See: Description
| Interface | Description |
|---|---|
| VTNManager |
OSGi service interface associated with VTN Manager service.
|
| Exception | Description |
|---|---|
| VTNException |
VTNException is an exception for notifying errors caused by the
VTN Manager. |
The VTN Manager manages the virtual network at VTN (Virtual Tenant Network) level. At least one VTN should be created for setting up virtual network using the VTN Manager.
VTN is a virtual network environment inside the network manager by the OpenDaylight controller. The VTN Manager sets up virtual network environment inside VTN by configuring virtual network elements (virtual node) like vBridge in VTN. If multiple VTNs are created, then networks inside different VTNs are managed as different individual networks.
vBridge is a virtual layer 2 switch inside VTN, and it represents one virtual broadcast domain. Virtual network environment in VTN is enabled when one or more vBridges are created inside VTN, and vBridge and physical network are mapped.
Following functionalities are provided at this point in time for mapping vBridge and physical network.
vBridge can have the following internal status.
VLAN mapping functionality is used for mapping VLAN network to any specified vBridge. It is possible to set one or more than one VLAN mapping to one vBridge.
While configuring VLAN mapping, specify the VLAN ID that is to be mapped to vBridge.
Also, it is possible to specify one physical switch for VLAN mapping. If the node identifier (node-id) corresponding to physical switch is specified during VLAN mapping, then only the input and output of that physical switch is mapped to vBridge. If a physical switch is not specified, then it will be used for all the physical switches recognized by the OpenDaylight controller.
Further, if the same VLAN ID specified with and without the physical switch are set to different vBridges, higher priority will be given to the VLAN mapping specified with the physical switch. E.g., let us assume that vBridge is configured as shown below.
Following will be the behavior in this case.
Please note the following caution while configuring VLAN mapping.
MAC mapping functionality is used to associate vBridge with any specified host and it is supported from Helium onwards. Only one MAC mapping can be configured on one vBridge. However, it is possible to associate multiple hosts to vBridge by using one MAC mapping.
A combination of MAC address of host and VLAN ID is specified to map hosts in MAC mapping.
MAC mapping has the following two access control lists. Host is specified in MAC mapping by setting host information to these access control lists.
If host information with and without MAC address are configured in different MAC mapping respectively, settings with MAC address specified are given higher priority. E.g., let us assume that vBridge is configured as shown below.
Following behavior will be seen in this case.
As against VLAN mapping etc., MAC mapping will not be activated just by configuring it. The mapping with a host is activated when a packet sent from the host specified in MAC mapping is detected for the first time. Also, when broadcast packets are sent towards MAC mapping, the packet will be sent only to the VLAN over the switch ports that have detected a host with which mapping is activated.
E.g., let us assume that a network isconfigured as shown below.
Here, following will be the behavior if the host with MAC address A sends a broadcast packet.
After that, following will be the behavior if host with MAC address B sends a broadcast packet.
Once the MAC mapping with the host is activated, the combination of physical switch port, which detected that host, and VLAN ID will be exclusive for that vBridge. In the above mentioned example, following switch port and VLAN ID combinations will be exclusive to bridge_1.
E.g., in the above case, let us assume that there is a host with MAC address C over the VLAN of port-1 and VLAN ID 10. Here, configure MAC address C and VLAN ID 10 on the Map Allow list of bridge_1, and after that when a packet sent from MAC address C is detected, mapping is activated between the host with MAC address C and bridge_1.
However, if a different vBridge bridge_2 is created, and MAC address C and VLAN ID 10 are configured in the Map Allow list of bridge_2, the mapping with bridge_2 will not be activated even if the packet sent from the host with MAC address C is detected. This is because port port-1 and VLAN ID 10 is exclusive to bridge_1. Therefore, packet sent from MAC address C is discarded.
Further, MAC mapping will not be used for hosts detected over a VLAN which is mapped using Port mapping.
Mapping, activated by MAC mapping, between vBridge and host will be removed at the following instances.
If a host on which MAC mapping is applied is detected over a VLAN, mapped with VLAN mapping, MAC mapping will be given higher priority.
E.g., let us assume that a network is configured as shown below.
Following behavior will be seen in such a case.
MAC mapping maps physical network with vBridge at host level but, when broadcast packet is sent towards MAC mapping, it is transmitted in the VLAN over switch port. Therefore, broadcast packet may be sent to hosts that are not mapped by MAC mapping.
E.g., let us assume that a network is configured as shown below.
In this case, packets sent by host with MAC address A or C will be mapped to bridge_1 but packets sent by host with MAC address B will not be mapped to bridge_1. Also, if untagged unicast packets with the destination MAC address B are detected, they will be discarded.
However, if the host with MAC address C sends broadcast packet, it will be forwarded to the untagged network over port-1 and broadcast packet will be delivered to host with MAC address B as well.
Each vBridge owns a MAC address table to learn MAC addresses detected in the vBridge. The following information is stored in the MAC address table when an input is detected from the physical network mapped to the vBridge.
Further, if source MAC address information of ethernet frame is registered in the MAC address table, and the physical switch port that received the ethernet frame and VLAN ID is different from the information in MAC address table, then the information inside MAC address table is updated to the information of the received ethernet frame.
If a unicast packet is sent to vBridge and that packet is notified to OpenFlow controller, then the VTN Manager checks whether the destination MAC address is registered in the MAC address table. Following flow entries are configured on the related physical switches only when it is found in the MAC address table.
If the destination MAC address is not found in the MAC address table, then this ethernet frame is sent to all the physical networks mapped to vBridge.
Only destination MAC address is used as the search key while searching inside MAC address table. Thus, it is necessary to configure vBridge in such a manner that ethernet frames that have the same MAC address as the source address and different VLAN IDs configured do not flow to the same vBridge.
For example, let us assume that the following vBridge and network devices are configured.
If the above configurations are done, then ethernet frames that have the source MAC address A and different VLAN IDs will be treated as an input of bridge_1.
Configuring vBridges in the above manner results in undefined behavior.
The VTN Manager carries out the MAC address aging process periodically against MAC addresses stored in the MAC address table. If the MAC address inside the MAC address table is not referred since the last aging process, then that MAC address information is deleted from the MAC address table.
Interval of the MAC address aging is configurable per vBridge. 600 seconds is the default value for the aging interval. That is, when we use default settings, if the MAC address information inside MAC address table is not referred for some time, then it will be deleted earliest by 600 seconds and latest by 1200 seconds.
vTerminal is isolated input and output terminal inside VTN. vTerminal can have only one virtual interface, and it can map a physical switch port by port mapping.
vTerminal is always used in conjunction with redirection by flow filter.
vTerminal can have the following internal status.
Virtual interface shows the input and output interface that could be set in virtual node of VTN. At this point in time, it is possible to set virtual interface to vBridge and vTerminal.
It is possible to dynamically enable or disable virtual interface. If a virtual interface is disabled, then all the inputs from that virtual interface will be ignored. Also, there will be no output against that virtual interface.
Virtual interface can have the following internal status.
Status of the virtual interface configured in vBridge is decided as follows.
Status of the virtual interface configured in vTerminal is decided as vBridge interface status is decided.
Port mapping functionality is used to map port of physical switch to virtual interface of vBridge. Only one port mapping can be set for one virtual interface. If you want to map ports of multiple physical switches to one vBridge, then it is necessary to create multiple virtual interfaces in the vBridge and configure port mapping against each virtual interface.
While configuring port mapping, specify a pair of physical switch port and VLAN ID that is to be mapped.
Please note the following caution while configuring port mapping.
Port mapping settings will be given higher priority if the same VLAN network, which was set in port mapping, is mapped to another vBridge using VLAN mapping.
For example, let us assume that two vBridges with the names bridge_1 and bridge_2 are configured like shown below.
In this case, it will operate like below.
If a host set in MAC mapping is detected over VLAN network set in Port mapping, Port mapping settings will be prioritized. If MAC mapping is already activated with the host connected to this VLAN network, all MAC mappings will get deactivated.
E.g., let us assume that a network is configured as shown below.
Further, newly create the following vBridge.
Following behavior will be there in this case.
A flow condition is a named list of flow match conditions, and it is used to select packets. Each flow match condition must have a match index, which is an unique index in a flow condition. When a flow condition tests a packet, flow match conditions in a flow condition are evaluated in ascending order of match indices. A packet is selected if at least one flow match condition matches the packet.
Flow conditions are shared with all the VTNs.
Flow filter provides packet filtering feature for packets forwarded in VTN. Flow filter can not only filter out the specified packets but also modify the specified packets.
Each flow filter must specify a flow condition by name. If a packet matches the condition described by the flow condition in a flow filter, then actions configured in the same flow filter is applied to that packet.
There are three types of flow filter as follows.
Flow action list is a list of rules to modify packet.
Note that modification done by flow actions in a flow filter is visible to succeeding evaluation of flow filters.
One or more flow filters can be configured in virtual node in VTN as a list, and it is evaluated when a packet is forwarded to the virtual node. Each flow filter has a unique index in the list, and they are evaluated in ascending order of indices, and only the first matched flow filter is applied to the packet. If none of flow filter in the list matches the packet, then the VTN Manager lets the packet through the virtual node without modifying the packet.
Flow filter can be configured in the following places.
Flow filters in this list are evaluated when an incoming packet is mapped to the VTN. Note that the VTN flow filter list is evaluated only once before other flow filter lists are evaluated.
Flow filters in this list are evaluated when a packet is forwarded to the specified vBridge. This list is evaluated at the following instances.
Flow filters in this list are evaluated when a packet is going to be transmitted to the physical network mapped to the vBridge by VLAN mapping or MAC mapping. Note that this list is not evaluated when a packet is forwarded to the virtual interface in the same vBridge.
Flow filters in this list are evaluated when a packet is forwarded to the specified virtual interface in the vBridge. This list is evaluated at the following instances.
Flow filters in this list are evaluated when a packet is going to be transmitted to the physical network mapped to the virtual interface in the vBridge. This list is evaluated at the following instances.
Flow filters in this list are evaluated when a packet is forwarded to the specified virtual interface in the vTerminal. This list is evaluated at the following instances.
vTerminal is an isolated input/output terminal. So an incoming packet is always discarded unless it is redirected to another virtual interface by the flow filter.
Flow filters in this list are evaluated when a packet is going to be transmitted to the physical network mapped to the virtual interface in the vTerminal.
This list is evaluated only when a packet is redirected by another flow filter to the vTerminal interface as an outgoing packet.
A REDIRECT flow filter forwards the packet to another virtual interface in the same VTN. A REDIRECT flow filter has the following configurations.
The location of the destination virtual interface must be configured in every REDIRECT flow filter.
Every REDIRECT flow filter must choose the direction of the packet redirection, input or output.
input means that a redirected packet should be treated as an incoming packet as if it is forwarded or mapped to the specified virtual interface.
A list of flow filters for incoming packets configured in the destination virtual interface is evaluated against the redirected packet. If the flow filter passes the packet, the packet is forwarded to the virtual node which contains the destination virtual interface.
output means that a redirected packet should be treated as an outgoing packet as if it is going to be transmitted to the physical network mapped to the specified virtual interface.
A list of flow filters for outgoing packets configured in the destination virtual interface is evaluated against the redirected packet. If the flow filter passes the packet, the packet is transmitted to the physical network mapped to the virtual interface by port mapping. Note that the packet is discarded if the port mapping is not configured in the virtual interface.
REDIRECT flow filter should be configured not to cause the packet loop. The number of virtual node hops per a flow (the number of packet redirections per a flow) is limited to 100. If the number of virtual node hops exceeds the limit, it is treated as the packet loop and then the packet is discarded.
The VTN manager cannot successfully build an isolated virtual network environment if an application that sets flow entry to switch is running because this might be inconsistent with flow entry set by the VTN manager.
Basically, flow filter can be applied to unicast packets. So flow filter ignores broadcast and multicast packets except for DROP flow filter.
For example, a broadcast packet is mapped to the VTN, flow filters in the VTN flow filter are evaluated as follows.
If an unicast packet is mapped to the vBridge, and its destination MAC address is not learned in the vBridge, the packet is broadcasted to all physical network elements mapped to the vBridge. In that case all REDIRECT flow filters configured in the vBridge and vBridge interface for outgoing packets are ignored.
Flow filters never affect packets originated by the VTN Manager.
Flow filters never affect packets sent to the controller. If the destination MAC address of the packet is equal to the controller's MAC address, the VTN Manager ignores all flow filters.
A flow condtition which specifies layer 4 protocol header fields (e.g. TCP/UDP port, ICMP type and code) never matches fragments of layer 4 packet except the first fragment because layer protocol header is present only in the first fragment. If a flow filter is configured with such a flow condition, it will never be applied to fragments of layer 4 packet except the first fragment.
Copyright © 2018 OpenDaylight. All rights reserved.