Software Defined Networking
If you learned networking the normal way, SDN rearranges it. The pieces stay the same. What changes is where they live.
Software Defined Networking (SDN) separates the control plane from the data plane. Instead of every device deciding for itself, one controller decides for all of them. You manage the network in software, from one place, and the hardware just forwards.
To see why that matters, you need the planes first.
Planes
Every network device is doing three jobs at once. They get split into planes.
Management plane — how you reach the device. Telnet, SSH, SNMP, an API. This is you, logging in and typing commands.
Control plane — the brain. It decides how traffic should move. Routing protocols like OSPF, NAT, ACLs, STP, CDP, VTP, QoS, and the MAC address table all sit here.
Data plane — the muscle. It does what the control plane decided. Encapsulation and decapsulation, matching frames against the MAC table, dropping traffic that breaks the rules.
Control plane decides. Data plane moves. Hold onto that, because everything below follows from pulling those two apart.
The three names ran together in my head at first. Management is you, control is the brain, data is the muscle. That is the whole trick to keeping them straight.
The plane is how you talk to the device, over SSH or SNMP. The plane decides how traffic moves. The plane does the actual forwarding.
Distributed vs controller-based
A normal network runs a distributed control plane. Every router and switch has its own brain and makes its own calls. They cooperate through routing protocols, but no single device is in charge. Kill one box and the others route around it.
SDN lifts that brain out of every device and drops it into one controller. The devices keep the data plane and lose the arguments. They forward what they're told, and the thinking happens in one place.
The trade is easy to see. You get one place to change the network and one place to break it. Central control is also central failure, which is why controllers run as a cluster.
Interfaces
The controller sits in the middle and needs two ways to talk. Down to the devices, and up to you.
Southbound Interface (SBI) — down to the switches and routers. This is how the controller programs them. A few protocols do the job:
- >OpenFlow — one of the first. The controller gets direct access to the forwarding table and writes the rules itself.
- >OpFlex — looser. The controller sends a policy and the device works out how to apply it. Cisco ACI leans on this.
- >CLI / SNMP — the old manual way, still there when nothing else fits.
- >NETCONF — XML config pushed over SSH. Built for automation, not for humans.
Northbound Interface (NBI) — up to you or your apps. Usually a REST API or a GUI. This is the side automation actually touches.
The NBI is where SDN pays off. You describe what you want the network to do and the controller works out the rules. That is intent-based networking.
Software defined architecture
An SDN fabric runs Layer 3 almost everywhere. Every link runs a routing protocol like OSPF, so any link can fail and traffic reroutes around it. That physical network is the underlay.
The overlay is a virtual network on top of it. It doesn't care where the hardware sits. VXLAN is the usual tool: it tunnels Layer 2 over Layer 3, so two servers at opposite ends of the data centre act like they're one hop apart. Each tenant gets its own overlay, isolated from the others.
Underlay, overlay, and every device that runs them together are the fabric.
Application Centric Infrastructure (ACI)
ACI is Cisco's version of all this for the data centre. Everything connects over Layer 3 in a spine-leaf layout. Leaf switches hang off the servers, spine switches connect the leaves, and every leaf reaches every spine.
The controller is the APIC (Application Policy Infrastructure Controller). It manages the underlay and the overlay together, and you run the whole data centre through it.
In ACI you stop configuring devices one at a time. You put servers into endpoint groups — a set of web servers, a set of database servers — and describe how those groups should talk. The APIC turns that into configuration. A normal data centre app is three tiers, web, app and database, and each tier gets its own endpoint group with policy between them.
What does SDN actually separate?