Re: [I2nsf] Key problems to reflect the narrower scoped I2NSF charter

[Sumandra Majee <[e-mail]>]

Linda,

My personal opinion is that the issue at hand is diversity of security functionality and lack of enabling those function.
I am not sure if this WG should need differentiate if enforcing NSF is distributed, local or remote or virtual or physical(section 3.1.3) .  It is in fact desirable that interface is consistent and leave the job of optimal placement on scheduling layer.


 The security functions that are invoked to enforce a security
     policy can be located in different equipment and network
     locations.

From: Linda Dunbar <[e-mail]<mailto:[e-mail]>>
Date: Tuesday, May 26, 2015 at 10:31 AM
To: DIEGO LOPEZ GARCIA <[e-mail]<mailto:[e-mail]>>
Cc: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: [I2nsf] Key problems to reflect the narrower scoped I2NSF charter

Diego,

Thank you very much for the suggestion (and the time taken yesterday for the conference call).

How about the following description of the key problems for I2NSF?

3.1. Challenges Facing Security Service Providers


-   Diverse types of Security Functions
         No Standard Characterization of NSFs


-   Diverse Interfaces to Control NSFs



-   Diverse mechanisms to monitor the behavior of NSFs


-   More Distributed NSFs and vNSFs


-   Demand to Control NSFs Dynamically



-   Demand for multi-tenancy of the interfaces to control and monitor NSFs.

Service providers may well require having several operational units to make this control and monitoring, especially when they become distributed and virtualized


      3.2. Challenges Facing Customers

-   Need consistent integration of NSFs over heterogeneous administrative domains
         - Today's Policy Expressions are Vendors Specific
         - Difficulty to Monitor the Execution of Desired Policies


Cheers,
Linda
From: DIEGO LOPEZ GARCIA [mailto:[e-mail]]
Sent: Monday, May 25, 2015 2:04 PM
To: Linda Dunbar
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [I2nsf] updated I2NSF problem statement to reflect the narrower scoped charter

Hi,

As we discussed recently, I'd say that:

1.- It is important to address multi-tenancy of the interfaces to control and monitor NSFs. First, because service providers may well require to have several operational units to make this control and monitoring, especially when they become distributed and virtualized. Second, service providers may find a value in offering a (mediated) interface to control and monitoring NSFs to their customers. This could certainly be part of 3.1.5...

2.- In what relates to 3.2.1, rather than distinguishing between "on-premises" and "remote", I'd talk about a consistent integration of NSFs, independently of their location and their implementation mechanisms.

Be goode,

On 22 May 2015, at 24:42 , Linda Dunbar <[e-mail]<mailto:[e-mail]>> wrote:


We updated the I2NSF problem statement to reflect the narrower scoped charter.

The primary issues and challenges facing NSFs hosted by different domains are:

     3.1. Challenges Facing Security Service Providers..............5
        3.1.1. Diverse types of Security Functions..................5
        3.1.2. No Standard Characterization of NSFs.................6
        3.1.3. More Distributed NSFs and vNSFs......................7
        3.1.4. More Demand to Control NSFs Dynamically..............7
        3.1.5. Diverse Interfaces to Control and Monitor NSFs.......7
        3.1.6. Lack of mechanism to monitor the behavior of NSFs....8
     3.2. Challenges Facing Customers...............................8
        3.2.1. Need to integrate on-premises NSFs with Remote NSFs..8
        3.2.2. Today's Policy Expressions are Vendors Specific......9
        3.2.3. Difficulty to Monitor the Execution of Desired Policies
        ...........................................................10
     3.3. Difficulty to Validate Policies across Multiple Domains..10
     3.4. Lack of Standard Interface to Inject Feedback to NSF.....11

Your comments and suggestions are highly appreciated.

Linda

-----Original Message-----
From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]]
Sent: Thursday, May 21, 2015 5:37 PM
To: Mohamed Boucadair; Shaibal Chakrabarty; Linda Dunbar; Christian Jacquenet; Myo Zarny; Christian Jacquenet; Myo Zarny; Shaibal Chakrabarty; Linda Dunbar; Mohamed Boucadair
Subject: New Version Notification for draft-dunbar-i2nsf-problem-statement-04.txt


A new version of I-D, draft-dunbar-i2nsf-problem-statement-04.txt
has been successfully submitted by Linda Dunbar and posted to the IETF repository.

Name: draft-dunbar-i2nsf-problem-statement
Revision: 04
Title: Interface to Network Security Functions (I2NSF) Problem Statement
Document date: 2015-05-21
Group: Individual Submission
Pages: 20
URL:            https://www.ietf.org/internet-drafts/draft-dunbar-i2nsf-problem-statement-04.txt
Status:         https://datatracker.ietf.org/doc/draft-dunbar-i2nsf-problem-statement/
Htmlized:       https://tools.ietf.org/html/draft-dunbar-i2nsf-problem-statement-04
Diff:           https://www.ietf.org/rfcdiff?url2=draft-dunbar-i2nsf-problem-statement-04

Abstract:
  This document describes the motivation and the problem statement for
  Interface to Network Security Functions (I2NSF).




Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.

The IETF Secretariat

_______________________________________________
I2nsf mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/i2nsf

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [e-mail]<mailto:[e-mail]>
Tel:    [phone]
Mobile: [phone]
----------------------------------


________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição