Re: [bess] Any protocols suitable for Application Flow Based Segmentation in draft-bess-bgp-sdwan-usage-3?

Sorry to talk implementation on or off list but from a pure net-net vpn VTI tunnel mode perspective using DMVPN that scales pretty well to 100’s of user sites homing to a pair of mGRE DMVPN head ends which I have deployed.  I have not done any with over a 1000 on a pair but that’s a lot even for any mpls deployments I have worked with.  The IPSEC SA is all done with hardware encryption and so the scaling is very high for most all vendors the maximum number of IPSEC tunnels that can be hit.

I would say a similar analogy would be that most SP routers support 1M+ FIB entires per customer VRF on average per vendor which is way high and its rare that you have an L3 VPN that exceeds 1M routes.  These days the hardware far exceeds the possible use cases.

Gyan

Sent from my iPhone

> On Nov 5, 2019, at 6:50 PM, Linda Dunbar <ldunbar@futurewei.com> wrote:
> 
> Robert,
>  
> Without getting into any implementation, are there any terrible problems of allowing IPsec tunnel as transport segment and each edge node forward packets destined to other nodes, as done by VRF. What issues do you see? (other than it is not IPsec tunnel per client interface/group)?
>  
> <image002.png>
>  
> Thanks, Linda
>  
> From: Robert Raszuk <robert@raszuk.net> 
> Sent: Tuesday, November 05, 2019 5:21 PM
> To: Linda Dunbar <ldunbar@futurewei.com>
> Cc: bess@ietf.org
> Subject: Re: [bess] Any protocols suitable for Application Flow Based Segmentation in draft-bess-bgp-sdwan-usage-3?
>  
> > it is tremendous amount of work.  
>  
> Well I am afraid this is entering implementation space and not subject to any further debate on or off the list. Only note that IPSec is not the only payload encryption option at your disposal for quality SDWANs.
>  
> On Tue, Nov 5, 2019 at 11:07 PM Linda Dunbar <ldunbar@futurewei.com> wrote:
> Robert,
>  
> It is not the FIB size, but the number of IPsec SA maintenance required at each edge node that makes it difficult to scale more than 100 nodes.
> Each IPsec SA requires periodical key refreshment. For one node maintaining X number of IPsec SA, it is tremendous amount of work.
>  
> Linda
>  
> From: Robert Raszuk <robert@raszuk.net> 
> Sent: Tuesday, November 05, 2019 3:15 PM
> To: Linda Dunbar <ldunbar@futurewei.com>
> Cc: bess@ietf.org
> Subject: Re: [bess] Any protocols suitable for Application Flow Based Segmentation in draft-bess-bgp-sdwan-usage-3?
>  
> Linda,
>  
> The key message here is that in properly designed SDWAN your limit is capped by volume of data traffic required to be encrypted and supported by your platform. Number of overlay adjacencies does not matter. 
>  
> It does not matter since the size of your FIB has orders of magnitude more capacity then any single SDWAN number of endpoints. 
>  
> Best,
> R,
>  
> On Tue, Nov 5, 2019 at 9:20 PM Linda Dunbar <ldunbar@futurewei.com> wrote:
> Robert,
>  
> You said “It has been deployed and is fully operating with no concern of scalability for number of years at least from one vendor I am aware of.”
>  
> How many nodes of this deployment?
>  
> As you described: just two nodes might need 18 IPsec tunnels. How about 100 node SDWAN network? 100*99 * 18?
>  
> “So number of overlay pipes to be created in corresponding SDWAN data planes is 9 in each direction just over those *two* end points. 18 if you consider bidirectional traffic”
>  
> Linda
>  
> From: Robert Raszuk <robert@raszuk.net> 
> Sent: Monday, November 04, 2019 6:54 PM
> To: Linda Dunbar <ldunbar@futurewei.com>
> Cc: bess@ietf.org
> Subject: Re: [bess] Any protocols suitable for Application Flow Based Segmentation in draft-bess-bgp-sdwan-usage-3?
>  
> Hi Linda,
>  
> > Overlay, the multipoint to multipoint WAN is an overlay network. If using IPsec 
> > Point to Point tunnel, there would be N*(N-1) tunnels, which is too many to many.  
>  
> Please observe that any to any encapsulated paths setup in good SDWAN is day one requirement. And that is not only any src/dst to any src/dst. It is actually from any source interface over any available underlay to any available remote interface of the destination. 
>  
> Imagine if you have two end points each with three interfaces to the underlay. So number of overlay pipes to be created in corresponding SDWAN data planes is 9 in each direction just over those *two* end points. 18 if you consider bidirectional traffic. 
>  
> Good SDWAN can build such state and not only that .. it can also run in continued fashion SLA probes over all possible paths between given src and destination. When data is sent over selected per application path it is then encrypted. It can even do much more ... it can perform SDWAN-TE treating some endpoints as transits :).  
>  
> It has been deployed and is fully operating with no concern of scalability for number of years at least from one vendor I am aware of. So I question your observation and do believe that adding vrf based routing over well designed and correctly written SDWAN is of any scalability concern. As a matter of fact the implementation I am familiar with also has built in concept of VRFs too. 
>  
> No it is not trivial - but clearly possible. 
>  
> Best,
> Robert. 
>  
>  
> On Mon, Nov 4, 2019 at 11:39 PM Linda Dunbar <ldunbar@futurewei.com> wrote:
> In MEF SD-WAN Service Specification WG, there has been a lot of discussion on Application Flow Based Segmentation.
> Application Flow based Segmentation refers to separating traffic based on business and security needs, e.g. having different topology for different traffic types or users/apps.
> For example, retail business requires traffic from payment applications in all branches only go to the Payment Gateway in its HQ Data Centers, whereas other applications can be multi-point (in Cloud DC too).
> Segmentation is a feature that can be provided or enabled for a single SDWAN service (or domain). Each Segment can have its own policy and topology. 
> In the figure below, the traffic from the Payment application (Red Dotted line) is along the Tree topology, whereas other traffic can be multipoint to multi point topology as in VRF.
>  
> <image001.jpg>
>  
>  
> Segmentation is analogous to VLAN (in L2 network) and VRF (in L3 network). But unlike VRF where all the intermediate nodes can forward per VRF, in SDWAN Overlay, the multipoint to multipoint WAN is an overlay network. If using IPsec Point to Point tunnel, there would be N*(N-1) tunnels, which is too many to many.
>  
> Does anyone know an existing protocol that can handle the above scenario described in https://datatracker.ietf.org/doc/draft-dunbar-bess-bgp-sdwan-usage/
>  
>  
> Thank you very much.
>  
> Linda Dunbar
>  
>  
>  
> _______________________________________________
> BESS mailing list
> BESS@ietf.org
> https://www.ietf.org/mailman/listinfo/bess
> _______________________________________________
> BESS mailing list
> BESS@ietf.org
> https://www.ietf.org/mailman/listinfo/bess