README_NFFG

This file describes, through many examples, how to write a NF-FG (Network Function Forwarding Graph).

===============================================================================

Create a new graph that directly connects two endpoints.

 * The graph connects the interface eth0 of a node identified by ip address 10.0.0.1 and the interface eth1 of the same node. The "domain" field tells the orchestrator where the whole graph will be instantiated.  

{
  "forwarding-graph": {
    "id": "00000001",
    "name": "Only network graph",
    "domain": "domain1",
    "end-points": [
      {
        "id": "00000001",
        "name": "ingress",
        "type": "interface",
        "interface": {
          "node-id": "10.0.0.1",
          "if-name": "eth0"
        }
      },
      {
        "id": "00000002",
        "name": "egress",
        "type": "interface",
        "interface": {
          "node-id": "10.0.0.1",
          "if-name": "eth1"
        }
      }
    ],
    "big-switch": {
      "flow-rules": [
        {
          "id": "00000001",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000001"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000002"
            }
          ]
        },
        {
          "id": "00000002",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000002"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000001"
            }
          ]
        }
      ]
    }
  }
 }
 
 * It is also possible to have more than one action in a flow-rule

{
  "id": "00000002",
  "priority": 1,
  "match": {
    "port_in": "endpoint:00000002"
  },
  "actions": [
    {
      "output_to_port": "endpoint:00000001"
    },
    {
      "output_to_port": "endpoint:00000003"
    },
    {
      "output_to_controller": true
    }
  ]
}

 or	a drop action

{
  "id": "00000002",
  "priority": 1,
  "match": {
    "port_in": "endpoint:00000002"
  },
  "actions": [
    {
      "drop": true
    }
  ]
}

 * The graph outputs traffic coming from the interface eth0 of a node identified by IP address 10.0.0.1 to the interface eth1 of the same node using the VLAN tag 123  
 
{
  "forwarding-graph": {
    "id": "00000001",
    "name": "Only network graph",
    "domain" : "domain1",
    "end-points": [
      {
        "id": "00000001",
        "name": "ingress",
        "type": "interface",
        "interface": {
          "node-id": "10.0.0.1",
          "if-name": "eth0"
        }
      },
      {
        "id": "00000002",
        "name": "egress",
        "type": "vlan",
        "vlan": {
          "vlan-id": "123",
          "node-id": "10.0.0.1",
          "if-name": "eth1"
        }
      }
    ],
    "big-switch": {
      "flow-rules": [
        {
          "id": "000000001",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000001"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000002"
            }
          ]
        },
        {
          "id": "000000002",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000002"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000001"
            }
          ]
        }
      ]
    }
  }
}

 * The graph connects the interface 300 in the switch openflow:110953238266560 of node identified by ip address 10.0.0.1 with the end-point external_endpoint_1 of the graph external_graph_2

{
  "forwarding-graph": {
    "id": "00000001",
    "name": "Only network graph",
    "domain" : "domain1",
    "end-points": [
      {
        "id": "00000001",
        "name": "ingress",
        "type": "interface",
        "interface": {
          "node-id": "openflow:110953238266560",
          "if-name": "300"
        }
      },
      {
        "id": "00000002",
        "name": "egress",
        "type": "interface",
        "remote_endpoint_id": "external_graph_2:external_endpoint_1"
      }
    ],
    "big-switch": {
      "flow-rules": [
        {
          "id": "000000001",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000001"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000002"
            }
          ]
        },
        {
          "id": "000000002",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000002"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000001"
            }
          ]
        }
      ]
    }
  }
}


Create a graph of VNFs not connected with the outside world. 
 * Note that the "domain" field is not present in the root of forwarding-graph but is set for every VNF. This implies that the VNF 00000001 will be instantied on domain1 and the VNF 00000002 on domain2 and then they will be connected. The orchestrator is in charge of performing these operations.   

{
  "forwarding-graph": {
    "id": "00000001",
    "name": "Forwarding graph",
    "VNFs": [
      {
        "vnf_template": "client.json",
        "id": "00000001",
        "name": "Client function",
        "ports": [
          {
            "id": "inout:0",
            "name": "data-port"
          }
        ],
        "domain": "domain1"
      },
      {
        "vnf_template": "server.json",
        "id": "00000002",
        "name": "Server function",
        "ports": [
          {
            "id": "inout:0",
            "name": "data-port"
          }
        ],
        "domain": "domain2"
      }
    ],
    "big-switch": {
      "flow-rules": [
        {
          "id": "000000001",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:inout:0"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000002:inout:0"
            }
          ]
        },
        {
          "id": "000000002",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000002:inout:0"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000001:inout:0"
            }
          ]
        }
      ]
    }
  }
}

Create a graph with end-points and VNFs.

 * This NF-FG is very simple, the traffic coming from the interface eth0 goes through the firewall and exit through the eth1 interface. The opposite happens to traffic from eth1.

{
  "forwarding-graph": {
    "id": "00000001",
    "name": "Forwarding graph",
    "domain": "domain1",
    "VNFs": [
      {
        "vnf_template": "firewall.json",
        "id": "00000001",
        "name": "Firewall",
        "ports": [
          {
            "id": "User:0",
            "name": "User side interface"
          },
          {
            "id": "WAN:0",
            "name": "WAN side interface"
          }
        ]
      }
    ],
    "end-points": [
      {
        "id": "00000001",
        "name": "ingress",
        "type": "interface",
        "interface": {
          "node-id": "10.0.0.1",
          "if-name": "eth0"
        }
      },
      {
        "id": "00000002",
        "name": "egress",
        "type": "interface",
        "interface": {
          "node-id": "10.0.0.1",
          "if-name": "eth1"
        }
      }
    ],
    "big-switch": {
      "flow-rules": [
        {
          "id": "000000001",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000001"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000001:User:0"
            }
          ]
        },
        {
          "id": "000000002",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:User:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000001"
            }
          ]
        },
        {
          "id": "000000003",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:WAN:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000002"
            }
          ]
        },
        {
          "id": "000000004",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000002"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000001:WAN:0"
            }
          ]
        }
      ]
    }
  }
}

 * Traffic splitting example. (the traffic coming from a VNF/end-point is divided for kind and sent to different destinations). The "domain" field is present in all VNFs and Endpoints. The two VNFS along with the egress endpoint will be instantiated on domain2, while the ingress endpoint will be on domain1.


{
  "forwarding-graph": {
    "id": "00000001",
    "name": "Forwarding graph",
    "VNFs": [
      {
        "vnf_template": "firewall80.json",
        "id": "00000001",
        "name": "Web Firewall",
        "ports": [
          {
            "id": "User:0",
            "name": "User side interface"
          },
          {
            "id": "WAN:0",
            "name": "WAN side interface"
          }
        ],
        "domain": "domain2"
      },
      {
        "vnf_template": "firewall.json",
        "id": "00000002",
        "name": "Non-Web Firewall",
        "ports": [
          {
            "id": "User:0",
            "name": "User side interface"
          },
          {
            "id": "WAN:0",
            "name": "WAN side interface"
          }
        ],
        "domain": "domain2"
      }
    ],
    "end-points": [
      {
        "id": "00000001",
        "name": "ingress",
        "type": "interface",
        "interface": {
          "node-id": "10.0.0.1",
          "if-name": "eth0"
        },
        "domain": "domain1"
      },
      {
        "id": "00000002",
        "name": "egress",
        "type": "interface",
        "interface": {
          "node-id": "10.0.0.2",
          "if-name": "eth1"
        },
        "domain": "domain2"
      }
    ],
    "big-switch": {
      "flow-rules": [
        {
          "id": "000000001",
          "priority": 100,
          "match": {
            "ether_type": "0x0800",
            "protocol": "tcp",
            "dest_port": "80",
            "port_in": "endpoint:00000001"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000001:User:0"
            }
          ]
        },
        {
          "id": "000000002",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:User:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000001"
            }
          ]
        },
        {
          "id": "000000003",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000001"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000002:User:0"
            }
          ]
        },
        {
          "id": "000000004",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000002:User:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000001"
            }
          ]
        },
        {
          "id": "000000005",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:WAN:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000002"
            }
          ]
        },
        {
          "id": "000000006",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000002:User:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000002"
            }
          ]
        },
        {
          "id": "000000007",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000002"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000002:User:0"
            }
          ]
        }
      ]
    }
  }
}

* Real example.

{
  "forwarding-graph": {
    "id": "00000001",
    "name": "Protected access to the internet",
    "domain": "domain1",
    "VNFs": [
      {
        "vnf_template": "switch.json",
        "id": "00000001",
        "name": "switch-data",
        "ports": [
          {
            "id": "L2Port:0",
            "name": "data-lan"
          },
          {
            "id": "L2Port:1",
            "name": "data-lan"
          },
          {
            "id": "L2Port:2",
            "name": "data-lan"
          }
        ],
        "groups": [
          "isp-function"
        ]
      },
      {
        "vnf_template": "dhcp.json",
        "ports": [
          {
            "id": "inout:0",
            "name": "data-port"
          }
        ],
        "name": "dhcp",
        "id": "00000002",
        "groups": [
          "isp-function"
        ]
      },
      {
        "vnf_template": "cisco_firewall.json",
        "ports": [
          {
            "id": "WAN:0"
          },
          {
            "id": "User:0"
          }
        ],
        "name": "firewall",
        "id": "00000003"
      },
      {
        "vnf_template": "nat.json",
        "ports": [
          {
            "id": "WAN:0"
          },
          {
            "id": "User:0"
          }
        ],
        "name": "router-nat",
        "id": "00000004",
        "groups": [
          "isp-function"
        ]
      }
    ],
    "end-points": [
      {
        "id": "00000001",
        "name": "ingress",
        "type": "interface",
        "interface": {
          "node-id": "130.192.225.193",
          "if-name": "to-br-usr"
        }
      },
      {
        "id": "00000002",
        "name": "egress",
        "type": "interface",
        "interface": {
          "node-id": "130.192.225.193",
          "if-name": "eth2"
        }
      }
    ],
    "big-switch": {
      "flow-rules": [
        {
          "id": "000000001",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000001"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000001:L2Port:0"
            }
          ]
        },
        {
          "id": "000000002",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:L2Port:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000001"
            }
          ]
        },
        {
          "id": "000000003",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000002:inout:0"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000001:L2Port:1"
            }
          ]
        },
        {
          "id": "000000004",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:L2Port:1"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000002:inout:0"
            }
          ]
        },
        {
          "id": "000000005",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000003:User:0"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000001:L2Port:2"
            }
          ]
        },
        {
          "id": "000000006",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000001:L2Port:2"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000003:User:0"
            }
          ]
        },
        {
          "id": "000000007",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000003:WAN:0"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000004:User:0"
            }
          ]
        },
        {
          "id": "000000008",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000004:User:0"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000003:WAN:0"
            }
          ]
        },
        {
          "id": "000000009",
          "priority": 1,
          "match": {
            "port_in": "endpoint:00000002"
          },
          "actions": [
            {
              "output_to_port": "vnf:00000004:WAN:0"
            }
          ]
        },
        {
          "id": "000000010",
          "priority": 1,
          "match": {
            "port_in": "vnf:00000004:WAN:0"
          },
          "actions": [
            {
              "output_to_port": "endpoint:00000002"
            }
          ]
        }
      ]
    }
  }
}