In this lesson,
we're going to discuss Software-Defined Networking.
Software-Defined Networking or SDN
is revolutionizing our network architectures
and is critical to the functioning of the cloud at scale.
At its most basic level, software-defined networking
allows us to use software to replace
traditional network devices,
but it's a little bit more complicated than that,
so we're going to spend a little bit of time
in this lesson discussing exactly how it works.
Now software-defined networks or SDNs
are defined as an approach to networking
that uses software-based controllers
or application programming interfaces known as APIs
to communicate with underlying hardware infrastructure
and then direct traffic on a network.
The true magic of an SDN
lies in its application aware capabilities,
which allows the network to make intelligent decisions
based upon the specific application requirements
that it's trying to support.
This ensures optimal performance for critical applications
and efficient resource utilization.
This is a critical aspect of cloud computing as well,
because it allows organizations to more easily manage
and control their network traffic,
which can improve their scalability, security,
and overall network performance.
Software-defined networks are part of a larger concept
known as Infrastructure as Code or IaC.
Infrastructure as code
includes the provisioning of architectures
in which deployment of resources is going be performed
by scripted automation and orchestration.
With zero trust provisioning,
SDNs can be configured and maintained
with minimal manual intervention,
and this dramatically reduces the time
and complexity that's involved in setting up your networks
and conducting network administration.
Now SDNs are not the only type of infrastructure as code,
but without SDNs, it would be truly impossible
to use infrastructure as code
with networking equipment and devices.
With IaC, the infrastructure could be a network device
such as what we use in SDNs,
or it can be servers, databases,
and other virtualized compute instances too.
Now to better understand software-defined networking,
you first have to understand the three portions
of a typical network architecture.
These are the control plane, the data plane,
and the management plane.
Now the control plane is going to be responsible for carrying
the traffic that provides the signals to and from a router,
such as those used in sharing information
and building routing tables.
Transport agnostic systems like SDNs are not limited
by the underlying network technology though,
whether that's going to be ethernet,
Wi-Fi or something else entirely.
And so this allows for the seamless integration
and operation across multiple diverse transport media types.
The control plane will make its decisions
about how traffic should be prioritized and secured
and where it should be switched to in the network.
If you think about traditional router
or switch or a quality of service device,
these all operate at the control plane layer.
Now the second plane we have is known as the data plane,
and the data plane is used to carry
user traffic on the network.
This is often called the forwarding plane as well.
This data plane is where the bulk
of our network traffic is going to reside.
That's where the actual switching and routing of the traffic
and the imposition of access control list
or ACLs are going to be implemented
to provide some security in our networks.
Now to make this a bit easier to understand,
remember that the control plane is making all the decisions
for how that data is going to be moved,
but it's actually the data plane
that's actually going to move that data around the network.
Therefore, as you can imagine,
these two planes are going to work very closely together.
Now the third plane we have
is known as the management plane.
The management plane is used to administer
the routers and switches inside of the network,
and it's used to monitor traffic conditions
and the status of your network.
Basically, the management plane provides us
with the oversight of the network
and allows us to make configuration changes
to make sure that things are working the way they should.
This type of central policy management
allows administrators to define
and enforce networking policies from a single control point,
and this streamlines network operations
and ensures consistency across
your entire network infrastructure.
Now, in a traditional or conventional network,
these different planes all exist
in a physical piece of hardware
that implements these functions through firmware
in that device like a router or a switch.
But with software-defined networking,
these functions are actually moved out of
the physical devices in their firmware.
And instead, these functions are incorporated
into a virtualized device or a decoupled device
that's going to focus on a single planes function at one time
using APIs provided by the vendors
to communicate between these three planes.
Now, to set up a software-defined network,
your organization is going to use an SDN application
to define the policy decisions.
This occurs on the management plane,
and then those rules and policies are going to be deployed
and operated within the control plane
of the different devices.
Of course, the data planes are still going to be there
to move all that traffic across the network too.
Using SDNs has advantages over conventional networks
because you now have the ability to mix
and match products from different vendors
because they're all using common API calls
to create the needed functionality.
Software-defined networks also provide organizations
with increased choices in their network development,
and this adds to the speed
and agility in which you can establish a network,
as well as the ability to add increased layers of automation
and policy management into
our organization's network functions
by easily using programming
to automate all this stuff for us.
Now, the best benefit of an SDN though
is that it can allow for the fully automated deployment
of a network within the cloud.
By using an SDN, you can have the ability to provision
all of your network links, your appliances,
and even your servers automatically
through the use of orchestration.
So if you're running servers in the cloud
and you need to horizontally
or vertically scale up to create more capacity,
the system can actually detect that
and then actually spin up those additional resources for you
and add them into your network using SDN.
Because of all this automated capability and scalability,
SDNs are critical when you're dealing with high velocity
or high availability architectures,
or if you're doing a lot of things
inside the disaster recovery space.
Also, because everything is treated as software,
you can also make it easier for yourself
to collect security data across your entire network too,
'cause everything is just software
and it's just ones and zeros going across the network.
This allows your security teams to more easily detect
the different traffic patterns in your network.
And if they start deviating from normal baselines,
you'll be able to detect that too.
Software-defined networks do have some
disadvantages though that you need to be aware of.
For example, if we lose connectivity to the SDN controller,
then our entire network could go down
or we could lose our ability to control our network.
Also, the use of a centralized controller
and SDNs does create a real target for attackers to focus on
because they can cripple our entire network
by taking over that singular controller.
So if you're going to be working
as a cybersecurity professional one day,
you really need to ensure you know how to harden
and protect that SDN controller.
Now, when it comes to software-defined networks,
there are three main types.
We call these Open SDN, Hybrid SDN, and SDN Overlay.
The first one is open SDN.
Open SDN is an open source variant
of software-defined networking
that relies on open source technologies like OpenFlow,
OpFlex, and OpenStack to operate.
The second is known as hybrid SDNA.
A hybrid SDN is a network that employs
traditional SDN protocols to operate itself.
This allows the network to use
open SDN technologies like OpenFlow,
as well as traditional protocols used
in physical network devices.
The third is SDN Overlay.
SDN Overlay is a method of using software
to create layers of network abstraction
that can be used to run multiple separate
and discrete virtualized network layers
on top of your physical network.
By using SDN Overlay,
you can create virtual connections
between different endpoints
and provide additional security benefits using it too.
From a security standpoint,
using an SDN can really add additional security
and logical isolation into your network.
For example, to add additional security
such as implementing zero trust,
you can use SDN overlay
to securely create logical peer-to-peer connections
across a physical network device
using these additional layers of abstraction.
This is a great use of SDN
to increase the security of your network,
and it'll be really hard to replicate
without the orchestration and automation
that's provided to us through the use
of a software-defined network.
So remember, software-defined networks
or SDN are a way of managing
and controlling networks using software
instead of using traditional hardware devices.
This allows for greater flexibility, scalability,
and security in our networks.
Software-defined networking is made up of three planes,
the control plane, the data plane, and the management plane.
The control plane is responsible for making decisions
about how traffic should be routed and secured.
The data plane is responsible
for carrying the actual traffic.
And the management plane is responsible
for monitoring and managing the network.