Hybrid OpenFlow switch

When operating in multiservice mode, SR OS H-OFS supports matching on port and VLAN IDs as part of Flow Table match criteria. When an OF controller specifies incoming port and VLAN values other than "any", the H-OFS instance translates them to an SR OS VPLS SAP (sros-cookie must be set to a valid VPLS service ID). If the translation does not result in an existing VPLS SAP, the rule is rejected and an error is returned to the controller.

A flow table rule with a port and VLAN ID match is programmed only if the matching SAP has this H-OFS instance embedded in its ACL ingress filter policy. Use the following commands to configure the SAP scope of embedding:

• MD-CLI

  configure filter ip-filter embed openflow sap
  configure filter ipv6-filter openflow embed openflow sap

• classic CLI

  configure filter ip-filter embed-filter open-flow sap
  configure filter ipv6-filter open-flow embed-filter sap
  configure filter mac-filter open-flow embed-filter sap

See SR OS H-OFS port and VLAN encoding for required encoding of port and VLAN IDs.

The SR OS H-OFS supports a mix of rules with service scope and with SAP scope. For VPLS SAPs, an H-OFS instance must be embedded twice: after for the VPLS service and after for the SAP if both service-level and SAP-level rules are to be activated.

The following example shows the activation of service-level and SAP-level rules inside a single ACL policy.

[ex:/configure filter ip-filter "1"]
A:admin@node-2# info
    scope exclusive
    embed {
        openflow "ofs1" offset 100 {
            vpls "vpls100"
        }
        openflow "ofs1" offset 200 {
            vpls "vpls100"
            sap 1/1/2:2
        }
    }

A:node-2>config>filter>ip-filter# info
----------------------------------------------
            scope exclusive
            embed-filter open-flow "ofs1" service 5 offset 100
            embed-filter open-flow "ofs1" sap 1/1/2:2 offset 200
----------------------------------------------

Logical ports are used in OpenFlow to encode switch-specific ports. SR OS H-OFS uses logical ports in steering actions by encoding PBR targets. Encoding and supported logical port types lists logical port types supported by SR OS H-OFS:

The following encoding shows logical port types supported by SR OS H-OFS.

RSVP LSP: LPT: 0100, LPT-S: 0000 (tunnel), LPT-V: RSVP TE Tunnel ID
MPLS-TP LSP: LPT: 0100, LPT-S: 0000 (tunnel), LTP-V: MPLS-TP Tunnel Number
SR-TE LSP: LPT: 0100, LPT-S: 0000 (tunnel), LTP-V: SR-TE LSP Index
GRT instance: LPT: 0100, LPT-S: 0001 (L3 routing instance), LPT-V: 0
VPRN Id: LPT: 0100, LPT-S: 0001 (L3 routing instance), LPT-V: VPRN Service ID for a 
VPRN instance configured on the system, NAT: LPT 0100, LPT-S: 0020 (NAT), LPT-V: 0

OF is limited to a 24-bit service ID value range (a subset of VPRN IDs supported by the SR OS system).

Logical port values other than RSVP-TE LSP, SR-TE LSP, and MPLS-TP LSP require H-OFS with the switch-defined-cookie command enabled. Only tunnel-encoded ports are stored in the H-OFS logical port table. Therefore, functionality such as retrieving statistics per port is not available for logical ports that are not stored in the H-OFS logical port table.

The OF controller can use port and VLAN values other than ‟ANY” for VPLS SAP match and for VPLS steering to SAP for H-OFS instances with the switch-defined-cookie command enabled.

To specify a port in an OF message, SR OS TmnxPortId encoding must be used. The allowed values are those for Ethernet physical ports and LAG.

The following table shows how OXM_OF_VLAN_ID and experimenter OFL_OUT_VLAN_ID fields are used to encode VLAN tags.

The following table shows how OF programmed values are translated to SR OS SAPs.

A router supports redirection of IPv4 or IPv6 next-hop for traffic arriving on a Layer 3 interface. An OF controller can rely on this functionality and program PBR next-hop steering actions for H-OFS instances with the switch-defined-cookie command enabled using the following OF encoding.

ALU_IPD_EXPERIMENTER_ID: 0x000025BA
ALU_AXN_REDIRECT_TO_NEXTHOP: 2
flow_mod: 
instruction= OFPIT_WRITE_ACTION/OFPIT_APPLY_ACTION, 
action= OFPAT_EXPERIMENTER(ALU_AXN_REDIRECT_TO_NEXTHOP), 
encoding:
struct alu_axn_redirect_to_nhopv4{
uint16_t type;                   /* OFPAT_EXPERIMENTER. */
uint16_t len;                    /* Total Length is a multiple of 8. */
uint32_t experimenter;           /* Experimenter ID vendor unique*/
uint8_t    redirect_type;        /* Type = 1 for Nhop*/
uint8_t    flags;                /* flags is 0-7 bits: 
     Bit 0 = Ipv4, 
     Bit 1 = Ipv6, 
     Bit 2   = indirect
     */
uint8_t     pad[2];
uint32_t   ipaddr;                /* ipv4 addr */
unit8_t     pad[0];               /* Not needed */
}; ASSERT(sizeof(alu_axn_redirect_to_nhopv4) == 16)
struct alu_axn_redirect_to_nhopv6{
uint16_t type;                   /* OFPAT_EXPERIMENTER. */
uint16_t len;                    /* Total Length is a multiple of 8. */
uint32_t experimenter;           /* Experimenter ID vendor unique*/
uint8_t    redirect_type;        /*  Type = 1 for Nhop*/
uint8_t    flags;                /* flags is 0-7 bits: 
     Bit 0 = Ipv4, 
     Bit 1 = Ipv6, 
     Bit 2   = indirect
     */
uint8_t       pad[2];
uint128_t   ip6addr;              /* ipv6 addr */
unit8_t     pad[4];               /* Make total len multiple of 8 */
}; ASSERT(sizeof(alu_axn_redirect_to_nhopv6) == 32)

In case of erroneous programming, the following experimenter-specific errors are returned to the controller.

enum alu_err_exp_class{
ALU_ERR_CLASS_RD_TO_SDP       = 0,
ALU_ERR_CLASS_RD_TO_NHOP      = 1,
}
enum alu_err_subtype_redirect_to_nhop
{
ALU_ERR_RN_INVALID_FLAGS      = 0
ALU_ERR_RN_INVALID_ARGS       = 1
ALU_ERR_RN_INVALID_ADDR       = 2
} 

A router supports redirection of IPv4 or IPv6 traffic arriving on a Layer 3 interface to a different routing instance (GRT or VRF). An OF controller can rely on this functionality and program PBR actions for GRT/VRF steering for H-OFS instances with the switch-defined-cookie command enabled using the following OF encoding.

flow_mod: 
instruction type: OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTION, 
action type: OFPAT_OUTPUT, 

port= SR OS LOGICAL port encoding GRT or VPRN Service ID as described in the SR OS H-OFS logical port section.

Because a 24-bit value is used to encode the VPRN service ID in the logical port, redirection to a VPRN service with a service ID above that range is not supported.

A router supports redirection of IPv4 or IPv6 traffic arriving on a Layer 3 interface to a different routing instance (GRT or VRF) and next-hop IP at the same time. An OF controller can rely on this functionality and program PBR steering action for H-OFS instances with the switch-defined-cookie command enabled using the following OF encoding.

ALU_IPD_EXPERIMENT_ID:0X000025BA
ALU_AXN_REDIRECT_TO_NEXTHOP:2
flow_mod: 
Instruction 1: 
instruction=OFPIT_WRITE_ACTION/OFPIT_APPLY_ACTION
action=OFPAT_EXPERIMENTER(ALU_AXN_REDIRECT_TO_NEXTHOP), 

Encoding as described in the Redirect to IP next-hop section (indirect flag must be set).

Instruction 2: 
instruction type: OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTION, 
action type: OFPAT_OUTPUT, 

port= SR OS LOGICAL port encoding GRT or VPRN Service ID as described in the SR OS H-OFS logical port section.

The router supports redirection of IPv4 or IPv6 traffic arriving on a Layer 2 interface to an Ethernet Segment Identifier (ESI) with an EVPN control plane. An OF controller can program Layer 2 ESI steering with the switch-defined-cookie command enabled using the following OF encoding.

flow_mod:
    instruction type: OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTION,
    action type: OFPAT_EXPERIMENTER(ALU_AXN_REDIRECT_TO_ESI_L2)
    encoding:

struct alu_axn_redirect_to_ESI_L2{
    uint16_t  type;               /* OFPAT_EXPERIMENTER. */
    uint16_t  len;                /* Total  Length is a multiple of 8. */
    uint32_t  experimenter;       /* Experimenter ID vendor unique*/
    uint8_t   redirect_type ;     /*  Type = 3 for ESI*/
    uint8_t   flags;              /*  flags is 0-7 bits: 
                                      Value   0 = L2,
                                  */
    uint8_t    esi[10];           /* 10 byte ESI */
    uint32_t   svcId;             /* Svc-Name Using the OF Encoding */
}; ASSERT(sizeof(alu_axn_redirect_to_ESI_L2) == 24)

The router supports redirection of IPv4 or IPv6 traffic arriving on a Layer 3 interface to an ESI with an EVPN control plane. An OF controller can program Layer 3 ESI steering with the switch-defined-cookie command enabled using the following OF encoding.

flow_mod:
    instruction type: OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTION,
    action type: OFPAT_EXPERIMENTER(ALU_AXN_REDIRECT_TO_ESI_L3)
    encoding:

struct alu_axn_redirect_to_ESI_L3_V4{
    uint16_t  type;               /* OFPAT_EXPERIMENTER. */
    uint16_t  len;                /* Total  Length is a multiple of 8. */
    uint32_t  experimenter;       /* Experimenter ID vendor unique*/
    uint8_t   redirect_type ;     /*  Type = 3 for ESI*/
    uint8_t   flags;              /*  flags is 0-7 bits: 
                                      Value   1 = L3 (ipv4)
                                  */
    uint8_t    esi[10];           /* 10 byte ESI */
    uint32_t   svcId;             /* Svc-Name Using the OF Encoding */
    uint32_t   sf-ip;             /* v4 address of sf-ip */
    uint32_t   ifIndex;           /* interface id*/
}; ASSERT(sizeof(alu_axn_redirect_to_ESI_L3_V42) == 32)

struct alu_axn_redirect_to_ESI_L3_V6{
    uint16_t  type;               /* OFPAT_EXPERIMENTER. */
    uint16_t  len;                /* Total  Length is a multiple of 8. */
    uint32_t  experimenter;       /* Experimenter ID vendor unique*/
    uint8_t   redirect_type ;     /*  Type = 1 for Nhop*/
    uint8_t   flags;              /*  flags is 0-7 bits: 
                                      Value = 2 = L3 (ipv6)
                                  */
    uint8_t    esi[10];           /* 10 byte ESI */
    uint32_t   svcId;             /* Svc-Name Using the OF Encoding */
    uint128_t  sf-ip;             /* v6 address of sf-ip */
    uint32_t   ifIndex;           /* interface id*/
    uint8_t    pad[4];
}; ASSERT(sizeof(alu_axn_redirect_to_ESI_L3_V6) == 48)

The router supports redirection of IPv4 or IPv6 traffic arriving on a Layer 3 interface to a VAS interface bound to an ESI with an EVPN control plane. In this encoding, the SF-IP address represents the VAS interface address, and the ifIndex is the VAS interface ID. An OF controller can program Layer 3 steering with the switch-defined-cookie command enabled using the following OF encoding.

flow_mod:
    instruction type: OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTION,
    action type: OFPAT_EXPERIMENTER(ALU_AXN_REDIRECT_TO_ESI_L3)
    encoding:

struct alu_axn_redirect_to_ESI_L3_V4{
    uint16_t  type;               /* OFPAT_EXPERIMENTER. */
    uint16_t  len;                /* Total Length is a multiple of 8. */
    uint32_t  experimenter;       /* Experimenter ID vendor unique*/
    uint8_t   redirect_type ;     /*  Type = 2 for ESI*/
    uint8_t   flags;              /*  flags is 0-7 bits: 
                                      Value 2 = L3 (ipv4)
                                  */
    uint8_t    esi[10];
    uint32_t   svcId;             /* Svc-Name Using the OF Encoding */
    uint32_t   vas-ip;            /* v4 address of sf-ip */
    uint32_t   ifIndex;           /* vas interface id*/
}; ASSERT(sizeof(alu_axn_redirect_to_ESI_L3_V4) == 24)

struct alu_axn_redirect_to_ESI_L3_V6{
    uint16_t  type;               /* OFPAT_EXPERIMENTER. */
    uint16_t  len;                /* Total Length is a multiple of 8. */
    uint32_t  experimenter;       /* Experimenter ID vendor unique*/
    uint8_t   redirect_type ;     /*  Type = 2 for ESI*/
    uint8_t   flags;              /*  flags is 0-7 bits: 
                                      Value 4 = L3 (ipv6)
                                  */
    uint8_t    esi[10];           /* 10 byte ESI */
    uint32_t   svcId;             /* Svc-Name Using the OF Encoding */
    uint128_t  vas-ip;            /* v6 address of sf-ip */
    uint32_t   ifIndex;           /* vas interface id*/
    uint8_t    pad[4]
}; ASSERT(sizeof(alu_axn_redirect_to_ESI_L3_V6) == 40)

The router supports traffic steering to an RSVP, MPLS-TP, IPv4 SR-TE, or IPv6 SR-TE LSP. The following shows the OF encoding to be used by an OF controller.

flow_mod: 
instruction type: OFPIT_WRITE_ACTIONS or OFPIT_APPLY_ACTION, 
action type: OFPAT_OUTPUT, 

The port uses SR OS LOGICAL port encoding RSVP-TE, SR-TE, or MPLS-TP LSP as described in the SR OS H-OFS logical port section.

An LSP received in a flow rule is compared against those in the H-OFS logical port table. If the table does not contain the LSP, the rule programming fails. Otherwise, the rule is installed in an ACL filter. As long as any path within the LSP is UP, the redirect rule forwards unicast IPv4 or IPv6 traffic on the current best LSP path by adding an LSP transport label and, in the case of IPv6 traffic, also adding an explicit NULL label.

When an LSP in the H-OFS logical port table goes down, the OF switch removes the LSP from its logical port table and notifies the controller of that fact if the logical port status reporting is enabled. It is up to the OF controller to decide whether to remove rules using this LSP. If the rules are left in the flow table, the traffic that was to be redirected to this LSP instead is subject to a forward action for this flow rule. If the controller does not remove the entries and the system reuses the LSP identified for another LSP, the rules left in the flow table start redirecting traffic onto this new LSP.

In some deployments, an SDN controller may need to learn from the router H-OFS logical ports status. To support this function, the OF switch supports optional status reporting using asynchronous OF protocol messages for ports status change.

The router supports redirection of IPv4 traffic arriving on a Layer 3 interface for ISA NAT processing. An OF controller can program NAT steering for H-OFS instances with the switch-defined-cookie command enabled using the following OF encoding.

flow_mod:
    instruction type: OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTION,
    action type: OFPAT_OUTPUT,

The port uses SR OS LOGICAL port encoding as described in the SR OS H-OFS logical port section.

For traffic arriving on a VPLS interface, a router supports PBF to steer traffic over another VPLS SAP in the same service. An OF controller can rely on this functionality and program PBF steering action for H-OFS instances with the switch-defined-cookie command enabled using the following OF encoding.

flow_mod:
instruction type: OFPIT_WRITE_ACTIONS or OFPIT_APPLY_ACTION, 
Action 1:
action type: OFPAT_OUTPUT, 

The port uses encoding as described in the SR OS H-OFS port and VLAN encoding section.

Action 2:
action type=OFPAT_SET_FIELD

OXM TLVs encode SAP VLANs as described in the SR OS H-OFS port and VLAN encoding section:

- OXM_OF_VLAN_VID 
- OFL_OUT_VLAN_ID (optional)

For traffic arriving on a VPLS interface, a router supports PBF to steer traffic over a VPLS SDP in the same service. An OF controller can rely on this functionality and program PBF steering action for H-OFS instances with switched-defined-cookie enabled using the following OF encoding.

ALU_IPD_EXPERIMENTER_ID:  0x000025BA
ALU_AXN_REDIRECT_TO_SDP: 1     
flow_mod: 
instruction= OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTIONS, 
action= OFPAT_EXPERIMENTER(ALU_AXN_REDIRECT_TO_SDP), 
encoding:
struct alu_axn_redirect_to_sdp{
uint16_t type;                   /* OFPAT_EXPERIMENTER. */
uint16_t len;                    /* Total Length is a multiple of 8. */
uint32_t experimenter;           /* Experimenter ID vendor unique*/
uint8_t    redirect_type;        /* Type = 0 for SDP*/
uint8_t    flags;               /
* Flags that can be used to denote    info(reserved)*/
uint16_t sdp-id;                 /* Sdp-id*/
uint32_t vcId;                   /* Vc-id*/
unit8_t    pad[0];                /* Not needed */
}; ASSERT(sizeof(alu_axn_redirect_to_sdp) == 16)

In case of erroneous programming, the following experimenter-specific errors are returned to the controller:

enum alu_err_exp_class
{
ALU_ERR_CLASS_RD_TO_SDP      = 0,
ALU_ERR_CLASS_RD_TO_NHOP     = 1,
}
enum alu_err_redirect_to_sdp
{
ALU_ERR_RS_INVALID_FLAGS     = 0
ALU_ERR_RS_INVALID_ARGS      = 1
ALU_ERR_RS_INVALID_SDP_ID    = 2
ALU_ERR_RS_INVALID_VC_ID     = 3
}

The router supports traffic steering within a VPRN, enabling the transport tunnels used by the SDP to be used for specific flows redirected from the system-selected default. This redirection enables large bandwidth flows to be moved to an alternative LSP.

For matching ingress traffic on a VPRN, the switch-defined-cookie command must be enabled, with the cookie encoded to match the ingress VPRN’s service ID.

Traffic can be redirected to the following:

• the default PE and a different LSP

• a different PE and the default LSP

• the default PE and the default LSP (traffic that may otherwise egress a SAP takes a specified BGP next hop)

• the default PE and a different VRF

• a different PE, the default LSP, and a different prefix

Parameters must be matched in the OF encoding to steer traffic.

flow_mod:
instruction type: OFPIT_WRITE_ACTIONS/OFPIT_APPLY_ACTION, 

Action 1:
action type: OFPAT_EXPERIMENTER
ALU_IPD_EXPERIMENTER_ID:  0x000025BA
ExpType= ALU_AXN_REDIRECT_TO_NEXTHOP,

Action 2:
action type: OFPAT_OUTPUT, 

port= SR OS LOGICAL port encoding RSVP-TE, MPLS-TP LSP, or segment routing, as described in SR OS H-OFS logical port section.

Action 3 (optional): to redirect to a different VPRN

Action 3:
action type: OFPAT_EXPERIMENTER
ALU_IPD_EXPERIMENTER_ID:  0x000025BA
ExpType= ALU_AXN_REDIRECT_TO_VPRN,

Encoding:

struct alu_axn_redirect_to_vprn {
    uint16_t              type;                   /* OFPAT_EXPERIMENTER =>  ff ff */
    uint16_t              len;
    uint32_t              experimenter;           /
* Vendor specific experimenter id => 00 00 25 ba */
    uint8_t               exp_axn_type;          /*  type => 03 */
    uint8_t               exp_axn_flags;         /* flag => any value is accepted */
    uint8_t               pad[2];                /* pad => 00 00  */         
    uint32_t              vprn;                  /* vrpn svc id */
};ASSERT(sizeof(alu_axn_redirect_to_vprn) == 16)

Action 4 (optional): to redirect to a different prefix

Action 4:
action type: OFPAT_SET_FIELD

Field is an IP destination address. Subnet masks are not supported in the set_field instruction.

An OF controller can program forward action, when a specific flow is to be forwarded using regular router forwarding. This would be a default behavior if the filter policy embedding this OF switch instance has a default-action forward and no filter policy rule matches the flow. To implement forward action, the following OF encoding is used.

flow_mod: 
instruction type: OFPIT_WRITE_ACTIONS or OFPIT_APPLY_ACTION, 
action type: OFPAT_OUTPUT, 
port= NORMAL

where NORMAL is an OF reserved value.

An OF controller can program a drop action, when packets of a specific flow are to be dropped. To implement a drop action, the OF encoding is a wildcard rule with empty action-set.

Packets that do not match any of the flow table entries programmed by the controller are subject to a default action. Use the following command to configure the default action:

• MD-CLI

  configure openflow of-switch flowtable mismatch-action fall-through

• classic CLI

  configure open-flow of-switch flowtable no-match-action fall-through

Three possible no-match actions are supported: drop, fall-through (packets are forwarded with regular processing by the router), and packet-in.

The packet-in action causes packets that do not match entries in the flow table, as programmed by the OpenFlow controller, to be extracted and sent to the controller in a flow-controlled manner. Because EQUAL is supported, packet-in messages are sent to all controllers in the UP state. To protect the controller, only the first packet of a specific 5-tuple flow (source IP address, destination IP address, source port, destination port, protocol) to which the no-match action is applied is sent to the controller. This 5-tuple flow context ages out after 10 s. Each switch instance maintains contexts for up to 8192 outstanding packet-in messages to the controller. If the packet-in action is used, an auxiliary channel should be enabled for packet-in processing. Use the following command to enable the packet-in processing:

• MD-CLI

  configure openflow of-switch aux-channel true

• classic CLI

  configure open-flow of-switch aux-channel-enable

A count of packets to which packet-in is applied is also available through the OpenFlow channel statistics.

The router supports DSCP remarking of IPv4 and IPv6 packets arriving on VPLS, VPRN, GRT, and system interfaces for OFS instances with the switch-defined-cookie command enabled using the following OF encoding.

flow_mod:
    instruction type: OFPIT_METER
    action type:  with the meterId.

The meters are configured using meter modification messages, and are configured before the flow messages are sent with meter instruction.

typedef struct tOfpMeterModMsg
{
    tOfpMsgHeader       msgHdr;
    uint16_t            mtrCommand;    /* One of OFP_MTR_CMD_*. */
    uint16_t            mtrConfig;     /* bitmap of OFP_MTR_CFG_*. */
    uint32_t            mtrId;         /* Meter instance. */
    tOfpMeterBandHeader bands[0];      /* The band list length is inferred from
                                       the length field in the msgHdr. */
} tOfpMeterModMsg;

typedef struct tOfpMeterBandHeader
{
    uint16_t            bandType;      /* One of OFP_MTR_BAND_*. */
    uint16_t            length;        /* Length in bytes of this band. */
    uint32_t            rate;          /* Rate for this band. */
    uint32_t            burstSize;     /* Size of bursts. */
} tOfpMeterBandHeader;
 
typedef enum eOfpMeterBandType
{
    OFP_MTR_BAND_DROP         = 1,             /* Drop packet. */
    OFP_MTR_BAND_DSCP_REMARK  = 2,             /* Remark DSCP in the IP header. */
    OFP_MTR_BAND_EXPERIMENTER = 0xFFFF         /* Experimenter meter band. */
} eOfpMeterBandType;

typedef struct tOfpMeterBandDscpRemark
{
    tOfpMeterBandHeader  bandHdr;      /* OFP_MTR_BAND_DSCP_REMARK */
    uint8_t              precLevel;    /* Number of drop precedence level to add */
    uint8_t              pad[3];
} tOfpMeterBandDscpRemark;