ICN - SDEWAN

Goals

In ICN's SDWAN usages, SFC (Service Function Chain) is designed to support Corp networks to connect to external internet with security connection. The SFC includes Security VNF (e.g. firewall etc.), WAN Opt CNF and SDWAN VNF/CNF, and SDWAN module is worked as software defined router which can be used to defined the rules when connect to external internet. Below diagram shows where SDWAN module located in the whole system.

Basic Technology

OpenWRT

The OpenWRT Project (https://openwrt.org/) is an open source project based on Linux, and it is primarily used on embedded devices to route network traffic. There are more than 3500 software packages which can be installed on OpenWRT via opkg package management system. OpenWRT provides both docker image and VM image to support virtualization solution (https://openwrt.org/docs/guide-user/virtualization/start). In ICN, we run OpenWRT in container.

OpenWRT Mwan3 package (a replacement for multiwan package) provides the capabilities for multiple WAN management: WAN interfaces management, outbound traffic rules, traffic load balancing etc.

ovn4nfv-k8s-plugin

ovn4nfv-k8s-plugin is a CNI plugin based on ovn. It can work together with Multus CNI to add multiple interfaces for the pod. One of the interfaces is the Multus default interface, it could be flannel, calico, etc. The other interfaces are added by ovn4nfv-k8s-plugin according the the pod annotation. With ovn4nfv-k8s-plugin, we can create virtual network in run-time. Also we can connect the pod with the provider network, this is important for CNF.

Design Proposals

SDEWAN is a solution to enable SDWAN functionalities include multiple WAN link support, WAN traffic management, NAT, firewall, IPSec and Traffic shaping etc. with focus to address the challenges when applying on edge computing environment like resource limitation, edge overlays, traffic sanitization, automation and cost sensitive etc. The solution includes below components:

SDEWAN CNF: implemented based on OpenWRT, it enhances OpenWRT Luci web interface with SDEWAN controllers to provide Restful API for network functions' configuration and control.
SDEWAN CRD Controller: implemented as k8s CRD Controller, it manages CRDs (e.g. Firewall related CRDs, Mwan3 related CRDs and IPSec related CRDs etc.) and internally calls SDEWAN Restful API to do CNF configuration.
Overlay Controller: provides central control of SDEWAN overlay networks by automatically configuring the SDEWAN CNFs through SDEWAN CRD controller located in edge location clusters and hub clusters.

Timeline

Module	Tasks	Owner	Due	Current Status	Description
PORs
POC	Setup IPSec tunnel	Ruoyu	Feb.26	WW09: setup POC environment by manual configuration (Site-2-Site, Initiator-responder, Initiator-responder with vip) - Done
SDEWAN CNF
	Service API	Huifeng		Done	Start/stop/restart/reload SDWAN service, includes: mwan3, firewall/NAT, IpSec. Reference: SDEWAN CNF#SDEWANService
	MWAN3 API	Huifeng		Done	Support MWAN3 rule/policy configuration. Reference: SDEWAN CNF#MWAN3 OpenWRT Reference: https://openwrt.org/docs/guide-user/network/wan/multiwan/mwan3
	Firewall API	Huifeng	Design: Feb.26 Implementation: Mar.12	WW08: Initial design Done WW09: Implementation - 50% WW10: 80% WW11: done	Support firewall configuration for zone (general rule for a group of interfaces), forwarding (iptables forward), rule, redirect (DNAT/SNAT). Reference: SDEWAN CNF#Firewall OpenWRT Reference: https://openwrt.org/docs/guide-user/firewall/firewall_configuration
	IPSec API	Ruoyu	Design: Feb.26 Implementation: Mar.18	WW08: Initial design Done WW09: design done (to be reviewed) WW10/11/12: 90%	Support IPSec configuration for remote site, proposal. Reference: https://wiki.akraino.org/display/AK/IPSec+Design#IPSecDesign-IPSecRestAPI OpenWRT Reference: https://openwrt.org/docs/guide-user/services/vpn/ipsec/strongswan/start (Note: OpenWRT Wiki page is out-of-date compare to 18.06 implementation which we used and the current design is based on openwrt ipsec code directly)
SDEWAN E2E scenario					E2E demo for SDEWAN solution
	manual steps	All	WW13 -14		manual steps (create CNF, openwrt configuration for Ipsec/NAT rule, manual connectivity test for ms) to verify E2E test scenarios
	auto test scripts to enable demo in ICN	All	WW15-16		leverage kud to setup 3 clusters (Hub, edge1, edge2) use pre-defined yaml file (with network interface information and rules definition) to create Sdewan CNF use linux shell script to call CNF Rest API (e.g. update rule, restart service etc.) shell script to verify ms connectivity in different edge cluster
SDEWAN CNF Controller
	POC to verify CR & CNF matching by label		WW17		R3.1 POC to verify the flow for n:m label matching between CR instances and CNF instances (e.g. a CR can apply to multiple CNF and a CNF can have multiple CR)
	CRD re-design		WW18-19		R3.1
	SDEWAN CRD	Cheng	WW20		Redesigned in R3.1 Define a SDWAN CNF with mwan3, firewall and IPSec configuration Reference: Sdewan CRD Controller
	MWAN3 CRD	Cheng	WW21		Redesigned in R3.1 Define MWAN3 configuration (policy, rule) Reference: Sdewan CRD Controller
	Firewall CRD	Cheng	WW22-WW23		Redesigned in R3.1 Define Firewall CRD (zone, forwarding, rule, redirect (NAT))
	IPSec CRD	Ruoyu	WW24-WW25		Redesigned in R3.1 Define IPSec CRD (remote site, proposal) Reference: https://wiki.akraino.org/display/AK/IPSec+Design#IPSecDesign-IPSecCRD Scenario design: SD-EWAN Scenarios
Integration					CNF controller and CNF Rest API integration
	MWAN3	Cheng/Huifeng	WW26		Redesigned in R3.1 MWAN3 CRD/Restful API integration
	Firewall	Cheng/Huifeng	WW27		Redesigned in R3.1 Firewall CRD/Restful API integration
	IPSec	Ruoyu/Huifeng	WW28		Redesigned in R3.1 IPSec CRD/Restful API integration
Stretch Goals
SDWAN Hub Controller	EWAN Config Manager: call EWAN Conf Agent to configure EWAN CNF	Rama
Key	Store key in TPM	Cheng
QAT Support	Investigate how to enable QAT support for IPSec (Client library such as OpenSSL configuration, kernel module is not need in CNF)	Ruoyu

SDEWAN CNF

Sdewan CRD Controller

Presentation

ICN Weekly meeting video recordings- Weekly Akraino ICN Engineering Meeting