SDN controllers: ONOS, OpenDaylight and commercial options
In short: An SDN controller is the central brain of a software-defined network. It discovers the topology, holds network state and programs devices through southbound protocols, while applications talk to it through northbound APIs. Open-source controllers such as ONOS and OpenDaylight exist alongside vendor controllers built into commercial fabrics.
What a controller does
In SDN, the controller is software that holds a central view of the network and pushes configuration or forwarding rules to devices. Typical jobs are:
- Discovering devices and links to build a topology map.
- Keeping the desired state, such as VLANs, paths and policies, and checking devices match it.
- Computing paths and installing forwarding rules.
- Collecting statistics and events for monitoring.
- Offering APIs so that applications and automation tools can request changes.
Northbound and southbound interfaces
The northbound interface faces applications and people. It is usually a REST API with JSON, sometimes gRPC, plus a web interface. A provisioning script might call it to say "create a segment for the new lab". The southbound interface faces devices. Options include OpenFlow for flow tables, NETCONF with YANG models for configuration, OVSDB for virtual switches, and BGP or PCEP for routing and traffic engineering. Large deployments run several controllers as a cluster that shares state, using an east-west interface between them.
Common controllers
| Controller | Type | Typical use |
|---|---|---|
| ONOS (Open Network Operating System) | Open source, community-maintained | Service provider and research networks; designed for clustering and high availability |
| OpenDaylight | Open source, Linux Foundation project | Model-driven platform with many southbound plug-ins; often embedded in other products |
| Ryu and similar frameworks | Open source, Python based | Learning, labs and small experiments |
| Data centre fabric controllers | Commercial | For example Cisco Application Policy Infrastructure Controller (APIC) for ACI, or network virtualisation managers such as VMware NSX Manager |
| Campus and multi-vendor controllers | Commercial | For example Cisco Catalyst Center, Juniper Apstra or Arista CloudVision, which manage intent and assurance |
Many commercial products are not "pure" OpenFlow controllers. They configure devices that still run their own routing protocols, which is sometimes called a hybrid or overlay approach. This is still SDN in spirit, because policy is defined centrally and pushed out by software.
Resilience and security
- Cluster the controller. Run at least three nodes so the cluster can keep a majority if one fails.
- Know the failure mode. Check what devices do if they lose the controller: keep forwarding with existing rules, or fall back to standalone mode.
- Protect the northbound API. Use strong authentication, role-based access and audit logs. An API token with write rights can change the whole network.
- Encrypt southbound channels. Use TLS or SSH and verify device identities.
- Place it on a management network. Keep controller interfaces off user and internet-facing networks.
- Back up state and patch it. Treat the controller as critical infrastructure.
Tip: if you want hands-on practice, run a small controller and Mininet (a network emulator) inside an isolated lab virtual machine. It is a good way to see topology discovery and flow installation in action.
Practice
What is the difference between northbound and southbound interfaces?
Name two southbound protocols other than OpenFlow.
Why should a controller cluster have at least three nodes?
Key takeaways
- The controller holds network-wide state and programs devices centrally.
- Northbound APIs serve applications; southbound protocols reach devices.
- ONOS and OpenDaylight are major open-source controllers; vendors offer commercial ones.
- Many commercial fabrics are hybrid SDN, configuring devices that still route themselves.
- Cluster, isolate and tightly secure the controller and its APIs.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.