Programmable packet processor (PPP) based adaptive network function chaining
Disclosed herein are system, method, and computer program product embodiments for dynamically applying PPP-based network functions to traffic flows based on heuristics, policy conditions, and client-specified conditions. A network monitors a network traffic flow to determine whether the network traffic flow meets a first criterion of a first rule. The criterion specifies that when the first criterion is met, a PPP-based network function be used to analyze or process the network traffic flow. When the network traffic flow is determined to meet the first criterion, the network determines a first route through the network to a PPP-based router that provides the PPP-based network function and configures one or more routers along the first route to forward the network traffic flow to the PPP-based router for analysis or processing.
1. A computer-implemented method for dynamically provisioning a programmable packet processor (PPP)-based network function in a network comprising one or more PPP-based routers, the computer-implemented method comprising:
(a) monitoring a network traffic flow, including at least one packet routed through the network, to determine whether the network traffic flow meets a first criterion of a first rule, the first rule specifying that, when the first criterion is met, the PPP-based network function be used to analyze or process the network traffic flow; and
(b) when the network traffic flow is determined to meet the first criterion:
(i) selecting, from the one or more PPP-based routers of the network, a PPP-based router able to provide the PPP-based network function;
(ii) configuring the selected PPP-based router to enable the PPP-based network function; and
(iii) determining a first route for the network traffic flow through the network to the selected PPP-based router;
wherein the traffic flow is routed through an existing route before the traffic flow is determined to meet the first criterion, and the selecting the PPP-based router (b)(i) comprises:
(1) determining that the existing route includes a PPP-based router able to provide the PPP-based network function;
(2) selecting the PPP-based router included in the existing route; and
(3) keeping the existing route as the determined first route.
2. The computer-implemented method of claim 1 , wherein the selected PPP-based router runs one or more programmable packet processors (PPPs) on a data forwarding plane of the selected PPP-based router.
3. The computer-implemented method of claim 2 , wherein the one or more PPPs of the selected PPP-based router are programmed to provide the PPP-based network function.
4. The computer-implemented method of claim 3 , wherein the one or more PPPs of the selected PPP-based router are programmed to provide the PPP-based network function using a programming protocol-independent packet processors (P4) programming language.
5. The computer-implemented method of claim 1 , wherein the PPP-based network function comprises at least one of real-time in-band network telemetry, real-time path load-balancing, real-time service chaining, real-time firewall, and real-time Access Control List (ACL).
6. The computer-implemented method of claim 1 , wherein the configuring (b)(ii) comprises enabling a PPP program corresponding to the PPP-based network function.
7. A program storage device tangibly embodying a program of instructions executable by at least one machine to dynamically provision a programmable packet processor (PPP)-based network function in a network comprising one or more PPP-based routers, the instructions comprising the steps of:
(a) monitoring a network traffic flow, including at least one packet routed through the network, to determine whether the network traffic flow meets a first criterion of a first rule, the first rule specifying that, when the first criterion is met, the PPP-based network function be used to analyze or process the network traffic flow; and
(b) when the network traffic flow is determined to meet the first criterion:
(i) selecting, from the one or more PPP-based routers of the network, a PPP-based router able to provide the PPP-based network function;
(ii) configuring the selected PPP-based router to enable the PPP-based network function; and
(iii) determining a first route for the network traffic flow through the network to the selected PPP-based router;
wherein the traffic flow is routed through an existing route before the traffic flow is determined to meet the first criterion, and the selecting the PPP-based router (b)(i) comprises:
(1) determining that the existing route includes a PPP-based router able to provide the PPP-based network function;
(2) selecting the PPP-based router included in the existing route; and
(3) keeping the existing route as the determined first route.
8. The program storage device of claim 7 , wherein the selected PPP-based router runs one or more programmable packet processors (PPPs) on a data forwarding plane of the selected PPP-based router.
9. The program storage device of claim 8 , wherein the one or more PPPs are programmed to provide the PPP-based network function.
10. The program storage device of claim 9 , wherein the one or more PPPs are programmed to provide the PPP-based network function using a programming protocol-independent packet processors (P4) programming language.
11. The program storage device of claim 7 , wherein the PPP-based network function comprises at least one of real-time in-band network telemetry, real-time path load-balancing, real-time service chaining, real-time firewall, and real-time Access Control List (ACL).
12. The program storage device of claim 7 , wherein the configuring (b)(ii) comprises enabling a PPP program corresponding to the PPP-based network function.
13. A system for dynamically provisioning a programmable packet processor (PPP)-based network function in a network comprising one or more PPP-based routers, comprising:
a memory; and
one or more processors coupled to the memory, the one or more processors configured to:
monitor a network traffic flow, including at least one packet routed through the network, to determine whether the network traffic flow meets a first criterion of a first rule, the first rule specifying that, when the first criterion is met, the PPP-based network function be used to analyze or process the network traffic flow; and
when the network traffic flow is determined to meet the first criterion:
select, from the one or more PPP-based routers of the network, a PPP-based router able to provide the PPP-based network function;
configure the selected PPP-based router to enable the PPP-based network function; and
determine a first route for the network traffic flow through the network to the selected PPP-based router;
wherein the traffic flow is routed through an existing route before the traffic flow is determined to meet the first criterion, and the selecting the PPP-based router comprises:
determining that the existing route includes a PPP-based router able to provide the PPP-based network function;
selecting the PPP-based router included in the existing route; and
keeping the existing route as the determined first route.
14. The system of claim 13 , wherein the selected PPP-based router runs one or more programmable packet processors (PPPs) on a data forwarding plane of the selected PPP-based router.
15. The system of claim 14 , wherein the one or more PPPs are programmed to provide the PPP-based network function.
16. A computer-implemented method for dynamically provisioning a programmable packet processor (PPP)-based network function in a network comprising one or more routers able to include a PPP, the computer-implemented method comprising:
(a) monitoring a network traffic flow, including at least one packet routed via a first route through the network, to determine whether the network traffic flow meets a first criterion of a first rule, the first rule specifying that, when the first criterion is met, the PPP-based network function be used to analyze or process the network traffic flow for a specified period of time; and
(b) when the network traffic flow is determined to meet the first criterion:
(i) selecting, from the one or more routers of the network, a router able to provide the PPP-based network function;
(ii) configuring the selected router to enable the PPP-based network function;
(iii) determining a second route for the network traffic flow through the network to the selected router; and
(iv) rerouting the network traffic flow through the selected router via the second route for the specified period of time, wherein the second route is different from the first route.
17. The computer-implemented method of claim 16 , further comprising disabling the PPP-based network function upon expiration of the specified period of time.
18. The computer-implemented method of claim 16 , further comprising receiving, through a user interface, information specifying the period of time, the first criterion, and the PPP-based network function.