VPNaaS in Neutron

1. VPNaaS in Neutron Kazunori Takeuchi

2. Quantum -‐> Neutron •  Based on the legal agreement with Quantum Corpora@on, the owner of the “Quantum” trademark. •  “Neutron” was announced on Jun 19. 2

3. History of “Neutron” 3 Essex •  L2 API Folsom •  L3 API •  More L2 plugins Grizzly •  LBaaS •  Scheduler •  etc. Havana •  FWaaS •  VPNaaS •  Modular L2/L3 •  QoS API •  etc. Ryu plugin Meta plugin Sta@c rou@ng for Router Incubated Project Core Project!!!

4. VPNaaS: Use Cases 4 Virtual Private Network OpenStack Tenant VM VM LB LR VM VPN Site VPN Site VPN Site VM VM LB LR VM Access from VPN Sites via VPN Remote Access VPN Types • IPsec-‐VPN • SSL-‐VPN • BGP/MPLS VPN OpenStack Tenant

5. Road to Havana •  Havana-‐2 (2013 Jul 18) – design and implement General VPN API – use IPsec-‐VPN as reference •  Havana-‐3 (2013 Sep 5) – Horizon integra@on – extend VPN types such as BGP/MPLS VPN 5

6. 6 VPNaaS for IPsec-‐VPN (WIP)

7. Peer CIDR Resource Model 7 VPNService id tenant_id vpn_type subnet_id router_id … VPNConnec?on id tenant_id peer_address peer_cidrs psk ikepolicy_id ipsecpolicy_id vpn_service_id … IKEPolicy id tenant_id transform_protocol encapsula@on_mode auth_algorithm encryp@on_algorithm … IPsecPolicy id tenant_id ike_version auth_algorithm encryp@on_algorithm … Router hfps://wiki.openstack.org/wiki/Neutron/VPNaaS Subnet Neutron Router Remote GW Peer Address

8. API and CLI 8 hfps://wiki.openstack.org/wiki/Neutron/VPNaaS e.g.) VPNService API and CLI REST API CLI Create a VPNService POST /v1.0/vpnservices vpn-‐service-‐create Delete a given VPNService DELETE /v1.0/vpnservices/vpnservice_id vpn-‐service-‐delete List all VPNService for a given tenant GET /v1.0/vpnservices/ vpn-‐service-‐list Show detailed informa@on GET /v1.0/vpnservices/vpnservice_id vpn-‐service-‐show Update a given VPNService UPDATE /v1.0/vpnservices/vpnservice_id vpn-‐service-‐update

9. Remote Site Architecture: First POC Driver 9 Neutron IPsecDriver L3 Agent CE (LR) Rou@ng Table RPC Conﬁgure Remote GW Tenant network IPsec Tunnel SPD SAD

10. 10 VPNaaS for BGP/MPLS VPN (Not Started)

11. What’s BGP/MPLS VPN? •  RFC4364 – CE: Customer Edge router – PE: Provider Edge router – P: Provider router – VRF: VPN Rou@ng and Forwarding table – VPN-‐IPv4 Address Family – RD: Route Dis@nguisher – RT: Route Target 11

12. VPN-‐B Site-‐B2 VPN-‐B Site-‐B1 What’s BGP/MPLS VPN? 12 PE P P PE RR CE CE LDP LDP LDP MP-‐iBGP MP-‐iBGP Sta@c BGP RIP OSPF Sta@c BGP RIP OSPF IP packet VPN Label Tunnel Label VRF VRF VRF VRF VRF VRF L2 VPN-‐A Site-‐A1 CE VPN-‐A Site-‐A1 CE

13. VPN-‐B Site-‐B2 VPN-‐B Site-‐B1 What’s BGP/MPLS VPN? 13 PE P P PE CE CE IP packet IP packet #B #X IP packet #B #Y IP packet #B IP packet MPLS Domain (AS) VRF VRF VRF VRF VRF VRF VPN-‐A Site-‐A1 CE VPN-‐A Site-‐A1 CE

14. MPLS Domain Architecture: Design 1 14 Neutron BGPMPLS Driver L3 Agent CE (LR) Rou@ng Table RPC Conﬁgure PE VRF VRF VRF PE controller Conﬁgure Sta@c or dynamic rou@ng Tenant network • PE provisioning: CLI in many cases • Per-‐tenant dynamic rou@ng

15. VPN-‐A Site-‐A2 VPN-‐A Site-‐A1 Inter-‐AS 15 PE ASBR CE CE AS #1 P ASBR PE AS #2 P RR RR MP-‐iBGP MP-‐iBGP MP-‐eBGP VRF VRF VRF MP-‐iBGP MP-‐iBGP VRF VRF VRF IP packet #A IP packet #A #X IP packet #A #Y

16. MPLS Domain Architecture: Design 2 16 Neutron BGPMPLS Driver L3 Agent CE (LR) Rou@ng Table RPC Conﬁgure Tenant network • L3 Agent & LR: simple • Impact to exis@ng BGP/MPLS infra: small VPN Connec@on Controller & Forwarder IP packet #A IP packet VRF VRF VRF MP-‐eBGP ASBR

17. 17 Thank you!!!

VPNaaS in Neutron

Vous êtes en train de lire un aperçu.

Consultez-les par la suite

VPNaaS in Neutron

Plus De Contenu Connexe

Diaporamas pour vous (20)

Les utilisateurs ont également aimé (20)

Similaire à VPNaaS in Neutron (20)

Plus récents (20)