Re: [nvo3] How does Overlay Network inform the Underlay network on which flows among Overlay network nodes need to go through IPSec Tunnel? (was : Flow Security Policies exchanged over I2NSF service layer interface?

[Sowmini Varadhan <[e-mail]>]

On (06/17/16 08:43), Linda Dunbar wrote:
>    Sowmini,
>     
>    You said:
>    "However, applying IPsec to specific flows (e.g., those defined by a src
>    or dst port on which the service listens) is important."
>     
>    What is the current operation procedure for Overlay network to inform the
>    underlay network on which flows to go through IPSec channel?
>    You said:
>    "..But that also made me wonder about the interaction between IPsec/IKE
>    and the proposed BGP FS (IPsec is frequently used between end-systems that
>    do not want to run a BGP daemon). Since the config information that needs
>    to be distributed are things like keys, algorithms etc to populate the
>    sadb/spd, IKE looks more appropriate in most cases."
>     
>    Does the underlay network controller get some information (or hint from
>    the Overlay network controller) on how the keys are configured for the
>    IPSec tunnel for the specific flows among the Overlay nodes?

there are 2 aspects to this

- for the underlay network, as nodes/NVEs appear, the controller 
  needs to update the relevant nodes, because, as you pointed out,
  ipsec SAs are between 2 end-points, so all the needed pair-wise
  associations need to be set up. 

- overlay -> underlay communication- overlay network needs some way
  to tell the underlay which flows need to the ipsec transforms
  (and what ipsec config params to use for those transforms). At the 
  moment we have a simplistic model for achieving this, but
  this obviously needs to scale. One way would be by orchestrating this
  via some management connection to the controller.

--Sowmini