Introducing F5 BIG-IP Next CNF Solutions for Red Hat OpenShift

5G and Red Hat OpenShift

5G standards have embraced Cloud-Native Network Functions (CNFs) for implementing network services in software as containers. This is a big change from previous Virtual Network Functions (VNFs) or Physical Network Functions (PNFs).

The main characteristics of Cloud-Native Functions are:

• Implementation as containerized microservices
• Small performance footprint, with the ability to scale horizontally
• Independence of guest operating system, since CNFs operate as containers
• Lifecycle manageable by Kubernetes

Overall, these provide a huge improvement in terms of flexibility, faster service delivery, resiliency, and crucially using Kubernetes as unified orchestration layer. The later is a drastic change from previous standards where each vendor had its own orchestration. This unification around Kubernetes greatly simplifies network functions for operators, reducing cost of deploying and maintaining networks. Additionally, by embracing the container form factor, allows Network Functions (NFs) to be deployed in new use cases like far edge. This is thanks to the smaller footprint while at the same time these can be also deployed at large scale in a central data center because of the horizontal scalability.

In this article we focus on Red Hat OpenShift which is the market leading and industry reference implementation of Kubernetes for IT and Telco workloads.

Introduction to F5 BIG-IP Next CNF Solutions

F5 BIG-IP Next CNF Solutions is a suite of Kubernetes native 5G Network Functions, implemented as microservices. It shares the same Cloud Native Engine (CNE) as F5 BIG-IP Next SPK introduced last year. The functionalities implemented by the CNF Solutions deal mainly with user plane data.

User plane data has the particularity that the final destination of the traffic is not the Kubernetes cluster but rather an external end-point, typically the Internet. In other words, the traffic gets in the Kubernetes cluster and it is forwarded out of the cluster again. This is done using dedicated interfaces that are not used for the regular ingress and egress paths of the regular traffic of a Kubernetes cluster. In this case, the main purpose of using Kubernetes is to make use of its orchestration, flexibility, and scalability.

The main functionalities implemented at initial GA release of the CNF Solutions are:

• F5 Next Edge Firewall CNF, an IPv4/IPv6 firewall with the main focus in protecting the 5G core networks from external threads, including DDoS flood protection and IPS DNS protocol inspection.
  
  
• F5 Next CGNAT CNF, which offers large scale NAT with the following features:
  • NAPT, Port Block Allocation, Static NAT, Address Pooling Paired, and Endpoint Independent mapping modes.
  • Inbound NAT and Hairpining.
  • Egress path filtering and address exclusions.
  • ALG support: FTP/FTPS, TFTP, RTSP and PPTP.
    
    
• F5 Next DNS CNF, which offers a transparent DNS resolver and caching services. Other remarkable features are:
  • Zero rating
  • DNS64 which allows IPv6-only clients connect to IPv4-only services via synthetic IPv6 addresses.
    
    
• F5 Next Policy Enforcer CNF, which provides traffic classification, steering and shaping, and TCP and video optimization. This product is launched as Early Access in February 2023 with basic functionalities. Static TCP optimization is now GA in the initial release.

Although the CGNAT (Carrier Grade NAT) and the Policy Enforcer functionalities are specific to User Plane use cases, the Edge Firewall and DNS functionalities have additional uses in other places of the network.

F5 and OpenShift

BIG-IP Next CNF Solutions fully supports Red Hat OpenShift Container Platform which allows the deployment in edge or core locations with a unified management across the multiple deployments. OpenShift operators greatly facilitates the setup and tuning of telco grade applications. These are:

• Node Tuning Operator, used to setup Hugepages.
  
• CPU Manager and Topology Manager with NUMA awareness which allows to schedule the data plane PODs within a NUMA domain which is aligned with the SR-IOV NICs they are attached to.

In an OpenShift platform all these are setup transparently to the applications and BIG-IP Next CNF Solutions uniquely require to be configured with an appropriate runtimeClass.

F5 BIG-IP Next CNF Solutions architecture

F5 BIG-IP Next CNF Solutions makes use of the widely trusted F5 BIG-IP Traffic Management Microkernel (TMM) data plane. This allows for a high performance, dependable product from the start. The CNF functionalities come from a microservices re-architecture of the broadly used F5 BIG-IP VNFs. The below diagram illustrates how a microservices architecture used.

The data plane POD scales vertically from 1 to 16 cores and scales horizontally from 1 to 32 PODs, enabling it to handle millions of subscribers. NUMA nodes are supported.

The next diagram focuses on the data plane handling which is the most relevant aspect for this CNF suite:

Typically, each data plane POD has two IP address, one for each side of the N6 reference point. These could be named radio and Internet sides as shown in the diagram above.

The left-side L3 hop must distribute the traffic amongst the lef-side addresses of the CNF data plane. This left-side L3 hop can be a router with BGP ECMP (Equal Cost Multi Path), an SDN or any other mechanism which is able to:

• Distribute the subscribers across the data plane PODs, shown in [1] of the figure above.
• Keep these subscribers in the same PODs when there is a change in the number of active data plane PODs (scale-in, scale-out, maintenance, etc...) as shown in [2] in the figure above. This minimizes service disruption.

In the right side of the CNFs, the path towards the Internet, it is typical to implement NAT functionality to transform telco's private addresses to public addresses. This is done with the BIG-IP Next CG-NAT CNF. This NAT makes the return traffic symmetrical by reaching the same POD which processed the outbound traffic. This is thanks to each POD owning part of this NAT space, as shown in [3] of the above figure. Each POD´s NAT address space can be advertised via BGP.

When not using NAT in the right side of the CNFs, it is required that the network is able to send the return traffic back to the same POD which is processing the same connection. The traffic must be kept symmetrical at all times, this is typically done with an SDN.

Using F5 BIG-IP Next CNF Solutions

As expected in a fully integrated Kubernetes solution, both the installation and configuration is done using the Kubernetes APIs. The installation is performed using helm charts, and the configuration using Custom Resource Definitions (CRDs). Unlike using ConfigMaps, using CRDs allow for schema validation of the configurations before these are applied. Details of the CRDs can be found in this clouddocs site. Next it is shown an overview of the most relevant CRDs.

General network configuration

Deploying in Kubernetes automatically configures and assigns IP addresses to the CNF PODs. The data plane interfaces will require specific configuration. The required steps are:

1. Create Kubernetes NetworkNodePolicies and NetworkAttchment definitions which will allow to expose SR-IOV VFs to the CNF data planes PODs (TMM). To make use of these SR-IOV VFs these are referenced in the BIG-IP controller's Helm chart values file. This is described in the Networking Overview page.
2. Define the L2 and L3 configuration of the exposed SR-IOV interfaces using the F5BigNetVlan CRD.
3. If static routes need to be configured, these can be added using the F5BigNetStaticroute CRD.
4. If BGP configuration needs to be added, this is configured in the BIG-IP controller's Helm chart values file. This is described in the BGP Overview page. It is expected this will be configured using a CRD in the future.

Traffic management listener configuration

As with classic BIG-IP, once the CNFs are running and plumbed in the network, no traffic is processed by default. The traffic management functionalities implemented by BIG-IP Next CNF Solutions are the same of the analogous modules in the classic BIG-IP, and the CRDs in BIG-IP Next to configure these functionalities are conceptually similar too.

Analogous to Virtual Servers in classic BIG-IP, BIG-IP Next CNF Solutions have a set of CRDs that create listeners of traffic where traffic management policies are applied. This is mainly the F5BigContextSecure CRD which allows to specify traffic selectors indicating VLANs, source, destination prefixes and ports where we want the policies to be applied.

There are specific CRDs for listeners of Application Level Gateways (ALGs) and protocol specific solutions. These required several steps in classic BIG-IP: first creating the Virtual Service, then creating the profile and finally applying it to the Virtual Server. In BIG-IP Next this is done in a single CRD. At time of this writing, these CRDs are:

• F5BigZeroratingPolicy - Part of Zero-Rating DNS solution; enabling subscribers to bypass rate limits.
• F5BigDnsApp - High-performance DNS resolution, caching, and DNS64 translations.
• F5BigAlgFtp - File Transfer Protocol (FTP) application layer gateway services.
• F5BigAlgTftp - Trivial File Transfer Protocol (TFTP) application layer gateway services.
• F5BigAlgPptp - Point-to-Point Tunnelling Protocol (PPTP) application layer gateway services.
• F5BigAlgRtsp - Real Time Streaming Protocol (RTSP) application layer gateway services.

Traffic management profiles and policies configuration

Depending on the type of listener created, these can have attached different types of profiles and policies.

In the case of F5BigContextSecure it can get attached the following CRDs to define how traffic is processed:

• F5BigTcpSetting - TCP options to fine-tune how application traffic is managed.
• F5BigUdpSetting - UDP options to fine-tune how application traffic is managed.
• F5BigFastl4Setting - FastL4 option to fine-tune how application traffic is managed.

and the following policies for security and NAT:

• F5BigDdosPolicy - Denial of Service (DoS/DDoS) event detection and mitigation.
• F5BigFwPolicy - Granular stateful-flow filtering based on access control list (ACL) policies.
• F5BigIpsPolicy - Intelligent packet inspection protects applications from malignant network traffic.
• F5BigNatPolicy - Carrier-grade NAT (CG-NAT) using large-scale NAT (LSN) pools.

The ALG listeners require the use of F5BigNatPolicy and might make use for the F5BigFwPolicy CRDs. These CRDs have also traffic selectors to allow further control over which traffic these policies should be applied to.

Firewall Contexts

Firewall policies are applied to the listener with best match. In addition to the F5BigFwPolicy that might be attached, a global firewall policy (hence effective in all listeners) can be configured before the listener specific firewall policy is evaluated. This is done with F5BigContextGlobal CRD, which can have attached a F5BigFwPolicy.

F5BigContextGlobal also contains the default action to apply on traffic not matching any firewall rule in any context (e.g. Global Context or Secure Context or another listener). This default action can be set to accept, reject or drop and whether to log this default action.

In summary, within a listener match, the firewall contexts are processed in this order:

1. ContextGlobal
2. Matching ContextSecure or another listener context.
3. Default action as defined by ContextGlobal's default action.

Event Logging

Event logging at high speed is critical to provide visibility of what the CNFs are doing. For this the next CRDs are implemented:

• F5BigLogProfile - Specifies subscriber connection information sent to remote logging servers.
• F5BigLogHslpub - Defines remote logging server endpoints for the F5BigLogProfile.

Demo

 

F5 BIG-IP Next CNF Solutions roadmap

What it is being exposed here is just the begin of a journey. Telcos have embraced Kubernetes as compute and orchestration layer. Because of this, BIG-IP Next CNF Solutions will eventually replace the analogous classic BIG-IP VNFs. Expect in the upcoming months that BIG-IP Next CNF Solutions will match and eventually surpass the features currently being offered by the analogous VNFs.

Conclusion