DFN B t i b tDFN Betriebstagung...2011/03/31 · Cisco ASR 1000 mit QQ(Q)uantum Flow Processor (QFP) Diese neue Recheneinheit bildet die Hardware-Grundlage der neuen Router-Generation

DFN B t i b tDFN Betriebstagung

Cisco Unified Border Element for Enterprise CUBE (E)

Thursday, March 31, 2011

Stephan Bastian

Agendag

Dimension DataDimension Data

Was ist ein Session Border Controller ?

Wo werden Session Border Controller eingesetzt ?

Technische Ausprägung bei Cisco

Leistungsmerkmale des Cisco Unified Border Element (CUBE )

2 © Copyright Dimension Data 2009 31 March 2011

( )

Dimension Data

Wersindwir ?Dimension Data ist einer der weltweit führenden Anbieter für Technologie und IT ServicesDimension Data ist einer der weltweit führenden Anbieter für Technologie und IT-Services und einer der größten Cisco-Gold-Partner weltweit mit Hauptsitz in Südafrika.Dimension Data wurde 1983 in Südafrika gegründet und hat mehr als 11.055 Mitarbeitern in 47 Ländernin 47 Ländern.Dimension Data unterstützt seine Kunden bei Konzeption, Planung, Aufbau, Support und Management der unternehmensweiten IT-Infrastrukturen. Das Unternehmen verfügt über ein umfangreiches Know how in den Bereichen Netzwerk und Speichertechnologien ITein umfangreiches Know-how in den Bereichen Netzwerk- und Speichertechnologien, IT-Sicherheit, ApplicationIntegration und Managed Services.

Dimension Data Global Konzernmutter:

Dimension Data Holdings plcDDT (LSE / JSE; FTSE 200)57 Sloane Street Bryanston, Stanton 2125 South Africa


2125 South Africa

Dimension Data Germany AG & Co. KGy

Die deutsche Niederlassung – Dimension Data Germany AG & Co. KG – hat ihre Zentrale inOberursel bei Frankfurt Weitere Niederlassungen finden sich in Hamburg Berlin DüsseldorfOberursel bei Frankfurt. Weitere Niederlassungen finden sich in Hamburg, Berlin, Düsseldorf,Stuttgart und München. In Deutschland sind ca. 350 Mitarbeiter beschäftigt.

Global Service Center ( GSC )Global Service Center ( GSC )Weltweit betreibt Dimension Data 5 Service Center um eine globale Abdeckung zu erreichen. Die GSC sindmiteinander vernetzt und arbeiten alle nach den gleichen Prozessen unter Einsatz einer gemeinsamen ITInfrastruktur (Tools,..). Hierdurch kann bei Ausfall eines GSC ein weiteres den gesamten Betrieb innerhalbInfrastruktur (Tools,..). Hierdurch kann bei Ausfall eines GSC ein weiteres den gesamten Betrieb innerhalbKürzester Zeit übernehmen und so die vereinbarten Service Level sicherstellen. Das europäische GSC hat seinen Sitz in Oberursel und ist an allen Tagen rund um die Uhr (7x24) durchgehend besetzt (Schichtbetrieb) um einen kontinuierlichen Support sicherzustellen.

Neben Cisco und vielen anderen Herstellern der IT Branche ist Dimension Data auch Partner von Acme Packet und leistet auch für diese Produkte Service und Beratung.


von Acme Packet und leistet auch für diese Produkte Service und Beratung.

Was istein SBC ?

Session Border Controller = Signaling Firewall mitvielenweiterenFunktionen ??

Session = Real-Time KommunikationBorder = IP ÜbergängezumKunden/Partner

Controller = Steuern und Überwachen der Session

Some key definitions in the SBC world y

Session – The OSI 7 layered model defines the session layer (layer 5) as being responsible for establishing, managing and terminating connections between applications. In SBC terminology, a session is any real time voice, video or multimedia communication, managed by a layer 5 control protocol (SIP, H.323, etc)., , g y y p ( , , )Border – Any IP to IP network border between service providers or between a service provider and its end users.Control – Functions that allow the secure connectivity between network borders (Firewall, NAT), service delivery assurance (Protocol interworking, QoS), network operation and management (SDR), law enforcement (CALEA) and more.


Wowerden Session Border Controller eingesetzt ?g

There are two main categories for SBC deployments: peering between service providers and access between a service provider and its end

users.

1. Peering - the session border controller forms the border between1. Peering the session border controller forms the border between network operators. Here it secures the network border, enforces Quality of Service policies, ensures that any intermediate NAT and firewalls can

be traversed, and provides regulatory compliance.

2. Access - the Session Border Controller enables the service provider to access the residential and corporate user across NAT and firewall

d i hil t l idi Q lit f S i t k itdevices whilst also providing Quality of Service, core network security and regulatory compliance.






SBC Szenarien

Der CUBE kann so konfiguriert

UNI scenario

gwerden das er Anrufe zwischenService Providern oder Service Provider zu Softswitch routen kann. Dieses Szenario wird auch

CE

Dieses Szenario wird auchNNI = Network-Network-Interface genannt. PE

SIP ServiceProvider A

Ebenso kann der CUBE Anrufe vomCPE zum SIP Proxy / Registrar

SIP ServiceProvider B

SBC

SIP Proxy with RegistrarO SER

NNI scenario

CPE zum SIP Proxy / Registrar routen.Dieses Szenario wird UNI = User-Network-Interface genannt.

e.g. OpenSER Softswitch e.g.PGW, BTS, CCM

Beide Szenarien können zur gleichen Zeit auf einem CUBE zum Einsatz kommen.


g

Technische Ausprägung bei Cisco p g g

ASR 1004/6 RP2

Cisco unterstützt die CUBE oder SBC Applikation auf verschiedenen Plattformen.

RP2

50-150

3900E ISR G2

ASR 100150-100

S

3900 ISR G2

17ASR 1002

G220-35

AS5000XM

CP

8-12

3800 ISR2900 ISR

G2

2800 ISR

<52801 ISR

800/1861 ISR

10 © Copyright Dimension Data 2009 31 March 2011Active Voice Call (Session) Capacity

12-16K<50 500-600 600-800 900-1000 1500-1700 2000-25004 10-12K

CUBE Session KapazitätsZusammenfassungPlatform CUBE Sessions

C880/C890 SKUs (Future) 5-15 C8xx targeted for 15 1 4M in CQ2 2011

CUBE Session KapazitätsZusammenfassung

2801 552811 1102821 2002851 225

15.1.4M in CQ2 2011

2851 2253825 4003845 500

AS5000XM 600AS5000XM 6002901 1002911 2002921 4002921 4002951 6003925 8003945 9503945 950

3925E 21003945E 2500

ASR1002/1004/1006 RP1 1750

3900E introduced in 15.1.1T in March 2010


S 00 / 00 / 006 50ASR1001 TBD

ASR1004/1006 RP2 15000ASR1001 introduced

in 3.2 in Nov 2010

Technische Ausprägung bei Cisco p g g

Der ASR1k ist eine hoch performante Routingplattform optimiert auf Traffic Throughput, aber auch auf CPU Power für das Processing.g p g

D ASR1k i d L A lik ti h P bl ll lDer ASR1k in der Lage Applikationen ohne Probleme parallel zu verarbeiten. SBC ist dabei nur eine von vielen Anwendungen, die der

ASR unterstützt.

Der SBC muss somit nicht mehr nur als reiner stand - alone SBC, als eigenständiges Netzelement, arbeiten, sondern ließe sich mit andereneigenständiges Netzelement, arbeiten, sondern ließe sich mit anderen

Netzfunktionalitäten kombinieren.


Cisco ASR 1000 mit Quantum Flow Processor (QFP)Q (Q )

Diese neue Recheneinheit bildet die Hardware-Grundlage der neuen Router-Generation.

Auf einem einzelnen Chip sitzen nun 40 Kerne die gleichzeitig bis zuAuf einem einzelnen Chip sitzen nun 40 Kerne, die gleichzeitig bis zu 160 Prozesse ausführen können.

Damit soll das Chipset in der Lage insbesondere die neuen undDamit soll das Chipset in der Lage, insbesondere die neuen und vielfältigen Herausforderungen an den Netzwerkverkehr zu erfüllen.

Di A hit kt l bt ß d i it S ktDiese Architektur erlaubt außerdem ein weites Spektrum an Netzwerk-Applikationen beziehungsweise Funktionen:

Firewall, IP Security Virtual Private Networks (IPsec VPNs), DeepPacket Inspection (DPI) und Session Border Control (SBC)Packet Inspection (DPI) und Session Border Control (SBC)


CUBE (Ent) on ASR1000 Series( )ASRASR--10061006

6 RU6 RUASRASR--10041004

ASRASR--100210022 RU2 RU

4 RU4 RU

ASRASR--100110011 RU1 RU

3-slot 8-slot 12-slotSPA Sl t

1-slot

1Integrated

11

22

# of ESP Slots# of RP Slots

SPA Slots

IntegratedIntegrated CPU Integrated

CPUIntegratedSW, B2B

12

SW, B2Bn/a

23

HW, Inboxn/a

# o S o s# of SIP Slots

IOS RedundancyBuilt in GigE

eg a ed C UIntegratedSW, B2B

4 SW, B2B4

5-10 Gbps

n/a10-20 Gbps

n/a10-40+ Gbps

Built in GigEBandwidth

42.5-5 Gbps

RP1-basedCUBE (Ent)

RP1, RP2CPU RP1 , RP2RP2-based


Inbox SW, B2B17CPS/1.75K

Inbox SW, B2B17CPS/1.75K RP1150CPS/15K RP2

CPUHA

Session CapacityInbox HW

17CPS/1.75K RP1150CPS/15K RP2

Inbox SW, B2BTBD

Grundsätzliche CUBE RedundanzOptionenp

ASR1006ASR1002/4• ASR 1001/2/4/6

• ASR 2 5 2 6 3 1Dual Forwarding

plane HW

Active OS Standby OS

Dual Control plane HW (CPU)

• ASR 2.5, 2.6, 3.1• Media preservation

• ASR 3.2 (Nov 2010)• Stateful failover

• Local redundancy

Inbox redundancy

•ISR G2 and ASR 1001/2/4

Active/Standby

•ISR G2 CUBE 8.5 (15.1.2T)•Media preservation

•ASR 3.2 (Nov 2010)•Stateful failover

•Local redundancy

L2 Box-to-Box

redundancy

SIP SIP SPSP

Virtual IP

CUBE

CUBE

Virtual IP

y

• All platforms SIP SIP SPSPLoad

BalancerLoad

Balancer

All platforms• Load balancing by

• SP call agent• Internal SIP proxy/load

balancer• Local redundancy

Clustering with load balancing


SIP SIP SPSP

• Local redundancy• Geographical redundancy

CUBE Box-to-Box FailoverCUBE Box-to-Box Failover

Inside OutsideConfiguration

SIP SPSIP SP

Active

10.10.25.14

GE 0/0GE 0/1

10.10.24.14

10.10.25.110.10.24.1

Standby

GE 0/0GE 0/1

10.10.25.1310.10.24.13

Virtual Interface Address

Virtual Interface Address

ActiveCall Handling

X Active calls are preserved via checkpointing at the time

of failover

SIP SIP SPSP

CUBE

Standby -> Active

X of failover

CUBE

New calls set up after the failure go through the


Standby (now Active) CUBE

ASR 1000 Series Building Blocksg

RP (Route Processor)• Handles control plane traffic

Route Processor (standby)

Embedded ServicesProcessor

(active)

Embedded ServicesProcessor(standby)

Route Processor

(active) Handles control plane traffic • Manages system• RP1, RP2

ESP• Handles forwarding plane traffic

ESP5 ESP10 ESP20 ESP40

(standby)

RP

I t

(active)

FECP

(standby)

FECP

(active)

RP

I t • ESP5,ESP10, ESP20, ESP40SPA Interface Processor

• Shared Port Adapters provide interface connectivity

Centralized Forwarding Architecture

Interconn.

Interconn.

QFP subsys-

temCrypto assist

Interconn.

QFP subsystemCrypto

assist

Interconn.

g• All traffic flows through the active ESP, standby is synchronized with all flow state with a dedicated 10Gbps link

Distributed Control Architecture• All major system components have a

Passive Midplanej y p

powerful control processor dedicated for control and management planes (using dedicated GigE links running between all system components – not shown)

IOCPSPA

A

Interconn.

IOCPSPA

A

Interconn.

IOCPSPA

A

Interconn.

SPASPA

Agg.

… SPASPA

Agg.

…SPASPA

Agg.

…


SIPsSPA-SPI, 11.2GbpsHypertransport, 10Gbps

ESI, (Enhanced Serdes) 11.5Gbps

Cisco Lizenzmodel

Ei f h Li d lEinfaches Lizenzmodel für die ASR1k Familie

Alle Features in den Lizenzen enthaltenBei Transcoding darauf achten =>entsprechende DSP (Digitale

Si l ) K t k lk liSignalprozessor) Karten kalkulieren


ASR DSP Shared Port Adapter (SPA)p ( )

A single-height form factor SPA with DSPs

ASR 100xVoice transcoding and transrating support with CUBE (Ent)− Traditional (G.711-any) and Universal ( y)

(any-any) CUBE (Ent) transcoding− No other voice/video services supported

by the DSPs in this phaseby the DSPs in this phaseLeverage ISR G2 PVDM3 DSP technology− Same technology, but different form-

factor, i.e. ISR PVDMs cannot be used in an ASR DSP SPA

Availability: ASR R3 2 in Nov 2010

DSP Shared Port Adapter (SPA)

Availability: ASR R3.2 in Nov 2010


CUBE (Ent) LeistungsmerkmaleCUBE (Ent) Leistungsmerkmale

CUBE (Ent) auf der ASR1k Plattform unterstützt unteranderem:• Verschlüsselung der Signalisierung und Medienströme durch

IPsec SRTP TLSIPsec , SRTP , TLS• Separation durch VLANs• SIP - H.323 Interworking

SIP SIP I Interworking• SIP – SIP-I Interworking• IPv4 - IPv6 Interworking• DTMF Interworking• Call admission control• Number manipulation• Header manipulation• ….


CUBE (Ent) Features in RLS 3.2CUBE (Ent) Features in RLS 3.2

CUBE (Ent) support on the ASR1001 Platform• Redundancy Enhancements

I b d d ASR1001/2/4/6 ith t t f l f il• Inbox redundancy on ASR1001/2/4/6 with stateful failover• Older releases provide media preservation• Box-to-Box redundancy on ASR1001/2/4 with stateful failoverDSP H d (SPA d) S t• DSP Hardware (SPA card) Support• Support for Transcoding and Transrating

• Configurable RTP port rangeN CUBE ISR F t t d ASR• New CUBE ISR Features now supported on ASR• RTP-SRTP interworking• SG3 fax and iSAC Support• Gain/Attenuation Control

• CVP 8.5 qualification of CUBE ASR for Contact Center deployment (target Jan 2011)


Herzlichen Dank für Ihre Aufmerksamkeit.

Sollten Sie noch Fragen oder den Wunsch nach weiterer Beratung/Information haben, können wir gern einen Termin vereinbaren.

Stephan BastianDimension Data Germany AG & Co. KG

stephan bastian@eu didata [email protected]+49 174 3299 134


Backup


QFPQFPQuantum Flow Processor


24

Introducing …

Cisco QuantumFlow Processor

Technology

Fundamental “Game Changing” Cisco Innovation


ASR 1000 Series Innovations Cisco QuantumFlow Processor

5 year designMassively parallel, 40 multi-threaded cores

Cisco QFPCisco QuantumFlow Processor

QFP Architecture designed to scale to >100Gbit/sec160 processes available to handle trafficHigh-priority traffic is prioritisedPacket replication capabilities for Lawful InterceptFull visibility of entire L2 frameLatency: tens of microseconds with features enabledInterfaces on-chip for external cryptographic engineCurrent generation QFP is capable of 20Gbit/sec, 32Mpps processing +

Cisco QFP Sun Ultrasparc T2 Intel Core 2 Mobile U7600

Total number processes (cores x

160 64 2p (threads)

Power per process 0.51W 1.01W 5WScalable traffic 128k queues None None


management128k queues None None

Cisco QFP Traffic Manager

S t A hit t (HW & SW) dSystem Architecture (HW & SW) and High Availability


27

RedundancyandHighavailability ( ASR 1002 )The SBC operating on the ASR 1000 series can offer hardware redundancy within a single chassis, and also software redundancy for non‐hardware‐redundant deployments, through the use of the IOS XE operating system

RedundancyandHighavailability ( ASR 1002 )

system.

The illustration here shows the ASR 1002 platform. It contains a built‐in Route Processor (RP) card and two power supplies, within a 2 Rack Unit chassis. The RP card provides the signaling plane (SBE) functionality The media plane (DBE) functionalityfunctionality. The media plane (DBE) functionality is supported by an ESP card. Since there are no slots for redundant RP and ESP cards, a unique software redundancy feature is supported. This is achieved by running two instances of the SBC software on the same CPU. The two instances are completely separate, and they communicate using inter‐process communication (IPC) for heartbeats, to synchronise SBC configuration, and to maintain connected call states across the active and standby instancesinstances.


RedundancyandHighavailability ( ASR 1006 )RedundancyandHighavailability ( ASR 1006 )The picture here shows the ASR 1006 platform. This is a 6 Rack Unit platform, with space for two RP (SBE) and two ESP (DBE) cards and up to 12 SPA cards. It has dual power supplies, similar to ASR 1002 and ASR 1004. With the ASR 1006, the pairs of cards operate in a hot standby ‘active standby’cards operate in a hot standby active‐standby configuration and the cards communicate to each other using the backplane.

Th l h d l ESP d RP d i hiThe example shows dual ESP and RP cards within the same chassis. These cards operate in an active/standby (hot‐standby) fashion.

Notethat there are a few considerations that need to be made when determining the type of cards fitted within a chassis. The considerations are concerned with call rate, media throughput.Pleasenote that during switchover, some new traffic is lost, but when the caller reattempts, the call can connect.


System Architecture Control PlaneyEthernet out-of-band Channel (EOBC)

Run between ALL components

Indication if cards are installed and ready

Watchdog timers

State information exchange forL2 or L3 Protocols

Route Processor (Standby)

Route Processor

(active)

Forwarding Processor(Standby)

FECP

Forwarding Processor

(active)

FECPRP RPL2 or L3 Protocols

I2C

Monitor health of hardware components

Control resets

QFP subsys-

temCrypto assist

QFP subsys-

temCrypto assist

RP RP

Control resets

Communicate acive/standby, Real time presence and ready indicators

Control the other RP (reset, power-down,

Interconn.Interconn.

Midplaneinterrupt, report Power-supplystatus, signal ESP active/standby)

EEPROM access

SPA control linksIOCPSPA

Agg

Interconn.

IOCPSPA

Agg

Interconn.

IOCPSPA

Agg

Interconn.

SPA control links

Run between IOCP and SPAs

Detect SPA OIR

Reset SPAs (via I2C)

SPASPA

Agg.

…SPASPA

Agg.

… SPASPA

Agg.

…


( )

Power-control SPAs (via I2C)

Read EEPROMsEOBC - 1GbpsI2C – Inter Integrated Circuit

SPA ControlSPA Bus

Data Packet Flow


31

Data Packet Flow: From SPA through SIPgFPs

1.SPA receives packet data from its network interfaces and transfers the packet to the SIP

2 SPA A ti l ifi th k t i t H/LInterconn.

2.SPA Aggregation classifies the packet into H/L priority

3.SIP writes packet data to external 128B memory (at 40Gbps from 4 full-rate SPA’s).

4 I b ff i d i t 64Ingress

Scheduler

Egress Buffer Status

4.Ingress buffer memory is carved into 64 queues. The queues are arranged by SPA-SPI channel and optionally H/L. Channels on “channelized” SPA’s share the same queue.

5 SIP selects among ingress queues for next pkt to

SIP

g…

Ingress Buffers (per port)

…

Egress Buffers (per port)

5.SIP selects among ingress queues for next pkt to send to ESP over ESI. It prepares the packet for internal transmission

6.The interconnect transmits packet data of selected packet over ESI to active ESP at up to

Ingress classifier

(p p )

SPA Agg.

selected packet over ESI to active ESP at up to 11.5Gbps.

7.Active ESP can backpressure SIP via ESI ctlmessage to slow pkt transfer over ESI if overloaded (provides separate backpressure for

ESI 11 2Gbps

overloaded (provides separate backpressure for Hi vs. Low priority pkt data).


ESI, 11.2GbpsSPA-SPI, 11.2Gbps

Hypertransport, 10Gbps Other

4 SPAsData SPA

Data Packet Flow: Through ESP

Pkt Buffer Part Len/Resource TCAM4 (10Mbit)

8. Interconnect on ESP receives packet data interleaved from all SIP’s over ESI’s at up to 11.5Gbps each and writes it t k tPkt Buffer

DRAM (128MB)

Part Len/ BW

SRAMDRAM

(512MB)

( )

Processor pool

PPE0 PPE0 ESP

it to packet memory9. The dispatcher assigns it to one of 40

processor/context(thread). 10. The PPE processes the packet. The

PPE acccesses external memoryPPE0PPE0PPE0PPE1

PPE0PPE0PPE0PPE6

PPE0PPE0PPE0PPE2

PPE0PPE0PPE0PPE5

PPE0PPE0PPE0PPE3

… PPE0PPE0PPE0PPE40

PPE0PPE0PPE0PPE4

Buffer, queue, schedule (BQS)Buffer, queue, schedule

(BQS)Buffer, queue, schedule (BQS)

PPE acccesses external memory (DRAM and TCAM) to perform various lookups, etc. It can also invoke HW assists for statistics, policers, WRED…

11. The PPE adds/modifies packet headers (incl adding the ESI header and any( )(BQS)

Dispatcher/Pkt B ff

(incl. adding the ESI header and any SPA shim header)

12. When the PPE has finished processing the packet, the packet is written to specified queue.

13Pkt Buffer 13. The HQF-based scheduler selects the next eligible packet for each scheduling hierarchy.

14. The selected packet for the hierarchy to SIP (or RP or other ESP) is transmitted

ESI 11 2Gbps

Interconn.

SIP (or RP or other ESP) is transmitted over the ESI.

15. CC can independently backpressure ESP via ESI control message to pace the packet transfer if overloaded.


ESI, 11.2GbpsSPA-SPI, 11.2Gbps

Hypertransport, 10Gbps Other

CCsData

Data Packet Flow: Through ESP To SPAFPs 16.Interconnect receives packet data over ESI

from the active ESP at up to 11.5Gbps.17 SPA Aggregation receives the packet and

Interconn.

17.SPA Aggregation receives the packet andwrites it to external egress buffer memory.

18.Egress buffer memory is carved into 64 queues. The queues are arranged by egress SPA-SPI channel and optionally H/L. ChannelsSIP

Ingress Scheduler

Egress Buffer Status

SPA SPI channel and optionally H/L. Channels on “channelized” SPA’s share the same queue.

19.SPA Aggregation selects and transfers packet data from eligible queues to SPA-SPI channel (Hi queue are selected before Low)

SIP

g…

Ingress Buffers (per port)

…

Egress Buffers (per port)

( q )20.SPA can backpressure transfer of packet data

burst independently for each SPA-SPI channel using SPI FIFO status.

21.SPA transmits packet data on network

Ingress classifier

(p p )

SPA Agg.

pinterface

ESI, 11.2Gbps


SPA-SPI, 11.2GbpsHypertransport, 10Gbps

Other4 SPAsData SPA

BackupBackupSRTP Passthrough Call Flow Redundant Topology


Software/System Stack on QFP/ASR 1000Software/System Stack on QFP/ASR 1000

IOSRoute Processor

Software View Hardware View

RPForwarding Manager

IOS

HT

RPCPU

GigE MAC Interconnect

Forwarding ManagerESP ESP Active Forwarding Processor

GigE EOBC (IPC)

QFP Client / DriverFECPCPU

HT

ESI (PUNT)

11.5 Gbps

QFPQFP Datapath s/w

SPI4.2

QFP SubsystemPUNT

Inter-connect

Inter-connect

Carrier Card - SPA


Forwarding Information Path Transit DataLegend Punt Traffic

Documents

DFN B t i b tDFN Betriebstagung...2011/03/31 · Cisco ASR 1000 mit QQ(Q)uantum Flow Processor (QFP) Diese neue Recheneinheit bildet die Hardware-Grundlage der neuen Router-Generation