Practical and Incremental Convergence between SDN and Middleboxes

Networks today rely on middleboxes to provide critical performance, security, and policy compliance functions. Today, however, achieving these benefits and ensuring that the traffic traverses the desired sequence of middleboxes requires significant manual effort and operator expertise. In this respect, Software-defined Networking (SDN) offers a promising alternative. However, middleboxes introduce new aspects (e.g., policy composition, resource management, packet modifications) that fall outside the purvey of traditional L2/L3 functions that SDN supports (e.g., access control or routing). Thus, prior attempts in applying the SDN philosophy to middlebox management have mandated significant changes to middlebox implementations and/or SDN control interfaces. This paper addresses a practical question: Can today’s SDN simplify and improve the management of current middlebox deployments? To this end, we address algorithmic and system design challenges to demonstrate the feasibility of using SDN to simplify middlebox management. In doing so, we also take a significant step toward addressing industry concerns surrounding the ability of SDN to integrate with existing infrastructure and support L4–L7 capabilities.