[Apn] 答复: comments and suggestions to the draft-yang-apn-sd-wan-usecase-00

[Feng Yang <[e-mail]>]

Hi Linda,

 

Thanks for your comments. See my comments inline.

 

BR£¬

Feng Yang

 

·¢¼þÈË: Apn [mailto:[e-mail]] ´ú±í Linda Dunbar
·¢ËÍʱ¼ä: 2020Äê9ÔÂ10ÈÕ 03:25
ÊÕ¼þÈË: apn
³­ËÍ: [e-mail]
Ö÷Ìâ: [Apn] comments and suggestions to the draft-yang-apn-sd-wan-usecase-00

 

Authors of the draft-yang-apn-sd-wan-usecase-00:

 

Here are my comments and suggestion to  the draft. 

 

1.	The draft has stated in multiple sections that  ¡°APN can provide
value¡±, but  doesn¡¯t have much description on ¡°HOW  APN provides value¡±.
It would be very useful to  elaborate more details on HOW.  

[Feng] APN conveys application information such as application/user/flow
identifiers and SLA/service requirements along data packets into network and
make the network aware of applications and their requirements, so to provide
corresponding network services and guarantee their SLA requirements. 

 

This draft intends to describe the values which APN can provide to SD-WAN in
various usage scenarios, as below.

   2.1.  APN for Traffic Steering into Dedicated WAN

   2.2.  APN for Traffic Steering into Particular Cloud 

   2.3.  APN for Value-added Service Provisioning in SD-WAN

   2.4.  APN for Data Processing in SD-WAN 

 

Basically APN can be used in these scenarios to provide the fine-granularity
traffic steering and service operations in SD-WAN. The description of each
scenario can be further enhanced.

 

2.	Among the 4 major characteristics of SD-WAN described in
https://datatracker.ietf.org/doc/draft-ietf-bess-bgp-sdwan-usage/ , I think
the following two are closely relevant to APN: 

 

-              Some traffic flows can be forwarded based on their
application identifiers instead of based on destination IP addresses, by the
edge nodes placing the traffic flows onto specific overlay paths based on
their application requirement.  

 

p.s. The BESS-bgp-sdwan-usage draft assumes there is a Matching ¨C ACTION
configured at the Edge node indicating a specific n-tuple MATCHING for
assigning traffic to a specific UNDERLAY networks. 

It would be very beneficial to document how APN provide more than the
current practices of MATCHING ¨C PATH SELECTION.

 

-              The traffic flows forwarding can also be based on specific
performance criteria (e.g. packets delay, packet loos, jitter) to provide
better application performance by choosing the right underlay that meets or
exceeds the specified criteria.

Again, the BESS draft assumes there is a MATCHING - ACTION provisioning at
the Edge node indicating a specific n-tuple MATCHING for assigning traffic
to paths with specific Performance criteria. Does APN do it differently?  It
would be very beneficial to add more details. 

[Feng] Indeed, these two are closely relevant to APN. The difference which
APN made here is that APN can directly add the application-aware information
including application identifiers and the performance requirements in the
data packets and then to facilitate the matching & action performed at the
edge devices. Furthermore, this application-aware information can be further
utilized by the underlay networks for application-aware network service
provisioning. So APN can be taken as a technology to facilitate this
matching-action for traffic steering.

 

3.	Section 2.1 describes a classic deployment of SDWAN split traffic
among multiple WAN paths. It is not clear how does APN do differently than
today¡¯s MATCHING ¨C ACTION provisioning  based approach. 

[Feng] The same as above.

 

4.	Section 2.2 shows applications behind CPE connect to different
Clouds. How does APN facilitate? Does APN use enhanced DNS to route APP to
the desired destination? What if the Applications communication are all
encrypted? 

[Feng] The anycast address can be used here. According to the
application-aware information, the proper cloud can be selected and the
traffic can be routed along the path towards this cloud. 

 

5.	Section 2.3: how does APN recognize malicious applications? Most
today¡¯s applications communication are encrypted. 

[Feng] The potential security issues that may be imposed by APN were
discussed during the APN side meeting@ IETF108. Basically the existing
access control and network security mechanisms can be utilized. According to
the application-aware information, the traffic can be steered into
corresponding FW VAS for validating its legitimacy.

https://github.com/APN-Community/IETF108-Side-Meeting-APN/blob/master/6%20Sh
uping%20Peng%20-%20Huawei%20-%20Discussions%20%26%20Clarifications%20-%20%20
Privacy%20%26%20Security.pdf

 

6.	Section 2.4: Does APN steer packets based on the configured Matching
¨C ACTION paradigm? How APN recognize Data?  Are the Data attached to
packets? Or Data in specific database? Or Performance measurement data
collected by network devices? 

[Feng] With APN the application-aware information can be attached to the
packets, based on which the traffic can be steered. If the application-aware
information is not carried in the packets, it can utilize the existing
capability of the edge devices and this information can be recognized by the
edge devices. The matching-action policy can be configured by the network
operators. The performance measurement can be done by the existing
mechanisms such as iOAM which can be further integrated with APN to achieve
fine-granularity performance measurement and visualization.

 

 

Cheers, 

 

Linda Dunbar