In Cisco IOS XE Bengaluru 17.5.1, Cisco Catalyst 9400 Series Switches support high availability in OpenFlow mode. A chassis-based platform, the Cisco Catalyst 9400 Series Switch supports dual supervisors. One of the supervisors act as the active, and the other as the standby.

Prior to the introduction of this feature, during a switchover, the OpenFlow controller deleted all installed flows on the device before resending all flows that led to the disruption of the forwarding traffic. Also during a switchover, the OpenFlow controller connection was reset, and re-established, and the controller deleted all installed flows.

With the high availability feature, the active supervisor establishes a connection with the OpenFlow controller, and all flows sent by the controller are programmed onto the device by the active supervisor. When the active supervisor fails due to software or hardware failure, or when a manual switchover from the active to standby supervisor is triggered, all flows are retained. The OpenFlow agent on the new active supervisor will continue the TCP session with the OpenFlow controller, and the connection will not be terminated by the OpenFlow agent.

Stateful switchover (SSO) maintains stateful protocol and application information to retain user session information during a switchover. The flows sent to the OpenFlow device by the controller are retained during a switchover from the active supervisor to the standby supervisor, so that the controller does not have to re-install the flows. It also provides a faster switchover relative to high system availability.

In devices that support dual supervisors, SSO takes advantage of the supervisor redundancy to increase the network availability. SSO establishes one of the supervisors as the active and the other as the standby, and then synchronizes critical state information between them. Following an initial synchronization between the two supervisors, SSO dynamically maintains state information between them.

SSO is used with the Cisco Nonstop Forwarding (NSF) feature.

With NSF, even during a switchover, packets are forwarded based on the flow entries programmed by the OpenFlow controller.

Symmetric high availability is when the both the active and standby supervisors are up and running before the active OpenFlow agent establishes an OpenFlow TCP connection with the OpenFlow controller.

In symmetric high availability mode, both the active and standby supervisors operate independently. Only the active supervisor exchanges OpenFlow protocol messages with the controller. All TCP packets received by the active supervisor from the OpenFlow controller are duplicated to the standby supervisor. The OpenFlow hardware table configuration, group table entries, and flow entries in both the active and standby supervisors are synchronized.

In asymmetric high availability the standby supervisor boots up only after the active OpenFlow agent establishes an OpenFlow TCP connection with the controller. When the standby boot up, the flows installed by the controller on the active supervisor, and the TCP controller connection are not synchronized on the standby. The high availability process on the active supervisor does a bulk sync to synchronize the controller TCP connection, and sends flows, groups, OpenFlow Table Feature Message installed on the active to the standby supervisor. The statistics counters on the standby supervisor are synchronized next, so that the standby can receive the duplicated, controller sent packets.

When the standby supervisor fails to install the Table Feature Message sent by the active, the standby supervisor notifies the active of the failure. On receiving the failure information, the active supervisor will not initiate any further synchronization to the standby. The active supervisor will mark the installation failure as a bulk sync failure, logs an error message, and notifies the standby supervisor. The standby supervisor reloads upon receiving the message. In case of group mod and flow mod failures, the same process is followed.

Statistics are also synchronized from the active supervisor to the standby during the bulk sync. Statistics synchronization failure is ignored, because the statistics are synchronized dynamically every few seconds after the bulk sync.

The active supervisor maintains the OpenFlow TCP connection with the controller through the management interface, GigabitEthernet 0/0, and this connection is synchronized with the standby supervisor. The active supervisor probes the controller-connection based on the configured probe interval.

After a switchover, the management interface on the new active takes a minimum of 13 seconds to become operational. Packets sent by the controller until then are not received, and this can lead to the disconnecting of the OpenFlow TCP connection. To avoid the OpenFlow agent timeout due to the probe-interval, a default value of 40 seconds is automatically configured on active supervisor.