Challenges with Cloud based
Switch Mgmt.
Shivaram Mysore, Founder/CEO
Mark Hapner, Chief Architect(415) 787-5578 |@ServiceFractal© 2019 Service Fractal Inc
Proprietary & Confidential

Thank youPay-as-you-go
A Cloud platform for Networking & Security Operations
Target consumers areEnterprises, Branches andCampus
Operators use Service Fractal
Cloud to manage on-prem
L2/L3 network switches● Vision is to create platform of applications forzero-friction network & security management● Emphasis on simplicity, efficiency & elastic● Instant analytics● No API or skills training neededWe are reimagining the distributed edge

Streaming
Telemetry

DynamicControl

Events
NETCONF, gNOI

gNMI, Netflow,etc

On-Prem Network Equipment →Business Outcome Speciﬁc Apps - Examples
Sideout, Network vitals, Bandwidth usage, Switch Stacking,Port Mirroring, Firewall, Threat intelligence enabled Firewall,
Tapestry, Microsegmentation, Network planning, Assetmanagement, Switch firmware update, Bandwidth control,
Device identification, Accelerating MapReducePricing$250/m
100G of Data, unlimited number of switches or ports or capacity (1-100G)

Faucet●●●Enables Control & Monitoring of network switches
Multi-vendor is a key differentiator
Required Switch Capabilities:
○○
○
○
○

●Protocol support for Openflow v1.3 or P4
Pass Faucet Test suite
Optional: GNMI / GNOI Protocol support
One Openflow managed port used as “uplink”# of Controllers to configure: (1) Control (2) Monitor (3) Local Survivability (4) HA Mode+

Service Fractal specific requirements○○○○

TLS support for Control connectivity
Optional: DNS support
Optional: TLS (Encrypted) Service Name Indication (SNI) support
Dial-out only support for GNMI / GNOI

Switch Provisioning Challenges●●●●Configure in Openflow mode (all manual steps)
Partial or Full (reboot)Select ports
Key Provisioning (numerous steps - Trust Anchor, generation, CSR, Cert upload;
Cert chain upload is mostly not supported)○○●

No support for separate control channel - currently, management port is also used
for control (even though it is dial-out). This port needs outbound Internet
connectivity. This risk profile is not supported by some organizations○●

The root certificate container supports only one root certificate not a chain. The root cert supported
is the one CSR is signed with.
CSR generation needs prior configuration with Cert fields (CN, OU, O, L, State, Country)

Downside of “Control channel” port is loss of one more ethernet port (can be 1Gb)

Capture DP ID and switch ports for inclusion in faucet.yaml

DNS support on Switches
Configure Controller with Fully Qualified Domain Name (FQDN) instead of IP
Addresses●●●●Controllers are run on VMs or Containers in totally different network segments
Use of IP implies routing policies are set accordingly & Firewall ports open
Use of FQDN relies on DNS infrastructureWith use of dynamic software infrastructures, controllers are deployed andrelocated. If Switch uses FQDN to connect to controller, then a change in IPaddress is automatically resolved with no change to switch configuration

TLS (E)SNI support on Switches●

SNI - Service Name Indication
○○

●

●
●
●

A TLS extension used by client to indicate which hostname it wishes to connect at the start of TLS
handshake process
ESNI - Encrypted SNI: To address domain/host name eavesdropping

Current mode for Openflow controller configuration on OVS is:ssl:controller.example.org:6653 → indicates controller service isavailable on port 6653 - an exposed port that is open for attacks.
If Controller is available as a Microservice in a cloud infrastructure, it normallyresides behind a Reverse ProxyIf TLS (E)SNI is supported, then we can open only port 443 - standardized testing
can be applied.
TLS (E)SNI can also help us (Cloud SPs) by using limited number of Public IPs

GNMI / GNOI●
●Need for Dial-out only support
Unsure if this would use Management port or Control channel port if one wereavailable

Questions
1. Any efforts to simplify switch provisioning from Openflow point of view?
2. Provide an automated way of including DP ID and switch ports for inclusion infaucet.yaml?
3. Enable DNS support on switches
4. Enable TLS (E)SNI support in switches - OVS has some support
5. Can we improve Certificate-Key provisioning?
6. Can we use DHCP options on the switch for automating provisioning items such
as:
a.
b.
c.
d.

Openflow mode + ports
DNS Resolver IPController FQDN
Create PKI profile✓ Simplicity✓ Time-to-value (real-time: data to actionable)✓ Multi-vendor✓ Scale✓ Fine-grained network telemetry on low bandwidth✓ SaaS

Call us for Cyber Networking
sales@ServiceFractal.com(415) 787-5578
13