ACI Cisco

August 28, 2022

by Matt Conran: The Visual Age Publications

Cisco ACI Components

In today's rapidly evolving technological landscape, organizations are constantly seeking innovative solutions to streamline their network infrastructure. Enter Cisco ACI Networks, a game-changing technology that promises to redefine networking as we know it. In this blog post, we will explore the key features and benefits of Cisco ACI Networks, shedding light on how it is transforming the way businesses design, deploy, and manage their network infrastructure.

Cisco ACI, short for Application Centric Infrastructure, is an advanced networking solution that brings together physical and virtual environments under a single, unified policy framework. By providing a holistic approach to network provisioning, automation, and orchestration, Cisco ACI Networks enable organizations to achieve unprecedented levels of agility, efficiency, and scalability.

Simplified Network Management: Cisco ACI Networks simplify network management by abstracting the underlying complexity of the infrastructure. With a centralized policy model, administrators can define and enforce network policies consistently across the entire network fabric, regardless of the underlying hardware or hypervisor.

Enhanced Security: Security is a top concern for any organization, and Cisco ACI Networks address this challenge head-on. By leveraging microsegmentation and integration with leading security platforms, ACI Networks provide granular control and visibility into network traffic, helping organizations mitigate potential threats and adhere to compliance requirements.

Scalability and Flexibility: The dynamic nature of modern business demands a network infrastructure that can scale effortlessly and adapt to changing requirements. Cisco ACI Networks offer unparalleled scalability and flexibility, allowing businesses to seamlessly expand their network footprint, add new services, and deploy applications with ease.

Data Center Virtualization: Cisco ACI Networks have revolutionized data center virtualization by providing a unified fabric that spans physical and virtual environments. This enables organizations to achieve greater operational efficiency, optimize resource utilization, and simplify the deployment of virtualized workloads.

Multi-Cloud Connectivity: In the era of hybrid and multi-cloud environments, connecting and managing disparate cloud services can be a daunting task. Cisco ACI Networks facilitate seamless connectivity between on-premises data centers and various public and private clouds, ensuring consistent network policies and secure communication across the entire infrastructure.

Cisco ACI Networks offer a paradigm shift in network infrastructure, empowering organizations to build agile, secure, and scalable networks tailored to their specific needs. With its comprehensive feature set, simplified management, and seamless integration with virtual and cloud environments, Cisco ACI Networks are poised to shape the future of networking. Embrace this transformative technology, and unlock a world of possibilities for your organization.

Matt Conran

Highlights: Cisco ACI Components

The ACI Fabric

Cisco ACI is a software-defined networking (SDN) solution that integrates with software and hardware. With the ACI, we can create software policies and use hardware for forwarding, an efficient and highly scalable approach offering better performance. The hardware for ACI is based on the Cisco Nexus 9000 platform product line. The APIC centralized policy controller drives the software, which stores all configuration and statistical data.

–The Cisco Nexus Family–

To build the ACI underlay, you must exclusively use the Nexus 9000 family of switches. You can choose from modular Nexus 9500 switches or fixed 1U to 2U Nexus 9300 models. Specific models and line cards are dedicated to the spine function in ACI fabric; others can be used as leaves, and some can be used for both purposes. You can combine various leaf switches inside one fabric without any limitations.

a) Cisco ACI Fabric: Cisco ACI’s foundation lies in its fabric, which forms the backbone of the entire infrastructure. The ACI fabric comprises leaf switches, spine switches, and the application policy infrastructure controller (APIC). Each component ensures a scalable, agile, and resilient network.

b) Leaf Switches: Leaf switches serve as the access points for endpoints within the ACI fabric. They provide connectivity to servers, storage devices, and other network devices. With their high port density and advanced features, such as virtual port channels (vPCs) and fabric extenders (FEX), leaf switches enable efficient and flexible network designs.

c) Spine Switches: Spine switches serve as the core of the ACI fabric, providing high-bandwidth connectivity between the leaf switches. They use a non-blocking, multipath forwarding mechanism to ensure optimal traffic flow and eliminate bottlenecks. With their modular design and support for advanced protocols like Ethernet VPN (EVPN), spine switches offer scalability and resiliency.

d) Application Policy Infrastructure Controller (APIC): At the heart of Cisco ACI is the APIC, a centralized management and policy control plane. The APIC acts as a single control point, simplifying network operations and enabling policy-based automation. It provides a comprehensive view of the entire fabric, allowing administrators to define and enforce policies across the network.

e) Integration with Virtualization and Cloud Environments: Cisco ACI seamlessly integrates with virtualization platforms such as VMware vSphere and Microsoft Hyper-V and cloud environments like Amazon Web Services (AWS) and Microsoft Azure. This integration enables consistent policy enforcement and visibility across physical, virtual, and cloud infrastructures, enhancing agility and simplifying operations.

–ACI Architecture: Spine and Leaf–

To be used as ACI spines or leaves, Nexus 9000 switches must be equipped with powerful Cisco CloudScale ASICs manufactured using 16-nm technology. The following figure shows the Cisco ACI based on the Nexus 9000 series. Cisco Nexus 9300 and 9500 platform switches support Cisco ACI. As a result, organizations can use them as spines or leaves to utilize an automated, policy-based systems management approach fully.

Diagram: Cisco ACI Components. Source is Cisco

**Hardware-based Underlay**

Server virtualization helped by decoupling workloads from the hardware, making the compute platform more scalable and agile. However, the server is not the main interconnection point for network traffic. So, we need to look at how we could virtualize the network infrastructure similarly to the agility gained from server virtualization.

**Mapping Network Endpoints**

This is carried out with software-defined networking and overlays that could map network endpoints and be spun up and down as needed without human intervention. In addition, the SDN architecture includes an SDN controller and an SDN network that enables an entirely new data center topology.

**Specialized Forwarding Chips**

In ACI, hardware-based underlay switching offers a significant advantage over software-only solutions due to specialized forwarding chips. Furthermore, thanks to Cisco’s ASIC development, ACI brings many advanced features, including security policy enforcement, microsegmentation, dynamic policy-based redirect (inserting external L4-L7 service devices into the data path), or detailed flow analytics—besides the vast performance and flexibility.

Related: For pre-information, you may find the following helpful:

Cisco ACI Components

Introduction to Leaf and Spine

The Cisco SDN ACI works with a Clos architecture, a fully meshed ACI network. Based on a spine leaf architecture. As a result, every Leaf is physically connected to every Spine, enabling traffic forwarding through non-blocking links. Physically, a leaf switch set creates a leaf layer attached to the spines in a full BIPARTITE graph. This means that each Leaf is connected to each Spine, and each Spine is connected to each Leaf.

The ACI uses a horizontally elongated Leaf and Spine architecture with one hop to every host in an entirely messed ACI fabric, offering good throughput and convergence needed for today’s applications.

The ACI fabric: Does Not Aggregate Traffic

A key point in the spine-and-leaf design is the fabric concept, like a stretch network. One of the core ideas around a fabric is that it does not aggregate traffic. This does increase data center performance along with a non-blocking architecture. With the spine-leaf topology, we are spreading a fabric across multiple devices.

Required: Increased Bandwidth Available

The result of the fabric is that each edge device has the total bandwidth of the fabric available to every other edge device. This is one big difference from traditional data center designs; we aggregate the traffic by either stacking multiple streams onto a single link or carrying the streams serially.

Challenge: Oversubscription

With the traditional 3-tier design, we aggregate everything at the core, leading to oversubscription ratios that degrade performance. With the ACI Leaf and Spine design, we spread the load across all devices with equidistant endpoints, allowing us to carry the streams parallel.

Required: Routed Multipathing

Then, we have horizontal scaling load balancing. Load balancing with this topology uses multipathing to achieve the desired bandwidth between the nodes. Even though this forwarding paradigm can be based on Layer 2 forwarding ( bridging) or Layer 3 forwarding ( routing), the ACI leverages a routed approach to the Leaf and Spine design, and we have Equal Cost Multi-Path (ECMP) for both Layer 2 and Layer 3 traffic.

Overlay and Underlay Design

Mapping Traffic:

So you may be asking how we can have Layer 3 routed core and pass Layer 2 traffic. This is done using the overlay, which can map different traffic types to other overlays. So, we can have Layer 2 traffic mapped to an overlay over a routed core.

L3 active-active links: ACI links between the Leaf and the Spine switches are L3 active-active links. Therefore, we can intelligently load balance and traffic steer to avoid issues. We don’t need to rely on STP to block links or involve STP in fixing the topology.

Challenge: IP – Identity & Location

When networks were first developed, there was no such thing as an application moving from one place to another while it was in use. So, the original architects of IP, the communication protocol used between computers, used the IP address to indicate both the identity of a device connected to the network and its location on the network. Today, in the modern data center, we need to be able to communicate with an application or application tier, no matter where it is.

Required: Overlay Encapsulation

One day, it may be in location A and the next in location B, but its identity, which we communicate with, is the same on both days. An overlay is when we encapsulate an application’s original message with the location to which it needs to be delivered before sending it through the network. Once it arrives at its final destination, we unwrap it and deliver the original message as desired.

The identities of the devices (applications) communicating are in the original message, and the locations are in the encapsulation, thus separating the place from the identity. This wrapping and unwrapping is done on a per-packet basis and, therefore, must be done quickly and efficiently.

Overlay and Underlay Components

The Cisco SDN ACI has an overlay and underlay concept, which forms a virtual overlay solution. The role of the underlay is to glue together devices so the overlay can work and be built on top. So, the overlay, which is VXLAN, runs on top of the underlay, which is IS-IS. In the ACI, the IS-IS protocol provides the routing for the overlay, which is why we can provide ECMP from the Leaf to the Spine nodes. The routed underlay provides an ECMP network where all leaves can access Spine and have the same cost links.

ACI overlay — Diagram: Overlay. Source Cisco

Underlay & Overlay Interaction

Example:

Let’s take a simple example to illustrate how this is done. Imagine that application App-A wants to send a packet to App-B. App-A is located on a server attached to switch S1, and App-B is initially on switch S2. When App-A creates the message, it will put App-B as the destination and send it to the network; when the message is received at the edge of the network, whether a virtual edge in a hypervisor or a physical edge in a switch, the network will look up the location of App-B in a “mapping” database and see that it is attached to switch S2.

It will then put the address of S2 outside of the original message. So, we now have a new message addressed to switch S2. The network will forward this new message to S2 using traditional networking mechanisms. Note that the location of S2 is very static, i.e., it does not move, so using traditional mechanisms works just fine.

Upon receiving the new message, S2 will remove the outer address and thus recover the original message. Since App-B is directly connected to S2, it can easily forward the message to App-B. App-A never had to know where App-B was located, nor did the network’s core. Only the edge of the network, specifically the mapping database, had to know the location of App-B. The rest of the network only had to see the location of switch S2, which does not change.

Let’s now assume App-B moves to a new location switch S3. Now, when App-A sends a message to App-B, it does the same thing it did before, i.e., it addresses the message to App-B and gives the packet to the network. The network then looks up the location of App-B and finds that it is now attached to switch S3. So, it puts S3’s address on the message and forwards it accordingly. At S3, the message is received, the outer address is removed, and the original message is delivered as desired.

App-A did not track App-B’s movement at all. App-B’s address identified It, while the switch’s address, S2 or S3, identified its location. App-A can communicate freely with App-B no matter where It is located, allowing the system administrator to place App-B in any area and move it as desired, thus achieving the flexibility needed in the data center.

Multicast Distribution Tree (MDT)

We have a Multicast Distribution Tree MDT tree on top that is used to forward multi-destination traffic without having loops. The Multicast distribution tree is dynamically built to send flood traffic for specific protocols. Again, it does this without creating loops in the overlay network. The tunnels created for the endpoints to communicate will have tunnel endpoints. The tunnel endpoints are known as the VTEP. The VTEP addresses are assigned to each Leaf switch from a pool that you specify in the ACI startup and discovery process.

Normalize the transports

VXLAN tunnels in the ACI fabric normalize the transports in the ACI network. Therefore, traffic between endpoints can be delivered using the VXLAN tunnel, resulting in any transport network regardless of the device connecting to the fabric.

So, using VXLAN in the overlay enables any network, and you don’t need to configure anything special on the endpoints for this to happen. The endpoints that connect to the ACI fabric do not need special software or hardware. The endpoints send regular packets to the leaf nodes they are connected to directly or indirectly. As endpoints come online, they send traffic to reach a destination.

Bridge Domains and VRF

Therefore, the Cisco SDN ACI under the hood will automatically start to build the VXLAN overlay network for you. The VXLAN network is based on the Bridge Domain (BD), or VRF ACI constructs deployed to the leaf switches. The Bridge Domain is for Layer 2, and the VRF is for Layer 3. So, as devices come online and send traffic to each other, the overlay will grow in reachability in the Bridge Domain or the VRF.

Direct host routing for endoints

Routing within each tenant, VRF is based on host routing for endpoints directly connected to the Cisco ACI fabric. For IPv4, the host routing is based on the /32, giving the ACI a very accurate picture of the endpoints. Therefore, we have exact routing in the ACI. In conjunction, we have a COOP database that runs on the Spines and offers remarkably optimized fabric to know where all the endpoints are located.

To facilitate this, every node in the fabric has a TEP address, and we have different types of TEPs depending on the device’s role. The Spine and the Leaf will have TEP addresses but will differ from each other.

The VTEP and PTEP

The Leaf’s nodes are the Virtual Tunnel Endpoints (VTEP), which are also known as the physical tunnel endpoints (PTEP) in ACI. These PTEP addresses represent the “WHERE” in the ACI fabric where an endpoint lives. Cisco ACI uses a dedicated VRF and a subinterface of the uplinks from the Leaf to the Spines as the infrastructure to carry VXLAN traffic. In Cisco ACI terminology, the transport infrastructure for VXLAN traffic is known as Overlay-1, which is part of the tenant “infra.”

The Spine TEP

The Spines also have a PTEP and an additional proxy TEP, which are used for forwarding lookups into the mapping database. The Spines have a global view of where everything is, which is held in the COOP database synchronized across all Spine nodes. All of this is done automatically for you.

Anycast IP Addressing

For this to work, the Spines have an Anycast IP address known as the Proxy TEP. The Leaf can use this address if they do not know where an endpoint is, so they ask the Spine for any unknown endpoints, and then the Spine checks the COOP database. This brings many benefits to the ACI solution, especially for traffic optimizations and reducing flooded traffic in the ACI. Now, we have an optimized fabric for better performance.

The ACI optimizations

Mouse and elephant flow

This provides better performance for load balancing different flows. For example, in most data centers, we have latency-sensitive flows, known as mouse flows, and long-lived bandwidth-intensive flows, known as elephant flows.

The ACI has more precisely load-balanced traffic using algorithms that optimize mouse and elephant flows and distribute traffic based on flow lets: flow let load-balancing. Within a Leaf, Spine latency is low and consistent from port to port.

The max latency of a packet from one port to another in the architecture is the same regardless of the network size. So you can scale the network without degrading performance. Scaling is often done on a POD-by-POD basis. For more extensive networks, each POD would be its Leaf and Spine network.

ARP optimizations: Anycast gateways

The ACI comes by default with a lot of traffic optimizations. Firstly, instead of using an ARP and broadcasting across the network, that can hamper performance. The Leaf can assume that the Spine will know where the destination is ( and it does via the COOP database ), so there is no need to broadcast to everyone to find a destination.

If the Spine knows where the endpoint is, it will forward the traffic to the other Leaf. If not, it will drop it.

Fabric anycast addressing

This again adds performance benefits to the ACI solution as the table sizes on the Leaf switches can be kept smaller than they would if they needed to know where all the destinations were, even if they were not or never needed to communicate with them. On the Leaf, we have an Anycast address too.

These fabric Anycast addresses are available for Layer 3 interfaces. On the Leaf ToR, we can establish an SVI that uses the same MAC address on every ToR; therefore, when an endpoint needs to route to a ToR, it doesn’t matter which ToR you use. The Anycast Address is spread across all ToR leaf switches.

Pervasive gateway

Now we have predictable latency to the first hop, and you will use the local route VRF table within that ToR instead of traversing the fabric to a different ToR. This is the Pervasive Gateway feature that is used on all Leaf switches. The Cisco ACI has many advanced networking features, but the pervasive gateway is my favorite. It does take away all the configuration mess we had in the past.

ACI Cisco: Integrations

Routing Control Platform

Then came along Cisco SDN ACI, the ACI Cisco, which operates differently from the traditional data center with an application-centric infrastructure. The Cisco application-centric infrastructure achieves resource elasticity with automation through standard policies for data center operations and consistent policy management across multiple on-premises and cloud instances.

Extending & Integrating the fabric

What makes the Cisco ACI interesting is its several vital integrations. I’m not talking about extending the data center with multi-pod and multi-site, for example, with AlgoSec, Cisco AppDynamics, and SD-WAN. AlgoSec enables secure application delivery and policy across hybrid network estates, while AppDynamic lives in a world of distributed systems Observability. SD-WAN enabled path performance per application with virtual WANs.

Cisco Multi-Pod Design

Cisco ACI Multi-Pod is part of the “Single APIC Cluster / Single Domain” family of solutions, as a single APIC cluster is deployed to manage all the interconnected ACI networks. These separate ACI networks are named “pods,” Each looks like a regular two-tier spine-leaf topology. The same APIC cluster can manage several pods, and to increase the resiliency of the solution, the various controller nodes that make up the cluster can be deployed across different pods.

ACI Cisco and AlgoSec

With AlgoSec integrated with the Cisco ACI, we can now provide automated security policy change management for multi-vendor devices and risk and compliance analysis. The AlgoSec Security Management Solution for Cisco ACI extends ACI’s policy-driven automation to secure various endpoints connected to the Cisco SDN ACI fabric.

These simplify network security policy management across on-premises firewalls, SDNs, and cloud environments. They also provide visibility into ACI’s security posture, even across multi-cloud environments.

ACI Cisco and AppDynamics

Then, with AppDynamics, we are heading into Observability and controllability. Now, we can correlate app health and network for optimal performance, deep monitoring, and fast root-cause analysis across complex distributed systems with numbers of business transactions that need to be tracked.

This will give your teams complete visibility of your entire technology stack, from your database servers to cloud-native and hybrid environments. In addition, AppDynamics works with agents that monitor application behavior in several ways. We will examine the types of agents and how they work later in this post.

ACI Cisco and SD-WAN

SD-WAN brings a software-defined approach to the WAN. These enable a virtual WAN architecture to leverage transport services such as MPLS, LTE, and broadband internet services. So, SD-WAN is not a new technology; its benefits are well known, including improving application performance, increasing agility, and, in some cases, reducing costs.

The Cisco ACI and SD-WAN integration makes active-active data center design less risky than in the past. The following figures give a high-level overview of the Cisco ACI and SD-WAN integration. For pre-information generic to SD-WAN, go here: SD-WAN Tutorial

The Cisco SDN ACI with SD-WAN integration helps ensure an excellent application experience by defining application Service-Level Agreement (SLA) parameters. Cisco ACI releases 4.1(1i) and adds support for WAN SLA policies. This feature enables admins to apply pre-configured policies to specify the packet loss, jitter, and latency levels for the tenant traffic over the WAN.

When you apply a WAN SLA policy to the tenant traffic, the Cisco APIC sends the pre-configured policies to a vManage controller. The vManage controller, configured as an external device manager that provides SDWAN capability, chooses the best WAN link that meets the loss, jitter, and latency parameters specified in the SLA policy.

Openshift and Cisco SDN ACI

OpenShift Container Platform (formerly known as OpenShift Enterprise) or OCP is Red Hat’s offering for the on-premises private platform as a service (PaaS). OpenShift is based on the Origin open-source project and is a Kubernetes distribution, the defacto for container-based virtualization. The foundation of the OpenShift networking SDN is based on Kubernetes and, therefore, shares some of the same networking technology along with some enhancements, such as the OpenShift route construct.

Other data center integrations

Cisco SDN ACI has another integration with Cisco DNA Center/ISE that maps user identities consistently to endpoints and apps across the network, from campus to the data center. Cisco Software-Defined Access (SD-Access) provides policy-based automation from the edge to the data center and the cloud.

Cisco SD-Access provides automated end-to-end segmentation to separate user, device, and application traffic without redesigning the network. This integration will enable customers to use standard policies across Cisco SD-Access and Cisco ACI, simplifying customer policy management using Cisco technology in different operational domains.

OpenShift and Cisco ACI

OpenShift does this with an SDN layer and enhances Kubernetes networking to create a virtual network across all the nodes. It is made with the Open Switch standard. For OpenShift SDN, this pod network is established and maintained by the OpenShift SDN, configuring an overlay network using a virtual switch called the OVS bridge. This forms an OVS network that gets programmed with several OVS rules. The OVS is a popular open-source solution for virtual switching.

OpenShift SDN plugin

We mentioned that you could tailor the virtual network topology to suit your networking requirements, which can be determined by the OpenShift SDN plugin and the SDN model you select. With the default OpenShift SDN, several modes are available. This level of SDN mode you choose is concerned with managing connectivity between applications and providing external access to them. Some modes are more fine-grained than others. The Cisco ACI plugins offer the most granular.

Integrating ACI and OpenShift platform

The Cisco ACI CNI plugin for the OpenShift Container Platform provides a single, programmable network infrastructure, enterprise-grade security, and flexible micro-segmentation possibilities. The APIC can provide all networking needs for the workloads in the cluster. Kubernetes workloads become fabric endpoints, like Virtual Machines or Bare Metal endpoints.

Cisco ACI CNI Plugin

The Cisco ACI CNI plugin extends the ACI fabric capabilities to OpenShift clusters to provide IP Address Management, networking, load balancing, and security functions for OpenShift workloads. In addition, the Cisco ACI CNI plugin connects all OpenShift Pods to the integrated VXLAN overlay provided by Cisco ACI.

Cisco SDN ACI and AppDynamics

AppDynamis overview

So, an application requires multiple steps or services to work. These services may include logging in and searching to add something to a shopping cart. These services invoke various applications, web services, third-party APIs, and databases, known as business transactions.

The user’s critical path

A business transaction is the essential user interaction with the system and is the customer’s critical path. Therefore, business transactions are the things you care about. If they start to go, your system will degrade. So, you need ways to discover your business transactions and determine if there are any deviations from baselines. This should also be automated, as learning baseline and business transitions in deep systems is nearly impossible using the manual approach.

So, how do you discover all these business transactions?

AppDynamics automatically discovers business transactions and builds an application topology map of how the traffic flows. A topology map can view usage patterns and hidden flows, acting as a perfect feature for an Observability platform.

AppDynamic topology

AppDynamics will automatically discover the topology for all of your application components. It can then build a performance baseline by capturing metrics and traffic patterns. This allows you to highlight issues when services and components are slower than usual.

AppDynamics uses agents to collect all the information it needs. The agent monitors and records the calls that are made to a service. This is from the entry point and follows executions along its path through the call stack.

Types of Agents for Infrastructure Visibility

If the agent is installed on all critical parts, you can get information about that specific instance, which can help you build a global picture. So we have an Application Agent, Network Agent, and Machine Agent for Server visibility and Hardware/OS.

App Agent: This agent will monitor apps and app servers, and example metrics will be slow transitions, stalled transactions, response times, wait times, block times, and errors.
Network Agent: This agent monitors the network packets, TCP connection, and TCP socket. Example metrics include performance impact Events, Packet loss, and retransmissions, RTT for data transfers, TCP window size, and connection setup/teardown.
Machine Agent Server Visibility: This agent monitors the number of processes, services, caching, swapping, paging, and querying. Example Metrics include hardware/software interrupts, virtual memory/swapping, process faults, and CPU/DISK/Memory utilization by the process.
Machine Agent: Hardware/OS – disks, volumes, partitions, memory, CPU. Example metrics: CPU busy time, MEM utilization, and pieces file.

Automatic establishment of the baseline

A baseline is essential, a critical step in your monitoring strategy. Doing this manually is hard, if not impossible, with complex applications. It is much better to have this done automatically. You must automatically establish the baseline and alert yourself about deviations from it.

This will help you pinpoint the issue faster and resolve it before it can be affected. Platforms such as AppDynamics can help you here. Any malicious activity can be seen from deviations from the security baseline and performance issues from the network baseline.

Summary: Cisco ACI Components

In the ever-evolving world of networking, organizations are constantly seeking ways to enhance their infrastructure’s performance, security, and scalability. Cisco ACI (Application Centric Infrastructure) presents a cutting-edge solution to these challenges. By unifying physical and virtual environments and leveraging network automation, Cisco ACI revolutionizes how networks are built and managed.

Understanding Cisco ACI Architecture

At the core of Cisco ACI lies a robust architecture that enables seamless integration between applications and the underlying network infrastructure. The architecture comprises three key components:

1. Application Policy Infrastructure Controller (APIC):

The APIC serves as the centralized management and policy engine of Cisco ACI. It provides a single point of control for configuring and managing the entire network fabric. Through its intuitive graphical user interface (GUI), administrators can define policies, allocate resources, and monitor network performance.

2. Nexus Switches:

Cisco Nexus switches form the backbone of the ACI fabric. These high-performance switches deliver ultra-low latency and high throughput, ensuring optimal data transfer between applications and the network. Nexus switches provide the necessary connectivity and intelligence to enable the automation and programmability features of Cisco ACI.

3. Application Network Profiles:

Application Network Profiles (ANPs) are a fundamental aspect of Cisco ACI. ANPs define the policies and characteristics required for specific applications or application groups. By encapsulating network, security, and quality of service (QoS) policies within ANPs, administrators can streamline the deployment and management of applications.

The Power of Network Automation

One of the most compelling aspects of Cisco ACI is its ability to automate network provisioning, configuration, and monitoring. Through the APIC’s powerful automation capabilities, network administrators can eliminate manual tasks, reduce human errors, and accelerate the deployment of applications. With Cisco ACI, organizations can achieve greater agility and operational efficiency, enabling them to rapidly adapt to evolving business needs.

Security and Microsegmentation with Cisco ACI

Security is a paramount concern for every organization. Cisco ACI addresses this by providing robust security features and microsegmentation capabilities. With microsegmentation, administrators can create granular security policies at the application level, effectively isolating workloads and preventing lateral movement of threats. Cisco ACI also integrates with leading security solutions, enabling seamless network enforcement and threat intelligence sharing.

Conclusion:

Cisco ACI is a game-changer in the realm of network automation and infrastructure management. Its innovative architecture, coupled with powerful automation capabilities, empowers organizations to build agile, secure, and scalable networks. By leveraging Cisco ACI’s components, businesses can unlock new levels of efficiency, flexibility, and performance, ultimately driving growth and success in today’s digital landscape.

BGP-based Routing Control Platform (RCP)

November 29, 2015

by Matt Conran Blog

Routing Control Platfrom

In today's fast-paced digital world, efficient network management is crucial for businesses and organizations. One technology that has revolutionized routing and network control is the Routing Control Platform (RCP). In this blog post, we will delve into the world of RCPs, exploring their features, benefits, and their potential impact on network infrastructure.

A Routing Control Platform is a software-based solution that offers centralized control and management of network routing. It acts as the brain behind the routing decisions, providing a unified platform for configuring, monitoring, and optimizing routing policies. By abstracting the underlying network infrastructure, RCPs bring simplicity and agility to network management.

Policy-based Routing: RCPs allow administrators to define routing policies based on various parameters such as network conditions, traffic patterns, and security requirements. This granular control enables efficient traffic engineering and enhances network performance.

Centralized Management: With RCPs, network administrators gain a centralized view and control of routing across multiple network devices. This simplifies configuration management, reduces complexity, and streamlines operations.

Dynamic Routing Adaptability: RCPs enable dynamic routing adaptability, which means they can automatically adjust routing decisions based on real-time network conditions. This ensures optimal traffic routing and improves network resiliency.

Enhanced Network Performance: RCPs optimize routing decisions, leading to improved network performance, reduced latency, and increased throughput. This translates into better user experiences and improved productivity.

Increased Flexibility: With RCPs, network administrators can easily adapt routing policies to changing business needs. This flexibility allows for rapid deployment of new services, efficient traffic engineering, and seamless integration with emerging technologies.

Simplified Network Management: RCPs provide a unified platform for managing and controlling routing across diverse network devices. This simplifies network management, reduces operational overhead, and enhances scalability.

Scalability: Ensure that the RCP can handle the scale of your network, supporting a large number of devices and routing policies without compromising performance.

Integration Capabilities: Look for RCPs that seamlessly integrate with your existing network infrastructure, including routers, switches, and SDN controllers. This ensures a smooth transition and minimizes disruption.

Security: Verify that the RCP offers robust security features, including authentication, access control, and encryption. Network security should be a top priority when implementing an RCP.

Routing Control Platforms have emerged as a game-changer in network management, offering centralized control, flexibility, and improved performance. By leveraging the power of RCPs, organizations can optimize their network infrastructure, adapt to changing demands, and stay ahead in the digital era.

Mattt Conran

Highlights: Routing Control Platfrom

Centralised Control

1: Routing control platforms are powerful tools that provide network administrators with centralized control and management over routing protocols. These platforms offer a comprehensive feature suite that allows fine-grained control over network traffic and routing decisions. From policy-based routing to traffic engineering, routing control platforms empower administrators to optimize network performance and enhance efficiency.

2: Effective routing control is vital for optimizing network performance, ensuring reliability, and improving overall internet connectivity. BGP-based routing control allows network administrators to influence the flow of traffic by manipulating route advertisements and selecting appropriate paths based on factors such as network policies, performance metrics, and economic considerations.

3: Internet Service Providers (ISPs) rely heavily on BGP-based routing control to manage the traffic within their networks and establish connections with other networks. By strategically configuring BGP policies, ISPs can control the routing of traffic to and from their networks, ensuring efficient utilization of their resources and maintaining high-quality services for their customers/

Routing control platforms come equipped with various features designed to streamline network operations. These include:

1. Policy-Based Routing: Administrators can define routing policies based on specific criteria such as source IP, destination IP, or application type. This allows for granular control over how network traffic is routed, enabling better traffic management and improved performance.

2. Traffic Engineering: Routing control platforms enable administrators to adjust network paths based on real-time traffic conditions dynamically. This ensures optimal utilization of available network resources and minimizes latency or bottlenecks.

3. Centralized Management: With a routing control platform, administrators can manage multiple routers and switches from a single, intuitive interface. This streamlines network management tasks and reduces the complexity of configuring individual devices.

Key Routing Control Benefits:

– Enhanced Scalability: RCPs enable efficient scaling of network infrastructure by allowing administrators to manage routing policies and protocols across a large number of routers from a single point of control. This eliminates the need for manual configuration on individual devices, reducing human errors and saving valuable time.

– Increased Flexibility: With RCPs, network administrators gain the ability to dynamically adapt routing policies based on network conditions and business requirements. RCPs provide a programmable interface that allows for automation and customization, empowering organizations to respond quickly to changing network demands.

– Improved Network Visibility: RCPs offer comprehensive monitoring and analytics capabilities, providing real-time insights into network performance, traffic patterns, and potential bottlenecks. This enhanced visibility enables proactive troubleshooting, efficient capacity planning, and optimization of network resource

Recap Technology: BGP Route Reflection

Understanding BGP Route Reflection

– BGP route reflection is a technique used to alleviate the scalability issues in BGP networks with multiple routers. It allows for reducing full mesh connections, which can be resource-intensive and challenging to manage. By implementing route reflection, network administrators can maintain a hierarchical routing structure while reducing the complexity of BGP configurations.

– In a BGP route reflection setup, one or more route reflector (RR) routers are designated within a BGP autonomous system (AS). These RR routers serve as central points for route advertisement and dissemination. Instead of establishing full mesh connections between all routers in the AS, non-RR routers establish peering sessions only with the RR routers. This simplifies the BGP topology and reduces the number of required peerings.

– The implementation of BGP route reflection offers several advantages. Firstly, it reduces the number of BGP peerings required, resulting in reduced memory and CPU overhead on routers. Secondly, it improves network stability by preventing routing loops that can occur in a full mesh BGP setup. Additionally, route reflection enables better scalability, as new routers can be added to the network without significantly impacting the existing BGP infrastructure.

**Centralized Forwarding Solution**

The Routing Control Platform (RCP) is a centralized forwarding solution, similar to BGP SDN that enables the collection of a network topology map, running an algorithm, and selecting the preferred BGP route for each router in an Autonomous System (AS). It does this by peering both the IGP platform and iBGP to neighboring routers and communicating the preferred routes using unmodified iBGP.

It acts similarly to an enhanced route reflector and does not sit in the data path. It is a control plane device, separate from the IP forwarding plane. The RCP protocol exhibits the accuracy of a full mesh iBGP design and scalability enhancements of route reflection without sacrificing route selection correctness.

**Hot Potato Routing**

A potential issue with route reflection is that AS exit best path selection (hot potato routing) is performed by route reflectors from their IGP reference point, which in turn gets propagated to all RR clients scattered throughout the network. As a result, the best path selected may not be optimal for many RR clients as it depends on where the RR client is logically placed in the network.

You may also encounter MED-induced route oscillations. The Routing Control Platform aims to solve this problem.

Recap Technology: BGP Multipath

Understanding BGP Multipath

BGP Multipath, or Border Gateway Protocol Multipath, is a feature that allows a router to install multiple paths for the same destination prefix in its routing table. This means that instead of selecting a single best path, the router can utilize multiple paths simultaneously to distribute traffic. By doing so, BGP Multipath enhances the efficiency and resilience of network routing.

Enhanced Load Balancing: One of BGP Multipath’s primary advantages is its ability to achieve optimal load balancing across multiple paths. By distributing traffic across multiple links, the network can utilize available bandwidth more efficiently, preventing congestion and ensuring a smooth user experience.

Increased Fault Tolerance: In addition to load balancing, BGP Multipath improves network resilience by providing redundancy. If one path fails or experiences degradation, the router can automatically divert traffic to alternative paths, ensuring uninterrupted connectivity. This fault tolerance greatly enhances network reliability.

Routers need to be correctly configured to enable BGP Multipath. This involves helping the multipath feature, specifying the maximum number of parallel paths, and adjusting various parameters, such as the tie-breaking criteria. Network administrators must carefully plan and configure BGP Multipath to ensure optimal performance and avoid potential issues.

Advanced Topics:

BGP Next Hop Tracking

BGP Next Hop is the IP address BGP routers use to reach a specific destination network. It is an essential component in the BGP routing table and is vital in determining the best path for data packets. However, traditional BGP routing can face challenges when link failures occur, resulting in suboptimal routing decisions. This is where BGP Next Hop Tracking comes into play.

BGP Next Hop Tracking is a feature that allows BGP routers to actively monitor the reachability of next-hop IP addresses. By tracking the next hop, routers can quickly identify whether a particular path is still valid or if an alternative route needs to be chosen. This dynamic approach enhances network resilience and reduces downtime, enabling routers to react swiftly to link failures.

a. Improved Network Resilience: BGP Next Hop Tracking ensures routing decisions are based on real-time reachability information. This capability significantly improves network resilience by dynamically adapting to changing network conditions, such as link failures or congestion.

b. Load Balancing and Traffic Engineering: With BGP Next Hop Tracking, network administrators can implement intelligent traffic engineering techniques. Routers can distribute traffic across diverse paths by actively monitoring the reachability of multiple next-hop IP addresses, balancing the load, and optimizing network performance.

c. Seamless Failover and Fast Convergence: In the event of a link failure, BGP Next Hop Tracking enables routers to switch to an alternative path swiftly with minimal disruption. This feature ensures seamless failover and fast convergence, reducing packet loss and improving overall network performance.

Example: BGP Add Path

Understanding the BGP Add Path Feature

The BGP Add Path feature allows BGP routers to advertise multiple paths for a given destination prefix. Traditionally, BGP only advertised the best path to a destination, but with Add Path, routers can now advertise multiple paths, providing redundancy, load balancing, and more granular traffic engineering capabilities.

Redundancy and Resilience: The BGP Add Path feature advertises multiple paths and provides backup paths in case of failures, enhancing network resilience. This redundancy ensures uninterrupted connectivity and minimizes service disruptions.

Load Balancing: Add Path enables traffic load balancing across multiple paths, optimizing network utilization and improving performance. Network operators can distribute traffic based on factors such as link capacity, latency, or cost, ensuring efficient resource utilization.

Traffic Engineering: With BGP Add Path, network operators gain fine-grained control over traffic engineering. They can influence the path selection process by manipulating attributes associated with each path, such as AS path length or local preference. This flexibility empowers operators to optimize routing decisions based on their specific requirements.

Before you proceed, you may find the following blog BGP of interest:

Routing Control Platfrom

Routing Foundations

A network carries traffic where traffic flows from a start node to an end node; generally, we refer to the start node as the source node and the end node as the destination node. We must pick a path or route from the source node to the destination node. A route can be set up manually; such a route is static. Or we can have a dynamic routing protocol, such as an IGP or EGP.

With dynamic routing protocols, we have to use a routing algorithm. The role of the routing algorithm is to determine a route. Each routing algorithm will have different ways of choosing a path. Finally, a network can be expressed as a graph by mapping each node to a unique vertex in the graph, where links between network nodes are represented by edges connecting the corresponding vertices. Each edge can carry one or more weights; such weights may depict cost, delay, bandwidth, and so on. Many of these methods are now enhanced with an IGP platform and different types of routing control.

A key point: Replacing iBGP with the OpenFlow protocol

The Routing Control Platform is proposed to be enhanced by replacing iBGP with the OpenFlow protocol, which provides additional capabilities beyond next-hop forwarding. This may be useful for a BGP-free edge core and will be addressed later. The following discusses the original Routing Control Platform proposed by Princeton University and AT&T Labs-Research.

iBGP and eBGP

Routers within an AS exchange routes to external destinations using internal BGP (iBGP), and routers peer externally to their AS using external BGP (eBGP). All BGP speakers within a single AS must be fully meshed to propagate external destinations. For loop prevention, the original BGP design states reachability information learned from an iBGP router can not be forwarded to another iBGP router inside the full mesh. eBGP designs use AS-PATH for loop prevention. All routing protocols, not just BGP, require some mechanism to prevent loops.

With iBGP, the maximum number of iBGP hops an update can traverse is 1.

Route-reflection (RR) and confederations

To combat the scalability concerns with an iBGP full mesh design, in 1996, several alternatives, such as route reflection and confederations, were proposed. Both of these enable hierarchies within the topology. However, route reflection has drawbacks, which may result in path diversity and network performance side effects. There is a trade-off between routing correctness and scalability. With iBGP full mesh designs, if one BGP router fails, it will have a limited impact. An update travels only one i-BGP hop. However, if a route reflector fails, it has an extensive network impact. All iBGP peers peering with the route reflector are affected.

An update message may traverse multiple route reflectors with a route reflection design before reaching the desired i-BGP router. This may have adverse effects, such as prolonged routing convergence. One of route reflection’s most significant adverse effects is reduced path diversity. A high path diversity can increase resilience, while low path diversity will decrease resilience. Since a route reflector only passes its best route, all clients peering with that route reflector use the same path for that given destination.

BGP Multipath and the Add Path capability

Proper route reflector placement and design can eliminate some of these drawbacks. We now have path diversity mechanisms such as the BGP ADD Path capability and parallel peerings for better route reflection design. These were not available during the original RCP proposal.

Routing Control Platform (RCP)

The RCP consists of several components: 1) Route Control Server ( RCS), 2) BGP Engine, and 3) IGP platform viewer. It is similar to the newer BGP SDN platform proposed by Petr Lapukhov but has an additional IGP platform viewer function. Petr’s BGP SDN solution proposes a single Layer 3 protocol with BGP – a pure Layer 3 data center.

The RCP platform has two types of peerings: IGP and iBGP. It obtains IGP information by peering with IGP and learns BGP routes with iBGP. The Route Control Server component then analyzes the IGP and BGP viewer information to compute the best path and send it back via iBGP. Notice how the IGP Viewer only needs one peering into each partition in the diagram below.

Since the link-state protocol uses reliable LSA flooding, the IGP viewer has an up-to-date topology view. To keep the IGP viewer out of the data plane, higher costs are configured on the links to the controller. As discussed, the BGP engine creates iBGP sessions for other directly reachable speakers or via the IGP.

By combining these elements, the RCS has full BGP and IGP topology information and can make routing decisions for routers in a particular partition. The RCP must have complete visibility. Otherwise, it could assign routes that create black holes, forwarding loops, or other issues preventing packets from reaching their destinations.

Centralized controller: Extract the topology

RPC uses a centralized controller to extract the topology and make routing decisions. These decisions are then pushed to the data plane nodes to forward data packets. It aims to offer the correctness of full-mesh iBGP designs and the scalability of route reflector designs. It uses iBGP sessions to peer with BGP speakers, learn topology information, and send routing decisions for destination prefixes.

As previously discussed, a route reflector design only sends its best path to clients, which limits path diversity. However, the RCP platform overcomes this route reflector limitation and sends each router a route it would have selected in an iBGP full mesh design.

Routing Control Platforms empower organizations to take control of their network routing, leading to enhanced performance, improved resilience, and increased security. By leveraging RCPs, businesses can optimize their network infrastructure, ensuring smooth operations and a seamless user experience. As the demand for robust and flexible networks grows, Routing Control Platforms will play an increasingly vital role in effectively managing and controlling network traffic.

Summary: Routing Control Platfrom

Routing control platforms play a crucial role in managing and optimizing network infrastructures. From enhancing network performance to ensuring efficient traffic routing, these platforms have become indispensable in the digital era. In this blog post, we explored the world of routing control platforms, their functionalities, benefits, and how they empower network management.

Understanding Routing Control Platforms

Routing control platforms are sophisticated software solutions designed to control and manage network traffic routing. They provide network administrators with comprehensive visibility and control over the flow of data packets within a network. By leveraging advanced algorithms and protocols, these platforms enable efficient decision-making regarding packet routing, ensuring optimal performance and reliability.

Key Features and Functionalities

Routing control platforms offer many features and functionalities that empower network management. These include:

1. Centralized Traffic Control: Routing control platforms provide a centralized interface for monitoring and controlling network traffic. Administrators can define routing policies, prioritize traffic, and adjust routing paths based on real-time conditions.

2. Traffic Engineering: With advanced traffic engineering capabilities, these platforms enable administrators to optimize network paths and distribute traffic evenly across multiple links. This ensures efficient resource utilization and minimizes congestion.

3. Security and Policy Enforcement: Routing control platforms offer robust security mechanisms to protect networks from unauthorized access and potential threats. They enforce policies, such as access control lists and firewall rules, to safeguard sensitive data and maintain network integrity.

Benefits of Routing Control Platforms

Implementing a routing control platform brings several benefits to network management:

1. Enhanced Performance: Routing control platforms improve overall network performance by efficiently managing traffic routing and optimizing network paths, reducing latency and packet loss.

2. Increased Reliability: These platforms enable administrators to implement redundancy and failover mechanisms, ensuring uninterrupted network connectivity and minimizing downtime.

3. Flexibility and Scalability: Routing control platforms provide the flexibility to adapt to changing network requirements and scale as the network grows. They support dynamic routing protocols and can accommodate new network elements seamlessly.

Conclusion:

Routing control platforms have revolutionized network management by providing administrators with powerful tools to optimize traffic routing and enhance network performance. These platforms empower organizations to build robust and efficient networks, from centralized traffic control to advanced traffic engineering capabilities. By harnessing the benefits of routing control platforms, network administrators can unlock the true potential of their infrastructures and deliver a seamless user experience.

BGP SDN – Centralized Forwarding

November 28, 2015

by Matt Conran Blog

BGP SDN

The networking landscape has significantly shifted towards Software-Defined Networking (SDN) in recent years. With its ability to centralize network management and streamline operations, SDN has emerged as a game-changing technology. One of the critical components of SDN is Border Gateway Protocol (BGP), a routing protocol that plays a vital role in connecting different autonomous systems. In this blog post, we will explore the concept of BGP SDN and its implications for the future of networking.

Border Gateway Protocol (BGP) is a dynamic routing protocol that facilitates the exchange of routing information between different networks. It enables the establishment of connections and the exchange of network reachability information across autonomous systems. BGP is the glue that holds the internet together, ensuring that data packets are delivered efficiently across various networks.

Scalability and Flexibility: BGP SDN empowers network administrators with the ability to scale their networks effortlessly. By leveraging BGP's inherent scalability and SDN's programmability, network expansion becomes a seamless process. Additionally, the flexibility provided by BGP SDN allows for the customization of routing policies, enabling network administrators to adapt to changing network requirements.

Traffic Engineering and Optimization: Another significant advantage of BGP SDN is its capability to perform traffic engineering and optimization. With granular control over routing decisions, network administrators can efficiently manage traffic flow, ensuring optimal utilization of network resources. This results in improved network performance, reduced congestion, and enhanced user experience.

Dynamic Path Selection: BGP SDN enables dynamic path selection based on various parameters, such as network congestion, link quality, and cost. This dynamic nature of BGP SDN allows for intelligent and adaptive routing decisions, ensuring efficient data transmission and load balancing across the network.

Policy-Based Routing: BGP SDN allows network administrators to define routing policies based on specific criteria. This capability enables the implementation of fine-grained traffic management strategies, such as prioritizing certain types of traffic or directing traffic through specific paths. Policy-based routing enhances network control and enables the optimization of network performance for specific applications or user groups.

BGP SDN represents a significant leap forward in network management. By combining the robustness of BGP with the flexibility of SDN, organizations can unlock new levels of scalability, control, and optimization. Whether it's enhancing network performance, enabling dynamic path selection, or implementing policy-based routing, BGP SDN paves the way for a more efficient and agile network infrastructure.

Matt Conran

Highlights: BGP SDN

BGP SDN, which stands for Border Gateway Protocol Software-Defined Networking, combines the power of traditional BGP routing protocols with the flexibility and programmability of SDN. It enables network administrators to have granular control over their routing decisions and allows for dynamic and automated network provisioning.

Enhanced Flexibility and Scalability: BGP SDN brings unmatched flexibility to network operators. By decoupling the control plane from the data plane, it allows for dynamic rerouting and network updates without disrupting the overall network operation. This flexibility also enables seamless scalability as networks grow or evolve over time.

Improved Network Performance and Efficiency: With BGP SDN, network administrators can optimize traffic flow by dynamically adjusting routing decisions based on real-time network conditions. This intelligent traffic engineering ensures efficient resource utilization, reduced latency, and improved overall network performance.

Simplified Network Management: By leveraging programmability, BGP SDN simplifies network management tasks. Network administrators can automate routine configuration changes, implement policies, and troubleshoot network issues more efficiently. This leads to significant time and cost savings.

Rapid Deployment of New Services: BGP SDN enables faster service deployment by allowing administrators to define routing policies and service chaining through software. This eliminates the need for manual configuration changes on individual network devices, reducing deployment time and potential human errors.

Improved Network Security: BGP SDN provides enhanced security features by allowing fine-grained control over network access and traffic routing. It enables the implementation of robust security policies, such as traffic isolation and encryption, to protect against potential threats.

BGP-based SDN

BGP SDN, also known as BGP-based SDN, is an approach that leverages the strengths of BGP and SDN to enhance network control and management. Unlike traditional networking architectures, where individual routers make routing decisions, BGP SDN centralizes the control plane, allowing for more efficient routing and dynamic network updates. By separating the control plane from the data plane, operators can gain greater visibility and control over their networks.

BGP SDN offers a range of features and benefits that make it an attractive choice for network operators. First, it provides enhanced scalability and flexibility, allowing networks to adapt to changing demands and traffic patterns. Second, operators can easily define and modify routing policies, ensuring optimal traffic distribution across the network.

Another notable feature is the ability to enable network programmability. Using APIs and controllers, network operators can dynamically provision and configure network services, making deploying new applications and services easier. This programmability also opens doors for automation and orchestration, simplifying network management and reducing operational costs.

Use Cases of BGP SDN: BGP SDN has found applications in various domains, from data centers to wide-area networks. In data centers, it enables efficient load balancing, traffic engineering, and rapid service deployment. It also allows for the creation of virtual networks, enabling secure multi-tenancy and resource isolation.

BGP SDN brings benefits such as traffic engineering and improved network resilience in wide-area networks. It enables dynamic path selection, optimizes traffic flows, and reduces congestion. Additionally, BGP SDN can enable faster network recovery during failures, ensuring uninterrupted connectivity.

BGP vs SDN:

BGP, also known as the routing protocol of the Internet, plays a vital role in facilitating communication between autonomous systems (AS). It enables the exchange of routing information and determines the best path for data packets to reach their destinations. With its robust and scalable design, BGP has become the go-to protocol for inter-domain routing.

SDN, on the other hand, is a paradigm shift in network architecture. SDN centralizes network management and allows for programmability and flexibility by decoupling the control plane from the forwarding plane. With SDN, network administrators can dynamically control network behavior through a centralized controller, simplifying network management and enabling rapid innovation.

Synergizing BGP and SDN

When BGP and SDN converge, the result is a potent combination that transcends the limitations of traditional networking. SDN’s centralized control plane empowers network operators to control BGP routing policies dynamically, optimizing traffic flow and enhancing network performance. By leveraging SDN controllers to manipulate BGP attributes, operators can quickly implement traffic engineering, load balancing, and security policies.

The Role of SDN

In contrast to the decentralized control logic that underpins the construction of the Internet as a complex bundle of box-centric protocols and vertically integrated solutions, software-defined networking (SDN) advocates the separation of control logic from hardware and its centralization in software-based controllers. Introducing innovative applications and incorporating automatic and adaptive control into these fundamental tenets can ease network management and enhance user experience.

Recap Technology: EBGP over IBGP

EBGP, or External Border Gateway Protocol, is a routing protocol typically used between different autonomous systems (AS). It facilitates the exchange of routing information between these AS, allowing efficient data transmission across networks. EBGP’s primary characteristic is that it operates between routers in different AS, enabling interdomain routing.

IBGP, or Internal Border Gateway Protocol, operates within a single autonomous system (AS). It establishes peering relationships between routers within the same AS, ensuring efficient routing within the network. Unlike EBGP, IBGP does not involve exchanging routes between different AS; instead, it focuses on sharing routing information between routers within the same AS.

While both EBGP and IBGP serve to facilitate routing, there are crucial differences between them. One significant distinction lies in the scope of their operation. EBGP connects routers across different AS, making it ideal for interdomain routing. On the other hand, IBGP connects routers within the same AS, providing efficient intradomain routing.

EBGP is commonly used by internet service providers (ISPs) to exchange routing information with other ISPs, ensuring global reachability. It enables autonomous systems to learn about and select the best paths to reach specific destinations. IBGP, on the other hand, helps maintain synchronized routing information within an AS, preventing routing loops and ensuring efficient internal traffic flow.

Recap Technology: BGP Route Reflection

Understanding BGP Route Reflection

BGP (Border Gateway Protocol) is a crucial routing protocol in large-scale networks. However, route propagation can become cumbersome and resource-intensive in traditional BGP setups. BGP route reflection offers an elegant solution by reducing the number of full-mesh connections needed in a network.

By implementing BGP route reflection, network administrators can achieve significant advantages. Firstly, it reduces resource consumption by eliminating the need for every router to maintain full mesh connectivity. This leads to improved scalability and reduced overhead. Additionally, it enhances network stability and convergence time, ensuring efficient routing updates.

To implement BGP route reflection, several key steps need to be followed. Firstly, identify the routers that will act as route reflectors in the network. These routers should have sufficient resources to handle the increased routing information. Next, configure the route reflectors and their respective clients, ensuring proper peering relationships. Finally, monitor and fine-tune the route reflection setup to optimize performance.

Challenges to Networking

Over the past few years, there has been a growing demand for a new approach to networking to address the many issues associated with current networks. According to the SDN approach, networking operations can be simplified, network management can be optimized, and innovation and flexibility can be introduced.

According to Kim and Feamster (2013), four key reasons can be identified for the problems encountered in managing existing networks:

(1) Complex and low-level network configuration: Network configuration is a distributed task typically configured vendor-specific at the low level. Moreover, network operators constantly change configurations manually due to the rapid growth of the network and changing networking conditions, adding complexity and introducing additional configuration errors to the configuration process.

(2) Growing complexity and dynamic network state: networks are becoming increasingly complex and more extensive. Moreover, as mobile computing trends continue to develop and network virtualization (Bari et al. 2013; Alam et al. 2020) and cloud computing (Zhang et al. 2010; Sharkh et al. 2013; Shamshirband et al. 2020) become more prevalent, the networking environment becomes even more dynamic as hosts are constantly moving, arriving and departing due to the flexibility offered by virtual machine migration, which results in a rapid and significant change of traffic patterns and network conditions.

(3) Exposed complexity: today’s large-scale networks are complicated by distributed low-level network configuration interfaces that expose great complexity. Many control and management features are implemented in hardware, which generates this complexity.

(4) Heterogeneous: Current networks contain many heterogeneous network devices, including routers, switches, and middleboxes of various kinds. As a result, network management becomes more complex and inefficient because each appliance has its proprietary configuration tools.

Because legacy networks’ static, inflexible architecture is ill-suited to cope with today’s increasingly dynamic networking trends and meet modern users’ QoE expectations, network management is becoming increasingly challenging. As a result, complex, high-level policies must be adopted to adapt to current networking environments, and network operations must be automated to reduce the tedious work of low-level device configuration.

Traffic Engineering

Networks with multiple Border Gateway Protocol (BGP) Autonomous Systems (ASNs) under the same administrative control implement traffic engineering with policy configurations at border edges. Policies are applied on multiple routers distributedly, which can be hard to manage and scale. Any per-prefix traffic engineering changes may need to occur on various devices and levels.

A new BGP Software-Defined Networking (SDN) solution introduced by P. Lapukhov and E. Nkposong proposes a centralized routing model. It introduces the concept of a BGP SDN controller, also known as an SDN BGP controller with a routing control platform. No protocol extensions or additional protocols are needed to implement the SDN architecture. BGP is employed to push down new routes and peers iBGP with all existing BGP routers.

BGP-only Network

A BGP-only network has many advantages, and this solution promotes a more stable Layer 3-only network, utilizing one control plane protocol – BGP. BGP captures topology discovery and links up/down events. BGP can push different information to different BGP speakers, while an IGP has to flood the same LSA throughout the IGP domain.

For additional pre-information, you may find the following helpful:

BGP SDN

BGP Peering Session Overview

In BGP terminology, a BGP neighbor relationship is called a peer relationship, unlike OSPF and EIGRP, which implement their transport mechanism. In place of TCP, BGP utilizes BGP TCP port 179 as its transport protocol. A BGP peering session can only be established between two routers after a TCP session has been established between them. Selecting a BGP session consists of establishing a TCP session and exchanging BGP-specific information to establish a BGP peering session.

A TCP session operates on a client/server model. On a specific TCP port number, the server listens for connection attempts. Upon hearing the server’s port number, the client attempts to establish a TCP session. Next, the client sends a TCP synchronization (TCP SYN) message to the listening server to indicate that it is ready to send data.

Upon receiving the client’s request, the server responds with a TCP synchronization acknowledgment (TCP SYN-ACK) message. Finally, the client acknowledges receipt of the SYN-ACK packet by sending a simple TCP acknowledgment (TCP ACK). TCP segments can now be sent from the client to the server. As part of this process, TCP performs a three-way handshake.

Diagram: BGP explained. The source is IPcisco.

So, how does BGP work? BGP is a path-vector protocol that stores routes in the Routing Information Bases (RIBs). The RIB within a BGP speaker consists of three parts:

The Adj-RIB-In,
The Loc-RIB,
The Adj-RIB-Out.

The Adj-RIB-In stores routing information learned from the inbound UPDATE messages advertised by peers to the local router. The routes in the Adj-RIB-In define routes that are available to the path decision process. The Loc-RIB contains routing information the local router selected after applying policy to the routing information in the Adj-RIB-In.

The Emergence of BGP in SDN:

Software-defined networking (SDN) introduces a paradigm shift in managing and operating networks. Traditionally, network devices such as routers and switches were responsible for handling routing decisions. However, with the advent of SDN, the control plane is decoupled from the data plane, allowing for centralized management and control of the network.

BGP plays a crucial role in the SDN architecture by acting as a control protocol that enables communication between the controller and the network devices. It provides the intelligence and flexibility required for orchestrating network policies and routing decisions in an SDN environment.

Layer-2 and Layer-3 Technologies

Traditional forwarding routing protocols and network designs comprise a mix of Layer 2 and 3 technologies. Topologies resemble trees with different aggregation levels, commonly known as access, aggregation, and core. IP routing is deployed at the top layers, while Layer 2 is in the lower tier to support VM mobility and other applications requiring Layer 2 VLANs to communicate.

Fully routed networks are more stable as they confine the Layer 2 broadcast domain to certain areas. Layer 2 is segmented and confined to a single switch, usually used to group ports. Routed designs run Layer 3 to the Top of the Rack (ToR), and VLANs should not span ToR switches. As data centers grow in size, the stability of IP has been preferred over layer 2 protocols.

A key point: Traffic patterns

Traditional traffic patterns leave the data center, known as north-to-south traffic flow. In this case, conventional tree-like designs are sufficient. Upgrades consist of scale-out mechanisms, such as adding more considerable links or additional line cards. However, today’s applications, such as Hadoop clusters, require much more server-to-server traffic, known as east-to-west traffic flow.

Scaling up traditional tree topologies to match these traffic demands is possible but not an optimum way to run your network. A better choice is to scale your data center horizontally with a CLOS topology ( leaf and spine ), not a tree topology.

Leaf and spine topologies permit equidistant endpoints and horizontal scaling, resulting in a perfect combination for optimum east-to-west traffic patterns. So, what layer 3 protocol do you use for your routing design? An Interior Gateway Protocol (IGP), such as ISIS or OSPF? Or maybe BGP? BGP’s robustness makes it a popular Layer 3 protocol for reducing network complexity.

How BGP works with BGP SDN: Centralized forwarding

What is BGP protocol in networking? Regarding internal data structures, BGP is less complex than a link-state IGP. Instead of forming adjacency maintenance and controls, it runs all its operations over Transmission Control Protocol (TCP) and uses TCP’s robust transport mechanism.

BGP has considerably less flooding overhead than IGPs, with a single flooding domain propagation scope. For these reasons, BGP is great for reducing network complexity and is selected as this SDN solution’s singular control plane mechanism.

Peter has written a draft called “Centralized Routing Control in BGP Networks Using Link-State Abstraction,” which discusses the use case of BGP for centralized routing control in the network.

The main benefit of the architecture is centralized rather than distributed control. There is no need to configure policies on multiple devices. All changes are made with an API in the controller.

A link-state map

The network looks like a collection of BGP ASN, and the entire routing is done with BGP only. First, BGP builds a link-state map of the network in the controller memory.

Then, they use BGP to discover the topology and notice link-up and link-down events. Instead of installing a 5-tuple that can install flows based on the entire IP header, the BGP SDN solution offers destination-based forwarding only. For additional granularity, implement BGP flow spec, RFC 55745, entitled “Dissemination of Flow Specification Rules.”

Routing Control Platform

The proposed method was inspired by the Routing Control Platform (RCP). The RCP platform uses a controller-based function and selects BGP routes for the routers in an AS using a complete view of the available routes and IGP topology. The RCP platform has properties similar to those of the BGP SDN solution.

Both run iBGP peers to all routers in the network and influence the default topology by changing the controller and pushing down new routes. However, a significant difference is that the RCP has additional IGP peerings. It’s not a BGP-only network. BGP SDN promotes a single control plane of BGP without any IGPs.

BGP detects health, builds a link-state map, and represents the network to a third-party application as multiple topologies. You can map prefixes to different topologies and change link costs from the API.

Multi-Topology view

The agent builds the link-state database and presents a multi-topology view of this data to the client applications. You may clone this topology and give certain links higher costs, mapping some prefixes to this new non-default topology. The controller pushes new routes down with BGP.

The peering is based on iBGP, so new routes are set with a better Local Preference, enabling them to be selected higher in the BGP path decision process. It is possible to do this with eBGP, but iBGP can be more accessible. With iBGP, you don’t need to care about the next hops.

BGP and OpenFlow

What is OpenFlow? BGP works like OpenFlow and pushes down the forwarding information. It populates routes in the forwarding table. Instead of using BGP in a distributed fashion, they centralize it. One main benefit of using BGP over OpenFlow is that you can shut the controller down, and regular BGP operation continues on the network.

But if you transition to an OpenFlow configuration, you cannot roll back as quickly as you could with BGP. Using BGP inband has great operational benefits. It is a great design by P. Lapukhov. There is no need to deploy BGP-LS or any other enhancements to BGP.

Future Outlook: As the demand for more agile and efficient networks continues to grow, BGP SDN is expected to play a pivotal role in shaping the future of networking. Its ability to simplify network management, enhance scalability, and improve security makes it an ideal choice for organizations seeking to modernize their network infrastructure.

BGP SDN represents a significant advancement in networking technology, allowing organizations to build agile, scalable, and secure networks. By centralizing control and leveraging BGP’s intelligence, SDN has the potential to revolutionize how networks are managed and operated. As the industry embraces SDN, BGP will continue to play a crucial role in enabling the next generation of network infrastructure.

Summary: BGP SDN

In the ever-evolving networking world, two key technologies have emerged as game-changers: Border Gateway Protocol (BGP) and Software-Defined Networking (SDN). In this blog post, we delved into the intricacies of these powerful tools, exploring their functionalities, benefits, and impact on the networking landscape.

Understanding BGP

BGP, an exterior gateway protocol, plays a crucial role in enabling communication between different autonomous systems on the internet. It allows routers to exchange information about network reachability, facilitating efficient routing decisions. With its robust path selection mechanisms and ability to handle large-scale networks, BGP has become the de facto protocol for inter-domain routing.

Exploring SDN

SDN, on the other hand, represents a paradigm shift in network architecture. SDN centralizes network management and provides a programmable and flexible infrastructure by decoupling the control plane from the data plane. SDN empowers network administrators to dynamically configure and manage network resources through controllers and open APIs, leading to greater automation, scalability, and agility.

The Synergy Between BGP and SDN

While BGP and SDN are distinct technologies, they are not mutually exclusive. They can complement each other to enhance network performance and efficiency. SDN can leverage BGP’s routing capabilities to optimize traffic flows and improve network utilization. Conversely, BGP can benefit from SDN’s centralized control, enabling faster and more adaptive routing decisions.

Benefits and Challenges

The adoption of BGP and SDN brings numerous benefits to network operators. BGP provides stability, scalability, and fault tolerance in inter-domain routing, ensuring reliable connectivity across the internet. SDN offers simplified network management, quick provisioning, and the ability to implement security policies at scale. However, implementing these technologies may also present challenges, such as complex configurations, interoperability issues, and security concerns that need to be addressed.

Conclusion:

In conclusion, BGP and SDN have revolutionized the networking landscape, offering unprecedented control, flexibility, and efficiency. BGP’s role as the backbone of inter-domain routing, combined with SDN’s programmability and centralized management, paves the way for a new era of networking. As technology advances, a deep understanding of BGP and SDN will be essential for network professionals to adapt and thrive in this rapidly evolving domain.

Cisco ACI Components

Highlights: Cisco ACI Components

The ACI Fabric

–The Cisco Nexus Family–

–ACI Architecture: Spine and Leaf–

Cisco ACI Components

Introduction to Leaf and Spine

The ACI fabric: Does Not Aggregate Traffic

**Overlay and Underlay Design**

Mapping Traffic:

**Overlay and Underlay Components**

Underlay & Overlay Interaction

Multicast Distribution Tree (MDT)

Normalize the transports

Bridge Domains and VRF

Direct host routing for endoints

The VTEP and PTEP

**The Spine TEP**

**Anycast IP Addressing**

The ACI optimizations

**Mouse and elephant flow**

**ARP optimizations: Anycast gateways**

**Fabric anycast addressing**

**Pervasive gateway**

ACI Cisco: Integrations

Cisco Multi-Pod Design

ACI Cisco and AlgoSec

ACI Cisco and AppDynamics

ACI Cisco and SD-WAN

Openshift and Cisco SDN ACI

OpenShift and Cisco ACI

Cisco SDN ACI and AppDynamics

Types of Agents for Infrastructure Visibility

Summary: Cisco ACI Components

Routing Control Platfrom

Highlights: Routing Control Platfrom

Centralised Control

Recap Technology: BGP Route Reflection

Recap Technology: BGP Multipath

Advanced Topics:

BGP Next Hop Tracking

Example: BGP Add Path

Routing Control Platfrom

Routing Foundations

iBGP and eBGP

Route-reflection (RR) and confederations

Routing Control Platform (RCP)

Centralized controller: Extract the topology

Summary: Routing Control Platfrom

BGP SDN

Highlights: BGP SDN

BGP-based SDN

BGP vs SDN:

Recap Technology: EBGP over IBGP

Recap Technology: BGP Route Reflection

Challenges to Networking

Traffic Engineering

BGP SDN

BGP Peering Session Overview

The Emergence of BGP in SDN:

Layer-2 and Layer-3 Technologies

How BGP works with BGP SDN: Centralized forwarding

Routing Control Platform

Summary: BGP SDN

Quick Links

Contact

Subscribe Now

Overlay and Underlay Design

Overlay and Underlay Components

The Spine TEP

Anycast IP Addressing

Mouse and elephant flow

ARP optimizations: Anycast gateways

Fabric anycast addressing

Pervasive gateway