Dynamic Service Discovery for the Enterprise Technology and Deployment Stephen Orr - Distinguished Systems Engineer
Total Page:16
File Type:pdf, Size:1020Kb
Dynamic Service Discovery for the Enterprise Technology and Deployment Stephen Orr - Distinguished Systems Engineer BRKCRS-2110 Session Abstract Have you ever experienced problems with service discovery on Apple devices when they reside on other subnets? Not seeing your Apple TV or printer? Fear not! Service Discovery Gateway is here to the rescue! With the proliferation of mobile devices, tablets and smartphones (also BYOD) in enterprise networks users might fail to discover services like printers, displays, and media servers among others. This is a major problem faced by many enterprise networks today and is especially acute in education and healthcare networks. Cisco is introducing a new solution in IOS and IOS XE for converged wireless and wired access that allows users to discover services overcoming those existing boundaries to unleash the true potential of BYOD. This session will introduce Cisco’s new solution for enterprise-wide service discovery enhancing the Zeroconf protocol family that is widely used especially in Apple products. 3 Session Objectives At the End of This Session, Participants Should: • Understand what Service Discovery is • Understand why this is a problem in todays networks • Understand how Service Discovery works • Know about the Service Discovery Gateway and how it addresses the described problem • Can design and configure a SDG with filters • Understand the benefit of deploying a SDG in a wired / wireless network and how it enhances the BYOD experience 4 Acronym Decoder Ring aTV: Apple TV ACL: Access Control List AP: (Wireless) Access Point BYOD: Bring Your Own Device RBAC: Role Based Access CAPWAP: Control And Control Provisioning of Wireless Access DNS-SD: DNS Service Points Discovery SGACL: Security Group ACL CVD: Cisco Validated Design IPP: Internet Printing Protocol SGT: Security Group Tag SDG: Service Discovery mDNS: Multicast Domain Name Gateway System WLC: Wireless LAN Controller RAOP: Remote Audio Output Protocol TTL: Time to Live 5 Agenda • Introduction • IOS Service Discovery Gateway • Implementation: How does it work? • Configuration • Topology Considerations • Best Practice Recommendations • Conclusion 6 Introduction 7 What is this about? • BYOD: Massive influx of consumer devices to be placed on Enterprise networks • Consumer devices are typically made to work within a single Layer 2 domain in the home • Customer expect to have the same type of services in the Enterprise / Campus that they do at home however across L3 boundaries • Device types include mobile devices (iOS, Android), printers, cameras, PCs etc. 8 “Bonjour technologies do not work in a scalable, sustainable fashion between different IP subnets” Educause Higher Ed Wireless Networking Admin Group Petition —761 Signatures 9 What is Zeroconf? • Zero Configuration Networking • “To enable communications of hosts and services on a network that may not contain configuration services such as DNS and DHCP without needing a guy in a white lab coat.” • Three components of the Zeroconf architecture 1. Addressing 2. Naming 3. Discovery • Available on Safari Books http://www.zeroconf.org/ 10 What is Service Discovery? A subset of Zeroconf • DNS-SD defined by RFC 6763 "DNS-Based Service Discovery" • Typically transported via multicast DNS (mDNS) • mDNS defined in RFC 6762 "Multicast DNS" Dynamically find resources like Printers or Displays • No central infrastructure required (no DHCP, no DNS, …) • Works on link-local addresses, if need be RFC says it should be IP address family agnostic • IPv4 • IPv6 11 • Enables the naming of hosts on the “local link” as opposed to using the global namespace defined in traditional DNS • Any DNS query for a name ending with ".local" uses mDNS • multicast address 224.0.0.251 or IPv6 FF02::FB • Name conflict resolution built in – appends a “-1, -2” etc. on conflict • Utilizes traditional DNS constructs: • A, AAAA, PTR, TXT, SRV and NSEC Records Use of PTR as a redirection into another node in the name hierarchy • Caching on each host, learning from others hosts 12 Where is Zeroconf available? • Printers • Smartphones • Windows • Access Points • Tablets • Mac OS X • Switches • Android / iOS based • Linux • Routers • Speakers • Applications • Cameras • Network Management • Displays Software • AV Receivers 13 Service Instance • DNS-SD utilizes “Service Instances” Service Type • Service Instance Name = <Instance> . <Service> . <Domain> Domain • Domain local. = Multicast DNS .local cisco.com ietf.org dns-sd.org cisco.com = Unicast DNS • Service first is an “_” followed by application protocol name Service second is an “_” followed by “tcp” or “udp” example _http_tcp _http._tcp _airplay._tcp _dacp._udp _raop._udp • Instance sorr-ipad Instance • Service Type: _http._tcp.local sorr-ipad • Specific Service Instance: sorr-ipad._http._tcp.local • Service Instance Enumeration (Browsing) – browse for specific services _services._dns-sd._udp.local (Browse for ALL available services) _airplay._tcp.local (all Airplay devices on the local segment) _ipp._tcp.local (all IPP Printers on the local segment) 14 The Issue Explained L2 L3 SAME L2 DOMAIN DIFFERENT L2 DOMAIN (OTHER SUBNET) Service Browsing stops here! Where’sWhere’s my my $!@#Printer? Printer?! Bonjour works I’m here! over “Link Local” Talk to me... scope X 15 Cisco Solution in the Network L2 L3 SAME L2 DOMAIN DIFFERENT L2 DOMAIN (OTHER SUBNET) Enable Service Discovery Feature 16 Cisco Solution in the Network L2 L3 SAME L2 DOMAIN DIFFERENT L2 DOMAIN (OTHER SUBNET) Store Advertisement I can print! Cache Function Stores Messages 17 Cisco Solution in the Network L2 L3 SAME L2 DOMAIN DIFFERENT L2 DOMAIN (OTHEROK to see? SUBNET) Yes! Where’s my printer? Filtering Function Controls Visibility to Services 18 Cisco Solution in the Network L2 L3 SAME L2 DOMAIN DIFFERENT L2 DOMAIN Here’s a (OTHERprinter that I SUBNET) know about. Message Please tell Handling people Function Handles about me. Messages from Cache 19 Cisco Solution in the Network L2 L3 SAME L2 DOMAIN DIFFERENT L2 DOMAIN (OTHER SUBNET) Now I can print! I love to With Service print! Discovery Complete, Everybody Can Work. 20 IOS SDG Service Discovery Gateway 21 IOS Cisco Service Discovery Gateway • Enables Zeroconf service discovery across VLANs • Easy to manage • Designed to scale • Transparent to consumer devices • IPv4 and IPv6 • Network-wide solution • Enhances BYOD on the campus • Can be combined with role-based access control, ‘Better Together’ 22 Where is this needed? Outside your home… • Wired / Wireless • Printers / handheld devices and • Displays (Apple TVs), … • Large-Scale Environments • Buildings with multiple floors • General L2 segregation using VLANs • Combination of both 23 Once the service discovery is completed the applications establish independent unicast media streams: • iTunes: Digital Audio Access Protocol (DAAP) – delivers the media stream from iTunes to the end device. Cannot cross multiple L3 boundaries (TTL=2) • Music Streaming: Remote Audio Output Protocol (RAOP) – streams audio from devices to remote speakers. Cannot cross multiple L3 boundaries (TTL=2) • iPhoto: Digital Photo Access Protocol (DPAP) • AirPlay: used for screen mirroring and display from iPad / iPhone / iPod to AppleTV – MacBook enabled with Mountain Lion Release • Finder, Printer Subsystem,Time Machine, Screen Sharing, FaceTime, Terminal, iChat (Messages), ... • Third Party Apps (JollysFastVNC, Adium, Cyberduck, ...) 24 mDNS Query for Airplay and RAOP Remote Audio Output Protocol = Streaming Music to Airport / AppleTV 25 Service Discovery vs. Access Control • Service Discovery • Is your Phone Book. What is Mr. Printer's number? • Can I call Mr. Printer? • Access Control • Phone book needed if known number? • Do we allow the phone call? • Better Together • use the phone book for easy lookup (Service Discovery) • Use 'caller screening' for security (e.g. ACLs) 26 Benefits and Considerations Benefits Considerations Eliminate Boundaries. Allow service Topology Support: Current implementation discovery crossing VLAN boundaries supports only one hop (access devices connected to a distribution switch) Granular application of filters. On either a Filtering per segment. Role Based Access global or per-interface basis will be addressed in a later phase Control of advertised and consumed No Hierarchy. Flat namespace implied by services. Like with ACLs, the visibility of protocol specification services can be controlled Supports both IPv4 and IPv6 Endpoints may have difficulties with longer lists Simultaneous integrated wired and wireless network support BYOD readiness – the service is transparent to end devices 27 Implementation 28 Service Discovery Gateway Architecture • Cache / Directory of available services Cache • Filter Services • Permit / Deny globally -or- on per-interface basis Identity* • Inbound and outbound filters Filter • Service Types and Instances Services Policy • Wildcarding / Regular Expressions • ACLs for mDNS Location* • Process mDNS message-set Message Handling • Includes Proxy functions • Combination with other technologies ACLs – L2 / L3 Forwarding • RBAC with ACLs / SGTs / SGACLs • Unicast / multicast forwarding *future Network 29 Service Discovery "Conversation“ Always talking to ALL Q: Hey, Everybody! Who can print using IPP? “PTR (QM)? _ipp._tcp.local.” RFC 2782 (DNS SRV Service Types) A: I do! “PTR Color Printer in Cube 1._ipp._tcp.local.” and RFC 6355 (Service name and Port numbers) Q: Color Printer, tell me about your service? “SRV (QM)? Color Printer in Cube 1._ipp._tcp.local.” “TXT (QM)?