Software Defined Networking (SDN)

Another tool that we have to segment out our networks, or at least manage all of those segmentations, is software-defined networking.

What software-defined networking is

What is software-defined networking? Well, it's adding a software abstraction layer to the network management, to the overall network. Well, what the heck does that mean? Essentially, what I like to think about it as is virtualizing network management.

Let's take a look at a typical network. This is a three-tier network, and we want to incorporate things to make sure that they're highly available, that it's performing well, and that there's security and manageability. So what we have here is we've got layer 3 switches, two of them at the core and two at the distribution layer, and then we have access switches down here. And ultimately what we're creating is this robust network that can really scale well and so on and so forth. But the problem with this is that we're managing quite a bit of equipment by doing this. We have to jump onto this layer 3 switch to be able to set up management of it, and then this one as well, and this one as well. So we're going and visiting each one of these to configure and set up and be able to control and do anything on these. So if we wanted to set up maybe, let's say, an access list, we'd have to set it up on this one and this one. We'd have to set it up on twice as much — or maybe even four times as much, depending on these access lists and how we want them configured.

Software-defined networking adds an extra layer to this. So now what we're doing is on these devices, we're installing extra software that does a lot of the control over these devices. And now when we're setting up things, we're not visiting each one of these switches, each one of these layer 3 switches and these access switches. We're not visiting all of that to do our management. In fact, it's a lot less hands-on when it comes to software-defined networking.

Now what we have is we have a controller software that manages all the big picture stuff. And so all we need to do is go in and manage the big picture stuff, and then dynamically all of this software figures out what it needs to do to manage the whole network. This makes it much easier from a management standpoint, because now we go to a controlling unit right here, and when we control it or type things in, it will control the different units here. And essentially what we're doing is we're entering in exactly what we want the behavior to be, and then this controlling software, along with the software that's installed on all of these machines, can then figure out exactly what the implementation should look like on these individual levels. So we can figure things out at a much higher level and then have it implemented at this lower level here.

One thing we may even do is we might just say, well, we're just going to have a single device here that just is an SDN device. We distribute that everywhere, and then we will program those and then they'll figure out where is it that we need to route things, where do we need to switch things, and it will assign the proper way of configuring all of this. So it really helps from a management perspective.

Example: access control lists

Let's use an example that we're implementing an ACL, and we would put this ACL on maybe this layer 3 switch, but we need to put it on two switches because it could fail over to this one. And so what ends up happening is that we end up going and configuring these ACLs on multiple switches. And what I've found is when you have multiple locations for something, something is going to get off. You need some sort of audit process. Well, not if you're doing SDN — although it always helps to have audit processes; I'm not saying it does away with the need for that. But what happens from a device-to-device perspective is we just configure that ACL on this device right here, and it automatically knows what devices it's going to need to put those ACLs on. So that way, we have a level of control that is going to be uniform across our network.

Example: spanning tree protocol

Let's use a different example here. We have a bunch of layer 2 switches here, and maybe they're running spanning tree protocol. Now the way spanning tree protocol is set up is you can't have a loop, and so spanning tree protocol eliminates the chances of there being a loop. It elects a root bridge, and then it makes a connection from the root bridge to all of these switches and says, okay, how can I get to that switch, and then it will turn off all of the extra connections. Well, look at this: I've just shut down six connections here that we normally could be communicating on. But if I didn't switch those off, then we would have this loop, and loops will cause a problem on a layer 2 network. So we can't have that. So it's got to be switched off.

Well, let's instead implement software-defined networking. When we implement software-defined networking, these networks can figure out what is the best way for this communication to happen and just utilize all of these links to do that. It makes it much more efficient, because now what we can do is we can utilize a lot of links here rather than just being stuck with a few of the links that spanning tree protocol would leave us. So by implementing software-defined networking, it really just dynamically figures things out for us.

SD-WAN

This happens also from a WAN perspective. So if we have a bunch of layer 3 devices that are spread across here, we can see there's a network of communication that happens here. But all of these different links here are set up differently. Some of them are slow, some of them are fast, some of them are unstable, some of them have jitter to them. So they all have their different characteristics. Well, if we have a software-defined network, we would just physically connect all of these up together the way they need to be connected up together, but then we would install this extra software on top. And what this extra software — we call it an abstraction — will do is be able to better create this network. So it's much more tuned towards performance and much more dynamic, and can really adapt well. So this is software-defined WAN, or SD-WAN.