14. Meanwhile, a Revolution Was Happening in Networking…
OpenFlow
• Protocol which
would allow
software running
on servers to
direct the flow of
packets in a
network
• Separation of
control and data
planes
Server
Virtualization
• Created need
for virtual
switches on
each server
• Vmware, Cisco
Nexus
1000v, Open
vSwitch
Virtualized
Network
Services
• Firewall,
load-
balancing, VPN
• Network service
orchestration
Network
Controller
• Lots of activity
around creating
new SDN
controllers
• Open source
projects: Open
Daylight
18. OpenStack Neutron ML2 Architecture
Neutron Server
DHCP Agent
L3 Agent
Message
Queue
REST API
Neutron Core
plugins
ML2
Cisco
(Nexus,N1Kv)
OVS
Morevendor
plugins
Type Drivers Mechanism Drivers
VLAN
GRE
VXLAN
CiscoNexus
OVS
OpenDayLight
APIC
Neutron Service
plugins
LoadBalancer
Firewall
VPN
HAProxy
IPTables
OpenSwan
• Core + Extension REST APIs
• Message queue for communicating with
neutron agents
• Core and service plugins
• Different vendor core plugins
• Different network technology support
• ML2 plugin with type and mechanism
drivers
• Service plugins with backend drivers
IPTables on
Network
Node
Core API
Network Port Subnet
Resource and Attribute Extension API
ProviderNetwork PortBinding Router Quotas SecurityGroups AgentScheduler LBaaS FWaaS VPNaaS ….
L2 Agent
OVS on
Compute
Node
Southbound Interfaces
L3ServicesFutures
Morevendor
drivers
19. OpenStack Neutron ML2 Architecture
Neutron Server
REST API
Neutron Core pluginsML2
Cisco
(Nexus,N1Kv)
OVS
Morevendor
plugins
Type Drivers Mechanism Drivers
VLAN
GRE
VXLAN
CiscoNexus
OVS
OpenDayLight
APIC
Neutron Service
plugins
LoadBalancer
Firewall
VPN
HAProxy
IPTables
OpenSwan
• Core + Extension REST APIs
• Message queue for communicating with
neutron agents
• Core and service plugins
• Different vendor core plugins
• Different network technology support
• ML2 plugin with type and mechanism
drivers
• Service plugins with backend drivers
Core API
Network Port Subnet
Resource and Attribute Extension API
ProviderNetwork PortBinding Router Quotas SecurityGroups AgentScheduler LBaaS FWaaS VPNaaS ….
Southbound Interfaces
L3ServicesFutures
Morevendor
drivers
28. 28
EXTENDING OPENSTACK NEUTRON API’S
NEUTRON ROUTER
SECURITY
GROUP
NEUTRON NETWORK
Neutron API Group Policy API
NEUTRON
NETWORK
Port
Port
Tenant Tenant
Use Existing Neutron APIs with APIC and Cisco ACI
Contract
GROUP
SERVICE
CHAIN
GROUP
Group Policy introduces a new API that maps to the
ACI policy model
29. 29
SEPARATING TENANT POLICIES FROM OPERATIONS
2
ACI Admin
(Manages Network
Operations and
Infrastructure)
L/B
EPG
APP
EPG DBF/W
L/B
EPG
WEB
Application Network Profile
Create Application Policy
3
5
ACI
Fabric
Push Policy
APIC
OpenStack
Tenant
(Manages Tenant
and Application
State only)
Instantiate VMs
Web WebWebWeb AppApp4
Create Application Network
Profile
1
DB DB
HYPERVISOR HYPERVISOR HYPERVISOR
NOVANEUTRON
Automatically Push
Network Profiles to
AFC
L/B
EPG
APP
EPG DBF/W
L/B
EPG
WEB
Application Network Profile
Application Policy
Infrastructure Controller
30. 30
OPENSTACK + CISCO’S APPLICATION POLICY CONTROLLER
NEUTRON
ROUTER
SECURITY
GROUP
Web WebWebWeb AppApp DB DB
HYPERVISOR HYPERVISOR HYPERVISOR
NEUTRON
NETWORK
APIC
Web WebWebWeb AppApp DB DB
HYPERVISOR HYPERVISOR HYPERVISOR
Contract Contract Contract
DBAPPWEB
ADC
F/W
ADC
APIC
APIC
Plugin
APIC
Plugin
OVS Plugin
Neutron
Networking
APIC Plugin
Group Policy
Plugin
OVS Plugin
Neutron
Networking
APIC PLUGIN GROUP POLICY PLUGIN