AW: [Teas] 答复: VPN security vs SD-WAN security

<Ruediger.Geib@telekom.de> Thu, 02 August 2018 12:07 UTC

Return-Path: <Ruediger.Geib@telekom.de>
X-Original-To: rtgwg@ietfa.amsl.com
Delivered-To: rtgwg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB158124BE5; Thu, 2 Aug 2018 05:07:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.31
X-Spam-Level:
X-Spam-Status: No, score=-4.31 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=telekom.de header.b=tEcnjyEk; dkim=pass (1024-bit key) header.d=telekom.onmicrosoft.de header.b=H9JMOiDv
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U12OMqD5mwWO; Thu, 2 Aug 2018 05:07:01 -0700 (PDT)
Received: from mailout24.telekom.de (MAILOUT24.telekom.de [80.149.113.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF29B12426A; Thu, 2 Aug 2018 05:06:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telekom.de; i=@telekom.de; q=dns/txt; s=dtag1; t=1533211621; x=1564747621; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=7W5uCj6/uSszSNn5c1sxgO3FsCEDGDXRxhZcAtzx5MM=; b=tEcnjyEk69KUUgHkrOHY7PyWB8sL/n100+wcftJ6gZVad82X3hxNbZxj KBbvwKF/jGkPP5/kJ/E8eLXcZ4cl3A5wmGUflsyjnZayRTwk0SeoDILnW 4Xfm+rf8QBHt8EHPTpL9XUHbelq7T0A7UZZjkBtDus7ZC4Xd4ucrWFPUS 8MYF5ffwzd2NMtLOQLBHjr2gT/g6A5RvXfmgPeW1bEtn4GEkBbRlbkjF9 Vl9qg8RB9MWgObAiJNmbPpeiXR1gD/t80JZSdXBrYvdZ6iAH7e+x4ynOY I1MSpjd3k/CRAImRohlZTGkKluxjc3B/phSV93qEjm9CivA/buVFKRffk g==;
Received: from qde9xy.de.t-internal.com ([10.171.254.32]) by MAILOUT21.telekom.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Aug 2018 14:06:56 +0200
X-IronPort-AV: E=Sophos;i="5.51,435,1526335200"; d="scan'208";a="96714392"
Received: from he105647.emea1.cds.t-internal.com ([10.169.119.61]) by QDE9Y1.de.t-internal.com with ESMTP/TLS/AES256-SHA; 02 Aug 2018 14:06:55 +0200
Received: from HE105660.EMEA1.cds.t-internal.com (10.169.119.56) by HE105647.emea1.cds.t-internal.com (10.169.119.61) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Thu, 2 Aug 2018 14:06:51 +0200
Received: from HE104163.emea1.cds.t-internal.com (10.171.40.38) by HE105660.EMEA1.cds.t-internal.com (10.169.119.56) with Microsoft SMTP Server (TLS) id 15.0.1367.3 via Frontend Transport; Thu, 2 Aug 2018 14:06:51 +0200
Received: from GER01-FRA-obe.outbound.protection.outlook.de (51.4.80.16) by O365mail05.telekom.de (172.30.0.230) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Thu, 2 Aug 2018 14:06:59 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telekom.onmicrosoft.de; s=selector1-telekom-onmicrosoft-de; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7W5uCj6/uSszSNn5c1sxgO3FsCEDGDXRxhZcAtzx5MM=; b=H9JMOiDvakOdaB+UimcqYIShKmIsKiUhFu82pZw1MaHir+QEx5wcf3/JDoVux3d5f8r9cAe8ehxpWRJXi+Yt8m1kRW1i+FNM+iqYI08hBJVA1TSphhdUkbkRX1+FwQyK6w3tIyI6C+WawnsuRaRqhaEuMqYPYCWRhpWNYn5Lxco=
Received: from FRAPR01MB0113.DEUPRD01.PROD.OUTLOOK.DE (10.158.130.143) by FRAPR01MB0113.DEUPRD01.PROD.OUTLOOK.DE (10.158.130.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1017.14; Thu, 2 Aug 2018 12:06:50 +0000
Received: from FRAPR01MB0113.DEUPRD01.PROD.OUTLOOK.DE ([fe80::e8f7:3190:beb6:eee2]) by FRAPR01MB0113.DEUPRD01.PROD.OUTLOOK.DE ([fe80::e8f7:3190:beb6:eee2%5]) with mapi id 15.20.1017.010; Thu, 2 Aug 2018 12:06:50 +0000
From: Ruediger.Geib@telekom.de
To: stewart.bryant@gmail.com
CC: teas@ietf.org, rtgwg@ietf.org
Subject: AW: [Teas] 答复: VPN security vs SD-WAN security
Thread-Topic: [Teas] 答复: VPN security vs SD-WAN security
Thread-Index: AQHUKlKmQsM4w1IkoEaJjjbC4+zUV6SsUlJg
Date: Thu, 02 Aug 2018 12:06:50 +0000
Message-ID: <FRAPR01MB0113308E7A5948226AFBA3889C2C0@FRAPR01MB0113.DEUPRD01.PROD.OUTLOOK.DE>
References: <CA+b+ERmfOaFMURD2eNPScs2SZ88rOEfGXZZJsqGDWX3M6bTY-g@mail.gmail.com> <0cb8f15b-7538-500c-dda3-915bf9814f94@gmail.com> <5D10C0C4-B93D-463F-A071-EEA6F35506CD@cisco.com> <CA+b+ERkqrr4Wr+Wy9q81SpyWi7H1s=z_RAvbc3Rbddvpgb7Xpg@mail.gmail.com> <76CD132C3ADEF848BD84D028D243C927A71506F6@NKGEML515-MBS.china.huawei.com> <CA+b+ERmWDhXf0ia8mQ25=QZw-h_ipkAQnttsirQb3kOk_fhUVA@mail.gmail.com> <CA+RyBmX1Wj-aH+rWhQ1LLVrBkEq12Hz-DT1gYBF0TRx1ewaEzg@mail.gmail.com> <CA+b+ERmOFwgv+_8KBUx_sQnxXxgua53j5d8QEm=C9ppObkgwVQ@mail.gmail.com> <76CD132C3ADEF848BD84D028D243C927A72042AB@NKGEML515-MBS.china.huawei.com> <89653c55-90e0-c52d-bdef-38b312b7feda@joelhalpern.com> <76CD132C3ADEF848BD84D028D243C927A72B1EF7@NKGEML515-MBS.china.huawei.com> <5c72cc37-c1e0-e806-701d-40a4cf756eee@joelhalpern.com> <644649c7-a5b5-9e78-8749-4a2109566cf9@gmail.com>
In-Reply-To: <644649c7-a5b5-9e78-8749-4a2109566cf9@gmail.com>
Accept-Language: en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Ruediger.Geib@telekom.de;
x-originating-ip: [164.19.3.235]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; FRAPR01MB0113; 6:EFHwp7uk0wrE+P293I3nj+3KWuBoFagFeUHnixkjKpIiKxb86h9CGIAw/AW7mjQmsDryFuo6FnJ8NBCJhriudT1S53M+O0YtRJqUS5k3BIxULgFqeKW9BLlyVzw4XDZE+crzOxbyjZ7xDfMSZ9xM7B33wsFC605USaVT8iC47M5MjBdlbHUnvMt2opt/yyw9PyxdROhwWHinyxCONBP6zpdclCP+A1VP9VRFHfNaFqORhR4a0+WbZvPlN9xfgBz7VrSOsacNu86GvUbaAb3q3ci9qqhmoLkF6+IOyFnNJGXD0E4pdYbLDNilr/yODZAfes3cV8xMJV+HYnhOW5JESjpCUyhg8DA0bjmfUIwTkHTb95o/JDQDiy17YUBe20myH9KBhupbH1yxKorXEPDyP3HTzmCTrxo14QtM8k09q+zd9Hs5L4/TYC1EF3u42I0HDvexgssrYQgvnREdwt1HWA==; 5:jEXvPhVsE+vKcIHCdYRPo/4iGMq8p5V37knqEqOuWtgF6PSsqq5k864yGzk9PbA92E21ZxH01s2NsI7mukLJxrLVIu2XmvWeUhd/VAC8WbW0J1TtqJ3cEN73Rg6O4OdgIa0FyoqpZIIJ4HZ2Bkcqjlj0bf9JlRQDmGmHof7miMY=; 7:vWckjXpfjQlr6Yc2FmoaUwQXhqw53opFJpfCyNhj5i3d0PWihWH5E7uLyWssP3TtY2j0PK2jalyEJoHSgj4BmT3b4y5RaBiYzTzRtvEhWe4BISIPOSBTC1YRoc/fuFfOb+vqMnXymrGz/ay31odXwbfHVFQV80aDyOM1LpHZEBMmHYu7Etx8uyt2ll0Eipcf98sxm1m2R+e1WsTBuF/AuSDT3ZufseLRGh3BCw6tPP1Fs56odlVbTg1LCcqBuUHR
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 02ed5ae3-ff70-463b-ae63-08d5f8706ddc
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:FRAPR01MB0113;
x-ms-traffictypediagnostic: FRAPR01MB0113:
x-microsoft-antispam-prvs: <FRAPR01MB01137C979C2506629F8EE7D39C2C0@FRAPR01MB0113.DEUPRD01.PROD.OUTLOOK.DE>
x-exchange-antispam-report-test: UriScan:(278428928389397)(72170088055959)(192374486261705)(50582790962513)(85827821059158)(95692535739014)(12901024606220);
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(3002001)(3231311)(944501410)(52105095)(10201501046)(93006095)(93001095)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123560045)(20161123564045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:FRAPR01MB0113; BCL:0; PCL:0; RULEID:; SRVR:FRAPR01MB0113;
x-forefront-prvs: 07521929C1
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(346002)(376002)(136003)(366004)(396003)(51444003)(37854004)(189003)(199004)(85182001)(2906002)(53936002)(966005)(75402003)(72206003)(478600001)(53946003)(66066001)(15650500001)(9686003)(5250100002)(5660300001)(33656002)(55016002)(14454004)(6306002)(86362001)(6916009)(11346002)(8936002)(85202003)(446003)(305945005)(476003)(6116002)(3846002)(224303003)(2900100001)(53546011)(7736002)(102836004)(486006)(186003)(106356001)(26005)(105586002)(256004)(14444005)(76176011)(52396003)(74482002)(39060400002)(93886005)(7696005)(4326008)(54906003)(97736004)(68736007)(81156014)(81166006)(316002)(777600001); DIR:OUT; SFP:1101; SCL:1; SRVR:FRAPR01MB0113; H:FRAPR01MB0113.DEUPRD01.PROD.OUTLOOK.DE; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: telekom.de does not designate permitted sender hosts)
x-microsoft-antispam-message-info: fCnohrXgNPAOU5VQrSL7WnpiMF6wvxOkPQSn7rXhMNdDz+TiH1C6slZ6QB+oa1vUQiXzyXCNXE0T4cbcBaCpXOER8E5oOPN+4grt09jcDYs1FKVEWY6Po6uTGkkhkMGOFbd6XM+HLPTaVwhgEYMPsiEqeb9MpNuJy6V7bqhhpmcYoXUqtzt3U9Be53IMnb8MH+zrJ8TSNiUscLx9kS0+VBi8V0HkCFM5LyMQqtuHPerm54wlATZob8Ek63AJAtLoxMbRgQ4ucUz3JmG1pyMoV/r+JaR+kXjwCM9D6lHj9aYt9SvyHPWbEu5MEAyKst9Xa5jg4Z+oYJuTEDTwc1JOBawKlv1tzSN0C/mvTri1Kkk=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 02ed5ae3-ff70-463b-ae63-08d5f8706ddc
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Aug 2018 12:06:50.5060 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bde4dffc-4b60-4cf6-8b04-a5eeb25f5c4f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FRAPR01MB0113
X-OriginatorOrg: telekom.de
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtgwg/pKwC-ymIRLIBrvBRZEBAdvTTeq8>
X-BeenThere: rtgwg@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: Routing Area Working Group <rtgwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtgwg>, <mailto:rtgwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtgwg/>
List-Post: <mailto:rtgwg@ietf.org>
List-Help: <mailto:rtgwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtgwg>, <mailto:rtgwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Aug 2018 12:07:06 -0000

Stewart,

I'd appreciate a discussion based on operational experience. In which Diffserv supported network did which application fail due to a lack of suitable scheduling or due to a lack of codepoints, which would have been working properly on the same network with Detnet and more codepoints? I'd be happy, if you were able to provide a link to a presentation.

I've started my QoS career with ATM, a technology offering dedicated QoS network resources. Spare capacities with a network-fully-booked indication were the first lesson I learned, and this combination turned out to be bad whenever I encountered it from then on. My take on Diffserv is, that it is useful to protect certain traffic in the case of not foreseen networking conditions. That means, in 99,....% of the time, todays Diffserv isn't required, because there's no congestion. 

You seem to head for generic solutions, applicable in all parts of the Internet. I don't understand what the benefit of dedicated resources would be, given they are required end-to-end. I excuse if I missed a statement that the approach you propose is limited to specific instances or sections of the Internet.

Regards,

Ruediger


-----Ursprüngliche Nachricht-----
Von: rtgwg [mailto:rtgwg-bounces@ietf.org] Im Auftrag von Stewart Bryant
Gesendet: Donnerstag, 2. August 2018 13:19
An: Joel M. Halpern <jmh@joelhalpern.com>; Dongjie (Jimmy) <jie.dong@huawei.com>
Cc: TEAS WG (teas@ietf.org) <teas@ietf.org>; rtgwg@ietf.org
Betreff: Re: [Teas] 答复: VPN security vs SD-WAN security



On 01/08/2018 16:26, Joel M. Halpern wrote:
> I am not disagreeing with a view that network resource allocation 
> requires some visibility to those resources.
> It is the assertion of a "deep integration" that seems to lack grounding.
>
> We know that one can use our existing VPN technologies and tools like 
> diffserv, with suitable admission control and path computation, to 
> provide strong service guarantees to meet SLAs. As others have noted 
> in other presentations, when it comes to the data plane this seems to 
> meet the articulated needs from various fora.
>
Hi Joel,

We can certainly get a long way with those tools for "conventional" 
applications.

However, as we support the sort of applications that look for a deterministic networking class of SLA, then I am concerned that we need to map the traffic to dedicated resources in more detail than we currently do through the diffserv mechanism.

What we do at the moment with diffserv is a mapping of packets to resources, but in practise we limit those resources to ingress and egress queues with the queue management algorithm out of scope. I am not convinced this is adequate for the future, and think that we need to start to consider CPU/NPU cores, queue algorithms, and maybe other resources.

I am also concerned that the number of diffserv code points available in MPLS is going to be insufficient.

Of course what we know today from experience is based on the applications that can run on the network infrastructure that we have today. That is a self limiting situation. We are designing DETNET because this model is inadequate for some classes of application that would like to run over a more general network. What we are doing with 
VPN+ is to integrate DETNET into a VPN structure alongside classic VPNs.

- Stewart


> Yours,
> Joel
>
> On 8/1/18 11:22 AM, Dongjie (Jimmy) wrote:
>> This statement is based on the comparison between overlay VPNs and 
>> network slices. The resource here refers to various data plane 
>> resources that can be allocated to a particular slice (queues, 
>> buffer, etc.). Some level of resource isolation is necessary to 
>> ensure that service in one slice never interferes with service in 
>> another slice.
>>
>> May I know what are the requirements you've got?
>>
>> Best regards,
>> Jie
>>
>>> -----邮件原件-----
>>> 发件人: Joel M. Halpern [mailto:jmh@joelhalpern.com]
>>> 发送时间: 2018年7月30日 23:05
>>> 收件人: Dongjie (Jimmy) <jie.dong@huawei.com>
>>> 抄送: TEAS WG (teas@ietf.org) <teas@ietf.org>; rtgwg@ietf.org
>>> 主题: Re: VPN security vs SD-WAN security
>>>
>>> Actually, assuming I understand the statement properly, "deep 
>>> integration with the underlay resource would be necessary" does not 
>>> appear to be an accurate statement derivable from the requirements 
>>> that I have seen.
>>>
>>> Yours,
>>> Joel
>>>
>>> On 7/30/18 8:23 AM, Dongjie (Jimmy) wrote:
>>>> (Adding TEAS as it is where the VPN+ framework draft is discussed)
>>>>
>>>> Hi Robert and Greg,
>>>>
>>>> As discussed during the VPN+ presentation in TEAS at IETF 102, the 
>>>> scope is not the internet, as we know it would quite difficult or 
>>>> even impossible to achieve the required guarantee at the scope of internet.
>>>>
>>>> And clearly the VPN overlays cannot provide the required guarantee, 
>>>> deep integration with the underlay resource would be necessary.
>>>>
>>>> Another aspect we may take into consideration is the factor of 
>>>> overprovisioning. The current network only has one overprovisioning 
>>>> factor, which may not meet the requirement of different 
>>>> services/customers. With network slicing, it is possible to have 
>>>> different overprovisioning policy and factor in different slices.
>>>>
>>>> Best regards,
>>>>
>>>> Jie
>>>>
>>>> *From:*rraszuk@gmail.com [mailto:rraszuk@gmail.com] *On Behalf Of 
>>>> *Robert Raszuk
>>>> *Sent:* Sunday, July 29, 2018 6:11 AM
>>>> *To:* Greg Mirsky <gregimirsky@gmail.com>
>>>> *Cc:* Dongjie (Jimmy) <jie.dong@huawei.com>; rtgwg@ietf.org
>>>> *Subject:* Re: VPN security vs SD-WAN security
>>>>
>>>> Hey Greg,
>>>>
>>>>>
>>>>
>>>> would not require global transit and likely be contained within 
>>>> access or, at most, metro domains.
>>>>
>>>> That's news to me, but perhaps on the positive side :) I always 
>>>> think WAN .. really wide one !
>>>>
>>>> The separation on "soft" vs "hard" guarantees is eventually all 
>>>> about amount of network robustness and level of over provisioning.  
>>>> I sincerely hope it will not be yet another EVPN overlay over IP 
>>>> network just painted with different marketing colors.
>>>>
>>>> Besides if any customer is serious and actually counts on those 
>>>> guarantees he better purchase two of such services coming from 
>>>> independent operators. That means that to be attractive financially 
>>>> cost of such premium service must not be higher then half of the 
>>>> p2p local fiber or cost of local access to closest IX ports + port 
>>>> subscription in a given MAN where non blocking IX fabric spans 
>>>> given
>>> geography.
>>>>
>>>> It seems to me that at the end of the day the space for those 
>>>> operators wishing to offer hard network slicing is actually pretty 
>>>> narrow, but time will tell ...
>>>>
>>>> Rgs,
>>>>
>>>> r.
>>>>
>>>> On Sat, Jul 28, 2018 at 9:34 PM, Greg Mirsky <gregimirsky@gmail.com 
>>>> <mailto:gregimirsky@gmail.com>> wrote:
>>>>
>>>>      Hi Robert,
>>>>
>>>>      very much agree with all you're saying and find us in violent
>>>>      agreement on "C". Proactive performance monitoring, in my view 
>>>> as
>>>>      well, is the reasonable path to provide "soft" SLA and, to a 
>>>> degree,
>>>>      prevent oversubscription of the network. And that, as you've 
>>>> said,
>>>>      is one way to "assured/guaranteed global IP transit".
>>>>
>>>>      But I think that there will be demand for "hard" guarantees 
>>>> for
>>>>      URLLC applications. But these, in my view,
>>>>
>>>>      would not require global transit and likely be contained 
>>>> within
>>>>      access or, at most, metro domains. Because of the limited size 
>>>> of
>>>>      the domain, IntServ may work, though that may be not the most
>>>>      efficient technique. We shall find out.
>>>>
>>>>      Hence my view on slicing:
>>>>
>>>>        * different applications will have different requirements 
>>>> and use
>>>>          different degrees of isolation and guarantees;
>>>>        * "soft" slices may not need much of additional 
>>>> standardization
>>>>          and use available VPN technologies in combination with PM 
>>>> OAM
>>>>          for SLA monitoring and assurance;
>>>>        * "hard" slices would span within a single access and/or 
>>>> metro
>>>>          domain. Networking solutions likely will be coupled with
>>>>          architecture and interfaces developed in Multi-access Edge
>>>>          Computing (MEC).
>>>>
>>>>      Regards,
>>>>
>>>>      Greg
>>>>
>>>>      On Sat, Jul 28, 2018 at 6:02 AM, Robert Raszuk 
>>>> <robert@raszuk.net
>>>>      <mailto:robert@raszuk.net>> wrote:
>>>>
>>>>          Hi Jie,
>>>>
>>>>          > (network slicing) is to provide the demanding services 
>>>> with guaranteed performance in a converged network,
>>>>
>>>>          Foundation of converged IP network is based on statistical
>>>>          multiplexing of traffic demands. As such it is in its 
>>>> principle
>>>>          quite contradictory to "guaranteed" characteristics
>>>>          (performance, delays, jitter, drops -- you name it).
>>>>
>>>>          Application layers usually deal very well with all of the 
>>>> above
>>>>          I would state - normal characteristics of IP networks..
>>>>
>>>>          No doubt there will be those trying to offer some network
>>>>          slicing with guarantees and even those who will buy it. 
>>>> Just
>>>>          like today there are those who offer you L2 circuit 
>>>> between
>>>>          endpoints except such L2 circuit is an emulated one with 
>>>> zero
>>>>          OEM visibility to the IP infrastructure underneath.
>>>>
>>>>          Now the network slicing is clearly aiming for even more
>>>>          complexity under the hood. And that is not the only 
>>>> problem. The
>>>>          issue is cost. When SP is building the IP network the goal 
>>>> is to
>>>>          mux as many services on it as it simply results in given's 
>>>> SP
>>>>          revenue. Network slicing is promising as potentially just 
>>>> by
>>>>          configuration of few knobs they will be claiming 
>>>> guarantees as
>>>>          RFC says - except RFC will not likely tell you to stop
>>>>          over-provisioning.
>>>>
>>>>          Unless the idea is to use strict policing with dedicated 
>>>> queuing
>>>>          on active and back paths or do something like RSVP IntServ 
>>>> also
>>>>          on active and backup paths per customer - I really don't 
>>>> think
>>>>          you can really guarantee much. And if you do that the cost 
>>>> would
>>>>          likely grow really steep.
>>>>
>>>>          So what is IMO the solution for assured/guaranteed global 
>>>> IP
>>>>          transit:
>>>>
>>>>          *A*  get diversely routed  dark fiber paths between your 
>>>> POPs
>>>>          (can be unprotected) which btw today do not cost that much 
>>>> anymore
>>>>
>>>>          *B* get diversely routed  optical channels alsol between 
>>>> your
>>>>          POPs (can be unprotected)
>>>>
>>>>          *C*  use N disjoined by design (single AS Internet 
>>>> providers
>>>>          between your end-points) + proper SD-WAN with active SLA 
>>>> monitoring
>>>>
>>>>          Clearly I am big supporter of *C* model for reasons 
>>>> discussed on
>>>>          this and few other recent threads.
>>>>
>>>>          I assume network slicing will try to get into be something
>>>>          between A/B & C but it is bounded up front with the cost 
>>>> of the
>>>>          two.
>>>>
>>>>          Many thx,
>>>>
>>>>          Robert.
>>>>
>>>>          On Sat, Jul 28, 2018 at 9:51 AM, Dongjie (Jimmy)
>>>>          <jie.dong@huawei.com <mailto:jie.dong@huawei.com>> wrote:
>>>>
>>>>              Hi Robert,
>>>>
>>>>              IMO the two approaches are targeting at different use 
>>>> cases
>>>>              and customers.
>>>>
>>>>              The former (network slicing) is to provide the 
>>>> demanding
>>>>              services with guaranteed performance in a converged
>>> network,
>>>>              while the latter (switching between multiple 
>>>> paralleled
>>>>              networks) provides the customer with the best 
>>>> performance
>>>>              that is available among those candidates. To me the 
>>>> latter
>>>>              is still some kind of best effort, and as Toerless 
>>>> said, it
>>>>              depends on the diversity you can have in the multiple
>>> networks.
>>>>
>>>>              And I agree with Stewart on “you always pay a price 
>>>> for
>>>>              better than best effort.”
>>>>
>>>>              Best regards,
>>>>
>>>>              Jie
>>>>
>>>>              *From:*rtgwg [mailto:rtgwg-bounces@ietf.org
>>>>              <mailto:rtgwg-bounces@ietf.org>] *On Behalf Of *Robert
>>> Raszuk
>>>>              *Sent:* Wednesday, July 25, 2018 8:24 PM
>>>>              *To:* Acee Lindem (acee) <acee@cisco.com
>>>>              <mailto:acee@cisco.com>>
>>>>              *Cc:* rtgwg@ietf.org <mailto:rtgwg@ietf.org>
>>>>
>>>>
>>>>              *Subject:* Re: VPN security vs SD-WAN security
>>>>
>>>>              True network slicing for IP networks means either 
>>>> waist of
>>>>              resources or very strict multi-level queuing at each 
>>>> hop and
>>>>              100% ingress traffic policing. Yet while this has a 
>>>> chance
>>>>              to work during normal operation at the time of even 
>>>> regular
>>>>              failures this all pretty much melts like cheese on a 
>>>> good
>>>>              sandwich.
>>>>
>>>>              It is going to be very interesting to compare how 
>>>> single
>>>>              complex sliced network compares for any end to end 
>>>> robust
>>>>              transport from N normal simple IP backbones and end to
>>> end
>>>>              SLA based millisecond switch over between one and 
>>>> another
>>> on
>>>>              a per flow basis. Also let's note then while the 
>>>> former is
>>>>              still to the best of my knowledge a draft the latter 
>>>> is
>>>>              already deployed globally in 100s of networks.
>>>>
>>>>              Best,
>>>>              R.
>>>>
>>>>              On Wed, Jul 25, 2018 at 1:21 PM, Acee Lindem (acee)
>>>>              <acee@cisco.com <mailto:acee@cisco.com>> wrote:
>>>>
>>>>                  *From: *rtgwg <rtgwg-bounces@ietf.org
>>>>                  <mailto:rtgwg-bounces@ietf.org>> on behalf of 
>>>> Stewart
>>>>                  Bryant <stewart.bryant@gmail.com
>>>>                  <mailto:stewart.bryant@gmail.com>>
>>>>                  *Date: *Wednesday, July 25, 2018 at 5:55 AM
>>>>                  *To: *Robert Raszuk <robert@raszuk.net
>>>>                  <mailto:robert@raszuk.net>>
>>>>                  *Cc: *Routing WG <rtgwg@ietf.org
>>> <mailto:rtgwg@ietf.org>>
>>>>                  *Subject: *Re: VPN security vs SD-WAN security
>>>>
>>>>                  On 25/07/2018 10:40, Robert Raszuk wrote:
>>>>
>>>>                      /* Adjusting the subject ... */
>>>>
>>>>                      Hello
>>>>
>>>>                      Stewart,
>>>>
>>>>                      You have made the below comment in the other
>>> thread
>>>>                      we are having:
>>>>
>>>>                          Indeed, I would have expected this to be 
>>>> on a
>>>>                          secure network of some sort either purely
>>>>                          private or some form of VPN. However, I am
>>> sure
>>>>                          I read in your text that you were
>>>>                          considering using the Public Internet much 
>>>> in
>>>>                          the way of SD-WAN.
>>>>
>>>>                      Would you mind as extensively as you can 
>>>> expand
>>> on
>>>>                      the above statement ?
>>>>
>>>>                      Specifically on what basis do you treat say 
>>>> L2VPN
>>> or
>>>>                      L3VPN of naked unencrypted packets often
>>> traveling
>>>>                      on the very same links as this "bad" Internet
>>>>                      traffic to be even slightly more secure then 
>>>> IPSEC
>>>>                      or DTLS encrypted SD-WAN carried data with
>>> endpoints
>>>>                      being terminated in private systems ?
>>>>
>>>>                      Thx,
>>>>
>>>>                      Robert
>>>>
>>>>
>>>>                  Robert, I think that you have to take it as read 
>>>> that an
>>>>                  air traffic control SoF system is encrypting its
>>>>                  packets. If it is not, then it is clearly not fit 
>>>> for
>>>>                  purpose.
>>>>
>>>>                  What concerns me is that an air traffic system is 
>>>> one of
>>>>                  the most, if not the most, high profile targets in 
>>>> civil
>>>>                  society. You get reminded of this each time you 
>>>> travel
>>>>                  to IETF.
>>>>
>>>>                  The thing about safety of flight traffic is that a
>>>>                  sustained and effective DDoS attack has global 
>>>> impact in
>>>>                  a way that few other such attacks have.
>>>>
>>>>                  A VPN system ought to sustain resistance to such 
>>>> an
>>>>                  attack better than the proposed system which 
>>>> treats
>>> the
>>>>                  SoF traffic the same as regular traffic.
>>>>
>>>>                  I guess you are making a case for your network 
>>>> slicing
>>>>                  work 😉
>>>>
>>>>                  Acee
>>>>
>>>>
>>>>
>>>>                  - Stewart
>>>>
>>>>          _______________________________________________
>>>>          rtgwg mailing list
>>>>          rtgwg@ietf.org <mailto:rtgwg@ietf.org>
>>>>          https://www.ietf.org/mailman/listinfo/rtgwg
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> rtgwg mailing list
>>>> rtgwg@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/rtgwg
>>>>
>
> _______________________________________________
> Teas mailing list
> Teas@ietf.org
> https://www.ietf.org/mailman/listinfo/teas

_______________________________________________
rtgwg mailing list
rtgwg@ietf.org
https://www.ietf.org/mailman/listinfo/rtgwg