Balancer Server System Packet Packet Middleboxes FIGURE 3.8 Physical service chain. Virtual Data Path Service Chain Wrapper Wrapper Intrusion Routes Detection Firewall Balancer Server Packet System Packet Network Funct Virtualiz tion Infrastruct re (NFVI) Virtual Network Functions (VNFs) FIGURE 3.9 Service chain on NFVI. to provide next-hop connectivity between functions, overlay networks are required. Traditional Ethernet, MPLS, and IP networks provide the foundational underlay of a service provider's network and it can be based on static configurations and static IP addressing. In order to connect two or VNFs together, we need to use virtual addresses for the VNFs that can be defined in real time and a way to tunnel or encapsulate the traffic over the top of the underlay. This facilitates the decoupling of the network service from the underlying infrastructure. Traditionally, the overlay could be done with generic routing encapsulation (GRE) or encrypted IPSEC tunnels, but these require explicit configurations, typically via CLI code. VPN technologies like MPLS, provide a way to support the tunneling with routing protocols like BGP, but even these, traditionally, need to be explicitly config- ured. In an SDN environment, these need to be instantiated in real time through a centralized SDN controller. MPLS continues to be an appealing overlay technology because it does rely on dynamic routing protocols. This allows for the creation of resilient architectures. VNFs can be deployed in pairs with active-active or active-backup configurations where fast restorations and segment rout- ing (IETF, Segment Routing) techniques can be employed. 3.3.3 OVERLAY, UNDERLAY, AND vSs/vRs Figure 3.10 reintroduces a diagram from Section 3.1.3 to highlight the use of overlay networks (dashed line) on top of the data center fabric that supports the underlay. To support this on demand virtual network, a vS or vR is used on the server and it sits on the hypervisor to provide connectivity to specific VNFs running on VMs. OpenStack envi