A Central Network Controller for Industrial
Automation – What Does It Mean for ODVATechnologies
Paul DidierCisco

SW-Defined Network and Centralized Network Control•

Why Centralized Control for the Network– Automated– Assurance– Security & Segmentation•

What is an SDN?
––––•

Underlay and Overlay
SDN architecture and roles
Virtual networking concepts: Control, Data and Policy “planes”
Segmentation and Zones & Conduits

What does this mean for ODVA-based technologies?
– EIP’s IP focus means native integration– Dynamic movement of workloads– APIs to coordinate network and IACS into a SW-Defined Factory

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

2

Why a Centralized Controller & SW-DefinedNetworking

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

3Benefits of SDN
Enhance Security and Compliance

Deliver consistent Experience

Boost operational effectivenessGain network insights

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

4

SDN - Interesting features for Industrial Networks
Key advantages for IACS:• Stretching VLANs to enable asset virtualization: Engineering workstations,
HMIs and PLCs
• Limit Spanning Tree impacts• Easily deploy Zones and Conduits model

Challenges:• Precision Time requires consistent paths• Resiliency – recovery from link/switch failures not the same range as the L2
protocols

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

5

Software Defined Network – key functions
Central Network Controller

PolicyAutomation

One AutomatedNetwork FabricSingle fabric for Wired and Wirelesswith full automation

Assurance

OutsideBBIdentity-Based
Policy and Segmentation

CPolicy definition decoupledfrom VLAN and IP address

EE

SD-Access
Extension

EEE

E

Client Mobility

AI-Driven
Insights and Telemetry
Analytics and visibility into
User and Application experience

Policy follows User

Technical Track
IoT Network© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
Employee Network
All rights reserved.

www.odva.org

6

What is a SW-Defined Network

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

7

SW-Defined Network: Virtualizing HW from Network
Overlay Control Plane

Overlay Network

Encapsulation

Edge Device

Edge Device

Hosts(End-Points)

Underlay Network
Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

Underlay Control Plane
www.odva.org

8

SW-Defined Network: Roles & Terminology
Security Policy
ManagerPolicy Center

Centralized Control Center

Automation

Assurance/
Monitoring
IP

Border Nodes
B

Wireless
Controllers
B

Intermediate
Nodes (Underlay)▪ Automation – Simple GUI and APIs for automateddeployment, configuration and management ofwired and wireless devices▪ Assurance – Data Collectors analyze Endpoint toApplication flows and monitor network/end device status▪ Security Policy Manager – Network Access Control& ID Services for dynamic Endpoint to Group
mapping and Policy definition▪ Control-Plane Nodes – Map System that manages

CControl-PlaneNodes

Endpoint to Device relationships▪ Border Nodes – A fabric device(e.g. Core) that connects External L3 network(s) tothe fabric

SDN FabricEdge Nodes▪ Edge Nodes – A fabric device

WirelessAccess Points(e.g. Access or Distribution) that connects WiredEndpoints to the fabric▪ Wireless Controller – A fabric device (WLC) thatconnects Fabric APs andWireless Endpoints to the fabricTechnical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

9SDN – Control Plane Nodes
Control-Plane Node runs a Host Tracking Database to map location information•A simple Host Database that maps Endpoint IDs to a
current Location, along with other attributes•

Host Database supports multiple types of Endpoint ID
lookup types (IPv4, IPv6 or MAC)

•Receives Endpoint ID map registrations from Edge and/orBorder Nodes for “known” IP prefixes•Resolves lookup requests from Edge and/or Border Nodes,
to locate destination Endpoint IDs

IP to RLOC

MAC to RLOC

Address Resolution

1.2.3.4 → FE1

AA:BB:CC:DD → FE1

1.2.3.4 → AA:BB:CC:DD

CB

B

FE1
IP - 1.2.3.4/32
MAC – AA:BB:CC:DD

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

10

SDN – Edge Nodes
Edge Node provides first-hop services for Users / Devices connected to a Fabric•

Responsible for Identifying and Authenticating Endpoints(e.g. Static, 802.1X, Active Directory)

IP to RLOC

MAC to RLOC

Address Resolution

1.2.3.4 → FE1

AA:BB:CC:DD → FE1

1.2.3.4 → AA:BB:CC:DD

CUnknown
NetworksKnown
Networks•

Register specific Endpoint ID info (e.g. /32 or /128) with theControl-Plane Node(s)•Provide an Anycast L3 Gateway for the connected
Endpoints (same IP address on all Edge nodes)•Performs encapsulation / de-encapsulation of data traffic
to and from all connected Endpoints

BB

FE1
IP - 1.2.3.4/32
MAC – AA:BB:CC:DD

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

11

SDN Key Components
1.

Control-Plane based on LISP or BGP-EVPN

2.

Data-Plane based on VXLAN

3.

Policy-Plane based on VRFs and SGTs

4.

Management-Plane
Key DifferencesBBC• L2 + L3 Overlay -vs- L2 or L3 Only
• Host Mobility with Anycast Gateway• Adds VRF + SGT into Data-Plane• Virtual Tunnel Endpoints (Automatic)• NO Topology Limitations (Basic IP)

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

12

Why LISP?
Pull Model• No massive routing tables• “DNS” for routing

Wired and Wireless unification• WLC participates in LISP control planecommunication• Conversational learning• Wired and Wireless endpoints have policy

applied at same point in the network

Scalability• Purpose built for scale

Address-Family support• IPv4, IPv6 and MAC address family

Technical Track© 2023 ODVA, Inc.

Host Mobility• Native support for this capability• Wired and Wireless2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

13

SDN Key Components – LISP
(Locator/ID Separation Protocol)
HostMobility

Control-Plane based on LISP
Routing Protocols = Big Tables & More CPU
with Local L3 Gateway

LISP DB + Cache = Small Tables & Less CPU
with Anycast L3 Gateway

BEFOREAFTER

IP Address = Location + Identity

PrefixNext-hop

189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128…......171.68.226.120….....171.68.226.121….....171.68.226.120…....171.68.228.121…....171.68.226.120….....171.68.226.121…......171.68.226.120….....171.68.228.121…....171.68.226.120….....171.68.226.121…......171.68.226.120….....171.68.228.121….....171.68.226.120…......171.68.226.121….....171.68.226.120….....171.68.228.121

Topology + Endpoint Routes
Technical Track© 2023 ODVA, Inc.

Separate Identity from Location
PrefixNext-hop

189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128….....171.68.226.120….....171.68.226.121….....171.68.226.120…....171.68.228.121…....171.68.226.120….....171.68.226.121…......171.68.226.120….....171.68.228.121…....171.68.226.120….....171.68.226.121…......171.68.226.120…......171.68.228.121….....171.68.226.120…......171.68.226.121….....171.68.226.120….....171.68.228.121

PrefixNext-hop

189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128….....171.68.226.120….....171.68.226.121….....171.68.226.120…....171.68.228.121…....171.68.226.120….....171.68.226.121…......171.68.226.120….....171.68.228.121…....171.68.226.120….....171.68.226.121…......171.68.226.120….....171.68.228.121….....171.68.226.120…......171.68.226.121….....171.68.226.120….....171.68.228.121

Endpoint
Routes areConsolidated
to LISP DB

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

PrefixNext-hop

189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128….....171.68.226.120….....171.68.226.121….....171.68.226.120…....171.68.228.121

PrefixNext-hop

189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128….....171.68.226.120….....171.68.226.121….....171.68.226.120…....171.68.228.121

Only Local Routes
www.odva.org

Prefix

RLOC

192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128
192.58.28.128
189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128….....171.68.228.121….....171.68.226.120….....171.68.226.121….....171.68.226.120….....171.68.228.121….....171.68.228.121….....171.68.226.120….....171.68.226.121….....171.68.226.120….....171.68.228.121

PrefixNext-hop

189.16.17.89
22.78.190.64
172.16.19.90
192.58.28.128….....171.68.226.120….....171.68.226.121….....171.68.226.120…....171.68.228.121

MappingDatabase

Topology Routes
Endpoint Routes

14

LISP Operations
Control-Plane Roles & Responsibilities

LISP Map Server / Resolver

Control-Plane

a.a.a.0/24
b.b.b.0/24
c.c.c.0/24
d.d.0.0/16(Control-Plane)•

EID to RLOC mappings•

Can be distributed acrossmultiple LISP devices

Edge

Non-LISP

Register EID with Map Server•

Ingress / Egress (ITR / ETR)

•Ingress / Egress (PITR / PETR)

RLOC

a.a.a.0/24
b.b.b.0/24
c.c.c.0/24
d.d.0.0/16

w.x.y.1
x.y.w.2
z.q.r.5
z.q.r.5

EID

RLOC

a.a.a.0/24
b.b.b.0/24
c.c.c.0/24
d.d.0.0/16

w.x.y.1
x.y.w.2
z.q.r.5
z.q.r.5

RLOC Space

Edge(External Border)

Provides a Default Gateway
when no mapping exists

EID

e.f.g.he.f.g.he.f.g.he.f.g.hBorderLISP Proxy Tunnel Router - PXTR•

w.x.y.1
x.y.w.2
z.q.r.5
z.q.r.5

Prefix Next-hop
w.x.y.1
x.y.w.2
z.q.r.5
z.q.r.5(Edge & Internal Border)•RLOC

EID SpaceLISP Tunnel Router - XTR

Technical Track© 2023 ODVA, Inc.

EID••

EID = Endpoint Identifier• Host Address or Subnet
RLOC = Routing Locator• Local Router Address

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

EID Space

15

LISP Operations
Control Plane Register & Resolution

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

16

LISP Operations
Fabric Internal Forwarding (Edge to Edge)3

EID-prefix: 10.2.2.2/32

Mapping
Entry
1

DNS Entry:
D.abc.com A 10.2.2.2Path Preference Controlled
by Destination Site

Locator-set:
2.1.2.1, priority: 1, weight:100
Non-FabricBranch

Non-Fabric10.1.0.0/24
Fabric Borders

Fabric EdgeSource2
1.1.1.1

10.1.0.1 → 10.2.2.2

5.3.3.3
5.1.1.1

IP Network4
1.1.1.1 → 2.1.2.1
10.1.0.1 → 10.2.2.2

5.2.2.2
Mapping
System2.1.1.1

2.1.2.1

3.1.1.1

3.1.2.1

10.2.2.4/16

10.2.2.5/16

Fabric Edges

5
10.1.0.1 → 10.2.2.2

Destination
10.2.2.3/16

10.2.2.2/16

Subnet 10.2.0.0 255.255.0.0 stretched acrossTechnical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

17

SDN Key Components – VXLAN

1. Control-Plane based on LISP

2. Data-Plane based on VXLANETHERNETIP

PAYLOADORIGINAL PACKETSupports L3
Overlay OnlyETHERNET

IP

UDP

LISP

IP

PAYLOADPACKET IN
LISP

Supports L2& L3 Overlay
ETHERNETTechnical Track© 2023 ODVA, Inc.

IP

UDP

VXLAN

ETHERNETIP

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

PAYLOAD

www.odva.org

PACKET IN VXLAN

18

What is VxLAN

VxLAN – Virtual eXtensible Local
Area Network is an extension ofVLANs created for cloud
applications

Technical Track© 2023 ODVA, Inc.

• Standards based Encapsulation IETF RFC7348• Uses UDP-Encapsulation• Transport Independent• Layer-3 Transport (Underlay)• Flexible Namespace• More VLANs - 24-bit field (VNID)
provides ~16M unique identifier• Allows Segmentations• Limits the impact of STP• Adds2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

19

VXLAN Overview

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

20

Key Components – Group Based Policy

1.

Control-Plane based on LISP

2.

Data-Plane based on VXLAN

3.

Policy-Plane based on VRF and SGT
Virtual Routing & Forwarding
Scalable Group Tagging

VRF + SGTETHERNETTechnical Track© 2023 ODVA, Inc.

IP

UDP

VXLAN

ETHERNETIP

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

PAYLOAD

www.odva.org

21

SDN Policy
Two Level Hierarchy – Macro & Micro Segmentation
FabricVirtual Network (VN)First-level Segmentation ensures zerocommunication between forwarding domains.
Ability to consolidate multiple networks into one
management plane.

FabricScalable Group (SG)Second-level Segmentation ensures role-based access control
between groups in a VN. Ability to segment the network intolines of business or functional blocks. Also know as Cisco
TrustSec (CTS)
IETF equivalent: https://datatracker.ietf.org/doc/html/draft-smith-kandula-sxp-10

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

22SDN – Macro segmentation
Virtual Network maintains a separate Routing & Switching table for each instance•Control-Plane uses Instance ID to maintain separate VRF(Virtual Routing and Forwarding) topologies (“Default” VRFis Instance ID “4098”)

CUnknown
NetworksKnown
Networks•

Nodes add a VNID to the Fabric encapsulation

B•

Endpoint ID prefixes (Host Pools) are routed and advertised
within a Virtual NetworkVN•

Campus

B

VN
IOT

VN
Guest

Uses standard “vrf definition” configuration, along with RD &RT for remote advertisement (Border Node)

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

23

SDN – Micro segmentation
Scalable Group is a logical policy object to “group” Users and/or Devices•

Nodes use “Scalable Groups” to ID and assign a unique
Scalable Group Tag (SGT) to Endpoints•

Nodes add a SGT to the Fabric encapsulation•

SGTs are used to manage address-independent “GroupBased Policies”•

Edge or Border Nodes use SGT to enforce local Scalable
Group ACLs (SGACLs)

C
Unknown
Networks

Known
Networks

B

B
SGT
17

SGT
3SGT
23

SGT
4
SGT
11

SGT
19

SGT
25

SGT
8
SGT
12

IETF equivalent: https://datatracker.ietf.org/doc/html/draft-smith-kandula-sxp-10

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

24

SDN - Access Control Policies
Source Group

Contract

Destination Group

Guest Users

Web Server

SDN FabricCentral Network Controller
CLASSIFIER: PORTACTION: DENYClassifier Type

Action TypePort Number

PermitProtocol Name

Deny

Application TypeCopy

All groups in a Policy must belong to the same Virtual Network
Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org25

What Does it Mean for ODVA Technologies?

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

26

SDN and ODVA•EIP based on IP means EIP is ready to be transported natively over SDN
networks– CIP Sync/Motion - PTP over SDNs needs to be tested and validated•••

DetNet (Layer 3 TSN) uses VXLAN
Virtualize assets that communicate via EIP
Redundancy protocols apply to networks connected to SDN– Redundancy protocols over an SDN has not been tested – not sure it adds value– PRP over SDN (2 fabrics) is a consideration•Application specific configuration data can be used to program the network– API’s in SDN platforms enable integration with Control applications beyond
telemetry

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

27