[I2nsf] "draft-dunbar-i2nsf-problem-statement-02.txt" - few comments.

[Alexey Gorbunov <[e-mail]>]

Hi Folks


Just read "draft-dunbar-i2nsf-problem-statement-02.txt" and would like to
share my thoughts and concerns. From my point of view it’s better to not
focus on the specific names but on the functionality of network security
function itself.  Most probably the main use case for NSF is virtual
firewall with IPS/IDS and VPN capabilities. Openstack is the ideal
candidate for NSF.


We have already virtual firewall and it's good to look at it's features and
functionality. I summarized most of the firewall features below:


*-Access-list*.  Defines which traffic are allowed to enter and pass
firewall.

It's covered in https://tools.ietf.org/html/draft-ietf-netmod-acl-model-02

*- Policy.*  Defines which traffic are allowed to pass firewall and in
which direction.

*- Dos protection:*  multicast, broadcast rate limiting. DHCP, ARP
protection and rate-limiting. Limitation of mac-address numbers.

*-“Screens”*  – Juniper calls it screens, cisco doesn’t have name for it.
Basically it’s protection against well-know network attacks.

*- “Intrusion prevention” *– Signatures of any malicious activity.

*- VPN PKI*- configuration of IPSEC with PKI.

*- Control-plane protection of firewall itself.*

*- L7 filtering and proxy.*

- *Application detection.*  Some applications uses tcp port 80 and most of
the firewall can detect it.

 - *Monitoring and reporting traffic.* Something similar to Openflow, Jflow
and etc.

What exactly is going to be covered by i2nsf? Is i2nsf going to meet in the
Dallas at IETF 92?

Thanks everybody for attention to this email.

Alexey Gorbunov

Telco Cloud and Security Architect at Nokia

CCIE R&S 41088