viptela1

Viptela Software Defined WAN (SD-WAN)

by Blog

 

viptela sd wan

Viptela SD WAN

Why can’t enterprise networks scale like the Internet? What if you could virtualize the entire network?

Wide Area Network (WAN) connectivity models follow a hybrid approach, and companies may have multiple types – MPLS and the Internet. For example, branch A has remote access over the Internet, while branch B employs private MPLS connectivity. Internet and MPLS have distinct connectivity models, and different types of overlay exist for the Internet and MPLS-based networks.

The challenge is to combine these overlays automatically and provide a transport-agnostic overlay network. The data consumption model in enterprises is shifting. Around 70% of data is; now Internet-bound, and it is expensive to trombone traffic from defined DMZ points. Customers are looking for topological flexibility, causing a shift in security parameters. Topological flexibility forces us to rethink WAN solutions for tomorrow’s networks and leads towards Viptela SD-WAN.

 

Before you proceed, you may find the following helpful:

  1. SD WAN Tutorial
  2. SD WAN Overlay
  3. SD WAN Security 
  4. WAN Virtualization
  5. SD-WAN Segmentation

 

Solution: Viptela SD WAN

Viptela created a new overlay network called Secure Extensible Network (SEN) to address these challenges. For the first time, encryption is built into the solution. Security and routing are combined into one solution. Enables you to span environments, anywhere-to-anywhere in a secure deployment. This type of architecture is not possible with today’s traditional networking methods.

Founded in 2012, Viptela is a Virtual Private Network (VPN) company utilizing concepts of Software Defined Networking (SDN) to transform end-to-end network infrastructure. Based in San Jose, they are developing an SDN Wide Area Network (WAN) product offering any-to-any connectivity with features such as application-aware routing, service chaining, virtual Demilitarized Zone (DMZ), and weighted Equal Cost Multipath (ECMP) operating on different transports.

The key benefit of Viptela is any-to-any connectivity product offering. Connectivity was previously found in Multiprotocol Label Switching (MPLS) networks. They purely work on the connectivity model and not security frameworks. They can, however, influence-traffic paths to and from security services.

Viptela sd wan

 

Ubiquitous data plane

MPLS was attractive because it had a single control plane and a ubiquitous data plane. As long as you are in the MPLS network, connection to anyone is possible. Granted, you have the correct Route Distinguisher (RD) and Route Target (RT) configurations. But why can’t you take this model to Wide Area Network? Invent a technology that can create a similar model and offer ubiquitous connectivity regardless of transport type ( Internet, MPLS ).

 

Why Viptela SDN WAN?

The business today wants different types of connectivity modules. When you map service to business logic, the network/service topology is already laid out. It’s defined. Services have to follow this topology. Viptela is changing this concept by altering the data and control plane connectivity model using SDN to create an SDN WAN technology.

SDN is all about taking intensive network algorithms out of the hardware. Previously, in traditional networks, this was in individual hardware devices using control plane points in the data path. As a result, control points may become congested (for example – OSPF max neighbors reached). Customers lose capacity on the control plane front but not on the data plane. SDN is moving the intensive computation to off-the-shelf servers. MPLS networks attempt to use the same concepts with Route-Reflector (RR) designs.

They started to move route reflectors off the data plane to compute the best-path algorithms. Route reflectors can be positioned anywhere in the network and do not have to sit on the data path. Controller-based SDN approach, you are not embedding the control plane in the network. The controller is off the path. Now, you can scale out and SDN frameworks centrally provision and push policy down to the data plane.

Viptela can take any circuit and provide the ubiquitous connectivity MPLS provided, but now, it’s based on a policy with a central controller. Remote sites can have random transport methods. One leg could be the Internet, and the other could be MPLS. As long as there is an IP path between endpoint A and the controller, Viptela can provide the ubiquitous data plane.

 

Viptela SD WAN and Secure Extensible Network (SEN)

Managed overlay network

If you look at the existing WAN, it is two-part: routing and security. Routing connects sites, and security secures transmission. We have too many network security and policy configuration points in the current model. SEN allows you to centralize control plane security and routing, resulting in data path fluidity. The controller takes care of routing and security decisions.

It passes the relevant information between endpoints. Endpoints can pop up anywhere in the network. All they have to do is set up a control channel for the central controller. This approach does not build excessive control channels, as the control channel is between the controller and endpoints. Not from endpoint to endpoint. The data plane can flow based on the policy in the center of the network.

Viptela SD WAN

 

Viptela SD WAN: Deployment considerations

Deployment of separate data plane nodes at the customer site is integrated into existing infrastructure at Layer 2 or 3. So you can deploy incrementally, starting with one node and ending with thousands. It is so scalable because it is based on routed technology. The model allows you to deploy, for example, a guest network and then integrate it further into your network over time. Internally they use Border Gateway Protocol (BGP). One the data plane, they use standard IPSec between endpoints. It also works over Network Address Translation (NAT), meaning IPSec over UDP.

When an attacker gets access to your network, it is easy for them to reach the beachhead and hop from one segment to another. Viptela enables per-segment encryption, so even if they get to one segment, they will not be able to jump to another. Key management on a global scale has always been a challenge. Viptela solves this with a propitiatory distributed manager based on a priority system. Currently, their key management solution is not open to the industry.

 

SDN controller

You have a controller and VPN termination points i.e data plane points. The controller is the central management piece that assigns the policy. Data points are modules that are shipped to customer sites. The controller allows you to dictate different topologies for individual endpoint segments. Similar to how you influence-routing tables with RT in MPLS.

The control plane is at the controller.

 

Data plane module

Data plane modules are located at the customer site. They connect this data plane module, which could be a PE hand-off to the internal side of the network. The data plane module must be in the data plane path on the customer site. Internal side, they discover the routing protocols and participate in prefix learning. At Layer 2, they discover the VLANs. Their module can either be the default gateway or perform the router neighbor relationship function. WAN side, data plane module registers uplink IP address to WAN controller/orchestration system. The controller builds encrypted tunnels between the data endpoints. The encrypted control channels are only needed when you build over untrusted third parties.

If the problem occurs with controller connectivity, the on-site module can stop being the default gateway and usually participate in Layer 3 forwarding for existing protocols. It backs off from being the primary router for off-net traffic. It’s like creating VRF for different businesses and default routes for each VRF with a single peering point to the controller; Policy-Based Routing (PBR) for each VRF for data plane activity. The PBR is based on information coming from the controller. Each control segment can have a separate policy (for example – modifying the next hop). From a configuration point of view, you need an IP on the data plane module and the remote controller IP. The controller pushes down the rest.

 

  • Viptela SD WAN: Use cases

For example, you have a branch office with three distinct segments, and you want each endpoint to have its independent topology. The topology should be service driven, and the service should not follow existing defined topology. Each business should depict how they want their business to connect to the network team should not say this is how the topology is, and you must obey our topology.

From a carrier’s perspective, they can expand their MPLS network to areas they do not have a physical presence. And bring customers with this secure overlay to their closest pop where they have an MPLS peering. MPLS providers can expand their footprint to areas where they do not have service. If MPLS has customers in region X and wants to connect to the customer in region Y, they can use Viptela. Having those different data plane endpoints through a security framework would be best before entering the MPLS network.

Viptela allows you to steer traffic based on the SLA requirements of the application, aka Application-Aware Routing. For example, if you have two sites with dual connectivity to MPLS and Internet, data plane modules (located at customer sites) nodes can steer traffic over either the MPLS or Internet transport based on end-to-end latency or drops. They do this by maintaining the real-time loss, latency, and jitter characteristics and then applying policies on the centralized controller. As a result, critical traffic is always steered to the most reliable link. This architecture can scale to 1000 nodes in a full mesh topology.

 

viptela sd wan

 

Border Gateway Protocol Complexity

What is BGP Protocol in Networking

by Blog

What is BGP Protocol in Networking

In the vast interconnected network of the internet, Border Gateway Protocol (BGP) plays a crucial role in ensuring efficient and reliable routing. As the primary protocol for exchanging routing information between internet service providers (ISPs) and networks, BGP serves as the backbone of the internet. In this blog post, we will delve into BGP's functionalities, benefits, and challenges, shedding light on its significance in today's digital landscape.

Border Gateway Protocol, commonly known as BGP, is an exterior gateway protocol that facilitates the exchange of routing information between different autonomous systems (AS). An autonomous system represents a collection of networks under a single administrative domain. BGP is responsible for determining the best path for data packets to traverse between ASes, allowing efficient communication across the internet.

BGP serves as the backbone of the Internet, enabling the interconnection of various networks and facilitating efficient routing decisions. Its primary purpose is to determine the best path for data transmission between networks, considering factors such as network policies, path attributes, and performance metrics.

BGP operates on a peer-to-peer basis, where routers establish connections with other routers to exchange routing information. These connections, known as BGP sessions, allow routers to exchange information about network reachability and determine the optimal path for data transmission.

BGP utilizes a range of attributes to evaluate and select the best path for routing. These attributes include the autonomous system path, next hop, origin, local preference, and community values. By analyzing these attributes, BGP routers make informed decisions about the most suitable path for data transmission.

BGP is of utmost importance to Internet Service Providers (ISPs) as it enables them to connect their networks to the rest of the Internet. ISPs rely on BGP to exchange routing information with other networks, ensuring efficient and reliable data transmission for their customers.

In conclusion, the Border Gateway Protocol (BGP) plays a vital role in the world of networking, serving as the backbone of the Internet. Its ability to facilitate routing decisions between autonomous systems and exchange routing information makes it a fundamental protocol for efficient data transmission. Understanding the basics of BGP and its operation is essential for anyone involved in the field of networking.

Matt Conran

Highlights: What is BGP Protocol in Networking

Moving packets between networks

A router is primarily responsible for moving packets between networks. Dynamic routing protocols distribute network topology information between routers so they can learn about unattached networks. Routers try to select the fastest loop-free path in a network based on the destination network. Link flaps, router crashes, and other unexpected events could impact the most efficient path, so the routers must exchange information with each other so that the network topology updates during these events.

IGP or EGP

Depending on whether the protocol is designed to exchange routes within or between organizations, routing protocols are classified as Interior Gateway Protocols (IGP) or Exterior Gateway Protocols (EGP). All routers in the routing domain use the same logic to find the shortest path to a destination in IGP protocols. A unique routing policy may be required for each external organization with which EGP protocols exchange routes.

Border Gateway Protocol

EGP standardized Border Gateway Protocol (BGP) provides scalability, flexibility, and network stability via path-vector routing. In designing BGP, the primary focus was on IPv4 inter-organization connectivity on public networks, such as the Internet and private networks. There are more than 600,000 IPv4 routes on the Internet, and BGP is the only protocol that exchanges them. OSPF and ISIS advertise incremental updates and refresh network advertisements, but BGP does not. Due to the possibility that thousands of routes could be calculated if there is a link flap in the network, BGP prefers stability within the network.

BGP defines an autonomous system (AS) as a collection of routers controlled by a single organization, using one or more IGPs and standard metrics. An AS must appear consistent with external ASs in routing policy if it uses multiple IGPs or metrics. ASs need not use an IGP and can also use BGP as their only routing protocol.

forwarding routing protoocols

Decrease Complexity

When considering BGP protocol in networking, we must first highlight a common misconception that Border Gateway Protocol ( BGP ) is used solely for network scalability, replacing Interior Gateway Protocol ( IGP ) once a specific prefix or router count has been reached. Although BGP does form the base for large networks, an adequately designed IGP can scale tens of thousands of routers.BGP is not just used for scalability; it is used to decrease the complexity of networking rather than size.

Split into smaller pieces.

The key to efficient routing protocol design is to start with business design principles and break failure domains into small pieces. Keeping things simple with BGP is critical to stabilizing large networks. What usually begins as a single network quickly becomes multiple networks as the business grows. It is easier to split networks into small pieces and to “aggregate” the information as much as possible. Aggregating routing information hides parts of the network and speeds up link/node failure convergence.

You may find the following posts helpful for pre-information:

  1. Port 179
  2. SDN Traffic Optimizations
  3. What does SDN mean? This post uses a BGP SDN approach to networking.
  4. BGP SDN
  5. Segment routing
  6. Merchant Silicon



What is BGP Protocol in Networking

Key What is BGP Discussion Points:


  • Introduction to BGP protocol and what is involved.

  • Highlighting the details on BGP scalability.

  • Critical points on BGP protocol and the use of policy.

  • Technical details on traffic engineering with BGP.

  • A final note on IGPs.

Back to basics with BGP

BGP is mature and powers the internet. Many mature implementations of BGP exist, including in the open-source networking world. A considerable benefit to BGP is that it is less chatty than its link state and supports multiple protocols (i.e., it supports advertising IPv4, IPv6, Multiprotocol Label Switching (MPLS), and VPNs natively). Remember that BGP has been understood for decades for helping internet-connected systems find one another. However, it is helpful within a single data center, as well. In addition, BGP is standards-based and supported by many free and open-source software packages.

How does BGP work?

BGP operates on a distributed architecture, where routers exchange routing information using rules and policies. It uses a path-vector algorithm to select the best path based on various attributes, such as the number of AS hops and the quality of the network links. BGP relies on the concept of peering, where routers establish connections with each other to exchange routing updates.

Lab Guide on BGP Dampening

In the following sample, we have two routers with BGP configured. Each BGP peer is in its own AS, and BGP dampening is configured on R2 only. Notice the output of the debug ip bgp dampening on R2 once the loopback on R1 is shut down.

The concept behind BGP dampening is relatively simple. When a router detects a route flapping, it assigns a penalty to that route. The penalty is based on the number of consecutive flaps and the configured dampening parameters. As the penalty accumulates, the route’s desirability decreases, making it less likely to be advertised to other routers.

The purpose of BGP dampening is to discourage the propagation of unstable routes and prevent them from spreading throughout the network. By penalizing flapping routes, BGP dampening helps to stabilize the network by reducing the number of updates sent and minimizing the impact of routing instability.

BGP dampening
Diagram: BGP Dampening

The Significance of BGP:

Scalability: BGP’s hierarchical structure enables it to handle the massive scale of the global internet. By dividing the internet into smaller autonomous systems, BGP efficiently manages routing information, reducing the burden on individual routers and improving scalability.

Path Selection: BGP allows network administrators to define policies for path selection, giving them control over traffic flow. This flexibility enables organizations to optimize network performance, direct traffic through preferred paths, and ensure efficient resource utilization.

Internet Resilience: BGP’s ability to dynamically adapt to changes in network topology is crucial for ensuring internet resilience. If a network or path becomes unavailable, BGP can quickly reroute traffic through alternative paths, minimizing disruptions and maintaining connectivity.

Challenges and Security Concerns:

BGP Hijacking: BGP’s reliance on trust-based peering relationships makes it susceptible to hijacking. Malicious actors can attempt to divert traffic by announcing false routing information, potentially leading to traffic interception or disruption. Initiatives like Resource Public Key Infrastructure (RPKI) aim to mitigate these risks by introducing cryptographic validation mechanisms.

Route Flapping: Unstable network connections or misconfigurations can cause routes to appear and disappear frequently, causing route flapping. This can lead to increased network congestion, suboptimal routing, and unnecessary router strain. Network administrators need to monitor and address route flapping issues carefully.

A policy-oriented control plane reduces network complexity.

BGP is a policy-oriented control plane-routing protocol used to create islands of networks that match business requirements to administrative domains. When multiple business units present unique needs, designing all those special requirements using a single set of routing policies is hard. BGP can decrease policy complexity and divide the complexity into a manageable aggregation of policies.

When considering what is BGP protocol in networking
Diagram: When considering what is BGP protocol in networking

Two business units, for example, HR, represented by a router on the left, and the Sales department, represented by a router on the right. The middle networks form a private WAN, used simply as transit. However, the business has decided that these networks should be treated differently and have different traffic paths. For example, HR must pass through the top section of routers, and Sales must pass through the bottom half of routers. With an Interior Gateway Protocol ( IGP ), such as OSPF, traffic engineering can be accomplished by manipulating the cost of the links to influence the traffic path.

However, the metrics on the links must be managed on a per-destination basis. If you have to configure individual links per destination, it will become almost impossible to do with a link-state IGP. If BGP is used, this logic can be encoded using Local Preference or Multiple Exit Discriminator. Local preference is used for a single AS design, and MED is used for multiple AS. Local preference is local and does not traverse multiple AS.

  • A final note: When considering what is BGP protocol in networking

Networks grow and should be allowed to grow organically. Each business unit may require several different topologies and design patterns. Trying to design all these additional requirements would increase network complexity. In the context of a single IGP, it may add too many layers of complexity. BGP provides a manageable approach to policy abstraction by controlling specific network traffic patterns within and between Autonomous Systems.

Border Gateway Protocol (BGP) plays a vital role in ensuring the smooth functioning of the internet by facilitating efficient routing between autonomous systems. Its scalability, flexibility in path selection, and ability to adapt to network changes contribute to the overall resilience and reliability of the internet. However, challenges such as BGP hijacking and route flapping require ongoing attention and mitigation efforts to maintain the security and stability of BGP-based networks. By understanding the intricacies of BGP, network administrators can effectively manage their networks and contribute to a robust and interconnected internet ecosystem.

 

Summary: What is BGP Protocol in Networking

In today’s interconnected world, where the internet plays a pivotal role, understanding how data is routed is crucial. One of the fundamental protocols responsible for routing data across the internet is the Border Gateway Protocol (BGP). In this blog post, we delved into the inner workings of BGP, exploring its essential components and shedding light on how it facilitates the efficient flow of information.

What is BGP?

BGP, short for Border Gateway Protocol, is an exterior gateway protocol that enables the exchange of routing information between different autonomous systems (ASes). It acts as the backbone of the internet, ensuring that data packets are efficiently forwarded across diverse networks.

Autonomous Systems (ASes)

An Autonomous System (AS) is a collection of interconnected networks operated by a single administrative entity. ASes can range from Internet Service Providers (ISPs) to large organizations managing their networks. BGP operates at the AS level, enabling ASes to exchange routing information and make informed decisions about the best paths for data transmission.

BGP Route Selection

When multiple paths exist for data to travel from one AS to another, BGP employs a sophisticated route selection process to determine the optimal path. Factors such as the path length, AS path attributes, and policies defined by AS administrators all play a role in this decision-making process.

BGP Peering and Neighbors

BGP establishes connections between routers in different ASes, forming peering relationships. These peering relationships define the rules and agreements for exchanging routing information. BGP peers, also known as neighbors, communicate updates about network reachability and ensure that routing tables are synchronized.

BGP Updates and Routing Tables

BGP updates provide crucial information about network reachability changes and modifications in routing paths. When a BGP router receives an update, it processes the data and updates its routing table accordingly. These updates are crucial for maintaining an accurate and up-to-date view of the internet’s routing topology.

Conclusion:

In conclusion, the Border Gateway Protocol (BGP) plays a vital role in the functioning of the Internet. Through its intricate mechanisms, BGP enables the efficient exchange of routing information between autonomous systems (ASes), ensuring that data packets reach their destinations in a timely and reliable manner. Understanding the fundamentals of BGP empowers us to appreciate the complexity behind internet routing and the robustness of the global network we rely on every day.