4.3Network virtualization

In a traditional network appliance, the control plane that decides routing and the data plane that actually forwards packets are integrated into a single device, requiring individual configuration per device. Network virtualization technologies separate this integration and turn it into software, raising operational efficiency in multi-site, large-scale environments subject to frequent change. This section teaches network designers to judge whether to migrate from a traditional network to SDN/SD-WAN, based on scale, rate of change, and operating structure.

4.3.1SDN (control plane / data plane separation)

• SDN (Software-Defined Networking) is a design philosophy that separates the control plane, which decides routing, from the data plane, which actually forwards packets, consolidating the control plane into an SDN controller managed centrally in software. This removes the need to configure each switch or router individually, letting network-wide policy be changed and applied from a single point.
• OpenFlow is the representative protocol used between the SDN controller and the switches (data-plane devices) to exchange flow tables (forwarding rules). The controller distributes rules such as "for this packet pattern, take this action (forward/drop/rewrite)" to the switches, giving a clear division of labor in which the switch merely forwards mechanically according to the rules (decision-making is consolidated in the controller).

4.3.2SD-WAN and NFV

• SD-WAN applies the SDN concept to a multi-site WAN, abstracting and centrally controlling multiple different circuits—leased lines, IP-VPN, Internet VPN, and so on—in software. It can dynamically route traffic to the optimal circuit based on application type and traffic conditions, and configuration for new sites can be pushed out in bulk from the controller, so the benefit is greatest for companies with many sites and complex circuit configurations.
• NFV (Network Functions Virtualization) realizes functions traditionally handled by dedicated hardware appliances—firewalls, load balancers, routers, and the like—as software (a VNF: virtualized network function) running on general-purpose servers. It eliminates the need to procure and install dedicated appliances, and adding functions or scaling out can be done quickly through software deployment alone. Whereas SDN is about "separating control from forwarding," NFV is about "turning dedicated functions into software"—a distinct concept with a different purpose (though the two are often used together).

4.3.3VXLAN and overlay/underlay

• VXLAN (Virtual Extensible LAN) encapsulates an L2 Ethernet frame inside a UDP packet, building a virtual L2 segment as an overlay on top of an L3 network. Unconstrained by the physical L3 network's (the underlay's) configuration, it lets groups of servers physically separated inside or outside a data center be treated as if they were on the same L2 segment, making it essential for use cases such as live migration of virtual machines.
• The VNI (VXLAN Network Identifier) is a 24-bit identifier VXLAN uses to distinguish individual virtual L2 segments. Whereas traditional VLAN (IEEE 802.1Q) tagging is 12 bits and can distinguish at most 4094 segments, VNI can identify roughly 16.7 million segments in theory, meeting the need to logically isolate a huge number of tenants in a multi-tenant cloud data center.

Suppose a company has connected 30 nationwide sites using a leased-line-like IP-VPN circuit arrangement, but individual router configuration work is required at each site, and opening a new site takes weeks—an operational burden that has become a problem. Management then asks that "latency-sensitive traffic such as video conferencing between the cloud application and branches should go over the dedicated circuit, while everything else should go over cheap Internet circuits to cut communication costs." SD-WAN, which abstracts multiple circuits in software and dynamically routes by application type, fits this request—the key point is that it centralizes and automates control while keeping the existing multiple circuits (IP-VPN, Internet), rather than simply replacing the circuit. Next, suppose virtual machines in the head-office data center are frequently added and removed, and a large number of tenants each need logical isolation: concerned that VLAN's cap of 4094 segments cannot withstand future growth in tenant count, the design adopts VXLAN (up to roughly 16.7 million segments via VNI) to build an L2 overlay on top of the L3 underlay, achieving flexible segment design unconstrained by physical placement. The trap to avoid here is the misconception that "deploying SD-WAN also solves the segment-count problem inside the data center"—SD-WAN targets circuit control for the inter-site WAN, a different scope from L2 segment design inside the data center (VXLAN's domain), so the right technology must be chosen per problem. Likewise, rather than deploying a dedicated firewall appliance individually at each site, distributing an NFV-virtualized firewall function (a VNF) as software in coordination with the SD-WAN controller can further speed up site rollout.

4.3.4Section summary

• SDN is a design philosophy that separates the control plane from the data plane, managed centrally via OpenFlow and similar protocols
• SD-WAN abstracts and dynamically routes across multiple inter-site circuits; NFV turns dedicated appliance functions into software (a VNF)—distinct concepts with different purposes
• VXLAN overlays L2 on top of L3, and its VNI (24 bits, roughly 16.7 million max) enables isolating far more tenants than VLAN's 4094 cap