A policy-aware switching layer for data centers

Abstract

Today's data centers deploy a variety of middleboxes (e.g., firewalls, load balancers and SSL offloaders) to protect, manage and improve the performance of the applications and services they run. Unfortunately, existing networks provide limited support for middleboxes. Administrators typically overload layer-2 path selection mechanisms to make sure that traffic traverses the desired sequence of middleboxes. These ad-hoc practices result in a data center network that is hard to configure, upgrade and maintain, wastes middlebox resources on unwanted traffic, and cannot guarantee middlebox traversal under network churn.To address these issues, we propose the policy-aware switching layer, or PLayer. The PLayer separates policies from reachability by allowing administrators to explicitly specify sequences of middleboxes. Middleboxes are connected to policy-aware switches, or pswitches, whose forwarding state is configured by a centralized controller according to the policy requirements. This way, the PLayer addresses the limitations of current middlebox deployments without modifying existing middleboxes or servers. To demonstrate the feasibility of our approach we implemented a prototype of the PLayer using the Click modular software router. Preliminary experimental results suggest that the PLayer is flexible, uses middleboxes efficiently, and ensures the correctness of middlebox traversal under churn.

Network Function Placement for NFV Chaining in Packet/Optical Datacenters

“…Joseph et al [5] propose to use a layer-2 switching layer for policy enforcement. The recent works of Steering [6] and Simple [7] employ the centralized control paradigm in SDN to route traffic to different services.…”

“…We propose to introduce an optical steering domain in addition to the conventional packet domain to steer large aggregate flows through core NFs [4]. Our work is complementary with the packet-based works [5]- [8].…”

Container-based network function virtualization for software-defined networks

“…The first allows the middleboxes to be placed on the shortest path, however it requires infrastructural changes and result in poor flexibility as the policy will be applied to all traffic. The second allows more flexibility as an arbitrary policy chain can be configured through custom routing entries, at the cost of a longer path and overloaded routing tables, making it hard to configure and maintain [16]. In our approach, we reroute traffic to the GLANF Server hosting the relevant network function.…”

Hybrid security architecture for data center networks

“…The most relevant work is the policy-aware switch (pswitch) proposed in [12]. In this design, a number of middleboxes are plugged into a pswitch that is deployed in-path.…”