Demystifying configuration challenges and trade-offs in network-based ISP services

Abstract

ISPs are increasingly offering a variety of network-based services such as VPN, VPLS, VoIP, Virtual-Wire and DDoS protection. Although both enterprise and residential networks are rapidly adopting these services, there is little systematic work on the design challenges and trade-offs ISPs face in providing them. The goal of our paper is to understand the complexity underlying the layer-3 design of services and to highlight potential factors that hinder their introduction, evolution and management. Using daily snapshots of configuration and device metadata collected from a tier-1 ISP, we examine the logical dependencies and special cases in device configurations for five different network-based services. We find: (1) the design of the core data-plane is usually service-agnostic and simple, but the control-planes for different services become more complex as services evolve; (2) more crucially, the configuration at the service edge inevitably becomes more complex over time, potentially hindering key management issues such as service upgrades and troubleshooting; and (3) there are key service-specific issues that also contribute significantly to the overall design complexity. Thus, the high prevalent complexity could impede the adoption and growth of network-based services. We show initial evidence that some of the complexity can be mitigated systematically.

Configuration analysis and recommendation: Case studies in IPv6 networks

“…Czyz et al [37] found that misconfiguration is prevalent in IPv6 networks. Benson et al proposed two models to quantify the complexity of configurations [23,24]. They not only captured the difficulty of configuring control and data plane behaviors on routers, but also unraveled the complexity of configuring network-based ISP services.…”

“…As depicted in Fig. 1, this snippet is made up of two types of function modules, i.e., interfaces module (lines 1-16) and firewall module (lines [17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34][35][36]. The Interfaces module consists of all kinds of interfaces that will be enabled on a router.…”

“…One is used to control the input (sava-ctc2bw) and the other is used to control the output (ipv6-sample). The filter of savactc2bw is defined in the firewall module (lines [19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34]. We omit the description of ipv6-sample for space reasons.…”

“…According to the complexity models and metrics [23,24], we intend to quantify the complexity of IPv6 configurations to answer the questions of Topic three. Investigating the complexity of IPv6 configurations can abstract the templates from the configuration files, as well as reveal the dependence among the configuration commands.…”

“…Understanding the structure and design pattern of configuration files can show us how the policies execute and collaborate, as well as, where are the key points that are error-prone. Thirdly, deep analysis about configuration files can uncover the complexity of network management and the challenges of network-based services [23,24]. We will know which parts of configurations are time-consuming and how to decrease the complexity of configurations, either through optimizing configuration languages, or adjusting the structure of network.…”