SONiC & VPP: Building a Software-Defined L3 Routing Lab with Containerlab

The push for more flexible and efficient network infrastructure continues to gain momentum, with disaggregated routing solutions leading the charge. Recent perform builds on the foundation laid in Part One of this series, demonstrating how the SONiC control plane and the Vector Packet Processing (VPP) data plane can work together to create a high-performance, software-defined routing stack. This second part moves beyond theory, detailing a practical lab demonstration that connects two SONiC-VPP routers with Linux hosts, showcasing a fully functional Layer 3 (L3) routing environment.

Reconstructing the L3 Routing Demo

The core of this demonstration, available on GitHub, isn’t just about proving the architecture works; it’s about illustrating how easily it can be deployed and configured. The setup leverages containerization, specifically using tools like Containerlab, to rapidly create a multi-node network topology based on a simple declarative file. This approach streamlines the process of building and testing network configurations, making it ideal for both development and validation.

Lab Topology and Components

The lab environment consists of four key nodes: two SONiC-VPP virtual routers (router1 and router2) and two Linux containers acting as hosts (PC1 and PC2). Router1 and router2 serve as gateways for their respective LAN segments. PC1 and PC2 represent typical finish-user devices within those segments. The physical connections are straightforward: an inter-router link connects router1:eth1 to router2:eth1, whereas PC1 connects to router1 via PC1:eth2 and router1:eth2, and PC2 connects to router2 via PC2:eth2 and router2:eth2. This relatively simple topology allows for focused testing of the routing functionality.

Initial Configuration: Setting the Stage

The initial network configuration involves setting up static IP addresses and routes on the Linux hosts and configuring the interfaces on the SONiC-VPP routers. PC1 is assigned 10.20.1.1/24 with a static route to the 10.20.2.0/24 network via router1 (10.20.1.254). Similarly, PC2 receives 10.20.2.1/24 and a route to 10.20.1.0/24 via router2 (10.20.2.254). On the router side, the inter-router interface (Ethernet0) is configured with IP addresses 10.0.1.1/30 on router1 and 10.0.1.2/30 on router2. The LAN-facing interface (Ethernet4) receives 10.20.1.254/24 on router1 and 10.20.2.254/24 on router2. These initial configurations establish the basic connectivity needed for dynamic routing to take effect.

Dynamic Routing with BGP

The demonstration utilizes Border Gateway Protocol (BGP) for dynamic routing between the two routers. This is achieved through the FRRouting suite, which is integrated within SONiC. An internal BGP (iBGP) session is established between router1 and router2, both operating within Autonomous System (AS) 65100. Router1, with a router-id of 10.0.1.1, peers with router2 at 10.0.1.2, while router2 (router-id 10.0.1.2) peers with router1 at 10.0.1.1. Crucially, each router advertises its connected LAN segment – router1 advertises 10.20.1.0/24, and router2 advertises 10.20.2.0/24 – allowing them to learn routes to each other’s networks.

Verification and Data Path Analysis

Verification of the setup occurs in three stages. First, the BGP session status and learned routes are checked within the vtysh shell on each router. Commands like ‘display ip bgp summary’ confirm the established peering session, and ‘show ip route’ displays the learned routes. Second, the forwarding table within the VPP data plane is inspected using the VPP command-line interface (vppctl) inside the syncd container. The ‘show ip fib’ command confirms that the BGP-learned routes have been successfully programmed into the forwarding table. Finally, end-to-end connectivity is tested with a simple ping from PC1 to PC2 (ping 10.20.2.1 from PC1). Successful pings confirm the entire data path is functional, from the host, through the routers, and back again.

Performance and Future Development

The SONiC-VPP integration isn’t just about functionality; it’s about performance. By offloading the data plane to VPP, which runs in user space, the solution unlocks significant throughput improvements. Benchmarks consistently show VPP outperforming kernel-based forwarding, with some sources claiming gains of 10x to 100x in packet processing throughput. This performance boost enables demanding utilize cases like “Terabit IPSec” on commodity hardware. A demonstration at the ONE Summit 2024 showcased a SONiC-VPP virtual gateway providing multi-cloud connectivity between AWS and Azure, achieving round-trip times of less than 1 millisecond.

This level of performance is particularly valuable for high-performance edge routing, multi-cloud connectivity, and integrated security services. The key advantage of VPP lies in its predictable, low-latency performance, achieved by running in user space on dedicated cores and utilizing poll-mode drivers, avoiding the unpredictable delays inherent in the Linux kernel’s network stack. This is critical for emerging workloads like real-time IoT data processing and 5G network functions.

Development of SONiC-VPP is ongoing, with a key focus on expanding the Switch Abstraction Interface (SAI) API to expose more of VPP’s features to the SONiC control plane. Currently, SAI primarily covers basic L2/L3 forwarding. However, VPP offers a vast library of advanced features, and efforts are underway to create SAI extensions for features like Network Address Translation (NAT) and advanced VxLAN multi-tenancy capabilities. Recent pull requests on the sonic-platform-vpp GitHub repository demonstrate ongoing work to add support for features like VxLAN BGP EVPN and improve ACL testing.

The Future of Disaggregated Networking

The integration of SONiC and VPP represents a significant step forward for disaggregated networking. It demonstrates the viability of separating the control and data planes, creating a flexible, high-performance, and open platform. The synergy between these two Linux Foundation projects highlights the power of collaborative, community-driven development. This approach transforms the traditional router into a dynamic software application deployable on commodity servers, enabling network engineers to embrace automation, version control, and CI/CD pipelines – treating network infrastructure as code. As detailed in the SONiC Foundation website, this shift promises a more agile, scalable, and innovative network infrastructure capable of supporting the demands of modern applications.

Looking ahead, continued development will focus on deepening the integration between SONiC and VPP, expanding the SAI API, and enhancing support for advanced networking features. The ongoing work within the open-source community ensures that SONiC-VPP will remain at the forefront of disaggregated networking innovation.