Re: [ippm] Call for adoption: draft-xiao-ippm-ioam-conf-state

Dear All,
I agree with Xiao Min's suggestion that IGP may be not the most effective
mechanism to collect information about a node's IAOM capability. Consider
the case when IOAM capability is controlled by a local policy that controls
the type of information available to different sources within an IOAM
domain. I think that it would be much more challenging to reflect that
through IGP than to discover that using ICMP.

Regards,
Greg

On Tue, Nov 17, 2020 at 11:57 PM <xiao.min2@zte.com.cn> wrote:

> Hi Cheng,
>
>
> I don't really understand your concern.
>
> ICMPv6 is a mature protocol mechanism, and IOAM function is limited in a
> trusted domain, then using ICMPv6 to discover IOAM capabilities wouldn't
> introduce any big challenge on security and privacy.
>
> I don't think IGP is better than ICMPv6 in this case. Firstly, flooding
> IOAM capabilities throughout the IGP domain is too heavy and unnecessary in
> my view. Secondly, IGP domain and IOAM domain don't always have the same
> coverage, one example is that when the IOAM encapsulating node is a host
> IGP flooding doesn't work for it.
>
>
> Best Regards,
>
> Xiao Min
> 原始邮件
> *发件人：*Chengli(ChengLi)
> *收件人：*Chengli (Cheng Li);肖敏10093570;
> *抄送人：*ippm-chairs@ietf.org;ippm@ietf.org;fbrockne=
> 40cisco.com@dmarc.ietf.org;tpauly=40apple.com@dmarc.ietf.org;
> *日 期 ：*2020年11月17日 17:53
> *主 题 ：**RE: [ippm] Call for adoption: draft-xiao-ippm-ioam-conf-state*
>
> I meantI don’t think we can detect the (Non Routing ) capabilities of a
> node in another domain. Sorry for the typo.
>
>
>
> *From:* ippm [mailto:ippm-bounces@ietf.org]*On Behalf Of *Chengli (Cheng
> Li)
> *Sent:* Tuesday, November 17, 2020 4:09 PM
> *To:* xiao.min2@zte.com.cn
> *Cc:* ippm-chairs@ietf.org; ippm@ietf.org; fbrockne=
> 40cisco.com@dmarc.ietf.org; tpauly=40apple.com@dmarc.ietf.org
> *Subject:* Re: [ippm] Call for adoption: draft-xiao-ippm-ioam-conf-state
>
>
>
> Hi Min,
>
>
>
> That is also my understanding. IOAM is limited in a trusted domain.
>
>
>
> But ICMP can be used in the global Internet? I don’t think we can detect
> the capabilities of a node in another node. Privacy and security will be a
> big challenge.
>
>
>
> So personally I prefer IGP/BGP/BGP-LS or NETCONF/YANG way.
>
>
>
> Thanks,
>
> Cheng
>
>
>
>
>
>
>
> *From:*xiao.min2@zte.com.cn [mailto:xiao.min2@zte.com.cn
> <xiao.min2@zte.com.cn>]
> *Sent:* Tuesday, November 17, 2020 3:52 PM
> *To:* Chengli (Cheng Li) <c.l@huawei.com>
> *Cc:* fbrockne=40cisco.com@dmarc.ietf.org;
> tpauly=40apple.com@dmarc.ietf.org;ippm@ietf.org; ippm-chairs@ietf.org
> *Subject:* Re:[ippm] Call for adoption: draft-xiao-ippm-ioam-conf-state
>
>
>
> Hello Cheng,
>
>
>
> I noticed that Frank has submitted an In-situ OAM deployment draft within
> OPSAWG, in section 3 of that draft it says:
>
> "
>
> IOAM is a network domain specific feature, with "network domain"
>
>    being a set of network devices or entities within a single
>
>    administration.  IOAM is not targeted for a deployment on the global
>
>    Internet.  The part of the network which employs IOAM is referred to
>
>    as the "IOAM-Domain".
>
> "
>
> To my understanding, the IOAM data is collected only within a trusted
> domain, of course, Frank can correct me if I'm wrong.
>
> For your convenience, the link for this quoted draft is provided as below.
>
> https://tools.ietf.org/html/draft-brockners-opsawg-ioam-deployment
>
>
>
> Best Regards,
>
> Xiao Min
>
> 原始邮件
>
> *发件人：*Chengli(ChengLi)
>
> *收件人：*Frank Brockners (fbrockne);Tommy Pauly;IETF IPPM WG (ippm@ietf.org);
>
> *抄送人：*IPPM Chairs;
>
> *日**期**：*2020年11月16日 17:28
>
> *主**题**：Re: [ippm] Call for adoption: draft-xiao-ippm-ioam-conf-state*
>
> _______________________________________________
> ippm mailing list
> ippm@ietf.org
> https://www.ietf.org/mailman/listinfo/ippm
>
> I have one simple question like I mentioned in the meeting: Is it secure
> to discover the non-routing capabilities info from the data plane?
>
>
>
> For instance, a packet may travel several network domains, and the trusted
> scope is only within each domain. When we use ICMP Ping, we can get the
> non-routing info from other domains. Is it OK to do it?  I think we should
> consider more about security and privacy.
>
>
>
> Furthermore, can we collect the IOAM data in multiple domain scenarios? Or
> only within a trusted domain?
>
>
>
> Thanks,
>
> Cheng
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *From:* ippm [mailto:ippm-bounces@ietf.org <ippm-bounces@ietf.org>]*On
> Behalf Of*Frank Brockners (fbrockne)
> *Sent:* Monday, November 16, 2020 3:13 PM
> *To:* Tommy Pauly <tpauly=40apple.com@dmarc.ietf.org>; IETF IPPM WG (
> ippm@ietf.org) <ippm@ietf.org>
> *Cc:* IPPM Chairs <ippm-chairs@ietf.org>
> *Subject:* Re: [ippm] Call for adoption: draft-xiao-ippm-ioam-conf-state
>
>
>
> Hello IPPM,
>
>
>
> per what I mentioned during the IPPM WG meeting today, I don’t think we
> should adopt the document before we have a couple of key questions resolved:
>
>
>
> * Why can’t we use Netconf/YANG (with the existing capabilities discovery
> process – a la RFC 6241) to retrieve the IOAM capabilities of IOAM nodes?
> E.g. the encapsulating node (as a NC client) could retrieve the IOAM
> capabilities from other IOAM nodes  (acting as a NC server). Plus there is
> already a YANG model in flight for IOAM (draft-zhou-ippm-ioam-yang-08). At
> a minimum I would have expected that the draft discusses why NC/YANG is not
> suitable for the scenario that the authors have in mind. The slides (
> https://datatracker.ietf.org/meeting/109/materials/slides-109-ippm-echo-requestreply-for-enabled-ioam-capabilities-00)
> that were presented in the IPPM WG meeting today, mention “Changed from
> “IOAM Configuration Data” to “Enabled IOAM Capabilities” since the former
> is too associated with NETCONF/YANG.” IMHO we need a bit more than just
> wordsmithing.
>
>
>
> * While the draft uses IOAM capabilities discovery as the use-case, in
> more general terms, it proposes to add management/ops capabilities to
> echo-request/reply protocols like ICMP, which is a much broader topic. The
> TLV structures which are proposed to be added to echo-requests and
> echo-replies could obviously be leveraged for other use-cases. Does the
> work really fit the scope of the IPPM WG?
>
>
>
> Thanks, Frank
>
>
>
> *From:* ippm <ippm-bounces@ietf.org>*On Behalf Of*Tommy Pauly
> *Sent:* Freitag, 30. Oktober 2020 19:46
> *To:* IETF IPPM WG (ippm@ietf.org) <ippm@ietf.org>
> *Cc:* IPPM Chairs <ippm-chairs@ietf.org>
> *Subject:* [ippm] Call for adoption: draft-xiao-ippm-ioam-conf-state
>
>
>
> Hello IPPM,
>
>
> This email starts a Working Group call for adoption
> for draft-xiao-ippm-ioam-conf-state. This document has been presented
> several times and discussed within the working group in the context of our
> overall IOAM work.
>
> The document can be found here:
>
> https://tools.ietf.org/html/draft-xiao-ippm-ioam-conf-state-07
> <https://tools.ietf.org/html/draft-zhou-ippm-ioam-yang-08>
>
> Please provide your feedback on these document, and state whether or not
> you believe the IPPM WG should adopt this work by replying to this email.
> Please provide your feedback by the start of the IETF 109 meeting week, on *Monday,
> November 16*.
>
> Best,
> Tommy & Ian
>
>
>
>
> _______________________________________________
> ippm mailing list
> ippm@ietf.org
> https://www.ietf.org/mailman/listinfo/ippm
>