(Peer-Reviewed) Fast Configuration Change Impact Analysis for Network Overlay Data Center Networks
Lizhao You 游理钊 ¹, Jiahua Zhang ², Yili Jin ² ³, Hao Tang ², Xiao Li ²
¹ School of Informatics, Xiamen University, Xiamen 361005, China
中国 厦门 厦门大学信息学院
² Huawei Technologies Company Ltd., Shenzhen 518129, China
中国 深圳 华为技术有限公司
³ The Chinese University of Hong Kong (Shenzhen), Shenzhen 518172, China
中国 深圳 香港中文大学（深圳）
This paper presents the first network configuration verifier that provides fast all-pair reachability analysis of incremental configuration changes for network overlay data center networks (DCNs). Network overlay DCNs leverage distributed routing protocol on edge leaf switches to disseminate overlay routes and establish overlay tunnels. In addition, network overlay DCNs use access control lists, microsegmentation policy, policy-based routing and firewall policy to control east-west and north-south traffic. Although some incremental verification approaches have been proposed, they either do not support certain forwarding features of the network, or are not efficient.
Our configuration verifier addresses these issues through the following components: 1) a port predicate based forwarding model that is general to support all features; 2) fine-grained association technique to index possibly affected reachable pairs by changed interfaces in the original network; and 3) required waypoint path computation that finds all reachable pairs related to changed interfaces in the new network. Based on these components, our verifier presents two incremental verification algorithms that are specially designed for different service update cases.
Experiment results show that our incremental verification algorithms are accurate and fast. For all-pair reachability, our verifier performs change-impact analysis within 15s for networks with 200 leafs (4000 subnets and 16 million pairs), outperforming existing approaches by up to 10x.