. In this case, the forwarding devices outright require the controller to forward packets; forwarding functionality is limited when the controller is down.

If the BGP SDN controller acts as a BGP route reflector, all announcements go to the controller, but the network runs fine without it. The controller is just adding value to the usual forwarding process. BGP-based SDN architecture augments the network; it does not replace it.

Decentralizing the control plane is the only way; look at Big Switch and NEC’s SDN design changes over the last few years. Centralized control planes cannot scale.

Why use BGP?

BGP is well-understood and field-tested. It has been extended on many occasions to carry additional types of information, such as MAC addresses and labels. Technically, BGP can be used as a replacement for Label Distribution Protocol (LDP) in an MPLS core. Labels can be assigned to IPv6 prefixes (6PE) and labeled switched across an IPv4-only MPLS core.

BGP is very extensible. It started with IPv4 forwarding, and address families were added for multicast and VPN traffic. Using multiple addresses inside a single BGP process was widely accepted and implemented as a core technology. The entire Internet is made up of BGP, and it carries over 500,000 prefixes. It’s very scalable and robust. Some MPLS service providers are carrying over 1 million customer routes.

The use of open-source BGP daemons

There are many high-quality open-source BGP daemons available. Quagga is one of the most popular, and its quality has improved since it adopted Cumulus and Google. Quagga is a routing suite that provides IGP support for IS-IS and OSPF. Also, a BIRD daemon is available. The implementation is based around Internet exchange points as the route server element. BIRD is currently carrying over 100,000 prefixes.

Using BGP-based SDN on an SDN controller integrates easily with your existing network. You don’t have to replace any existing equipment, deploy the controller, and implement the add-on functionality that BGP SDN offers. It enables a preferred step-by-step migration approach, not a risky big bang OpenFlow deployment.

IGP to the controller?

Why not run OSPF or ISIS to the controller? IS-IS is extendable with TLVs and, too, can carry a variety of information. The real problem is not extensibility but the lack of trust and policy control. IGP extension to the SDN controller with few controls could present a problem. OSPF sends LSA packets; there is no input filter. BGP is designed with policy control in mind and acts as a filter by implementing controls on individual BGP sessions.

BGP offers control on the network side and predicts what the controller can do. For example, the blast radius is restricted if the controller encounters a bug or is compromised. BGP also provides excellent policy mechanisms between the SDN controller and physical infrastructure. 

Introducing BGP-LS

SDN requires complete topology visibility. The picture is incomplete if some topology information is hidden in IGP and other NLRIs in BGP. If you have an existing IGP, how do you propagate this information to the BGP controller? Border Gateway Protocol Link-State (BGP-LS) is cleaner than establishing an IGP peering relationship with the SDN controller. 

BGP-LS extracts network topology information and updates it to the BGP controller. Once again, BGPv4 is extended to provide the capability to include the new Network Layer Reachability Information (NLRI) encoding format. It sends information from IS-IS or OSPF topology database through BGP updates to the SDN controller. BGP-LS can configure the session to be unidirectional and stop incoming updates to enhance security between the physical and SDN worlds.

A key point: SDN controller cannot leak information back

As a result, the SDN controller cannot leak information back into the running network. BGP-LS is a relatively new concept. It focuses on the mechanism to export IGP information and does not describe how the SDN controller can use it. Once the controller has the complete topology information, it may be integrated with traffic engineers and external path computing solutions to interact with information usually only carried by an IGP database.

For example, the Traffic Engineering Database (TED), built by ISIS and OSPF-TE extensions, is typically distributed by IGPs within the network. Previously, each node maintained its own TED, but now, this can be exported to a BGP RR SDN application for better visibility.

BGP scale-out architectures

SDN controller will always become the scalability bottleneck. It can scale better when it’s not participating in data plane activity, but eventually, it will reach its limits. Every controller implementation eventually hits this point. The only way to grow is to scale out. 

Reachability and policy information is synchronized between individual controllers. For example, reachability information can be transferred and synchronized with MP-BGP, L3VPN for IP routing, or EVPN for layer-2 forwarding.

BGP SDN

Utilizing BGP between controllers offers additional benefits. Each controller can be placed in a separate availability zone, and tight BGP policy controls are implemented on BGP sessions connecting those domains, offering a clean failure domain separation.

An error in one available zone is not propagated to the next available zone. BGP is a very scalable protocol, and the failure domains can be as large as you want, but the more significant the domain, the longer the convergence times. Adjust the size of failure domains to meet scalability and convergence requirements. 

BGP SDN combines the power of BGP routing and SDN to create a networking paradigm that enhances flexibility, scalability, and manageability. By leveraging BGP SDN, organizations can build dynamic networks that adapt to their changing needs and optimize resource utilization. As the demand for faster, more reliable, and flexible networks continues to grow, BGP SDN is poised to play a critical role in shaping the future of network infrastructure.

Summary: BGP-Based SDN

In today’s rapidly evolving technological landscape, software-defined networking (SDN) has emerged as a groundbreaking approach to network management. One of the key components within the realm of SDN is the Border Gateway Protocol (BGP). In this blog post, we delved into the world of BGP SDN, exploring its significance, functionality, and how it transforms traditional networking architectures.

Understanding BGP

BGP, or Border Gateway Protocol, is a routing protocol that facilitates the exchange of routing information between different autonomous systems (AS). It plays a crucial role in determining the optimal path for data packets to traverse across the internet. Unlike other routing protocols, BGP operates on a policy-based routing model, allowing network administrators to have granular control over traffic flow and network policies.

The Evolution of SDN

To comprehend the importance of BGP SDN, it is essential to understand the evolution of software-defined networking. SDN revolutionizes traditional network architectures by decoupling the control plane from the underlying physical infrastructure. This separation enables centralized network control, programmability, and dynamic configuration, enhancing flexibility and scalability.

BGP in the SDN Paradigm

Within the SDN framework, BGP plays a pivotal role in interconnecting different SDN domains, providing a scalable and flexible solution for routing between virtual networks. By incorporating BGP into the SDN architecture, organizations can achieve dynamic network provisioning, traffic engineering, and efficient handling of network policy changes.

Benefits of BGP SDN

The integration of BGP within the SDN paradigm brings forth numerous benefits. Firstly, it enables seamless interoperability between SDN and traditional networking environments, ensuring a smooth transition towards software-defined infrastructures. Additionally, BGP SDN empowers network administrators with enhanced control and visibility, simplifying the management of complex network topologies and policies.

Conclusion:

In conclusion, BGP SDN represents a significant milestone in the networking industry. Its ability to merge the power of BGP with the flexibility of software-defined networking opens new horizons for network management. By embracing BGP SDN, organizations can achieve greater agility, scalability, and control over their networks, ultimately leading to more efficient and adaptable infrastructures.