Changes between Version 5 and Version 6 of GENIExperimenter/Tutorials/OpenFlowNFVFirewall


Ignore:
Timestamp:
11/20/15 14:19:31 (6 years ago)
Author:
nriga@bbn.com
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • GENIExperimenter/Tutorials/OpenFlowNFVFirewall

    v5 v6  
    1111<h3 align="left"> <u>Overview: </u> </h3>
    1212In this tutorial you will learn <b> how to build a Firewall for a network using OpenFlow. We will use the following network topology for this experiment. You will also learn how to <b> take advantage of kernel L3 routing while using OVS </b>. 
    13 <img border="0" src="http://www.gpolab.bbn.com/experiment-support/NFVApps/GENI-NFV-NAT.png" alt="route topology"  align="center" width="350" title="nat topology" />
     13<img border="0" src="http://groups.geni.net/geni/raw-attachment/wiki/GENIExperimenter/Tutorials/OpenFlowNetworkDevices/Firewall/Firewall-2.png" alt="firewall topology"  align="center" width="350" title="firewall topology" />
    1414
    1515</td>
     
    9494                <td >
    9595                 <ol type="a">
    96             <li>Log into <tt>switch</tt> and run the following commands to download and run the firewall controller:
    97 <pre>
    98 sudo apt-get install python-pip python-dev libxml2-dev libxslt-dev zlib1g-dev
    99 sudo pip install oslo.config
    100 </pre>
    101 </li>
     96 
    10297<li>
    10398Run a simple learning switch controller:
     
    187182
    188183
    189 For this experiment we will run an !OpenFlow Firewall. 
    190 
    191 [[Image(http://groups.geni.net/geni/raw-attachment/wiki/GENIExperimenter/Tutorials/OpenFlowNetworkDevices/Firewall/Firewall-2.png, 50%, nolink)]]
    192 
    193 {{{
    194 #!html
    195 
    196 
    197 
    198 
    199             <table border="0">
    200               <tr>
    201                 <td >
    202                  <ol type="a">
    203             <li>Log into <tt>switch</tt> and run the following commands to download and run the firewall controller:
    204 <pre>
    205 sudo apt-get install python-pip python-dev libxml2-dev libxslt-dev zlib1g-dev
    206 sudo pip install oslo.config
    207 </pre>
    208 </li>
    209 <li>
    210 Run a simple learning switch controller:
    211 <pre>
    212 cd /tmp/ryu
    213 ./bin/ryu-manager --verbose ryu/app/simple_switch.py
    214 </pre>
    215 </li>
    216 <li> Verify simple connectivity by logging into <tt>right</tt> ping <tt>left</tt>
    217 <pre>
    218 ping left
    219 </pre>
    220 Notice the printouts of the ryu simple switch controller.
    221 </li>
    222 <li>
    223    Stop your controller by Ctrl-c and remove all your flows
    224 <pre>
    225 sudo ovs-ofctl del-flows br0
    226 </pre>
    227 <li> Make your switch into a firewall by downloading and running the appropriate Ryu controller:
    228 <pre>
    229 wget http://www.gpolab.bbn.com/exp/OpenFlowExampleExperiment/ryu/gpo-ryu-firewall.tar.gz
    230 tar xvfz gpo-ryu-firewall.tar.gz
    231 cd gpo-ryu-firewall/
    232 /tmp/ryu/bin/ryu-manager simple_firewall.py
    233 </pre>
    234 <b> WARNING </b> If at some point your controller prints an error, kill it (ctrc-c) and start it again.
    235  </li>
    236             <li>Log into <tt>right</tt> and run a <tt>nc</tt> server:
    237 <pre>
    238 nc -l 5001
    239 </pre>
    240 </li>
    241             <li>Log into <tt>left</tt> and run a <tt>nc</tt> client:
    242 <pre>
    243 nc 10.10.11.1 5001
    244 </pre></li>
    245             <li>Type some text in <tt>left</tt> and it should appear in <tt>right</tt> and vise versa.</li>
    246             <li>In the terminal for <tt>switch</tt> you should see messages about the flow being passed or not:
    247 <pre>
    248 Extracted rule {'sport': '57430', 'dport': '5001', 'sip': '10.10.10.1', 'dip': '10.10.11.1'}
    249 Allow Connection rule {'dport': '5001', 'dip': '10.10.11.1', 'sip': '10.10.10.1', 'sport': 'any'}
    250 </pre>
    251 </li>
    252             <li><tt>CTRL-C</tt> to kill <tt>nc</tt> in each terminal. </li>
    253             <li>Run a <tt>nc</tt> server on port 5002, then 5003.
    254        <ul>
    255          <li> Compare the observed behavior to the contents of <tt>~/gpo-ryu-firewall/fw.conf</tt>.  <i>Does the behavior match the configuration file?</i>
    256          <li> Stop the Firewall controller and run a simple switch controller. Is there any traffic being blocked now? Don't forget to delete the flows after you stop the controller</li>
    257          <li>  Feel free to modify the configuration file to allow more traffic.</li>
    258       </ul>
    259 
    260            </ol>
    261 }}}
    262 
    263 = [.. Return to the main page] =