Software-Defined Networking (SDN) was developed to meet the growing requirements of virtualization technologies and data networks. SDN uses software to separate controlling functions from data forwarding, and provides simple, flexible device operations and high extensibility.

OpenFlow is the communication interface between a controller and network devices to implement SDN. With OpenFlow, you can perform centralized data forwarding management for physical and virtual devices.

Overview

OpenFlow separates the data forwarding and routing decision functions. It keeps the flow-based forwarding function and uses a separate controller to make routing decisions. A switch communicates with the controller through a secure channel.

Figure 1 OpenFlow network diagram

Basic concepts

OpenFlow switch

OpenFlow switches include the following types:

· OpenFlow-only—Supports only OpenFlow operation.

· OpenFlow-hybrid—Supports both OpenFlow operation and traditional Ethernet switching operations. Switches of this series are OpenFlow-hybrid switches.

OpenFlow port

OpenFlow supports the following types of ports:

· Physical port—Corresponds to a hardware interface of a switch, such as an Ethernet interface. A physical port can be either an ingress port or an output port.

· Logical port—Does not correspond to a hardware interface of a switch and might be defined by non-OpenFlow methods. For example, aggregate interfaces are logical ports. A logical port can be either an ingress port or an output port.

IMPORTANT:

The switch does not support loopback interfaces.

· Reserved port—Defined by OpenFlow to specify forwarding actions. Reserved ports include the following types:

? All—All OpenFlow ports that can be used to forward a packet.

? Controller—OpenFlow controller.

? Local—Local CPU.

? Normal—Normal forwarding process.

? Flood—Flooding.

Except the Any type, all reserved ports can be used only as output ports.

OpenFlow flow table

An OpenFlow switch matches packets with one or more user-defined flow tables. A flow table contains flow entries, and packets are matched based on the matching precedence of flow entries.

Figure 2 Flow entry components

OpenFlow flow tables include the following types:

· MAC-IP—Combines the MAC address table and FIB table.

A MAC-IP flow table provides the following match fields:

? Destination MAC address.

? VLAN.

? Destination IP address.

A MAC-IP flow table provides the following actions:

? Modifying the destination MAC address.

? Modifying the source MAC address.

? Modifying the VLAN.

? Specifying the output port.

· Extensibility—Provides more matching fields and actions than a MAC-IP flow table.

A flow entry contains the following fields:

· Match fields—Matching rules of the flow entry, including the ingress port, packet headers, and metadata specified by the previous table.

· Priority—Matching precedence of the flow entry. A packet is matched with the table and only the highest priority flow entry that matches the packet is selected.

· Counters—Counts of the packets that match the flow entry.

· Instructions—Modify the action set or pipeline processing. Instructions include the following types:

? Meter—Directs the packets to the specified meter to rate limit the packets.

? Apply-Actions—Applies the specified actions in the action list immediately.

? Clear-Actions—Clears all actions in the action set immediately.

? Write-Actions—Modifies all actions in the action set immediately.

? Goto-Table—Indicates the next MAC-IP flow table in the processing pipeline.

Actions are executed in one of the following ways:

? Action Set—When the instruction set of a flow entry does not contain a Goto-Table instruction, pipeline processing stops. Then, the actions in the action set are executed. An action set contains a maximum of one action of each type.

? Action List—The actions in the action list are executed immediately in the order specified by the action list. The effect of those actions is cumulative.

· Timeouts—Maximum amount of idle time or hard time for the flow entry.

? idle Time—The flow entry is removed when it has matched no packets during the idle time.

? hard Time—The flow entry is removed when the hard time timeout is exceeded, whether or not it has matched packets.

· Cookies—Flow entry identifier specified by the controller.

Table-miss flow entry

Every flow table must support a table-miss flow entry to process table misses. The table-miss flow entry specifies how to process packets unmatched by other flow entries in the flow table.

The table-miss flow entry wildcards all match fields (all fields omitted) and has the lowest priority 0.

The table-miss flow entry behaves in most ways like any other flow entry.

OpenFlow pipeline

The OpenFlow pipeline processing defines how packets interact with flow tables contained by a switch.

The flow tables of an OpenFlow switch are sequentially numbered, starting at 0. The packet is first matched with flow entries of the first flow table, which is flow table 0. A flow entry can only direct a packet to a flow table with a number greater than its own flow table number.

When a packet matches a flow entry, the OpenFlow switch updates the action set for the packet and passes the packet to the next flow table. In the last flow table, the OpenFlow switch executes all actions to modify packet contents and specify the output port for packet forwarding. If the instruction set of a flow table contains an action list, the OpenFlow switch immediately executes the actions for a copy of the packet in this table.

Figure 3 OpenFlow forwarding workflow

Group table

The ability for a flow entry to point to a group enables OpenFlow to represent additional methods of forwarding. A group table contains group entries.

Figure 4 Group entry components

A group entry contains the following fields:

· Group Identifier—A 32 bit unsigned integer uniquely identifying the group.

· Group Type—Type of the group.

· Counters—Updated when packets are processed by a group.

· Action Buckets—An ordered list of action buckets, where each action bucket contains a set of actions to execute and associated parameters.

Meter table

Meters enable OpenFlow to implement various simple QoS operations, such as rate-limiting. A group table contains meter entries.

Figure 5 Meter entry components

A meter entry contains the following fields:

· Meter Identifier—A 32 bit unsigned integer uniquely identifying the meter.

· Meter Bands—Each meter can have one or more meter bands. Each band specifies the rate at which the band applies and the way packets should be processed. If the current rate of packets exceeds the rate of multiple bands, the band with the highest configured rate is used.

· Counters—Updated when packets are processed by a meter.

Figure 6 Band components

A meter band contains the following fields:

· Band Type—Packet processing methods. Packets that exceed the band rate are dropped.

· Rate—Defines the lowest rate at which the band can apply.

· Counters—Updated when packets are processed by a band.

· Type Specific Arguments—Some band types have optional arguments.

OpenFlow instance

You can configure one or more OpenFlow instances on the same device. A controller considers each OpenFlow instance as a separate OpenFlow switch and deploys forwarding instructions to it.

In this chapter, an OpenFlow switch is the same as an OpenFlow instance, unless otherwise specified.

Associated VLAN

When an OpenFlow instance is associated with VLANs, the flow tables take effect on packets only within those VLANs.

Activation and reactivation

The controller can deploy flow entries only to activated OpenFlow instances.

An activated OpenFlow instance need be reactivated when any of the following parameters are changed:

· Associated VLANs.

· Flow tables.

· Maximum number of supported flow entries.

After reactivation, the OpenFlow instance is disconnected from all controllers and then reconnected to them.

OpenFlow instance port

An OpenFlow switch sends information about the following ports to the controller:

· Physical ports.

· Logical ports.

· Reserved ports of the local type.

These ports belong to the VLANs that are associated with the OpenFlow instance. To prevent errors, make sure all associated VLANs are within the list of the VLANs to which the ports are assigned.

Protocols and standards

OpenFlow Switch Specification Version 1.3.1

OpenFlow configuration task list

Tasks at a glance
(Required.) Configure an OpenFlow instance: 1. (Required.) Creating an OpenFlow instance 2. (Required.) Configuring an OpenFlow instance: ? (Required.) Configuring the OpenFlow instance mode ? (Optional.) Configuring flow tables for an OpenFlow instance ? (Optional.) Setting the controller mode ? (Optional.) Setting the maximum number of flow entries ? (Optional.) Configuring inband management VLANs ? (Optional.) Preventing an OpenFlow instance from reporting the specified types of ports to controllers ? (Optional.) Configuring the default action of table-miss flow entries ? (Optional.) Setting the datapath ID for an OpenFlow instance 3. (Required.) Activating or reactivating an OpenFlow instance
(Required.) Configure controllers for an OpenFlow switch: · (Required.) Configuring controllers and main connections · (Optional.) Setting the connection interruption mode
(Optional.) Setting OpenFlow timers
(Optional.) Configuring an OpenFlow instance to support dynamic MAC addresses
(Optional.) Disabling logging for successful flow table modifications
(Optional.) Allowing dynamic ARP entries to overwrite OpenFlow ARP entries
(Optional.) Refreshing all Layer 3 flow entries in the MAC-IP flow table for an OpenFlow instance
(Optional.) Allowing link aggregation member ports to be in the deployed flow tables
(Optional.) Setting a DSCP value for OpenFlow packets
(Optional.) Enabling OpenFlow connection backup

Configuring OpenFlow instances

To use LLDP together with OpenFlow, you must enable LLDP globally on OpenFlow switches. As a best practice to prevent LLDP from affecting topology discovery of OpenFlow controllers, disable LLDP on ports of OpenFlow instances. For more information about LLDP, see Layer 2—LAN Switching Configuration Guide.

Creating an OpenFlow instance

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create an OpenFlow instance and enter OpenFlow instance view.	openflow instance instance-id	By default, no OpenFlow instance exists.
3. (Optional.) Configure a description for the OpenFlow instance.	description text	By default, an OpenFlow instance does not have a description.

Configuring the OpenFlow instance mode

By default, an OpenFlow instance is in VLAN mode. When an OpenFlow instance is associated with VLANs, the flow entries take effect only on packets within those VLANs.

When the global mode is enabled for an OpenFlow instance, the flow entries take effect on packets within the network. All interfaces on the device belong to the OpenFlow instance, including VLAN interfaces, Layer 2 or Layer 3 Ethernet interfaces, and tunnel interfaces.

When you associate an OpenFlow instance with VLANs, follow these guidelines:

· For VLAN traffic to be processed correctly, do not associate multiple OpenFlow instances with the same VLAN.

· To ensure correct traffic processing, assign an Ethernet interface to only one OpenFlow instance.

· When you activate an OpenFlow instance that is associated with non-existent VLANs, the system automatically creates the VLANs. Do not delete any of these VLANs after the OpenFlow instance is activated.

· If a VLAN is associated with an OpenFlow instance, do not configure BFD MAD on the VLAN interface of the VLAN. For more information about BFD MAD, see IRF configuration in Virtual Technologies Configuration Guide.

To associate an OpenFlow instance with VLANs:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Configure the OpenFlow instance scope.	· Enable the global mode for the OpenFlow instance: classification global · Associate the OpenFlow instance with VLANs. classification vlan vlan-id [ mask vlan-mask ] [ loosen ]	Use either command. By default, an OpenFlow instance is not associated with any VLANs. If you execute the classification global and classification vlan commands multiple times, the most recent configuration takes effect.

Configuring flow tables for an OpenFlow instance

You can configure one MAC-IP flow table and one extensibility flow table for an OpenFlow instance. For an OpenFlow instance, the MAC-IP flow table ID must be smaller than the extensibility flow table ID.

To configure flow tables for an OpenFlow instance:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Configure flow tables for the OpenFlow instance.	flow-table { extensibility table-id \| mac-ip table-id }*	By default, an OpenFlow instance contains one extensibility flow table with an ID of 0. An OpenFlow instance supports only one MAC-IP flow table and one extensibility flow table. If you execute the command multiple times, the most recent configuration takes effect.

Setting the controller mode

An OpenFlow instance can connect to one or more controllers, depending on the controller mode the OpenFlow instance uses:

· Single—The OpenFlow instance connects to only one controller at a time. When communication with the current controller fails, the OpenFlow instance uses another controller. In this mode, an OpenFlow instance attempts to connect to a controller one by one according to the controller ID in ascending order until it successfully connects to a controller. If multiple controllers that are configured for the OpenFlow instance are unreachable, the OpenFlow instance might take a long time to connect to a reachable controller.

· Multiple—The OpenFlow instance can simultaneously connect to multiple controllers. When communication with a controller fails, the OpenFlow instance attempts to reconnect to the controller after a reconnection interval.

To set the controller mode for an OpenFlow instance:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Set the controller mode.	controller mode { multiple \| single }	By default, the multiple mode is used.

Setting the maximum number of flow entries for an extensibility flow table

You can set the maximum number of flow entries that each extensibility flow table supports. When the maximum number is reached, the OpenFlow instance does not accept new flow entries for that table and sends a deployment failure notification to the controller.

To set the maximum number of flow entries that each extensibility flow table supports:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Set the maximum number of extensibility flow entries.	flow-entry max-limit limit-value	By default, an OpenFlow extensibility flow table supports at most 65535 flow entries.

Configuring inband management VLANs

Inband management VLANs of an OpenFlow instance are used to establish connections between the OpenFlow instance and controllers.

The data packets within the inband management VLANs of an OpenFlow instance are not forwarded through OpenFlow. The ports that are assigned only to inband management VLANs are not OpenFlow ports. Before configuring inband management VLANs, you must plan the network.

To configure inband management VLANs:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Configure inband management VLANs.	in-band management vlan vlan-list	By default, no inband management VLAN is configured. The inband management VLANs of an OpenFlow instance must be within the list of the VLANs that are associated with the OpenFlow instance. This feature is applicable only to OpenFlow instances in VLAN mode.

Preventing an OpenFlow instance from reporting the specified types of ports to controllers

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Prevent the OpenFlow instance from reporting the specified types of ports to controllers.	forbidden port { vlan-interface \| vsi-interface } *	By default, all ports that belong to an OpenFlow instance are reported to the controllers.

Configuring the default action of table-miss flow entries

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Change the default action of table-miss flow entries to forward packets to the normal pipeline.	default table-miss permit	By default, the default action of table-miss flow entries is to drop packets after the OpenFlow instance is activated and before the controller deploys flow entries.

Setting the datapath ID for an OpenFlow instance

In an OpenFlow network, each OpenFlow instance is uniquely identified by a datapath ID. By default, the datapath ID of an OpenFlow instance contains the instance ID and the bridge MAC address.

To set the datapath ID for an OpenFlow instance:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Set the datapath ID for the OpenFlow instance.	datapath-id datapath-id	By default, the datapath ID of an OpenFlow instance contains the instance ID and the bridge MAC address. The upper 16 bits are the instance ID and the lower 48 bits are the bridge MAC address.

Activating or reactivating an OpenFlow instance

CAUTION:

Reactivating an OpenFlow instance refreshes the configuration data and interrupts communication with the controllers.

To activate or reactivate an OpenFlow instance:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Activate or reactivate the OpenFlow instance.	active instance	By default, an OpenFlow instance is not activated.

Configuring controllers for an OpenFlow switch

Configuring controllers and main connections

An OpenFlow switch supports up to 64 controllers. However, the OpenFlow channel between the OpenFlow switch and each controller can have only one main connection, which uses TCP or SSL. The main connection must be reliable and processes control messages to complete operations such as deploying entries, obtaining data, and sending information.

To specify a controller for an OpenFlow switch and configure the main connection to the controller:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Specify a controller and configure the main connection to the controller.	controller id address { ip ip-address \| ipv6 ipv6-address } [ port port-number ] [ local address { ip local-ip-address \| ipv6 local-ipv6-address } [ port local-port-number ] ] [ ssl ssl-policy-name ] [ vrf vrf-name ]	By default, an OpenFlow instance does not have a main connection to a controller.

Setting the connection interruption mode

An OpenFlow switch is set to either of the following modes when it is disconnected from all controllers:

· Secure—In this mode, the OpenFlow switch forwards traffic based on flow tables and does not delete unexpired flow entries.

· Standalone—The OpenFlow switch uses the normal forwarding process and does not delete the flow entries.

To set the connection interruption mode for an OpenFlow switch:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Set the connection interruption mode.	fail-open mode { secure \| standalone }	By default, the secure mode is used.

Setting OpenFlow timers

An OpenFlow switch supports the following timers:

· Connection detection interval—Interval at which the OpenFlow switch sends two consecutive Echo Request messages to a controller. The OpenFlow switch can send up to three Echo Request messages. If none of the requests receives a reply, the OpenFlow switch is disconnected from the controller.

· Reconnection interval—Interval for the OpenFlow switch to wait before it attempts to reconnect to a controller.

To set OpenFlow timers for an OpenFlow switch:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Set the connection detection interval.	controller echo-request interval interval-value	The default setting is 5 seconds. As a best practice to reduce the CPU load, set the connection detection interval to a large value.
4. Set the reconnection interval.	controller connect interval interval-value	The default setting is 60 seconds.

Configuring an OpenFlow instance to support dynamic MAC addresses

On an OpenFlow switch that supports MAC-IP flow tables, you can configure OpenFlow to support querying and deleting dynamic MAC addresses in the flow tables.

To configure an OpenFlow instance to support dynamic MAC addresses:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Configure the OpenFlow instance to support dynamic MAC addresses.	mac-ip dynamic-mac aware	By default, OpenFlow prohibits controllers from querying and deleting dynamic MAC addresses. This feature is applicable only to OpenFlow instances in VLAN mode.

Disabling logging for successful flow table modifications

This feature disables logging for successful flow table modifications. Logging for other events is not affected.

To disable logging for successful flow table modifications:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Disable logging for successful flow table modifications.	flow-log disable	By default, logging for successful flow table modifications is enabled.

Allowing dynamic ARP entries to overwrite OpenFlow ARP entries

Perform this task to increase the precedence of dynamic ARP entries to overwrite OpenFlow ARP entries. OpenFlow ARP entries are generated based only on the MAC-IP flow table of an OpenFlow instance.

To allow dynamic ARP entries to overwrite OpenFlow ARP entries:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Configure the OpenFlow instance to allow dynamic ARP entries to overwrite OpenFlow ARP entries.	precedence dynamic arp	By default, an OpenFlow instance does not allow dynamic ARP entries to overwrite OpenFlow ARP entries.

Refreshing all Layer 3 flow entries in the MAC-IP flow table for an OpenFlow instance

Perform this task to obtain all Layer 3 flow entries in the MAC-IP flow table from the controller again if the Layer 3 flow entries have been overwritten.

To refresh all Layer 3 flow entries in the MAC-IP flow table for an OpenFlow instance:

Step	Command
1. Enter system view.	system-view
2. Enter OpenFlow instance view.	openflow instance instance-id
3. Refresh all Layer 3 flow entries in the MAC-IP flow table.	refresh ip-flow

Allowing link aggregation member ports to be in the deployed flow tables

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Allow link aggregation member ports to be in the deployed flow tables.	permit-port-type member-port	By default, link aggregation member ports cannot be in the deployed flow tables.

Setting a DSCP value for OpenFlow packets

Step	Command	Remarks
1. Enter system view	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Set a DSCP value for OpenFlow packets.	tcp dscp dscp-value	By default, the DSCP value for OpenFlow packets is 16. This configuration takes effect only on OpenFlow packets over the main connection that the OpenFlow instance establishes with a controller through TCP.

Enabling OpenFlow connection backup

This feature enables an OpenFlow instance to back up OpenFlow connections established over TCP. This prevents connection interruption when an active/standby switchover occurs.

To enable OpenFlow connection backup:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter OpenFlow instance view.	openflow instance instance-id	N/A
3. Enable OpenFlow connection backup.	tcp-connection backup	By default, OpenFlow connection backup is enabled.

Displaying and maintaining OpenFlow

Execute display commands in any view.

Task	Command
Display the detailed information for an OpenFlow instance.	display openflow instance [ instance-id ]
Display flow table entries for an OpenFlow instance.	display openflow instance instance-id flow-table [ table-id ]
Display controller information for an OpenFlow instance.	display openflow instance instance-id controller
Display group table information for an OpenFlow instance.	display openflow instance instance-id group [ group-id ]
Display meter information for an OpenFlow instance.	display openflow instance instance-id meter [ meter-id ]
Display summary OpenFlow instance information.	display openflow summary
Clear statistics about packets that a controller sends and receives for an OpenFlow instance.	reset openflow instance instance-id controller [ controller-id ] statistics

OpenFlow configuration example

Network requirements

As shown in Figure 7, perform the following tasks on the switch to enable OpenFlow communication with the controller in specific VLANs:

· Create OpenFlow instance 1, associate VLANs 4092 and 4094 with the OpenFlow instance, and activate the OpenFlow instance.

· Configure the controller's IP address to have the controller manage the OpenFlow switch.

Figure 7 Network diagram

Configuration procedure

# Create VLANs 4092 and 4094.

<Switch> system-view

[Switch] vlan 4092

[Switch-vlan4092] port ten-gigabitethernet 1/0/1

[Switch-vlan4092] quit

[Switch] vlan 4094

[Switch-vlan4092] port ten-gigabitethernet 1/0/2

[Switch-vlan4092] quit

# Create OpenFlow instance 1 and associate VLANs with it.

[Switch] openflow instance 1

[Switch-of-inst-1] classification vlan 4092 mask 4093 loosen

# Specify a controller for the OpenFlow instance and activate the instance.

[Switch-of-inst-1] controller 1 address ip 192.168.49.49

[Switch-of-inst-1] active instance

Verifying the configuration

# Display the detailed information for OpenFlow instance 1.

[Switch-of-inst-1] display openflow instance 1

Instance 1 information:

Configuration information:

Description : --

Active status : Active

Inactive configuration:

None

Active configuration:

Classification VLAN, total VLANs(2)

4092, 4094

In-band management VLAN, total VLANs(0)

Empty VLAN

Connect mode: Multiple

Mac address learning: Enabled

TCP DSCP value: 0

Flow table:

Table ID(type): 0(Extensibility), count: 0

Flow-entry max-limit: 65535

Datapath ID: 0x00010cda415e232e

Default table-miss: Drop

Forbidden port: None

TCP connection backup: Enabled

Port information:

Ten-GigabitEthernet1/0/1

Ten-GigabitEthernet1/0/2

Active channel information:

Controller 1 IP address: 192.168.49.49 port: 6633

16-OpenFlow Configuration Guide

OpenFlow switch

OpenFlow port

OpenFlow flow table

Table-miss flow entry

OpenFlow pipeline

Group table

Meter table

Associated VLAN

Activation and reactivation

OpenFlow instance port

Setting the maximum number of flow entries for an extensibility flow table

Verifying the configuration

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us