Multi-Data Plane Architecture for Non-Disruptive Network Upgrades
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Upgrading network edge devices is disruptive, requiring scheduled maintenance windows, extensive pre- and post-upgrade checks, and uncertainty due to differences between testing environments and customer networks, leading to potential failures and downtime.
Innovation Solution
Implementing dual dataplanes, with a primary dataplane for current operations and a shadow dataplane for new version verification, allowing seamless upgrades by comparing performance in the customer's network environment, reducing the need for rollback and ensuring continuous integration and deployment (CI/CD).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If infrastructure upgrades are performed on network edge devices, then the software version is updated, but device downtime and network disruption occur
Solution Approach 1:
The network device is divided into multiple independent dataplanes (active and standby). Each dataplane can be upgraded independently without affecting the other, allowing seamless failover and eliminating device downtime during software updates.
Solution Approach 2:
The standby dataplane is pre-upgraded with the new software version before the active dataplane. This preliminary action allows the standby dataplane to be ready for immediate failover, ensuring continuous operation without downtime when the active dataplane needs maintenance or experiences issues.
2Reliability
If exhaustive pre- and post-upgrade checks are performed, then upgrade reliability is improved, but the complexity and time required for the upgrade process increases
Solution Approach 1:
A shadow dataplane is created as a copy of the active dataplane and used for testing the new software version. This copy allows exhaustive verification of the upgrade without affecting the production system, reducing the need for complex post-upgrade checks and simplifying the overall upgrade process.
Solution Approach 2:
The new software version is tested and verified on the standby dataplane before being activated. This preliminary verification ensures upgrade reliability is achieved through thorough testing, while the standardized failover mechanism keeps the process complexity manageable.
3Reliability
If in-house testing is performed before deployment, then some issues are identified, but issues related to customer-specific network characteristics remain undetected
Solution Approach 1:
The standby dataplane serves as an intermediary testing environment that runs in the actual customer network. It allows verification of software compatibility with customer-specific network characteristics without risking production stability, bridging the gap between controlled in-house testing and live deployment.
Solution Approach 2:
The new software version is preliminarily tested in the standby dataplane within the customer's actual network environment. This allows detection of compatibility issues specific to the customer's network characteristics before the upgrade is activated, ensuring reliable deployment.
4Reliability
If rollback and contingency plans are implemented, then failure risk is mitigated, but the upgrade process becomes more complex and time-consuming
Solution Approach 1:
A standby dataplane is maintained in advance as a cushion against failures. This standby instance can immediately take over if the active dataplane fails, providing automatic failure mitigation without requiring time-consuming rollback procedures or complex contingency planning.
Solution Approach 2:
The standby dataplane is pre-configured and kept ready with the same or newer software version. This preliminary preparation ensures that failure mitigation is already in place, eliminating the need for time-consuming rollback operations when failures occur.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A system and method are provided for continuous integration, continuous deployment of a network component, such as a software-defined wide area network, a firewall, a router, or a load balancer. The software development lifecycle is achieved without interrupting the data flow of the network by using a multi-dataplane architecture, including a primary dataplane and a shadow dataplane. A packet dispatcher relays ingress data packets to the primary dataplane executing a current version of the network component and the shadow dataplane executing an upgrade to the network component. A control plane agent analyzes/compares the performances of the respective dataplanes for verification testing, and the control plane agent upgrades the network component to the new version upon passing the verification testing. The upgrades is achieved without interruption to the data flow of the network component by gradually transitioning to outputting egress data packets generated using the upgraded version.