Software Defined Networking

Software-Defined Networking

Software-defined networking capabilities can be supported by hardware in the Science DMZ – software defined networking and OpenFlow allow the flexible provisioning of policies to route science flows. Having Science DMZ components at a single location near the site border means there is a single location to install and configure new technologies such as OpenFlow and connect to services like the Internet2 Innovation platform, the GENI project, or other similar resources.

Software-defined networking concepts and production uses of OpenFlow are still in their early stages of adoption by the community.  Many innovative approaches are still being investigated to develop best practices for the deployment and integration of these services in production environments.  A general use case for SDN is to assist in identifying high profile flows from the general internet, and removing them the general purpose infrastructure. 


With SDN components the identified elephant flow can be removed from the general purpose infrastructure, and placed onto dynamically controlled links.  This seperation allows for better performance in all cases. 

ESnet and its collaborators at Indiana University and University of Delaware have demonstrated an OpenFlow-based Science DMZ architecture that interoperates with a virtual circuit service like OSCARS. An example of how these services might be integrated into a production Science DMZ is outlined below. 

Service Integration - From Test to Deployment

The Science DMZ model allows new services to be tested, validated, and rolled into production once they are proven operationally sound. Testing and deploying Software Defined Networking – particularly the use of OpenFlow as a platform – is a timely example of how this model could be used.  Before experiementation with a potentially production service, it is recommended that a "research" Science DMZ be created. 

Initially, an OpenFlow-capable connection could be brought into the Science DMZ area (e.g. the same physical area of the data center as the production Science DMZ infrastructure), and connected to a stand-alone switch.  A separate test host can be connected to the stand-alone switch for prototyping purposes.  

Note that several aspects of the Science DMZ model are already at work here: the OpenFlow switch need only permit access to the minimum set of hosts necessary to test the prototype service, so the security of the production infrastructure is not put at risk.  By provisioning the prototype in this manner, the service can be tested without the up-front requirement that stateful firewalls or security mechanisms support a cutting-edge service before it's ready for production deployment.

After the service is determined to be production-ready, and the security model for the new service has been vetted, the test host can be removed from the OpenFlow switch, and the OpenFlow switch connected to the production Science DMZ.  By doing so, the Science DMZ is effectively expanded to include the OpenFlow-enabled services, while making only minimal changes to the existing production Science DMZ environment.  Once the OpenFlow technology is available in equipment that also supports the other production Science DMZ functions, the Science DMZ core hardware can be upgraded on normal budget cycles to fully integrate the new OpenFlow-based services.

Open Exchange Software Suite (OESS) and Flow Space Firewall (FSFW)

OESS is a set of software used to configure and control dynamic (user-controlled) layer 2 virtual circuit (VLAN) networks on OpenFlow enabled switches. OESS provides sub-second circuit provisioning, automatic circuit failover, per-interface permissions, and automatic per-VLAN statistics.  More information can be found on the GlobalNOC web page:

FlowSpace Firewall (FSFW) provides network virtualization of OpenFlow enabled switches.  The virtualization happens on a per-vlan tag per-interface basis.  Instead of attempting to interpret a rule and make possible modifications (like FlowVisor) to a flow mod, FlowSpace firewall either allows a rule to pass through or rejects it, and sends an error back to the controller.  More information can be found on the GlobalNOC web page:

The OESS and FSFW user lists are places to hear ask questions, make requests, and hear announcements.  The sign up for each of the lists can be found here: