DCN Challenges

IN cloud computing, resources are allocated on demand and charged by usage. A configurable pool of shared resources is provided, which users can access through the network in addition to services such as storage space, network bandwidth, servers, and application software. Cloud computing pools computing, network, and storage resources, which results in larger service volumes over higher bandwidth but lower latency. In the cloud computing era, as cloud DCs are deployed for large-scale commercial use, and new technologies are shooting up, legacy DCNs face the following challenges:

1. Big data requires wide pipes.

With the continuous development of Internet technologies, the number of applications and the associated service volume in DCs dramatically increases. Every minute there are more than 1.6 million Google searches, 260 million emails sent, 47,000 apps downloaded, 220,000 photos uploaded to Facebook, and 660 million data packets transmitted. And this explosive growth is set to continue. According to statistics, global DC IP traffic increases five-fold every year. It is also estimated that the total number of servers in global DCs will see a ten times greater increase in 2020 compared with 2015. This results in huge challenges to DCNs as big data requires wide pipes.

In addition, as a large number of applications are migrated to DCs, the traffic model is also changing. As shown in Figure 2.1, the data from 2015 confirms that the east-west traffic (traffic between

20 ■ Cloud Data Center Network Architectures and Technologies

FIGURE 2.1 DCN traffic.

internal servers) in a DC accounted for more than 90% of the total traffic. As such, the tree-shaped network architecture of legacy DCs can no longer meet service requirements, and a new distributed network architecture needs to be built in order to deploy Layer 3 gateways at edge nodes to optimize traffic paths and effectively satisfy the steep increase in new requirements on bandwidth and latency.

2. Quick service rollout requires network pooling and automation.

As shown in Figure 2.2, legacy DCNs are separated and unable to provide large-scale resource pools, unlike cloud DCNs. Their compute resources are limited to modules and cannot be scheduled in a unified manner, which often leads to some resources running out, while others are left idle. In addition, distributed routing policies are used between networks, which results in difficult route optimization and reduces network utilization.

Legacy DCNs feature a low level of automation, which cannot meet the demands for rapid and elastic service rollout. Applications require months for deployment, which is not suitable for new service development. In addition, applications are as complex to scale out as they are to install and deploy, with long interruptions required for installation, storage migration, and service switchover.

DC resources are separated and hard to manage. As services are deployed across DCs, service access relationships and policy management between DCs become more complex. Link bandwidth is

DCN Challenges ■ 21

FIGURE 2.2 Separated legacy DCNs.

unevenly allocated between DCs, leading to low overall utilization and high costs.

3. Comprehensive threat escalation requires service-oriented security deployment.

DC security is provided as a service at a low degree and features high OpEx. According to a recent banking industry survey, more than half of the O&M and update operations are related to security services. The following major issues exist:

• • Limited types of security services: Open-source OpenStack offers weak security capabilities and only provides basic firewall services.
• • Network association required for security services: Network link connectivity cannot be achieved through firewall configurations alone and requires collaboration between network devices.
• • Complex manual configurations: Security and network devices must be deployed and configured manually, resulting in heavy workloads.
• • Scattered device deployment: Security devices must be deployed at each risk point and are difficult to manage.

• • Complex configuration entries: Multiple security devices require separate logins in order to configure specific policies for onetime security protection.
• • Waste of security resources: To cope with traffic bursts, each security device maintains many redundant resources.

In addition, constantly escalating threats mean manual threat analysis is inefficient, and countermeasures are difficult to coordinate.

• • Inefficient manual analysis of threats: Logs from a large number of security devices are stored separately, making analysis inefficient and ineffective.
• • Difficult investigation and countermeasure deployment: Once new attacks occur, security devices cannot detect, trace, or analyze the threats.
• • Security silos: Different types of security devices function separately, resulting in security silos, which offer a weak defense.

Visualized analysis of security threats is poor and cannot guide security O&M due to the following issues:

• • Excessive threat logs: A large number of security devices use different log formats, making it impractical to view all logs.
• • Poor correlative analysis: The correlative analysis software analyzes only a small number of threats, offering unreliable results.
• • Non-intuitive display: Security issues cannot be solved based on the unintuitive threat display.
• 4. Service continuity takes top priority, requiring networks to provide reliable foundations.

Many countries and regions have developed clear security policies and regulations for key industries such as banking, energy, and transportation. For example, in China, the China Banking Regulatory Commission (CBRC) has issued the Guidelines on Business Continuity Supervision of Commercial Banks (CBRC Doc.

No. [2011] 104), which specifies the following criteria for grading business continuity events.

Grade I (extremely critical operation interruption event): Such an event causes interruption to the regular business operations of multiple financial institutions in one or more provinces (autonomous regions or municipalities directly under the Central Government) for 3 hours or more. During this interruption, a single financial institution cannot provide services to two or more provinces (autonomous regions and municipalities under the Central Government) for more than 3 hours, or cannot provide normal services to a province (autonomous regions or municipalities) for more than 6 hours. CBRC will send a special task force to analyze, evaluate, and handle such an event, and related progress shall be reported to the State Council.

Grade II (critical operation interruption event): Such an event causes interruption to the regular business operations of multiple financial institutions in one or more provinces (autonomous regions or municipalities directly under the Central Government) for more than half an hour. During this interruption, a financial institution cannot provide services in two or more provinces (autonomous regions and municipalities directly under the Central Government) for more than 3 hours. CBRC will send a special task force to analyze, evaluate, and handle such an event.

Grade III (major operation interruption event): Such an event causes interruption to the regular business operations of one financial institution in one province (autonomous region or municipality under the Central Government) for more than half an hour.

As shown in Figure 2.3, financial services can be classified by their level of importance as follows: Class A+, Class A, Class B, and Class C. Class A+ and A services must be deployed in active-active mode in the same city to implement Recovery Point Objective (RPO) of 0 and ensure that no data will be lost during DC switchover. As shown in Figure 2.4, service interruptions will result in a great amount of loss to both enterprises and society. The actual requirements for financial service continuity are far beyond the supervision requirements. DC active/standby and active-active disaster recovery (DR) services are indispensable.

FIGURE 2.3 Financial service classification.

FIGURE 2.4 Losses caused by service interruption.

FIGURE 2.5 Gartner’s analysis report on unplanned system breakdowns.

As shown in Figure 2.5, according to Gartner’s analysis report on unplanned system breakdowns, 40% of a bank’s recent service- affected events were caused by human error. In most events, application or system faults spread to the network, which are not well protected. As indicated by the root cause analysis, most faults are related to Layer 2 network technologies. DCNs should provide suppression or self-healing capabilities for Layer 2 loops, unknown unicast flooding, policy switching, and redundancy switchover.

5. Applications are migrated dynamically on demand, traffic increases sharply, and DCNs require intelligent O&M.

26 ■ Cloud Data Center Network Architectures and Technologies

Driven by the development of DC cloudification and Network Function Virtualization (NFV) technologies, the number of managed objects (MOs) in a cloud DCN is ten times greater than that of a legacy DCN. In addition, the network needs to detect dynamic VM migration and elastic scaling of applications, which results in frequent configuration changes and traffic surges. Legacy network O&M cannot adapt to DCN development, and O&M pain points become increasingly prominent. Consequently, Linkedln data shows that the number of network faults saw an 18-fold increase from 2010 to 2015. As the man-machine interface becomes the machine- machine interface, the network becomes invisible. Network, computing, and storage boundaries are blurred, and as larger amounts of data become involved, network faults become more difficult to locate and isolate.

In addition, application policies and mutual access within DCs become increasingly complex. As a result, 70% of faults cannot be identified using legacy O&M, as shown in Figure 2.6. These faults are classified into the following types:

• • Connection faults, such as a VM going offline unexpectedly or communication becoming intermittently interrupted.
• • Performance faults, such as network congestion during heavy loads.
• • Policy faults, such as unauthorized access and port scanning.

FIGURE 2.6 Abnormal flows.

To address these issues, DCNs require a new intelligent analysis engine. Leveraging big data algorithms, an intelligent analysis engine associates application traffic with the network status in data analysis to accurately and rapidly predict, detect, and isolate network faults, and to form a closed system for network data collection, analysis, and control. Network devices must utilize increased intelligence, as well as the ability to self-heal upon the occurrence of single-NE faults. Based on telemetry and edge intelligence technologies, they collect and pre- process data at a high speed and report to the analysis engine.

Huawei has launched the cloud DCN solution to address the five major challenges faced by DCNs. This powerful solution is capable of building intent-driven cloud DCNs, which are simplified, ultrabroadband, secure, reliable and intelligent.

• • Simplified: An SDN controller enables a user to create a logical network in drag-and-drop mode, and cloud-network integration enables service rollout in minutes.
• • Ultra-broadband: DC switches featuring a switching capacity three times that of the industry average are used, and which have been running stably at the core layer for 10 years. Access leaf nodes support smooth evolution from 10GE to 25GE Ethernet interface standards. The SDN controller is used to build an elastic large-scale network with zero packet loss and delivers a management scale ten times that of the industry average. It also utilizes a Huawei unique congestion scheduling algorithm to improve AI training efficiency by 40%.
• • Security: Seventeen types of value-added services (VASs) are available in PAYG mode. They are flexibly orchestrated using SFC and isolated for security purposes in fine-grained manner using microsegmentation.
• • Reliable: The SDN controller enables self-healing of devices, and the solution provides proactive loop prevention. The underlay and overlay protocols isolate resources to prevent crosstalk, and services can be switched over between the active and standby DCs. ^[1]

consumption. Real paths between VMs are detected to enable the rapid location of service faults, with intelligent O&M system locating faults in minutes.

In addition, Huawei has launched the HA Fabric, Multi DC Fabric, and AI Fabric solutions for enterprise EDC, carrier telco cloud, and AI distributed computing or storage, addressing the demands for quick cloudification. The following chapters will elaborate on the DCN solutions and demonstrate some solutions in which Huawei has built cloud DCNs.

• [1] Intelligent: The SDN controller monitors the service runningstatus, logical resource consumption, and physical resource