Service-Based Interface Packet Order Enforcement (SBIPOE)

Note:  The configuration and management of hardened SBIPOE application, including automatic migration of existing SBIPOE deployments during config sync are supported only when VSN 6.9.04 is managed by GigaVUE-FM 6.13.01.

SBI Packet Order Enforcement (SBIPOE) is a GigaVUE V Series 2 application designed for 5G service-based environments that use a service mesh to secure communication between network functions with TLS encryption.

In this environment, the Service Mesh Tap provides an authorized monitoring point for encrypted transactional traffic, and Gigamon Containerized Broker (GCB) integrates with it to receive, translate, and forward packet data to GigaVUE V Series for delivery to monitoring tools.

Because packet ordering can become disrupted during the Service Mesh Tap and GCB integration, monitoring tools may receive incoherent transaction data. SBIPOE addresses this issue by enforcing the correct packet order for transactions captured from the Kubernetes-based service mesh before the traffic is forwarded for analysis.

Configure SBIPOE Application

To configure a SBIPOE application:

1.

In GigaVUE-FM, go to Traffic > Orchestrated Flows > Openstack (Select the required platform). The Monitoring Session page appears.

2.

Select New Monitoring Session to create a monitoring session. For information on how to create a monitoring session refer to Create a Monitoring Session.

3.

Once the monitoring session is created, the monitoring session page opens with the monitoring session canvas.

4.

Select the Traffic Processing tab in the monitoring session canvas.

5.

Drag and drop a Tunnel from the Traffic Elements section. The Add Tunnel Spec pane appears.

6.

Enter or select the following fields to create an ingress tunnel:

a.

Alias - Enter a name for the ingress tunnel.

b.

Description - Enter the description for the tunnel.

c.

Type - Select the type of the ingress tunnel.

7.

Select Save. The ingress tunnel appears in the canvas.

8.

Drag and drop a Sbipoe application from the Applications dropdown list. The Sbipoe pane appears.

9.

In the Details tab of the Sbipoe pane, configure the following fields:

a.

Alias - Enter a name of the Sbipoe application.

b.

TCP Server Ports - Enter the TCP server ports for HTTP2 transactions. The valid server ports lies in the range of 1-65535.

Note:  This field populates with the default TCP server ports in GigaVUE-FM. You can add the required server ports along with the existing ports. It is recommended not to delete the default ports that are populated.

c.

Number of Flows - Enter the number of flows in the range of 500-25600. This allows the user to monitor the concurrent TCP flows. The default value is 2000.

Note:  
Ensure that the cumulative sum of all SBIPOE applications for a V Series Node does not exceed the defined maximum range.
It is recommended to deploy the VSN with 8 vCPU / 32 GB RAM. With this form factor, you can deploy not more than 7 SBIPOE application instances per VSN. Initially, you can deploy with the default 2000 flows and increase that value only if flow allocation errors are observed.

d.

Request Timeout (s) - Enter the timeout value for the HTTP2 request in seconds. The valid range is 1-300 seconds and the default value is 10 seconds.

e.

Response Timeout (s) - Enter the timeout value for the HTTP2 response in seconds. The valid range is 1-300 seconds and the default value is 2 seconds.

f.

HTTP2 MTU - Enter the maximum size of each packet that the tunnel endpoint can carry to the tool. The valid range is 1000-9600 and the default value is 8800.

10.

Click Save. The Sbipoe application appears in the canvas.

11.

Create a link between the ingress tunnel and the Sbipoe application.

12.

Drag and drop a Tunnel from the Traffic Elements section. The Add Tubbel Spec pane appears.

13.

Enter or select the following fields to create an egress tunnel:

a.

Alias - Enter a name for the ingress tunnel.

b.

Description - Enter the description for the tunnel.

c.

Type - Select the type of the egress tunnel.

14.

Select Save. The egress tunnel appears in the canvas.

15.

Create a link between the Sbipoe application and the egress tunnel.

After you deploy the monitoring session, you can view the detailed statistics of an individual traffic processing element in the Traffic Processing tab. For more details, refer to View Application Statistics for Service-Based Interface Packet Order Enforcement (SBIPOE) Application