HPE Network Protector SDN Application Part 7 - Demo Service Insertion Tunnel / GRE Tunnel

Key Takeaways

now one of the concerns you may have had when watching this is when traffic is sent from this host to the switch so it does a DNS query that DNS query is intercepted forwarded across the network to the sdn controller it's sent to network protector which then queries the database and then has to send a response back to the client if it's a malicious domain or it's sent back to the switch if it's not a malicious domain and is then sent normally to the DNS server which then replies so there's an additional delay for the client getting a response from the DNS server now one of the things HP have done on specific switches that support what are called version 2 asex so there's some specific Hardware requirements in this case is they use the asex on the switch for forwarding traffic to the controller via a tunnel called a service insertion tunnel essentially it's a GRE tunnel but it can use Hardware forwarding of traffic from the switch to the controller via the GE tunnel using the Asic on the switch rather than using the central CPU of the switch so it allow us for very high throughput of traffic we can see that by looking at one of the switches so as an example this is a 3800 series switch when I look at the port ports of that switch you'll notice there's a port ID here with a long number when I look at the flows you'll see that DNS traffic is forwarded to this port and not to the controller Port the reason why is that on that switch when I use the command show interfaces tunnel type intercept we can see that a service insertion tunnel 01 has been created from the local switch to the controller and it has this interface index if I type the command show interface tunnel I'll see something similar tunnel number tunnel name tunnel Source the local switch tunnel destination the controller it's a service tunnel it's a service insertion tunnel we can see some routing information we can see that the tunnel is enabled this tunnel was created on the fly by Network protector using SNMP when I click on device status and look at that switch I can see that the current inspection mode is inline service insertion so the switch has been configured by Network protector to use a service insertion tunnel for high throughput of DNS queries to the controller using the Asic on the switch