Re: [Apn] APN Policy Enforcement

["Pengshuping (Peng Shuping)" <[e-mail]>]

Hi Hesham,

Currently, the APN ID is the key field to be checked against for finding the policy to be applied to the traffic. APN Para and Intent are optional.

The comparison on the lengths of both the APN ID and the 5 tuples is not the key. The focal point should be their locations. The 5 tuples are located in various places in a packet. For example, when it is an IPv6 packet with extension headers, the transport layer information is being pushed very deep. In this case, it become very hard to resolve the 5 tuples. While APN ID is in a single location it will be relatively easier to be checked.

It will depend on how we are going to define the intent. In the current draft https://datatracker.ietf.org/doc/html/draft-li-apn-header-00, the intent is defined as follows,
   Intent: A 32-bit identifier, represents a set of service requirements
   to the network.

Compared to the APN Parameters, this intent is a more high-level abstract requirement to the network, e.g. low-latency. To my understanding, it does not directly carry the policies to be enforced but only requirements. But policies are somehow related with the requirements.

Your proposal does sound interesting. Would you like to elaborate more? What is the background of your proposal? Why people want to avoid configuring policies to PEP? Due to what limitations or any reasons? Do you have any thoughts on how to embed these policies as part of the intent field?

Thank you!

Best regards,
Shuping




From: Apn [mailto:[e-mail]] On Behalf Of Hesham ElBakoury
Sent: Monday, December 13, 2021 10:32 AM
To: [e-mail]
Subject: [Apn] APN Policy Enforcement

Hi,

My understanding from APN drafts is that policies are defined at Policy Definition Point (PDP) and get configured in Policy Enforcement Points  (PEP) using CLI or SDN or distributed to PEP using a protocol.

When a PEP receives a packet what fields in APN header it uses to find the right policy to apply to the packet? One of the main APN goals is to avoid using DPI or 5-tuple to find the right policy to use. Therefore, the length of these fields in APN header should be much shorter than the length of the 5-tuple.

To avoid configuring policies to PEP, can the entry point of the APN domain embed these policies in the APN header ? For example these policies can be part of the Intents field of the header.

Thanks
Hesham