The idea
Software-defined networking (SDN) takes the deciding out of the switches: one SDN controller computes every path and writes it into them, and they only forward. Here it programs s1, s2 and s3, cabled in a triangle, so that alice, bob and webServer can talk; then it is cut off, a cable fails, and a policy goes in.
Steps
-
A switch that decides nothing
alice and webServer share a network. A classic switch learns where each MAC address is by itself; these do only what their flow table says. Read s1's.
alice:~# ping -c 2 -W 1 10.0.1.15 s1:~# ovs-ofctl -O OpenFlow13 dump-flows br0 s1:~# ovs-vsctl show
-
The controller programs the flows
Deciding where traffic goes is the control plane, and one controller holds it. It asks each switch, over a management network, which ports are up. Read what it sees, then let it program.
controller:~# sdn-controller status controller:~# sdn-controller apply alice:~# ping -c 2 -W 1 10.0.1.15
Pro
4 more steps in the app
- No controller, and the traffic still flows
- A cable fails: nothing happens until the controller acts
- A policy written once, enforced in a switch
- The controller's tables win