Open Flow
Open Flow
OpenFlow
1
OpenFlow
OpenFlow Overview
OpenFlow Overview
OpenFlow is a specification from the Open Networking Foundation (ONF) that defines a flow-based forwarding
infrastructure and a standardized application-programmatic interface. OpenFlow allows a controller to direct
the forwarding functions of a device through a secure channel.
OpenFlow is the protocol between a controller (control plane) and an Ethernet switch (data plane). The switch
has flow tables arranged in a pipeline. Flows are rules to examine packets that reach these tables.
An OpenFlow agent on the switch communicates with the controller using the OpenFlow protocol. The agent
supports both OpenFlow 1.0 (wire protocol 0x1) and OpenFlow 1.3 (wire protocol 0x4). It can have up to
eight controller connections. These connections are not preserved across a switchover, and the controller will
have to reconnect to the agent after a switchover.
The OpenFlow implementation on Cisco Catalyst 9400 Series Switches is stateless, and nonstop forwarding
(NSF) is not supported. The standby supervisor does not synchronize with the flow database.
OpenFlow Controller
The OpenFlow controller is an entity that interacts with an OpenFlow switch using the OpenFlow protocol.
In most cases, a controller is a software that manages many OpenFlow logical switches. Controllers offer a
centralized view of the network, and enable administrators to dictate to the underlying systems (switches and
routers) on how to handle the network traffic. A controller typically runs on a Linux server, and must have
IP connectivity to OpenFlow-capable switches.
A controller manages a switch, and inserts and deletes the flows on the switch. These flows support a subset
of OpenFlow 1.3 and 1.0 match and action criteria.
The switch connects to the controller using the management port. The management port is in the management
virtual routing and forwarding (VRF) instance, and hence provides a secure connection to the controller. To
connect a controller to the switch, configure the IP address and port number on which the controller can be
reached.
Flow Management
A flow entry is an element in a flow table that is used to match and process packets. It contains priority levels
for matching precedence, a set of match fields for matching packets, a set of instructions to apply, and packet
and byte counters. A timeout is also associated with each flow (a hard timeout or an inactivity timeout), which
is used to automatically remove flows.
Cisco Catalyst 9000 Series Switches support a maximum of nine flow tables.
Each flow provides the following information:
• Priority: High-priority flows are matched first. A flow update requires all the flows to be prioritized
based on the configured priority.
• Match fields: A part of a flow entry against which a packet is matched. Match fields can match the various
packet header fields. If no match information is provided for a field, a wildcard is used.
• Action: An operation that acts on a packet.
OpenFlow
2
OpenFlow
OpenFlow Pipeline
OpenFlow Pipeline
An OpenFlow pipeline is a set of linked flow tables that provide matching, forwarding, and packet modification
in an OpenFlow switch. A port is where packets enter and exit the pipeline.
Packets are received on an ingress port and processed by the OpenFlow pipeline that forwards it to output
ports. The packet ingress port is owned by the packet throughout the pipeline, and represents the port on which
the packet was received into the switch. Note that the ingress port can also be used as a match field in a flow.
Flow actions allow packets to be sent to subsequent tables in the pipeline for further processing, and allow
information to be communicated between tables. Pipeline processing stops when the action associated with
a matching flow entry does not specify the next table. At this point, the packet is usually modified and
forwarded. The packet can also be dropped.
Flow tables of an OpenFlow switch are sequentially numbered, starting from 0. Pipeline processing always
starts by matching the packet against flow entries of flow table 0. Other flow tables can be used depending
on the outcome of the match and actions in the first table, which could result in matching the packet against
flow entries in subsequent tables.
VLAN ID — 0x13f
OpenFlow
3
OpenFlow
Supported Match Fields and Actions
IPv4 source address Ethernet type should be Yes 10.0.0.0/24 (with mask)
set to 0x0800
IPv4 destination address Ethernet type should be Yes 10.0.0.254 (without mask)
set to 0x0800
Incoming interface — — —
Supported Actions
A flow can send a packet to:
• The controller.
• Any interface of the switch (including the incoming interface).
• A subsequent flow table (after Table 0) for another lookup.
• A group.
OpenFlow
4
OpenFlow
OpenFlow Scale Information
• The switch CPU for local processing. Only Cisco Discovery Protocol and Link Layer Discovery Protocol
(LLDP) packets can be sent for local processing.
A flow can add (push) or remove (pop) a VLAN tag. If a packet is an IP packet, the flow can decrement the
Time to Live (TTL) header field.
Cisco Catalyst 9300 Series Cisco Catalyst 9400 Series Cisco Catalyst 9500
Switches Switches, and Cisco High-Performance Series
Catalyst 9500 Series Switches
Switches
When a system boots up, by default, there are two table entries per flow. With table feature message, flows
use a single entry; however, keys with IPv6_SRC _AND_ IPv6_DEST requires two entries per flow.
Flow Operations
This section describes the operations that take place when a flow is sent by the controller to be programmed
in the OpenFlow device.
Typically a device has flow tables arranged in a pipeline. The pipeline capabilities information specifies the
structure of the pipeline, such as the number of tables or stages, what each stage is capable of doing (match
or actions), and the size of each table.
When the controller sends a flow request, the OpenFlow agent verifies whether the flow can be handled by
the hardware. It compares the flow against the capabilities of the hardware that are defined when the switch
is booted up. If the flow is valid, it is programmed in the appropriate flow table.
If the new pipeline is validated (whether the hardware can support the pipeline), it becomes the new set of
capabilities used to check if a flow can be installed or not.
After the pipeline is instantiated and flows are installed, packets are forwarded by the switch. Ingress packets
are matched against the flows in each flow table, until the highest-priority matching flow entry is found. Packet
matching may be exact (match all fields of the table exactly), or partial (match some or all fields, and fields
with bit masks may be partially matched). Packets can be modified or forwarded based on the configured
OpenFlow
5
OpenFlow
OpenFlow Table Pipeline
actions. Actions can be applied in the pipeline at any time. An action can determine the next flow table to
match, the set of egress ports for the packet, and whether the packet should be routed to the controller.
SUMMARY STEPS
1. enable
2. configure terminal
3. boot mode openflow
4. exit
5. write erase
6. • delete flash:vlan.dat
• delete flash:stby-vlan.dat
7. reload
8. enable
9. show boot mode
OpenFlow
6
OpenFlow
Enabling OpenFlow Mode on a Device
DETAILED STEPS
Step 4 exit Exits global configuration mode and enters privileged EXEC
mode.
Example:
Device(config)# exit
Step 6 • delete flash:vlan.dat • Deletes the vlan.dat file that stores the VLAN
• delete flash:stby-vlan.dat information.
Example: • Deletes the stby-vlan.dat file, if you have a standby
Device# delete flash:vlan.dat device.
Device# delete flash:stby-vlan.dat
Step 7 reload Reloads the switch and enables OpenFlow forwarding mode
for the switch.
Example:
Device# reload
Step 9 show boot mode Displays information about the device's forwarding mode.
Example:
Device# show boot mode
Example
The following is sample output from the show boot mode command that shows the device in
OpenFlow mode:
OpenFlow
7
OpenFlow
Configuring OpenFlow
What to do next
To go back to normal mode, configure the no boot mode openflow command and then reload the device.
Configuring OpenFlow
SUMMARY STEPS
1. enable
2. configure terminal
3. feature openflow
4. openflow
5. switch 1 pipeline 1
6. controller ipv4 ip-address port port-number vrf vrf-name security {none | tls}
7. datapath-id ID
8. tls trustpoint local name remote name
9. end
DETAILED STEPS
Step 5 switch 1 pipeline 1 Configures a logical switch and pipeline, and enters
OpenFlow switch configuration mode.
Example:
Device(config-openflow)# switch 1 pipeline 1
OpenFlow
8
OpenFlow
Configuring an Interface in OpenFlow Mode
Step 8 tls trustpoint local name remote name (Optional) Configures an OpenFlow switch Transport Layer
Security (TLS) trustpoint.
Example:
Device(config-openflow-switch)# tls trustpoint
local trustpoint1 remote trustpoint1
SUMMARY STEPS
1. enable
2. configure terminal
3. feature openflow
4. interface type number
5. switchport mode trunk
6. switchport nonnegotiate
7. no keepalive
8. spanning-tree bpdufilter enable
9. end
DETAILED STEPS
OpenFlow
9
OpenFlow
Verifying OpenFlow
Step 4 interface type number Configures an interface and enters interface configuration
mode.
Example:
Device(config)# interface gigabitethernet 1/0/3
Step 5 switchport mode trunk Sets the trunking mode of the Layer 2-switched interface
to trunk.
Example:
Device(config-if)# switchport mode trunk
Step 6 switchport nonnegotiate Specifies that the device will not engage in negotiation
protocol on this interface.
Example:
Device(config-if)# switchport nonnegotiate
Step 8 spanning-tree bpdufilter enable Enables bridge protocol data unit (BPDU) filtering on the
interface.
Example:
Device(config-if)# spanning-tree bpdufilter enable
Verifying OpenFlow
Use these commands to verify your OpenFlow configuration. These commands can be used in any order.
SUMMARY STEPS
1. enable
2. show openflow hardware capabilities
3. show openflow switch 1 controller
OpenFlow
10
OpenFlow
Verifying OpenFlow
DETAILED STEPS
Step 1 enable
Enables privileged EXEC mode.
• Enter your password if prompted.
Example:
Device> enable
Pipeline ID: 1
Pipeline Max Flows: 2322
Max Flow Batch Size: 100
Statistics Max Polling Rate (flows/sec): 10000
Pipeline Default Statistics Collect Interval: 5
.
.
.
OpenFlow
11
OpenFlow
Verifying OpenFlow
Protocol: tcp
VRF: Mgmt-vrf
Connected: Yes
Role: Equal
Negotiated Protocol Version: OpenFlow 1.3
Last Alive Ping: 2018-06-04 17:59:20 PDT
state: ACTIVE
sec_since_connect: 50
OpenFlow
12
OpenFlow
Configuration Examples for OpenFlow
The following sample output displays a flow that is available in Table 0, where match any goes to Table 1. (match any
means that all the packets go to Table 1.) In Table 1, the destination MAC address 00:00:01:00:00:01 is matched, and
the output port is set to 36.
Example:
Device# show openflow switch 1 flows list
Flow: 1 Match: any Actions: goto_table:1, Priority: 9000, Table: 0, Cookie: 0x1,
Duration: 2382.117s, Packets: 34443, Bytes: 3359315
OpenFlow
13
OpenFlow
Additional References
Additional References
Related Documents
Technical Assistance
Description Link
The Cisco Support website provides extensive online resources, http://www.cisco.com/support
including documentation and tools for troubleshooting and resolving
technical issues with Cisco products and technologies.
To receive security and technical information about your products,
you can subscribe to various services, such as the Product Alert
Tool (accessed from Field Notices), the Cisco Technical Services
Newsletter, and Really Simple Syndication (RSS) Feeds.
Access to most tools on the Cisco Support website requires a
Cisco.com user ID and password.
OpenFlow
14
OpenFlow
Feature Information for OpenFlow
OpenFlow Power over Cisco IOS XE Gibraltar 16.12.1 PoE is supported on OpenFlow ports.
Ethernet
This feature was implemented on the following
platforms:
• Catalyst 9300 Series Switches
• Catalyst 9400 Series Switches
OpenFlow
15
OpenFlow
Feature Information for OpenFlow
OpenFlow
16