2020 12th International Conference on Information Technology and Electrical Engineering (ICITEE), Yogyakarta,

Indonesia

Performance Evaluation of Data Center Network

with Network Micro-segmentation
1st Muhammad Mujib 2nd Riri Fitri Sari
Departement of Electrical Engineering Departement of Electrical Engineering
University of Indonesia University of Indonesia
Depok, Indonesia Depok, Indonesia
[email protected] [email protected]

Abstract—Research on the design of data center throughput, and the level of availability. The flexibility of
infrastructure is increasing, both from academia and industry, development (scalability), in addition to the flexibility in
due to the rapid development of cloud-based applications such installing a large number of servers and the flexibility in
as search engines, social networks, and large-scale computing. progress are essential factors in the future. Another problem
On a large scale, data centers can consist of hundreds to with data center network systems is the use of static resources
thousands of servers that require systems with high- using VLAN mechanisms based on each application's needs.
performance requirements and low downtime. To meet the In addition to the advantages of VLANs in terms of
network's needs in a dynamic data center, infrastructure of performance and network traffic isolation, VLANs is lacking
applications and services are growing. It takes a process of
on the agility. This is because the concept of VLAN integrates
designing a network topology so that it can guarantee
availability and security. One way to surmount this is by
many aspects such as network traffic management, security
implementing the zero trust security model based on micro- and isolation performance, and traffic on a VLAN becomes
segmentation. Zero trust is a security idea based on the principle one, causing a high level of oversubscription on core
of “never trust, always verify” in which no concepts of trust and networks. In conventional data center networks, the design of
untrust in network traffic. The zero trust security model load balancing mechanisms is limited by the applications
implemented network traffic in the form of untrust. deployed. The fragmentation of resources sorted out this
Microsegmentation is a way to achieve zero trust by dividing a problem by dividing them into smaller subnets to restrict
network into smaller logical segments to restrict the traffic. In access to resources that are not needed at the same time. We
this research, data center network performance based on conducted simulations to determine micro-segmentation
software-defined networking with zero trust security model performance by measuring round trip time, jitter, and packet
using micro-segmentation has been evaluated using a testbed loss on east-west data center traffic using a testbed simulation.
simulation of Cisco Application Centric Infrastructure by This research was conducted on east-west traffic using SDN
measuring the round trip time, jitter, and packet loss during technology that focuses on data centers that makes the
experiments. Performance evaluation results show that micro- network more flexible, dynamic, and cost-effective. SDN can
segmentation adds an average round trip time of 4 μs and jitter simplify the complexity of operations, thereby increasing
of 11 μs without packet loss so that the security can be improved performance on network systems [5]. The testbed simulation
without significantly affecting network performance on the data using a Cisco Application Centric Infrastructure (ACI) is
center.
based on software-defined networking with zero trust security
Keywords—data center network, micro-segmentation,
model based on micro-segmentation because of
software defined networking, zero trust security programmable fabrics, dynamically provisioned, and scalable,
Cisco ACI is the best choice [6].
I. INTRODUCTION The structure of the rest of this paper is as follows. We
provide the related work in Section 2. In Section 3, we
Data center network requirements can be met using
show the material and method. Section 4 presents the
interconnected switches, which is referred to as data center
results and discussion for the evaluation performance of
networks in this paper [1]. In its application, most of the data
micro-segmentation simulation in detail and provides
center network technology uses ethernet technology. The use
evaluation performance studies. In Section 5, we offer a
of Ethernet technology on data center networks is
conclusion and future work.
implemented using the Ethernet-switched or Internet
Protocol-routed (IP- routed) method. Ethernet-switched and II. RELATED WORKS
IP-routed, each has advantages and disadvantages; one of the
essential factors to consider is one a high level of flexibility in Hernandez, L. et al. [7] conducted research using the
development. Flexibility aims to meet the availability of methodology of preparation, planning, design,
networks for interconnection from thousands to millions of implementation, operation, and optimization (PPDIOO) by
servers if one day is needed on a data center network. building and comparing conventional IP network simulation
Somethings that need to be considered in technology selection systems and Software-Defined Networking (SDN).
are the ability to handle massive traffic (packet forwarding), Traditional IP network simulations run on Enhanced Interior
routing features efficiently, and the ability to process Gateway Routing Protocol (EIGRP) and Border Gateway
migration on a virtual machine (VM) [2]. Protocol (BGP) protocols using GNS3 simulators. In
Problem-solving in data center networks using approaches contrast, SDN-based network simulation systems with
by following IETF standards is an interesting topic. Greenberg OpenFlow protocols and POX controllers use Mininet
et al. [3] and Zhang et al. [4] explain the problems that are simulators. In this study, the variables on network
often encountered in data center networks, among others, in performance measured and compared are delay, throughput,
terms of flexibility of development (scalability), data integrity, and jitter. The test was carried out using a ping mechanism

thorized licensed use limited to: AMRITA VISHWA VIDYAPEETHAM AMRITA SCHOOL OF ENGINEERING. Downloaded on May 09,2024 at 11:38:18 UTC from IEEE Xplore. Restrictions appl
978-1-7281-1097-4/20/$31.00 ©2020 IEEE 27
 2020 12th International Conference on Information Technology and Electrical Engineering (ICITEE), Yogyakarta,
Indonesia

using IPv4 and IPv6 as many as 500 data packets with planning, design, implementation, operation, and
variable-size data sent by 200 Bytes, 1,000 Bytes, 10,000 optimization (PDIOO) and building a testbed simulation
Bytes, and 15,000 Bytes. In the process of measurement with environment in the form of a cubicle container system design
the ping mechanism, traffic recording is recorded on the by implementing network security using a zero trust model.
network using the Wireshark tool, the results used as analysis Tests on the testbed simulation environment in the way of
material. The study results showed that the measurement propagation of data transmission paths in network traffic
results using an SDN-based network system showed better (routing) using the BGP protocol and port scanning using the
performance than using a traditional IP-based network Nmap tool. The test is carried out using the concept of zero
system both in measurements using IPv4 and IPv6. On the trust in which all network traffic is considered untrustworthy
other hand, the SDN network system is a new technology in by applying a configuration that rejects all network traffic.
network design and implementation that is dynamic, flexible, The test results show that the testbed simulation's design
and easy to implement for current network and application using the zero trust security model was successfully
needs. implemented by preventing attacks in the form of route
Kasi, A. A., et al. [8] conducted a study using the testbed hijacking and scanning on the network from external parties
simulation method by analyzing the core switch network's by applying a configuration on the perimeter firewall. On the
performance by building a testbed simulation using a switch other hand, the use of labels on Kubernetes is used to limit
device with different brands and types, namely 3Com 3500 network traffic to the internal container environment by
and Cisco 3550. The study was conducted by developing a restricting communication to unidentified and unauthorized
testbed simulation system with five topology systems. The network traffic, looking at the tags used on the test
difference is topology without VLAN, topology with the mechanism.
same VLAN (intra-VLAN), topology with different VLANs
(inter-VLAN), topology with different VLANs and operating III. THE MATERIAL AND METHOD
systems, and topologies with spanning tree protocols. The A. Software Defined Networking
variables used to measure performance are consistency,
Software-Defined Networking (SDN) is a relatively new
throughput, and latency. Performance measurement is done technology for designing and controlling network devices, so
by sending a data packet of 589 MB. As many as eight times, that limitations on network devices can be overcome, using
the transmission is made between 2 computer systems using two methods [11]. First, the separation between the control
the FileZilla tool and then recording the traffic using the plane and the data plane; in this case, the network device
Wireshark tool for the analysis process. In addition to this, functions only to forward the data packet so that it becomes
measurements were made using the ping mechanism and simpler and improves performance. Second, the division of
recording using Wireshark to determine the topology's vertical integration functions in logical systems that control
performance with the spanning tree protocol. The results of the network with network devices that forward data packets.
performance measurements using a testbed simulation with Logical tasks that control the network can be implemented
five scenarios show that 3Com shows a consistent using a centralized controller to facilitate the configuration
consistency but is lower than Cisco, which shows and application of policies relating to the system. Besides, the
inconsistent consistency. Cisco shows better data separation of the control plane with the data plane aims to
transmission compared to 3Com. On the other hand, 3Com promote the development of innovation by adding other
shows better performance in sending data at the Layer 2 features on the network such as load balancing, firewalls,
mechanism. Based on the results of performance IDS/IPS, and others.
measurements show that Cisco has better performance when
it functions as a distribution and core layer (L3). In
comparison, 3Com has better performance can be operated as
access ( L2).
Vuletic, D. V. et al. [9] conducted research to measure
computer systems' performance against distributed denial of
services (DDoS) attacks. The study was carried out by
building the same network system between the victim and the
Windows operating system and the attacker with the Linux
operating system (Kali Linux). Testing is done by running the
ping mechanism and carrying out DDoS attacks using the
Fig. 1. Architecture of SDN [12]
hping3 tool from Kali Linux. Hping3 is a free tool that can be
used to simulate network traffic in the form of TCP / IP Fig. 1 shows the architecture of SDN. According to S.
protocol by generating network traffic according to needs Sezer et al. [12], there are four ways to identify SDN
such as TCP Sync flood to flood network channels so that the technology. First, there is a separation in the control plane and
availability of network systems is disrupted. The results of the data plane, so that the device functions only forward the
testing using hping3 show that DDoS attacks succeeded in data packet. In contrast, the device control process is done
disrupting service performance for victims. The result is separately using a controller. Second, monitoring all
indicated in the CPU process has increased. On the other components of network devices can be done using a
hand, monitoring attack suggests that the ping process means centralized controller. Third, the protocol used to
a request time out so that the service becomes unavailable. communicate between the controller and the device. Fourth,
Surantha, N. et al. [10] conducted a study to test the network programming can be done using external applications
performance of network system security design using (third-party).

thorized licensed use limited to: AMRITA VISHWA VIDYAPEETHAM AMRITA SCHOOL OF ENGINEERING. Downloaded on May 09,2024 at 11:38:18 UTC from IEEE Xplore. Restrictions appl
28
 2020 12th International Conference on Information Technology and Electrical Engineering (ICITEE), Yogyakarta,
Indonesia

B. The Zero Trust Security Model D. Micro-segmentation

The zero trust security model is a security concept that is Micro-segmentation is a way of dividing networks into
based on the principle of never trust, always verify. The core smaller segments to limit network traffic. Micro-
concept of zero trust is that there are no more trusted, untrusted segmentation has an advantage over traditional perimeter
user interfaces, networks, and users in the security device. security systems in that a smaller section can reduce the
broader damage from malicious software (malware) attacks,
and access to resources can be controlled based on
established rules [18]. Micro-segmentation is an
implementation of a distributed firewall that regulates access
to network traffic based on security rules that have been
Fig. 2. All interface are untrust [13] determined on each resource. At present, both Cisco ACI and
VMWare NSX are leading vendors in micro-segmentation,
Fig. 2 shows that zero trust treats all network traffic as
each of which has advantages and disadvantages [19]. Fig. 3
untrusted. Zero trust does not say that employees cannot be
trusted, but trust is a concept that should not be applied by shows the concept of micro-segmentation in east-west
information security. The zero trust security model's basic network traffic in the data center.
idea is to verify and secure all resources, tightly restrict access, Northbound Interface (REST APIs)
control, check, and record all network traffic [13]. First, the
application of security and verification of resources is carried Distributed Firewall Manager
out on all access regardless of the source originating. All Southbound Interface
traffic is considered a threat and is not trusted so that traffic is
authorized, checked, and secured. The application of internal
East-West Traffic
security is carried out as the case with external protection.
Second, access restrictions are strictly implemented by VSwitch VSwitch

applying access controls correctly by the rules made so that

access to resources is limited.
C. The Advantage of Zero Trust Security Model VM1 VM2 VM3 VM4 VM5 VM6

The conventional security model uses the concept of trust NIC NIC NIC NIC
and untrust in network traffic, from now on, referred to as the
perimeter concept [14]. In building conventional security
North-South Traffic
models, an organization's concept of the perimeter has been
used to facilitate access from outsiders so that the mitigation
process against attacks can run optimally. In the perimeter
concept, the capability is needed in securing using security
devices such as firewalls and VPNs. The need for security
increases with the development of technologies such as cloud Fig. 3. Micro-segmentation concept [19]
computing and the internet of things that cause cyber attacks,
making the perimeter concept did not run optimally in Along with the development of software-defined
preventing cyber attacks. This concept is not worth the networking (SDN) and software-defined data center (SDDC),
investment that has been spent to build the idea of the micro-segmentation is now an increasingly popular
perimeter. At present, the need for a security system is technology because it has a high level of security and
essential to improve organizational security [13], with a zero flexibility in its implementation. Micro-segmentation
trust security model [14]. facilitates work in network administration and enforcement
Implementing a zero trust security model can provide a of security rules in data centers. With micro-segmentation,
high-security system, so it has a positive impact on business smaller segments can limit access rights on users,
processes, such as the company's visibility in protecting applications, and servers. Thereby it reduced the more
customer data. The adoption of a zero trust security model can extensive damage from malware attacks. Besides, access to
provide benefits from the organization's side to external resources can be controlled based on rules that have been
parties with a good reputation in implementing security made [19].
systems and budget savings in security system audits. On the
inner side of the company, it has high feasibility and use of E. Cisco Application Centric Infrastructure (ACI)
time to be efficient in monitoring security systems with high Cisco Application Centric Infrastructure (ACI) is a
visibility, thereby reducing the complexity of implementing concept in software-defined networking (SDN) by
security systems. Service needs and easy maintenance of implementing architecture under application requirements.
security systems are other benefits that can be obtained by That way, that network implementation can be adjusted based
applying zero trust [15]. The zero trust security model cannot
on application requirements. This architecture aims to
be 100% fully capable but can mitigate well and reduce the
occurrence of cyber-attacks [16]. simplify, optimize, and accelerate an application's
Cisco's zero trust is a thorough approach to securing all development cycle. The Cisco Application Policy
access by networks, applications, and environments. One of Infrastructure Controller (APIC) is an application
the zero trust security models at Cisco is zero trust for programming interface (API) used to connect applications,
workloads, which minimizes lateral movements that comprise the network, and storage securely. APIC makes it easy for
breaches with micro-segmentation using Cisco ACI [17]. network administrators to define the optimal network for an
application. APIC provides management and automation, use

thorized licensed use limited to: AMRITA VISHWA VIDYAPEETHAM AMRITA SCHOOL OF ENGINEERING. Downloaded on May 09,2024 at 11:38:18 UTC from IEEE Xplore. Restrictions appl
29
 2020 12th International Conference on Information Technology and Electrical Engineering (ICITEE), Yogyakarta,
Indonesia

of policies by programming, application implementation, simulation infrastructure built consisted of network

monitoring the condition of the fabric, and regulating the infrastructure using Cisco ACI as an illustration of a data
scalability of various tenants in the fabric [20]. center network system with a research focus on east-west
Cisco ACI fabric consists of Cisco Nexus 9000 series and traffic. While the server infrastructure as an illustration of the
APIC built using ACI leaf/spine fabric by adopting a fat-tree application system services consisting of 3 tier applications,
network topology that connects each leaf switch to the spine namely web server (web), app server (app), and database
switch controlled by APIC. In contrast, all devices are server (DB), by using a virtual machine (VM). The test
connected to the leaf switch. The recommended scenario is carried out by measuring network performance in
the form of round trip time, jitter, and packet loss with and
configuration on APIC uses a minimum of 3 servers in
without a micro-segmentation process, a feature that a
groups. ACI fabric can send traffic with low lag times
network system has on a Cisco ACI against 3 tier web
because it runs on networks with a bandwidth capacity of 40 systems, apps, and DB. Fig. 5 shows the testbed simulation
Gigabit per second (Gbps). Network traffic from the source topology.
and destination on the same leaf will be carried out locally,
while traffic from the source and destination on the different
leaf will pass through the spine first. The ACI fabric
architecture runs on L3 even though there are only two hops
physically [20].
End Point Group (EPG) is an object that can be controlled
and is called a logical entity that contains a set of endpoints
(endpoints). Endpoints are resources that are connected to the
network both directly and indirectly and have addressed
(identity), location, attributes, and can be either physical or
virtual resources. EPG is wholly separated from physical and
logical topology. Servers, virtual machines, and network-
attached storage are examples of endpoints that can be Fig. 5. The testbed simulation topology
dynamic or static. Micro-segmentation in Cisco ACI is the
interconnecting endpoints of several EPGs into micro- Testing on network performance can be done using many
segmented EPGs based on machine attributes, IP address, or variables. In this study, testing focused on three variables:
MAC address. Virtual machines can have vNIC domain name round trip time (RTT), jitter, and packet loss with and without
attributes, VM markers, VM names, hypervisor markers, micro-segmentation processes on 3 tier web, app, and DB
VMM domains, datacenter, operating systems, or self- systems. Round Trip Time (RTT) is a unit of time required to
defined attributes [20]. send a packet the total time needed to initiate the
interconnection process and transmit data packets so that the
F. Methods and Design Scenario RTT is a delay time consisting of propagation time between 2
We conducted this research using the Preparation, hosts in a network system. RTT in a network system is known
Planning, Design, Implementation, Operation, and as ping time. Jitter is a variety of delays that occur in
Optimization (PPDIOO) methodology. consecutive nodes whose value depends on the burden of data
traffic and the amount of collision between packets in a
network system. The more significant weight of data traffic is
a factor that affects the chances of a more substantial collision,
changing the higher value of jitter. Packet loss is the
occurrence of failed data packet delivery to achieve its
destination.
The scenario of network performance testing is done by
sending data packets of 100 packets with significant data
variations of 200 bytes, 500 bytes, 1,000 bytes, 10,000 bytes,
and 15,000 bytes. Data packet delivery is carried out from the
web to the app and app to the DB by using the ping
mechanism. The data traffic is recorded using Wireshark for
analysis of Round Trip Time (RTT), jitter, and packet loss.
The results of network performance testing are carried out
with a micro-segmentation process. Without a micro-
segmentation process using a simulated ACI fabric testbed,
the results of both are analyzed. Network performance testing
Fig. 4. PPDIOO Methodology is done using a test tool in the form of Wireshark to obtain
Round Trip Time (RTT), Jitter, and Packet Loss information.
Fig. 4 shows the PPDIO methodology from Cisco [21] that Wireshark is a network packet analyzer that can function to
defines the cycle in building a network system with detect and display packets that pass through a network in
sustainable services for providing a high level of availability. detail.
Fig. 4 shows the process's stages to be carried out to produce Fig. 6 shows the testbed simulation design without the
an output target by the research objectives. micro-segmentation process. We conduct the testbed
A testbed simulation system to test performance was built simulation design without a micro-segmentation on the ACI
using an SDN-based network system based on a micro- fabric with the following steps. First, creating EPG, i.e., Web,
segmentation-based zero trust security model. The testbed App, and DB, are in the same EPG as epg_all. Second,

thorized licensed use limited to: AMRITA VISHWA VIDYAPEETHAM AMRITA SCHOOL OF ENGINEERING. Downloaded on May 09,2024 at 11:38:18 UTC from IEEE Xplore. Restrictions appl
30
 2020 12th International Conference on Information Technology and Electrical Engineering (ICITEE), Yogyakarta,
Indonesia

configuring the BD and EPG epg_all with the aim of the Web IV. RESULT AND DISCUSSION
VM, App, and DB entering the network segment /24. In this paper, the design and implementation of micro-
segmentation are built using Cisco ACI. Subsequently, we
created three application tiers in the form of a Web, App, and
DB in one network segmentation /24. We conducted a testing
scenario using a ping mechanism with a variate data transfer
to evaluate the performance of the micro-segmentation
process. We compared the test results related to the concept of
micro-segmentation and without micro-segmentation.
Fig. 6. Experiment without Micro-Segmentation Process Testbed simulation without a micro-segmentation process is
Fig. 7 shows the testbed simulation design with the micro- done by creating 3 tier web applications, apps, and DB in one
segmentation process. We conduct the testbed simulation EPG with the name epg_all, which contains a Web, App, and
design with a micro-segmentation on the ACI fabric with the DB. Testbed simulation with a micro-segmentation process is
following steps. First, creating EPG, i.e., web, app, and DB, is done by creating 3 tier Web, App, and DB in 3 EPG, each with
in a different EPG with epg_web, epg_app, and epg_db. epg_web, epg_app, and epg_db.
Second, configuring the BD and EPG epg_web, epg_app, Testing the performance of testbed simulation with and
epg_db with the destination VM web, app, and DB entering without a micro-segmentation process is done by sending data
the network segment /24. Third, creating a contract (CT), a packets using the ping mechanism. Data packet delivery is
policy on the network that regulates the interconnection done from the Web to the App server and App server to the
between epg_web to epg_app, epg_app to epg_db with access DB server, with a large variety of 200 bytes, 500 bytes, 1,000
policy in the form of ICMP (ping). bytes, 10,000 bytes, and 15,000 bytes many as 100 times the
delivery.
Fig. 8 and Fig. 9 show that the average RTT that occurs
from the Web to the App in the measurement process without
a micro-segmentation process is better than measurement with
a micro-segmentation process. Still, the difference in delay is
only in the microsecond unit, so it will not affect the network
performance significantly. In RTT measurements, the results
show that the testbed simulation without running a micro-
segmentation process with the lowest average RTT of 285 µs
Fig. 7. Experiment with Micro-Segmentation Process is better than the testbed simulation by running a micro-
segmentation process of 289 µs on sending 200-byte and 500-
G. Components of The Testbed Simulation byte data packets. The average addition of 4 µs. These results
Network infrastructure is a component that consists of show that one of the factors that affect the RTT value is the
hardware and software used to build SDN-based network size of the data packet sent and the security policy
system testbed simulations based on micro-segmentation- implemented in the micro-segmentation process.
based zero trust security models. Table 1 shows the testbed
simulation component consisting of leaf switches, spine
switches, and SDN controllers using the Cisco brand. Leaf
switches for interconnecting servers to network systems use
a 10 GB interface. Spine switch for interconnection between
leaf switches using a 40 Gb interface. SDN controller is used
to configuring the network system.
TABLE I. THE LIST OF A COMPONENT OF THE CISCO ACI
Name Bandwidth Type Firmware
Spine Switch 40 GB Nexus 9336PQ n900-14.2 (3I)
Nexus 9372PX Fig. 8. Average Web RTT measurement results to App
Leaf Switch 10 GB n900-14.2 (3I)
Nexus 93128TX
SDN Controller 10 GB APIC Cluster M-1 version 4.2 (3I)

Server infrastructure is a component consisting of

hardware and software used to build a testbed simulation
system using 3 tier web applications, apps, and DB. The
server infrastructure used is based on a virtual machine (VM)
under the VMWare brand name. Table 2 shows the testbed
simulation component in the form of 3 tier Web, App, and
DB.
TABLE II. VIRTUAL MACHINE SPECIFICATION TESTBED
Name vMemory vCPU Operating System
Fig. 9. Average App RTT measurement results to DB
Web 2 GB 1 vCPU Linux Ubuntu
Application 2 GB 1 vCPU RHEL 7.8 Fig. 10 and Fig. 11 show that the jitter in measurements
without a micro-segmentation process is better than the test
Database 4 GB 2 vCPU RHEL 7.8 with a micro-segmentation process. The micro-segmentation

thorized licensed use limited to: AMRITA VISHWA VIDYAPEETHAM AMRITA SCHOOL OF ENGINEERING. Downloaded on May 09,2024 at 11:38:18 UTC from IEEE Xplore. Restrictions appl
31
 2020 12th International Conference on Information Technology and Electrical Engineering (ICITEE), Yogyakarta,
Indonesia

process will pass a security policy in the form of a contract [2] L. Yang, J. K. Muppala, M. Veeraraghava, D. Lin and M. Hamdi,
(CT) that has been configured on the ACI fabric. In jitter Data Center Network Topologies, Architecture and Fault-Tolerance
measurement, the results show that the testbed simulation Characteristics, London: Springer, 2013.
without running a micro-segmentation process with the lowest [3] A. Greenberg, J. Hamilton and D. A. Maltz, "The Cost of a Cloud:
jitter of 293 µs is better than the testbed simulation by running Research Problems in Data Center Networks," ACM SIGCOMM
Computer Communication Review, vol. 39, no. 1, pp. 68-73, 2009.
a micro-segmentation process 304 µs on sending 500-byte
[4] Y. Zhang and N. Ansari, "On Architecture Design, Congestion
data packets. The average addition of jitter is 11 µs. Notification, TCP Incast and Power Consumption in Data Centers,"
IEEE Communications Surveys & Tutorials, vol. 15, no. 1, pp. 39 -
64, 2013.
[5] K. Bakshi, "Considerations for Software Defined Networking
(SDN): Approaches and Use Cases," in 2013 IEEE Aerospace
Conference, Big Sky Montana, 2013.
[6] P. Ijari, "Comparison between Cisco ACI and VMWARE NSX,"
IOSR Journal of Computer Engineering. (IOSR-JCE), vol. 19, no. 1,
pp. 70-72, 2017.
[7] L. Hernandez, G. Jimenez and A. Pranolo, "Comparative
Performance Analysis Between Software-Defined Networks and
Conventional IP Networks," in 5th International Conference on
Fig. 10. Jitter measurement results from Web to App
Science in Information Technology (ICSITech), Yogyakarta, 2019.
[8] A. A. Kasi, F. Khan, B. A. Ahmed, S. Rashid and S. Waseem,
"Performance Analysis of Homogenous and Heterogenous Network
Core Switches," in 2017 International Symposium on Wireless
Systems and Networks (ISWSN), Lahore, 2017.
[9] D. V. Vuletić and N. D. Nojković, "Realization of A TCP Syn Flood
Attack using Kali Linux," Military Technical Courier, vol. 66, no.
3, pp. 640-649, 2018.
[10] N. Surantha and F. Ivan, "Secure Kubernetes Networking Design
Based on Zero Trust Model: A Case Study of Financial Service
Enterprise in Indonesia," Advances in Intelligent Systems and
Computing , vol. 994, pp. 348-361, 2019.
Fig. 11. Jitter measurement results from App to DB [11] D. Kreutz, F. M. V. Ramis, P. E. Verissimo, C. E. Rothenberg, S.
In packet loss measurement, the results show that the Azodolmolky and S. Uhlig, "Software-Define Networking: A
Comprehensive Survey," Proceedings of the IEEE , vol. 103, no. 1,
testbed simulation without and with the micro-segmentation pp. 14-76, 2015.
process succeeded in sending a data packet with no packet
[12] S. Sezer, S. . S. Hayward, Pushpinder , B. Fraser, D. Lake, J.
loss. These results indicate there is no collision and congestion Finnegan, N. Viljoen, M. Miller and N. Rao, "Are We Ready for
in network traffic, because the Cisco ACI concept develops as SDN? Implementation Challenges for Software-Define Networks,"
a single switch to the outside world, proficient in bridging and IEEE Communications Magazine, vol. 51, no. 7, pp. 36 - 43, 2013.
routing. Moving Layer 3 routing to the access layer would [13] J. Kindervag, "Build Security into Your Network’s DNA: The Zero
restrict the Layer 2 reachability by decoupling Layer 2 Trust Network Architecture," Forrester Research Tech. Rep,
domains. Cambridge, 2010.
[14] E. Gilman and D. Barth, Zero Trust Networks, Sebastopol: O’Reilly
V. RESULT AND DISCUSSION Media Inc, 2017.
The results of the analysis of the research have been done [15] Akamai, "https://www.akamai.com," June 2018. [Online].
Available: https://www.akamai.com/us/en/multimedia/documents/
by measuring the testbed simulation show that micro- white-paper/the-6-business-and-security-benefits-of-zero-trust-
segmentation adds an average round trip time of 4 µs and jitter white-paper.pdf. [Accessed 07 June 2020].
of 11 µs without packet loss. Based on these results, the [16] P. Assunção, "A Zero Trust Approach to Network Security," in
security of the data center network can be improved without Proceedings of the Digital Privacy and Security Conference 2019,
significantly affecting network performance. Porto, 2019.
Future work uses a test scenario of high traffic compared [17] Cisco, "https://www.cisco.com," Augustus 2019. [Online].
to low traffic in the network so that performance comparisons Available: https://www.cisco.com/c/en/us/products/collateral/
can be obtained. Another approach the performance of a zero security/solution-overview-c22-742591.pdf. [Accessed 7 September
trust security model based on micro-segmentation using 2020].
brands from other vendors such as NSX VMware. [18] Cisco, "Data Center Microsegmentation: Enhance Security for Data
Center Traffic," Cisco, San Jose, 2015.
ACKNOWLEDGMENT [19] A. Chowdhary, D. Huang and S. Pisharody, "Microsegmentation,"
in Software-Defined Networking and Security: from Theory to
We thank the University of Indonesia for financial support Practice, Boca Raton Florida, CRC Press Taylor & Francis Group,
for this research under the PUTI Prosiding Grant number 2018, pp. 155-180.
NKB-1073/UN2.RST/HKP.05.00/2020. [20] Cisco, "https://www.cisco.com," 28 August 2018. [Online].
Available: https://www.cisco.com/c/en/us/td/docs/switches/
REFERENCES datacenter/aci/apic/sw/1-x/aci-fundamentals/b_ACI-
Fundamentals.pdf. [Accessed 07 June 2020].
[1] M. Al-Fares, A. Loukiss and A. Vahdat, "A Scalable, Commodity [21] P. Oppenheimer, Top-down Network Design, 3rd ed, Indianapolis:
Data Center Network Architecture," ACM SIGCOMM Computer Cisco Press, 2011.
Communication Review, vol. 38, no. 4, p. 63–74, 2008.

thorized licensed use limited to: AMRITA VISHWA VIDYAPEETHAM AMRITA SCHOOL OF ENGINEERING. Downloaded on May 09,2024 at 11:38:18 UTC from IEEE Xplore. Restrictions appl
32