Software-Defined Networking軟體定義網路

Controller-based networking solutions and architectures is one ways to simply how networks are built and managed. Software-Defined Networking (SDN) controllers centralize management of many devices in one single point of administration. This method decreases complexity, human error, and the time it takes to deliver a new service.

以控制器為基礎的網路解決方案與架構，是簡化網路建置與管理方式的方法之一。軟體定義網路（SDN）控制器將許多裝置的管理集中到單一管理點。這種方式可降低複雜度、人為錯誤，並縮短交付新服務所需的時間。

Software-Defined Networking (SDN) is a set of techniques, not necessarily a specific technology, that seeks to program network devices either through a controller or some other external mechanism. Software-Defined Networking (SDN) refers to the capacity to control, manage, and change network behavior dynamically through an open interface rather than through direct, closed-box methods. It allows the network to be managed as a whole and increases the ability to configure the network in a more deterministic and predictable way.

軟體定義網路（SDN）是一組技術手法，而非某項特定技術，其目的是透過控制器或其他外部機制對網路裝置進行程式化控制。軟體定義網路（SDN）是指透過開放介面（而非直接的封閉式方法）動態控制、管理與改變網路行為的能力。它讓網路可以被視為一個整體來管理，並提升以更具確定性、可預測方式設定網路的能力。

With Software-Defined Networking (SDN), you can reduce the complexity of your network by using a standardized network topology and by building an abstract overlay network on top. In this way, you move from a single device view of the network (box-oriented) to a global, high-level view (network-oriented). This high-level view enables you to use abstractions and simplifications when provisioning new services. For example, the network operator configuring a virtual private network (VPN) for a remote office environment is not concerned (and should not be) with the physical layout of the network. The only requirement of the remote site and operator is that the network spans all geographic regions required for the VPN (for example, the Main Campus and Remote Office). The controller will figure out what needs to be provisioned. The prerequisite to this is that the controller is the central point of management and the "source of truth" for the configuration.

透過軟體定義網路（SDN），你可以使用標準化的網路拓樸，並在其上建置抽象化的覆蓋網路，藉此降低網路的複雜度。如此一來，你便能從單一裝置觀點（以裝置為導向）轉變為全域、高層次的觀點（以網路為導向）。這種高層次的觀點讓你在佈建新服務時能運用抽象化與簡化。舉例來說，為遠端辦公室環境設定虛擬私人網路（VPN）的網路操作人員，不需要（也不應該）關心網路的實體佈局。遠端站點與操作人員唯一需要確保的是，網路涵蓋 VPN 所需的所有地理區域（例如主校區與遠端辦公室）。控制器會負責釐清需要佈建的內容。這一切的前提是，控制器是管理的中心點，也是設定的「真實來源」。

Using abstractions when managing your network also enables you to use standardized components. Software-Defined Networking (SDN) implementations typically define a standard architecture and Application Programming Interfaces (APIs) that the network devices use. To a limited degree, you can also swap a network device for a different model or a different vendor altogether. The controller will take care of configuration, but the high-level view of the network for the operators and customers will stay the same.

在管理網路時運用抽象化，也能讓你使用標準化元件。軟體定義網路（SDN）的實作通常會定義網路裝置所使用的標準架構與應用程式設計介面（API）。在有限程度上，你甚至可以將某台網路裝置更換為不同型號，或完全不同廠牌的裝置。控制器會負責處理設定，而操作人員與客戶所看到的網路高層次視圖則維持不變。

Simplification of configuration and automated management also directly results in operating expenses (OPEX) savings. Typically, the total cost of ownership (TCO) for a network in a 5-year span comprises about 30 percent capital expenditure (CAPEX) and about 70 percent OPEX. Manual service configuration and activation represent a significant chunk of OPEX.

設定的簡化與自動化管理也會直接帶來營運支出（OPEX）的節省。一般而言，網路在 5 年期間的總持有成本（TCO）中，約 30% 為資本支出（CAPEX），約 70% 為 OPEX。人工進行的服務設定與啟用，正是 OPEX 中相當大的一部分。

Software-Defined Networking (SDN) allows network engineers to provision, manage, and program networks more rapidly, as it greatly simplifies automation tasks by providing a single point of administration for the programming of the infrastructure.

軟體定義網路（SDN）讓網路工程師能更快速地佈建、管理與程式化網路，因為它提供了單一的基礎架構程式化管理點，大幅簡化了自動化工作。

Controller-based networking makes centralized policy easy to achieve. Networkwide policy can be easily defined and distributed consistently to the devices connected to the controller. For example, instead of attempting to manage access control lists across many individual devices, a flow rule can be defined on the central controller and pushed down to all the forwarding devices as part of the normal operations.

以控制器為基礎的網路，讓集中式政策更容易達成。可輕鬆定義網路整體政策，並一致地分發到連接至控制器的所有裝置。舉例來說，與其嘗試在許多個別裝置上管理存取控制清單，不如在中央控制器上定義一條流量規則，並作為一般作業程序的一部分，推送到所有轉送裝置。

Compared to traditional networking, controller-based networking makes it easy to define special treatment for specific network traffic. Instead of adding complexity to the network through advanced mechanisms like policy-based routing, a traffic flow rule can be defined on the controller and pushed down to all the forwarding devices as part of normal operations. The largest benefit here is that there is a device, a controller, that has a unified view of the network in one location.

相較於傳統網路，以控制器為基礎的網路能更輕鬆地為特定網路流量定義特殊處理方式。與其透過政策式路由等進階機制為網路增加複雜度，不如在控制器上定義一條流量規則，並作為一般作業程序的一部分，推送到所有轉送裝置。這樣做最大的好處在於，有一台控制器能在單一位置對整個網路擁有統一的視圖。

This single point of administration addresses the scalability problem where administrators are no longer required to touch each individual device to make changes to the environment. This concept is also not new as controllers have also been around for many years and used for campus wireless networking. Similar to the behavior between a Cisco Wireless LAN Controller (WLC) and its managed access points (APs), the controller provides a single point to define business intent or policy, reducing overall complexity through the consistent application of intent or policy to all devices that fall within the management domain of the controllers. For example, think about how easy it is to enable authentication, authorization, and accounting (AAA) for wireless clients using a WLC, compared to enabling AAA for wired clients (where you would need AAA changes on every switch if you are not using a controller).

這種單一管理點解決了可擴充性的問題，管理人員不再需要逐一操作每台裝置來變更環境設定。這個概念其實並不新穎，控制器多年來一直存在，並用於校園無線網路。這與 Cisco 無線 LAN 控制器（WLC）及其所管理的無線基地台（AP）之間的運作方式類似，控制器提供單一的定義點來設定業務意圖或政策，並藉由對管理網域內所有裝置一致套用意圖或政策，降低整體複雜度。舉例來說，想想使用 WLC 為無線用戶端啟用驗證、授權與記帳（AAA）有多麼容易，相較之下，為有線用戶端啟用 AAA 就困難得多（若不使用控制器，你需要在每一台交換器上進行 AAA 變更）。

With automated processes, the time to provision a new service or implement a change request is drastically reduced. What would previously take days or weeks to implement can be automated to run in hours, along with testing and verification. Lifecycle management is another important step in the automation process—from design and installation of the infrastructure components (day 0) to service enablement (day 1) to management and operations (day 2). Also, after the customer no longer needs the service, the resources that are used must be deallocated and the configuration of the devices must be cleaned up. Even with proper change management procedures, this process is tedious at best if performed manually. If the process is fully automated, you can make sure that the same configuration changes that were applied when provisioning the new service will be removed when it is deprovisioned.

透過自動化流程，佈建新服務或實施變更請求所需的時間會大幅縮短。過去可能需要數天甚至數週才能完成的工作，現在可自動化在數小時內完成，同時包含測試與驗證。生命週期管理是自動化流程中另一個重要步驟，從基礎架構元件的設計與安裝（第 0 天），到服務啟用（第 1 天），再到管理與維運（第 2 天）。此外，當客戶不再需要該服務時，也必須解除配置所使用的資源，並清理裝置上的設定。即使有完善的變更管理程序，若以人工方式執行，這個過程頂多也只能說是繁瑣。若整個流程完全自動化，就能確保在服務解除佈建時，先前佈建新服務時所套用的相同設定變更會被一併移除。