A Policy-aware Switching Layer for Data Centers

This paper proposes managing middleboxes in data center and enterprise networks through logic in the switching layer rather than physical placement of middleboxes. The basic idea is simple - have a policy that propagates to the switches and lets them route packets through middleboxes in whatever order they wish to before delivering them to their destination. The difficult part is the details, and this paper does a very good job covering those, in contrast to some pure architecture papers we've read. The end result is a very compelling way to manage networks.

The authors provide a good overview of the different types of middleboxes that will be present in a data center and of the problems in trying to manage them by just placing middleboxes on the path. This was very useful to see because the situation is more complicated than it might appear at first due to redundant links. Apart from the basic design of the policy-aware switching layer, which is to look at tuples of header fields to route packets, the authors also focus on how to support redundant middleboxes (consistent hashing) and how to deal with changes in policy and topology without violating the policies. The latter is especially important for middleboxes that provide security, such as firewalls. Some other students' blogs have suggested dropping packets on a policy change, but a correlated set of drop events could really confuse some applications, and there is also no way with that technique to fully guarantee that some won't be mishandled if they are delayed a bit. Better to provide some guarantees as long as this does not overcomplicate the system.

The main thought I get after reading this paper and X-Trace is "wouldn't it be nice to have some extra fields per frame where we could tag things". It's too bad that IP options never really took off, because they would be very useful. With a way to mark packets and a simple way to push policies to switches, you can get a pretty nifty "network OS" that will let you manage your flows without requiring excessive state or forwarding logic at the switches. OpenFlow and NOX promise to bring something like this.