Changes between Initial Version and Version 1 of GENIExperimenter/Tutorials/NSDI13/OpenFlowTutorial/Execute


Ignore:
Timestamp:
03/12/13 09:25:06 (11 years ago)
Author:
nriga@bbn.com
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • GENIExperimenter/Tutorials/NSDI13/OpenFlowTutorial/Execute

    v1 v1  
     1= Configure and Initialize Services: Configure your OpenFlow switch =
     2Although OVS is installed and initialized on the host that is meant to act as a software switch, it has not been configured yet.
     3There are two main things that need to be configured : ''create your software switch with the interfaces as ports'' and ''point the switch to an OpenFlow controller''.
     4
     5In order to configure our switch, we first need to login to the host that will be used as an OpenFlow switch.
     6
     7== Login to OVS host ==
     8{{{
     9#!html
     10<table border="0">
     11      <tr>
     12        <td >
     13        <img border="0" src="http://groups.geni.net/geni/attachment/wiki/GENIExperimenter/Tutorials/OpenflowOVS/Graphics/login-to-ovs.png?format=raw" alt="Login information for a VM"  height="120" title="Login information for a VM" /> </a>
     14       </td>
     15       <td >
     16         <ol>
     17           <li><FONT COLOR="black">Return to the Slice page. Press the <b>Details</b> button in the row of the slice table for <i>Utah ProtoGENI</i>.</font></li>
     18           <li>Click on the ssh link. If you have installed <a target="https://addons.mozilla.org/en-us/firefox/addon/firessh/"> FireSSH </a> a new tab will open up.</li>
     19           <li> In the window that will pop up :
     20                <ul>
     21                  <li> in the password field type in your passphrase</li>
     22                  <li> in the private key, browse to the file that has your private key
     23                   <li>  Press OK </li>
     24                </ul>
     25             </li>
     26             <li> If you don't have FireSSH installed, open a new terminal window. Copy the command to the right of Login into that terminal window. </li>
     27             <li> You are now logged in to the OVS host. </li>
     28         
     29          </ol>
     30       </td>
     31    </tr>
     32 </table>
     33}}}
     34
     35== 1. Create the Software Switch ==
     36Now that you are logged in, we need first to initialize OVS:
     37   * Start the OVS database:
     38      {{{
     39sudo ovsdb-server --remote=punix:/usr/local/var/run/openvswitch/db.sock \
     40                     --remote=db:Open_vSwitch,manager_options \
     41                     --private-key=db:SSL,private_key \
     42                     --certificate=db:SSL,certificate \
     43                     --bootstrap-ca-cert=db:SSL,ca_cert \
     44                     --pidfile --detach
     45}}}
     46   * Initialize OVS:
     47     {{{
     48sudo ovs-vsctl --no-wait init
     49}}}
     50     {{{
     51sudo ovs-vswitchd --pidfile --detach
     52}}}
     53Ignore the warnings you are going to see. Now that OVS is running it is time to create our software switch. The software switch will be a bridge, in which we are going to add all the interfaces we want to be part of the switch.
     54
     55{{{
     56#!html
     57<table border="0">
     58      <tr >
     59       <td width = "500">
     60         <ol>
     61           <li> Create the ethernet bridge
     62              <ul>
     63                 <li><code> sudo ovs-vsctl add-br br0 </code></li>
     64                <li> <code> sudo ovs-vsctl set bridge br0 datapath_type=netdev </code></li>
     65              </ul>
     66     
     67             </li><br/>
     68           <li>List all the interfaces of the node
     69            <ul> <li> <code>ifconfig</code> </ul></li>
     70           </li> <br/>
     71           <li> Be careful <b> not to bring down eth0</b>. This is your control interface, if you bring that interface down you <b> won't be able to login</b> to your host!. For all interfaces other than <code>eth0</code> and <code> l0</code>, remove the IP from the interfaces: <br/>
     72              <ul><li> <code> sudo ifconfig ethX 0 </code> </li></ul>
     73             </li> <br/>
     74             <li> Add all the interfaces you just brought down to your switch (bridge):
     75                <ul><li> <code> sudo  ovs-vsctl add-port br0 ethX </code> </li></ul>
     76             </li>
     77          </ol>
     78       </td>
     79        <td>
     80        <img border="0" src="http://groups.geni.net/geni/attachment/wiki/GENIExperimenter/Tutorials/OpenflowOVS/Graphics/ovs-interfaces.png?format=raw" alt="Login information for a VM"  height="350" title="Login information for a VM" /> </a>
     81       </td>
     82    </tr>
     83 </table>
     84}}}
     85 
     86Congratulations! You have configured your software switch, which three ports, let's see them. Run:
     87{{{
     88sudo ovs-vsctl list-ports br0
     89}}}
     90
     91== 2. Point your switch to a controller ==
     92An OpenFlow switch will not forward any packet, unless instructed by a controller. Basically the forwarding table is empty, until an external controller inserts forwarding rules. The OpenFlow controller communicates with the switch over the control network and it can be anywhere in the Internet as long as it is reachable by the OVS host. For the purpose of this tutorial and in order to minimize the resources we have reserved we are going to run OpenFlow controller at the same host as the OVS switch. This is '''merely''' for convenience reasons, the controller could have been anywhere on the Internet.
     93
     94In order to point our software OpenFlow switch to the controller run:
     95{{{
     96sudo ovs-vsctl set-controller br0 tcp:127.0.0.1:6633
     97}}}
     98
     99=== `standalone` vs `secure` mode ===
     100The OpenFlow controller is responsible for setting up all flows on the switch, which means that when the controller is not running there should be no packet switching at all. Depending on the setup of your network, such a behavior might not be desired. It might be best that when the controller is down, the switch should default back in being a learning layer 2 switch. In other circumstances however this might be undesirable. In OVS this is a tunable parameter, called `fail-safe-mode` which can be set to the following parameters:
     101  * `standalone` [default] : in which case OVS will take responsibility for forwarding the packets if the controller fails
     102  * `secure` : in which case only the controller is responsible for forwarding packets, and if the controller is down all packets are going to be dropped.
     103
     104In OVS when the parameter is not set it falls back to the `standalone` mode. For the purpose of this tutorial we will set the `fail-safe-mode` to `secure`, since we want to be the ones controlling the forwarding. Run:
     105{{{
     106sudo ovs-vsctl set-fail-mode br0 secure
     107}}}
     108
     109= Execute Experiment =
     110Now that our switch is up and running we are ready to start working on our controller. For this tutorial we are going to use the [http://www.noxrepo.org/pox/about-pox/ PoX controller].
     111
     112== Login to your hosts ==
     113{{{
     114#!html
     115<table border="0">
     116      <tr>
     117        <td >
     118        <img border="0" src="http://groups.geni.net/geni/attachment/wiki/GENIExperimenter/Tutorials/OpenflowOVS/Graphics/login-to-hosts.png?format=raw" alt="Login information for a VM"  width="350" title="Login information for a VM" /> </a>
     119       </td>
     120       <td >
     121         <ol>
     122           <li><FONT COLOR="black">Return to the Portal browser tab.</font></li>
     123           <li>Click on the ssh link for each of your hosts.  If you have installed <a target="https://addons.mozilla.org/en-us/firefox/addon/firessh/"> FireSSH </a> a new tab will open up.</li>
     124           <li> In the window that will pop up :
     125                <ul>
     126                  <li> in the password field type in your passphrase</li>
     127                  <li> in the private key, browse to the file that has your private key
     128                   <li>  Press OK </li>
     129                </ul>
     130             </li>
     131             <li> If you don't have FireSSH installed, open a new terminal window. Copy the command to the right of Login for each of your hosts into that terminal window. </li>
     132             <li> You are now logged in to the all your hosts. </li>
     133         
     134          </ol>
     135       </td>
     136    </tr>
     137 </table>
     138}}}
     139
     140All of the hosts are in the `10.10.1.0/24` subnet. From `host1` try pinging `host2`:
     141{{{
     142ping 10.10.1.2
     143}}}
     144
     145This ping should timeout, since there is no controller running.
     146
     147== Use a Learning Switch Controller ==
     148We have installed the PoX controller under `/tmp/pox`. On the terminal of the OVS host run:
     149{{{
     150cd /tmp/pox
     151}}}
     152PoX comes with a set of example modules that you can use out of the box. One of the modules is a learning switch. Let's start the controller:
     153{{{
     154./pox.py --verbose forwarding.l2_learning
     155}}}
     156Go back to the terminal of `host1` and try to ping `host2` again:
     157{{{
     158ping 10.10.1.2
     159}}}
     160Now the ping should work.
     161
     162Go back to your OVS host and take a look at the print outs. You should see that your controller installed flows based on the mac addresses of your packets. Kill your controller by pressing `Ctrl-C`. Notice what will happen to your ping.
     163
     164=== Soft vs Hard Timeouts ===
     165All rules on the switch have two different timeouts:
     166  * '''Soft Timeout''': This determines for how long the flow will remain at the forwarding table of the switch, if there no packets received that match the specific flow. As long as packets from that flow are received the flow remains on the flow table.
     167  * '''Hard Timeout''': This determines the total time that a flow will remain at the forwarding table, independent of whether packets that match the flow are received; i.e. the flow will be removed after the hard timeout expires.
     168
     169Can you tell now why there were packets flowing even after you killed your controller?
     170
     171== Run a port deflection Controller ==
     172In the above example we ran a very simple controller. The power of OpenFlow comes from the fact that you can decide to forward the packet anyway you want based on the supported OpenFlow actions.
     173
     174== Run a server deflection Controller ==