Network Virtualization - An Overview: Kilian Rausch
Network Virtualization - An Overview: Kilian Rausch
Kilian Rausch
Email: [email protected]
ABSTRACT
This paper introduces the basic approach of Network Virtualization, as well as Xen and OpenFlow as two opportunities to realize this approach. A virtual network is an
autonomous, fully isolated network above an existing physical infrastructure. The goal of virtual networks is to run
side-by-side to productive networks without aecting them
and consequently to enable new network innovations to be
tested safely. Xen is a hypervisor running directly on the
hardware and able to host a large number of guest systems.
This paper presents the qualifications of Xen to act as a virtual router platform. OpenFlow itself is an open standard
for network devices to enable the easy deployment of experimental networks over an existing infrastructure. The related
FlowVisor project expands OpenFlow by the opportunity
to create and administrate fully isolated virtual networks.
These two approaches were chosen among others because of
their advanced progress and relevancy to practice.
Keywords
Network Virtualization, Router Virtualization, Software Designed Networking, Virtual Networks, Xen, OpenFlow, FlowVisor
1.
INTRODUCTION
In the past years a high interest in reconsidering the existing network and Internet architecture came up. Some even
describe the todays Internet architecture as ossified [10].
This movement was mainly carried by researchers, wanting
to experiment with new network innovations. But building
a realistic network environment for experimental purposes
would require enormous investments. Therefore the success
of new protocols and network architectures depends the possibility to run and test them coexistent, but isolated to existing network infrastructures. So they can not aect the
productive networks, but can be tested in detail under real
conditions. Productive networks are networks, which reliably carry out the everyday load. Network Virtualization
is an efficient way to overcome this obstacle and to pave
the way for new network ideas and developments. Network
Virtualization is generally achieved through running an additional software on the network devices.
Besides the named above, Network Virtualization oers other
various benefits. For example it allows the network operators to save a fix state of the network (In this paper we will
describe this operation with the term Checkpoint Saving).
This works like saving an image of a virtual operating system
(OS) and could be very useful before changes are deployed.
87
2.
Virtualization in general is a method to concentrate or divide resources of a computer. It abstracts from the physical
hardware, but gives the user the impression of interacting directly with it through the allocation of hardware resources.
Besides the rapid development of virtualization of operating
systems, researchers began to pay more attention to the virtualization of routers. This means running several virtual
routers on the same machine as the basis of administrating
multiple networks. Every router then belongs to a dedicated
network, giving the full administrative power. The approach
of Network Virtualization itself is not really new, as we already know Virtual Private Networks (VPNs) as solution
for connecting dierent networks. The dierence between
VPNs and Virtual Networks (VNs) is illustrated in [1, page
2] as follows:
Although VPNs provide a virtualized channel above a physical network infrastructure, they have a few disadvantages
in comparison with Virtual Networks. So all virtual networks have to be based on the same protocols, topology and
doi: 10.2313/NET-2011-07-2_12
addressing schemes. This mainly penalizes the reasearchers, wanting to deploy many dierent kinds of experimental
networks. Another big issue is the missing isolation of the
VPNs. While a few workarounds exist to deal with that
problem, even these solutions provide no real isolation. Furthermore the infrastructure provider and the VPN service
provider are normally the same entities. This disadvantage
is among other things caused by the missing resource isolation. So multiple providers can not be sure, that another one
is not aecting his network (for example by stressing the infrastructure). But the most important advantage of Virtual
Networks over VPNs is the true isolation of the dierent Virtual Networks [1, page 2]. This mainly targets on hiding of
network infrastructure specifications and even the existence
of another administrative domain. But of course, we must
consider the dierent use cases of VPNs and VNs. VPNs
are often used to safely connect two networks or to establish a single connection remotely, for example to and within
company networks. On the other hand a Virtual Network
is used when researchers want to deploy a complete network
over an existing one to test it under real conditions. So the
Virtual Network provides the feature to be programmed individually with experimental protocols, address schemes et
cetera.
3.1
In a traditional Virtual Machine Monitor (VMM) the hardware is emulated [5]. In contrast to this technique Xen uses
paravirtualization to host a guest OS. This means a software interface is provided for the hardware; similar, but not
equal to the hardware (no hardware emulation). As a consequence of that some slight modifications of the OS are
indispensable. But the relative low costs to port an OS to
Xen are worth to invest. This results in a system, which is
nearly as efficient as a native system [13]. Figure 2 shows
the eorts, measured in lines of codes (LOC), of porting a
convenient OS to Xen.
3.
XEN
In this Section Xen and an approach to use its virtualization technology to build and operate a virtual network is
introduced. Xen is a hypervisor on x86 base which allows
multiple operating systems to run on the same hardware.
It is widely known as virtualization platform for operating
systems. Xen is operating directly on the hardware and is
able to host dierent OSs in the so called domains at the
same time. The primary intention was to keep the performance overhead as small as possible to simultaneously host
up to 100 Virtual Machines [3, page 1] and to isolate the
domains safely. In the following we will introduce how the
virtualization capabilities of Xen can be used to host virtual
88
doi: 10.2313/NET-2011-07-2_12
one virtual machines performance can not impact the performance of another one (what of course is a desirable goal).
But as in [4, page 19] mentioned, this works only under
certain conditions. We will treat this especially for virtual
router purposes in detail in the Section Evaluation and Performance.
3.2
3.2.1
Memory Management
3.2.2
CPU Management
treats the capability of Xen to be used as a system for driving virtual routers. Multiple logically independent software
routers are hosted on one single hardware. Each of them is
responsible for his own isolated Virtual Network. The following statements and evaluations are based on [6] and [2].
Enabled by by powerful hardware and virtualization support, Xens guest domains (called domU) can be equipped
with virtual routers.
3.2.3
3.3
89
doi: 10.2313/NET-2011-07-2_12
these conditions are taken into account, Xen is suited for the
application as a virtual router platform.
4.
Figure 4: structure of an OpenFlow switch, showing the OpenFlow Software running above the hardware, modifying the FlowTable and communicating
with the Controller [10]
The data path is still a task of the switch hardware, based
on the flow table (provided by the OpenFlow controller).
Here OpenFlow provides an interface to modify the flow tables of commercial router or switch products, exploiting the
fact of many identical functions in the dierent products.
As a result the experimental network traffic can be segregated from production traffic. All in all this enables similar
benefits to the introduced solution with Xen (experiment
with new routing protocols, addressing schemes and even IP
alternatives [10]). The control instance saves a kind of forwarding rules as flow entries in the flowtable, each containing how to handle specific packets. A normal procedure in
an OpenFlow-based hardware is to forward packets, when
a flow entry already exists. The OpenFlow Software then
knows how to forward the packet to which port. Another
case is, that the arriving packet is unknown. Then OpenFlow sends the packet to the Controller via the encrypted
OpenFlow Protocol. The Controller then decides, whether
to create a new entry in the flow tables and to send it back
to the switch, or to drop the packet.
So in an example configuration with many switches and
routers, when a flow is defined at the control unit a new
protocol comes into operation and automatically creates a
new route for the packets by entering automatically all relevant FlowEntries in each switch. This is called a flow.
The OpenFlow standard [10] is another possibility to enhance the possibilities of given networks. This open standard runs as an AddOn on Ethernet switches and routers
and primarily separates the data path from the control path.
The network is programmable and allows administrators to
individually control and channel their data. Therefore only
one single control unit is needed to administrate multiple
routers and switches. This communication is carried out
via a special OpenFlow Protocol, which has the benefit of
beeing independent from hardware vendors. At the moment
major device vendors are implementing OpenFlow in their
hardware. OpenFlow is already be seen as a network virtualization technology by some members of the ONF, because
it provides similar benefits. But this depends on the definition and point of view, of course. But to clarify: no multiple
virtual router instances are running on the devices, like in
Xen. To achieve real Network Virtualization FlowVisor is
used [Section 4.2].
4.1
90
doi: 10.2313/NET-2011-07-2_12
4.2
One step ahead goes FlowVisor, a special purpose OpenFlow controller that acts as a transparent proxy between
OpenFlow switches and multiple OpenFlow controllers [11].
So in a FlowVisor application field, when a packet arrives
at an OpenFlow Switch, it is routed by the FlowVisor to
the belonging Controller and reverse forwards the packets
back to the switches. This is performed in an isolated way
by assuring, that no resources, like the FlowTables can affect each other. So FlowVisor supplements OpenFlow by
adding real virtualization possibilities. FlowVisor provides
virtualization of switches to build a divided, fully isolated
and autonomous network above the physical structure. Every network is logically independent and runs in addition to
a productive network on the same hardware. In [12] these
virtual networks are called slices. FlowVisor regards a slice
as any combination of switch ports and layer 2, 3 and 4 of
the OSI-model [14]. Of course, FlowVisor follows the virtual
network approach and supports its advantages, like resource
allocation or Checkpoint Saving [Section 1].
4.2.1
Figure 5: FlowVisor layer comparison to Xen and
abstract virtualization - Flow Visor is located betweeen the OpenFlow Switch Software and the Controllers above. Open Roads, PlugN and Open Pipes
are examples of virtual network controllers [12]
The layer location of FlowVisor in Figure 5 shows, that
it is comparable to other virtualization technologies and of
course to Xen, we treated before. Flow Visor is located between the OpenFlow Switch(forwarding path) Software and
the Controllers (control path) above. Open Roads, PlugN
and Open Pipes are examples of virtual network controllers
[12]. To the controllers FlowVisor appears as a set of OpenFlow Switches and to the OpenFlow Switches it appears as
a set of Controllers. FlowVisor itself hosts multiple OpenFlow guest controllers, as shown in Figure 6, one for each
Since isolation is one of the critical issues in Network Virtualization, this Section treats the isolation capabilities of
FlowVisor. Bandwidth Isolation is only provided with the
instruments of VLANs. Each packet has a VLAN Priority
Code Point field, where an entry assigns a packet to a certain priority level. Combined with the traffic class in the
Resource Allocation Policy this enables a kind of bandwith
allocation. But the big disadvantage is, that the exact specifications of a traffic class must be manually implemented in
each switch. This shows, that in this field future research has
to be done to make this issue more practicable. Topology Isolation means, that FlowVisor transmits only information of
the belonging switches to each of its virtual guest controllers
inside. So each virtual network, or each guest controller gets
only information about his own network. Due to the fact
most switch hardware has low-performance CPUs, the risk
of a breakdown of the OpenFlow Software is very high on an
overload. FlowVisor does not support CPU Isolation at the
91
doi: 10.2313/NET-2011-07-2_12
[3]
[4]
4.2.2
Performance
[5]
[6]
[7]
[8]
5.
CONCLUSION
[9]
Our goal was to give an overview over Network Virtualization and to highlight the ability of Xen and OpenFlow/
FlowVisor to realize this approach. So all-in-all the topic
of Network Virtualization is still an experimental field. But
recent developments show, that the industry is interested in
deploying this technique in praxis [Section 1]. What solution has the best chances to become successfully deployed
in large scale networks, depends on many factors and can
not be clearly identified. Here future research is needed.
So Xen provides a relative stable technology yet, while the
quite young OpenFlow Project now receives great support
by the ONF. But a disadvantage of FlowVisor is, that at this
time the software itself is not stable enough to be transferred
into production. Given the quite big performance overhead
of the flow messages, we can summarize, that a lot of work
has to be done in future. With the given constraints, Xen
can even nowadays provide a functional platform for virtual
routers and networks. Due to the increasing interest in programmable, virtual networks, this is going to be a subject
of interest in the future. Especially science will benefit from
this demand in research.
6.
[10]
[11]
[12]
[13]
REFERENCES
[14]
92
doi: 10.2313/NET-2011-07-2_12