Re: [mpls] Alissa Cooper's Discuss on draft-ietf-mpls-sfc-05: (with DISCUSS and COMMENT)

[Alissa Cooper <[e-mail]>]

Hi Adrian,

> On Mar 7, 2019, at 6:24 AM, Adrian Farrel <[e-mail]> wrote:
> 
> Hey Alissa,
> 
> Thanks for reading.

Any time.

> 
>> DISCUSS:
>> 
>> Comparing the requirements in RFC 8300 Section 8.1 under "Single Domain
>> Boundary" and the text in Section 15 of this document, it seems that the
>> mechanism specified in this document is not subject to the same normative
>> requirements as specified for the administrative boundaries of a network where
>> MPLS is used as the transport encapsulation for NSH. What is the reasoning for
>> that? I would have expected to see similar normative requirements here as in
>> RFC 8300 Section 8.1.
> 
> RFC 8300 is concerned with the forwarding plane, so (obviously) includes normative language about packet handling.
> But it is worth noting that the term used in 8.1 is "NSH domain".
> However, the reference is back to the general SFC architecture in RFC 7665. That's a more appropriate place to look for the constraints on deploying SFC systems.
> 
> 7665 defines an SFC-Enabled Domain as "A network or region of a network that implements SFC.  An SFC-enabled domain is limited to a single network administrative domain." We should note that an "administrative domain" is (probably?) not the same as a single AS: an administrative domain is often partitioned into multiple ASes.
> 
> We do say that "Discussion of the security properties of SFC networks can be found in [RFC7665].  Further security discussion for the NSH and its use is present in [RFC8300]." So we intend to inherit all the security and deployment constraints.

That should be made explicit then, in particular that the normative security requirements from those documents apply to this specification.

> 
> We also have...
>   o  The MPLS network is often considered to be a closed network such
>      that insertion, modification, or inspection of packets by an
>      outside party is not possible.  This is particularly pertinent in
>      the SFC context because [RFC7665] notes that "The architecture
>      described herein is assumed to be applicable to a single network
>      administrative domain."
> 
> We could maybe tighten this by clarifying the concept of a closed network. For example,
>   o  The MPLS network is often considered to be a closed network such
>      that insertion, modification, or inspection of packets by an
>      outside party is not possible.  MPLS networks are operated with
>      closed boundaries so that MPLS encapsulated packets are not 
>      admitted to the network, and MPLS headers are stripped before 
>      packets are forwarded from the network.  This is particularly 
>      pertinent in the SFC context because [RFC7665] notes that "The
>      architecture described herein is assumed to be applicable to a
>      single network administrative domain."  Furthermore, [RFC8300]
>      states that packets originating outside the SFC-enabled domain
>      MUST be dropped if they contain an NSH and packets exiting the 
>      SFC-enabled domain MUST be dropped if they contain an NSH.  These
>      constraints apply equally to the use of MPLS to encode a logical
>      representation of the NSH.

That works for me.

> 
>> COMMENT:
>> 
>> = Section 4.5 =
>> 
>> OLD
>> The application of SR to SFC was considered in early versions of the
>>  SR architecture [RFC8402] and the MPLS-SR specification
>>  [I-D.ietf-spring-segment-routing-mpls], but has since been moved out
>>  of those documents.
>> 
>> NEW
>> The application of SR to SFC was considered in early versions of the
>>  SR architecture [RFC8402] and the MPLS-SR specification
>>  [I-D.ietf-spring-segment-routing-mpls], but was not ultimately adopted.
>> 
>> (I think this is about the ideas, not the organization of documents.)
> 
> Well, yes and no. There are, in fact, a number of drafts working their way through the system that discuss the use of SR for SFC. Most of these documents are not fully mature, but their proponents remain confident that they will be adopted and become RFCs in the fullness of time. I could list...
> - draft-filsfils-spring-srv6-network-programming
> - draft-guichard-spring-nsh-sr
> - draft-xuclad-spring-sr-service-programming
> There are probably others.

This is not the impression the reader is left with from reading Section 4.5.

> 
> So, SFC is clearly in scope for SR and the SPRING charter explicitly says:
>  o Source-routed stateless service chaining using SR-MPLS
>     and SRv6 dataplanes.
> 
> We included the reference to draft-xuclad-spring-sr-service-chaining (now replaced by draft-xuclad-spring-sr-service-programming - we need to make an update!) and believe that and the text cover the point.

I wonder about the archival value of the second paragraph altogether, given the multiple streams of work on this. Perhaps it would make more sense to just add a sentence to the end of the first paragraph noting that implementation work was ongoing at the time of this writing, and drop the second paragraph.

Thanks,
Alissa

> 
> Cheers,
> Adrian