1) SDN is a critical component of PayPal's Software Defined Data Center (SDDC) initiative to orchestrate compute, storage, and networking resources. 2) SDN uses OpenFlow to separate the network control plane from the forwarding plane, enabling a logically centralized control of software switches on hypervisors. 3) This allows PayPal to gain agility, enable multi-tenancy across physical and overlay networks, and provide distributed firewall and security group services to tenants in an automated manner.

1. SDN AND OPENFLOW
IMPLICATIONS AND PERSPECTIVES
Vinay Bannai
SDN Architect, PayPal (eBay Inc. company)
Oct 22, 2013

2. SDN DEFINITION
 ONF definition
 Separation of Control Plane and Forwarding Plane
 Logically centralized Control Plane
 Abstractions and Programmatic Interface to the Applications
 SDN at PayPal
 SDN is part of our larger effort to implement SDDC (Software Defined Data Center) and is
a critical component
 SDDC : Orchestration of compute, storage and network
 Part of our new network architecture

3. unity*
efforts*
* SOFTWARE
DEFINED DATA CENTER
Proprietary
Vendor Solution
*
industry*
efforts*
orts*
*
rights* 2013*
reserved.*
pyright*
Alcatel4Lucent.* rights*
All*
reserved.*
ONS* FOR* A*
HAVING* NEED* KNOW* HAVING* NEED* KNOW*
TO* PERSONS*
*
SOLELY*
AUTHORIZED*
A*
TO*
*
MPANY* USE*
ETARY* INSTRUCTION* TO*
–* PURSUANT* COMPANY*
INSTRUCTION*
Networking
Object Storage
Compute
Block Storage

4. WHY NEW NETWORK ARCHITECTURE IS
NEEDED?
 Stranded Compute Capacity
 Compute virtualization has been the key driver
 Use Compute capacity wherever available irrespective of network zones and boundaries
 Multi Tenancy
 Different Cloud Clients with varying service and security requirements
 Tenant isolation
 Rigid Network Topologies
 Design networks according to application needs instead of other way around
 Automate Everything
 Cloud Orchestration

5. USE CASES DRIVING SDN AT PAYPAL
 Production
 LTS deployment
 Flex-up
 Flex-down
 Multi-tenancy

6. LIVE TO SITE – HOW IT IS DONE
Design
Networking
LB Tickets
Collaborate
& Review
Storage
FW
Tickets
Code
Capacity
Misc
Tickets
CI&CD
Release
Live to
Site
6

7. LTS – WHAT WE LIKE TO SEE
Code
Build/Test
Deploy

8. FLEX UP AND FLEX DOWN BURSTING
Provisioning IaaS
Server
IaaS
Application
Demand *
Demand
Automated
Allocate
Cache
Automated
provision per
application
PaaS
Automated
Add to LB
0 hours
Partial
Automated
F/W config
Roll code
Application
Demand *
Demand
LTM Disable
3-24 hrs
Live in
Function
15 min
0 hours
PaaS
Automated
Light Server
IaaS
Validate Capacity
(3-24 hrs)
Delete VM’s
0 hours
Allocate to
cache
15 min
8

9. MULTI-TENANCY
Tenant B
App Svr
App Svr
OS
OS
VM
VM
Tenant C
Router
App Svr
App Svr
Tenant A
App Svr
App Svr
OS
OS
OS
OS
VM
VM
VM
VM
App Svr
App Svr
OS
OS
VM
VM
Network Virtualization
Physical Network

10. OPENFLOW BASICS
SDN
App
SDN
App
SDN
App
OpenFlow Control Layer
OpenFlow

11. OPENFLOW BASICS

12. SERVICE NEEDS OF A TENANT IN A DATA CENTER
 Compute and Storage
 Network separation/isolation
 Overlay networks (VXLAN, NVGRE, STT etc)
 Provider networks (VLANs)
 Three tier architecture
 Logical switches and routers for the VM’s
 Perimeter Firewalls and Security Groups
 Load Balancers
 etc

13. DATACENTER ARCHITECTURE
Internet
Core
Data Center
Layer-3 router
Bisection BW
Aggregation
Layer-3 switch
Bisection BW
Access
Layer-3 switch
Bisection BW
Racks

14. DATACENTER ARCHITECTURE
WITH OPENFLOW VSWITCHES
Internet
Data Center
Layer-3 router
Core
Bisection BW
Aggregation
Layer-3 switch
Bisection BW
Layer-3 switch
Access
Bisection BW
Edge
Layer
VM
OF switches
VM
VM
VM
VM
VM
VM
VM
VM
VM

15. DATACENTER ARCHITECTURE
WITH OPENFLOW VSWITCHES
Data Center
Layer-3 switch
Access
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
Racks
Racks
Racks

16. Multi-Tenancy with
Overlay Network
Service API
SDN Controller
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM

17. Distributed Firewall
& SG
Firewall As A Service
SDN Controller
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM

18. IMPORTANT IMPLICATIONS
 Challenges due to organization structure
 System Admins (manage compute infrastructure)
 Network Admins (manage network infrastructure)
 OF enabled Software Switches now reside in a computer server
 There are lots of them!!
 Networking Device sitting in a device controlled by IT admins
 Different approaches to SDN’s
 Pure Software play
 Pure Hardware play
 Hybrid Play

19. Data Center
Physical Network
Service API
SDN Controller
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM

20. SUMMARY
• SDN is a component of our SDDC
• SDN is mostly pure software, but will move to Hybrid mode
• Enables agility, cuts cycle time
• OF soft switches reside in the hypervisors
• OF soft switches outnumber physical switches 50 to 1
• OF soft switches operate at the edge of the network
• Enable multi-tenancy with overlay and physical networks
• Enable distributed firewalls and security groups
20
Confidential and Proprietary

21. THANK YOU
Vinay Bannai, vbannai@paypal.com