RE: [bess] comments and suggestions to draft-rosen-bess-secure-l3vpn-01

Ron Bonica <rbonica@juniper.net> Fri, 06 July 2018 21:23 UTC

Return-Path: <rbonica@juniper.net>
X-Original-To: rtgwg@ietfa.amsl.com
Delivered-To: rtgwg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E2E7130F7B; Fri, 6 Jul 2018 14:23:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.71
X-Spam-Level:
X-Spam-Status: No, score=-0.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ormnfMnwrV2c; Fri, 6 Jul 2018 14:23:39 -0700 (PDT)
Received: from mx0a-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4205F130F6C; Fri, 6 Jul 2018 14:23:39 -0700 (PDT)
Received: from pps.filterd (m0108156.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w66LKAm6025219; Fri, 6 Jul 2018 14:23:32 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=TyuenYXZ9nAZrYyoQn4eBgPENtWcH88VFmt05o2x53U=; b=edChY7U9+upZowrGwL7AXbBuYzSCoTnH9iX0gHGtKsLlix1Ra8Vubx01IK+/JW9Yy+wH WOQ+OMI+GMzQeryPzdFrdXJSi5Mlg3vgaV4ZOeOHyX2NyS1/7AuOqlm7eFmMmRP1H/Na grK8CpM0oa+9lAhsHkylPBdcjrxXcT2uJYn640gUYAKfgPpelVGQHAsUwvbWE181mRn6 McgLyxdQWst78cSHXMQU4I2GvMGdJbruv+oN9sLp0RFnLlkY/id4LXdkGhHWlekPpGeX EPWo67Vhe8EYlh5p4C9IPDvz6a8bnajjOw99j5ReLCpcsdNDvr+CtVhTfy8ZvsIFiNom PA==
Received: from nam02-cy1-obe.outbound.protection.outlook.com (mail-cys01nam02lp0055.outbound.protection.outlook.com [207.46.163.55]) by mx0a-00273201.pphosted.com with ESMTP id 2k2fwj0102-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 06 Jul 2018 14:23:32 -0700
Received: from DM2PR05MB448.namprd05.prod.outlook.com (10.141.104.152) by DM2PR05MB768.namprd05.prod.outlook.com (10.141.179.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.930.11; Fri, 6 Jul 2018 21:23:30 +0000
Received: from DM2PR05MB448.namprd05.prod.outlook.com ([fe80::696f:a99c:c42:917f]) by DM2PR05MB448.namprd05.prod.outlook.com ([fe80::696f:a99c:c42:917f%15]) with mapi id 15.20.0930.016; Fri, 6 Jul 2018 21:23:29 +0000
From: Ron Bonica <rbonica@juniper.net>
To: Linda Dunbar <linda.dunbar@huawei.com>, Jeff Tantsura <jefftant.ietf@gmail.com>, Robert Raszuk <robert@raszuk.net>
CC: RTGWG <rtgwg@ietf.org>, Eric Rosen <erosen@juniper.net>, "bess@ietf.org" <bess@ietf.org>
Subject: RE: [bess] comments and suggestions to draft-rosen-bess-secure-l3vpn-01
Thread-Topic: [bess] comments and suggestions to draft-rosen-bess-secure-l3vpn-01
Thread-Index: AdQUd6UGClvRk5FQRUGF9YyejctT/AA3qsZwAAIU+0AAAcNyAAAAP8cAAAB6C4AAAbraYA==
Date: Fri, 6 Jul 2018 21:23:29 +0000
Message-ID: <DM2PR05MB448D2B060B09D4275A9BC6AAE470@DM2PR05MB448.namprd05.prod.outlook.com>
References: <4A95BA014132FF49AE685FAB4B9F17F66B07E161@sjceml521-mbs.china.huawei.com> <DM2PR05MB4485047CBE1ABF17FBE7083AE470@DM2PR05MB448.namprd05.prod.outlook.com> <4A95BA014132FF49AE685FAB4B9F17F66B07EB23@sjceml521-mbs.china.huawei.com> <CA+b+ERnwvYF4JdoiHhPPBYds-Tm9EPyZm6vPLdscjNtKhqTY4A@mail.gmail.com> <49131D01-708D-4A17-9521-F0DEA6891FC9@gmail.com> <4A95BA014132FF49AE685FAB4B9F17F66B07EDB4@sjceml521-mbs.china.huawei.com>
In-Reply-To: <4A95BA014132FF49AE685FAB4B9F17F66B07EDB4@sjceml521-mbs.china.huawei.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.0.300.84
dlp-reaction: no-action
x-originating-ip: [66.129.241.11]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; DM2PR05MB768; 7:AoZbpb1RXKHO9XfKmVyjVIqKNUCUcaK7JHGVDKwvypFJ8lp7Zsc7AKh4rE51d3ZN11haLJk1XZJFNlOcd63RC5P8iKRMue9lq0LCya7ZaynVChJLFzBsrQqntdhyhjxYbNt+k/zcg+xCRjbWIy9+rv9Rz5MEKfzwNRCLx5KXdexDhsf8u1PinSl+ipeFfC/DkUTzWQUAN/vXJcgq3IfyekiEwmpyCcLv5EEIqDSieVhskBWU3s0cFrLa4fEjfSIM
x-ms-exchange-antispam-srfa-diagnostics: SOS;SOR;
x-forefront-antispam-report: SFV:SKI; SCL:-1; SFV:NSPM; SFS:(10019020)(346002)(136003)(366004)(376002)(39860400002)(396003)(189003)(199004)(86362001)(54896002)(54556002)(25786009)(9686003)(236005)(102836004)(733005)(6246003)(39060400002)(55016002)(14454004)(6436002)(106356001)(53936002)(105586002)(99286004)(97736004)(81166006)(26005)(8676002)(2906002)(81156014)(186003)(7736002)(316002)(33656002)(4326008)(93886005)(8936002)(5660300001)(2900100001)(66066001)(11346002)(446003)(76176011)(790700001)(74316002)(229853002)(6506007)(53546011)(110136005)(3846002)(54906003)(6116002)(476003)(7696005)(486006)(5250100002)(14444005)(478600001)(19609705001)(6306002)(606006)(256004)(68736007)(966005); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR05MB768; H:DM2PR05MB448.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 718b7593-7f12-4676-fe80-08d5e386b7d1
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(48565401081)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:DM2PR05MB768;
x-ms-traffictypediagnostic: DM2PR05MB768:
x-microsoft-antispam-prvs: <DM2PR05MB768B2B1A6AC63D8228E2073AE470@DM2PR05MB768.namprd05.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(28532068793085)(10436049006162)(120809045254105)(50582790962513)(85827821059158)(21748063052155)(138986009662008);
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3231254)(944501410)(52105095)(3002001)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(20161123558120)(20161123564045)(6072148)(201708071742011)(7699016); SRVR:DM2PR05MB768; BCL:0; PCL:0; RULEID:; SRVR:DM2PR05MB768;
x-forefront-prvs: 0725D9E8D0
received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts)
x-microsoft-antispam-message-info: WKNiyyDpMjsxe94HlXaSP0WtiiEj46is7t2SrAxD+aZDEBZAaqOmr8+3S24jFMVgbD7y6mmtWcw+lwmWF9bELYCKFGMzHV/1Zdsmygr1FJchyrR3px6TPIqaHSLmvDawP3Rno8H+xCLU0yDWyTH870gebWkG7o8Hpq8qlgNgqtC+7S8x66MpElMcr5Xd9nrYdEXyO4YvBhX5BXNOrAawwCMR0nLEjwBV39Q8vR6C/Md5oQzWZ3WdbD4q2R0cM0m1oOKQUlHyFX2IFuzCYVgetxW0nwdRcs7pftheH1sgifLBussPkSqK8QgLiVZ4zUccXq/6LA0p0raUCP/RMpR3HkseDinRvae9aRYPygOdcHo=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_DM2PR05MB448D2B060B09D4275A9BC6AAE470DM2PR05MB448namprd_"
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
X-MS-Exchange-CrossTenant-Network-Message-Id: 718b7593-7f12-4676-fe80-08d5e386b7d1
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 21:23:29.1127 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR05MB768
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-07-06_06:, , signatures=0
X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1806210000 definitions=main-1807060240
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtgwg/l-cYGBnrL8rDTIuqJr_ivGwnNzk>
X-BeenThere: rtgwg@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: Routing Area Working Group <rtgwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtgwg>, <mailto:rtgwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtgwg/>
List-Post: <mailto:rtgwg@ietf.org>
List-Help: <mailto:rtgwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtgwg>, <mailto:rtgwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Jul 2018 21:23:43 -0000

+1

Let’s follow up on this discussion in Montreal.

From: Linda Dunbar <linda.dunbar@huawei.com>
Sent: Friday, July 6, 2018 4:33 PM
To: Jeff Tantsura <jefftant.ietf@gmail.com>om>; Robert Raszuk <robert@raszuk.net>
Cc: Ron Bonica <rbonica@juniper.net>et>; RTGWG <rtgwg@ietf.org>rg>; Eric Rosen <erosen@juniper.net>et>; bess@ietf.org
Subject: RE: [bess] comments and suggestions to draft-rosen-bess-secure-l3vpn-01

Jess,

Great Action! There are much more than the Data modeling.
A lot to be done in Control Plane. Many SD-WAN deployment (ours included) use NHRP/DMVPN/DSPVN to manage routes via internet. But NHRP being developed decades ago (for ATM) just doesn’t scale to support Managed Overlay network of 100s or 1000s CPEs.

Linda

From: BESS [mailto:bess-bounces@ietf.org] On Behalf Of Jeff Tantsura
Sent: Friday, July 06, 2018 3:20 PM
To: Robert Raszuk <robert@raszuk.net<mailto:robert@raszuk.net>>
Cc: Ron Bonica <rbonica@juniper.net<mailto:rbonica@juniper.net>>; RTGWG <rtgwg@ietf.org<mailto:rtgwg@ietf.org>>; Eric Rosen <erosen@juniper.net<mailto:erosen@juniper.net>>; bess@ietf.org<mailto:bess@ietf.org>; Linda Dunbar <linda.dunbar@huawei.com<mailto:linda.dunbar@huawei.com>>
Subject: Re: [bess] comments and suggestions to draft-rosen-bess-secure-l3vpn-01

Robert/Linda,

RTGWG chairs have been thinking of starting SD-WAN discussion in RTGWG.
Service data modeling(data modeling in general)is an obvious candidate (at ONUG we started, there’s some early effort, but IETF help is needed).
Control plane interworking is another interesting topic.
Please bring your ideas, I’m still working on agenda

Regards,
Jeff

On Jul 6, 2018, at 13:12, Robert Raszuk <robert@raszuk.net<mailto:robert@raszuk.net>> wrote:
Hi Linda,

What you are expressing is very clear and in fact happens today on any good SD-WAN controller.

But in the context of this discussion are you bringing it here to suggest that draft-rosen-bess-secure-l3vpn should have such functionality build in ?

Personally I don't think it really belongs in this draft as perfect sweet spot for it still IMHO resides on a SD-WAN controller. Pushing all that logic into BGP may be a bit excessive ...

Many thx,
R.


On Fri, Jul 6, 2018 at 9:32 PM, Linda Dunbar <linda.dunbar@huawei.com<mailto:linda.dunbar@huawei.com>> wrote:
Ron,

This is referring to a Managed Overlay WAN services with many CPEs (large scale SD-WAN) and where

-        there are many CPEs at each location and multiple WAN ports on each CPE

-        SD-WAN Controller needs to detour a path between Site -A-&  Site-B via another site (e.g. Site-C) for reasons like Performance, Regulatory,  or others. Instead of designating to specific CPE of the site-C.

It is preferable to partition CPEs to clusters, as shown in the figure below:

[cid:image001..png@01D41536.30DC7AC0]

Do I explain well? If not, can we talk face to face in Montreal?

Thanks, Linda Dunbar

From: Ron Bonica [mailto:rbonica@juniper.net<mailto:rbonica@juniper.net>]
Sent: Friday, July 06, 2018 1:25 PM
To: Linda Dunbar <linda.dunbar@huawei.com<mailto:linda.dunbar@huawei.com>>; Eric Rosen <erosen@juniper.net<mailto:erosen@juniper.net>>; bess@ietf.org<mailto:bess@ietf.org>
Subject: RE: comments and suggestions to draft-rosen-bess-secure-l3vpn-01

Hi Linda,

I’m not sure that I understand what you mean when you say, “aggregate CPE-based VPN routes with internet routes that interconnect the CPEs”. Could you elaborate?

                                                            Ron


From: Linda Dunbar <linda.dunbar@huawei.com<mailto:linda..dunbar@huawei.com>>
Sent: Thursday, July 5, 2018 11:53 AM
To: Eric Rosen <erosen@juniper.net<mailto:erosen@juniper.net>>; Ron Bonica <rbonica@juniper.net<mailto:rbonica@juniper.net>>; bess@ietf.org<mailto:bess@ietf.org>
Subject: comments and suggestions to draft-rosen-bess-secure-l3vpn-01

Eric and Ron,

We think that the method described in your draft is useful for CPE based EVPN, especially for SD-WAN between CPEs.
But, it misses some aspects to aggregate CPE-based VPN routes with internet routes that interconnect the CPEs.

Question to you: Would you like to expand your draft to cover the scenario of aggregating CPE-based VPN routes with internet routes that interconnect the CPEs?

If yes, we think the following areas are needed:


•        For RR communication with CPE, this draft only mentioned IPSEC. Are there any reasons that TLS/DTLS are not added?

•        The draft assumes that C-PE “register” with the RR. But it doesn’t say how. Should “NHRP” (modified version) be considered?

•        It assumes that C-PE and RR are connected by IPsec tunnel. With zero touch provisioning, we need an automatic way to synchronize the IPSec SA between C-PE and RR. The draft assumes:

•  A C-PE must also be provisioned with whatever additional information is needed in order to set up an IPsec SA with each of the red RRs

•        IPsec requires periodic refreshment of the keys. How to synchronize the refreshment among multiple nodes?

•        IPsec usually only send configuration parameters to two end points and let the two end points to negotiate the KEY. Now we assume that RR is responsible for creating the KEY for all end points. When one end point is confiscated, all other connections are impacted.

If you are open to expand your draft to cover SD-WAN, we can help providing the sections to address the bullets mentioned above.

We have a draft analyzing the technological gaps when using SD-WAN to interconnect workloads & apps hosted in various locations: https://datatracker.ietf.org/doc/draft-dm-net2cloud-gap-analysis/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Ddm-2Dnet2cloud-2Dgap-2Danalysis_&d=DwMFAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-AWF2EfpHcAwrDThKP8&m=zU9RrstHx08_qwVE-_wbaPcJUwA0Cx7W9wg4K6cDAOs&s=1SH5CDBkEFKTyKPWRpPpy-dfxkl19-hrgXiR7nRkq50&e=>
Appreciate your comments and suggestions to our gap analysis.


Thanks, Linda Dunbar


_______________________________________________
BESS mailing list
BESS@ietf.org<mailto:BESS@ietf.org>
https://www.ietf.org/mailman/listinfo/bess<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_bess&d=DwMGaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-AWF2EfpHcAwrDThKP8&m=-YF-QCTv5uEfMyt2Wc0PmtR67-K6YA_3N6rtLgrOn8s&s=SriB9BByrX7UeyUS1mlwSgHjqLf0roIqfTnM8SdQA7E&e=>

_______________________________________________
BESS mailing list
BESS@ietf.org<mailto:BESS@ietf.org>
https://www.ietf.org/mailman/listinfo/bess<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_bess&d=DwMGaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-AWF2EfpHcAwrDThKP8&m=-YF-QCTv5uEfMyt2Wc0PmtR67-K6YA_3N6rtLgrOn8s&s=SriB9BByrX7UeyUS1mlwSgHjqLf0roIqfTnM8SdQA7E&e=>