[I2nsf] draft-zarny-i2nsf-data-center-use-cases

[Kathleen Moriarty <[e-mail]>]

The scope in section 1 would need to be trimmed to meet the evolving scope
of the I2NSF list.  It would be good to combine this
with draft-qi-i2nsf-access-network-usecase or select one of these to
develop.  This will help avoid scope confusion.

In reviewing draft-zarny-i2nsf-data-center-use-cases, my first
recommendation is to get rid of the word cloud and instead use a term that
explicitly defines what is intended.  Instead of "Cloud-scale network
resources", perhaps "Hosted DC resources" or some other set of terms could
be used.

Section 4.  I do like the idea of this service and can think of one
particular firewall I've managed in bulk where this type of thing would be
easy.  The problem is that is not vendor agnostic.  If there were some way
to replicate sets of existing policy deployments for particular services
(mail, video calls, access to ERP systems, etc.) independent of firewall
brand where you might replace to/from addresses for the deployment of rules
making them replaceable objects, there could be a way to do this in a
vendor agnostic way.  Firewalls would need service configuration defaults
where IP addressees may be added in the I2NSF configuration for particular
service. This is really borrowing from how the Lucent Managed Firewall
works as the management scales well using an object oriented management
approach.  I don't know if they have IP on that method of management though.

In any case, more work is needed to define what types of policies would be
deployed and how this could work across vendors and for multiple tenants.
This draft is too high-level at the moment to get an idea of how I2NSF will
accomplish these goals.

If the work switches to manage flow-based policy automation, understanding
how I2NSF will affect the deployed policies will be needed instead.


-- 

Best regards,
Kathleen