Re: [saag] [Apn] APN presentation in SAAG on Thursday.

["Pengshuping (Peng Shuping)" <[e-mail]>]

Hi Joey,

Thank you for your questions. Please find in line below.

From: Joey S [mailto:[e-mail]]
Sent: Thursday, March 11, 2021 9:52 PM
To: Pengshuping (Peng Shuping) <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: Re: [Apn] APN presentation in SAAG on Thursday.

Hi Shuping,

Thank you for the presentation in saag today, a couple of follow up questions;

  *   What type of user identifying information is included in the implementation of 'fine-grain user' and 'application' groups?
APN is not about identifying either the particular user or application. It is about applying policies on the differentiated traffic flow based on the APN attribute information in the various nodes/service functions along the path more efficiently. For identifying the user group the access port on the network edge devices could be used by the network operators such as VLAN ID or QinQ.
The attribute is an opaque value and just a bit string against which the policies are applied within the network. No need to say who the user is and what the application is. Those type of information is not useful for the policy enforcement on the network nodes either.

  *   How is the mapping of '5-tuple to SLA/policy' generated?
This mapping can be generated by the configuration or the controller.
How would a CPE treat an application whose 5-tuple information is not included/defined in the APN attribute?
CPE is the network device which tags the APN attribute. On this network edge device, the information already in the packet header such as 5-tuple can be used to generate the APN attribute.
Best regards,
Shuping

Thank you,

--

Joey Salazar

Digital Sr. Programme Officer

ARTICLE 19

6E9C 95E5 5BED 9413 5D08 55D5 0A40 4136 0DF0 1A91
On 10-Mar-21 8:46 AM, Pengshuping (Peng Shuping) wrote:
Hi Folks,

Thanks to the ADs and the Chairs, we are going to present APN (Application-aware Networking) in the SAAG working group at 13:00-15:00 (UTC+1) Thursday.

APN is focused on developing a framework and set of mechanisms to derive, convey and use an attribute information to allow for the implementation of fine-grain user (group)-, application (group)-, and service-level requirements at the network layer. APN works within a limited trusted domain, which typically is defined as a service provider's limited domain in which MPLS, VXLAN, SR/SRv6 and other tunnel technologies are adopted to provide services.

In the presentation, we would like to introduce the concepts, clarify the scope, attract people to understand and discuss the topic, and collect feedback and suggestions on this work, to further address the main concerns that were raised by the IESG.

For the SECers, we would like to especially know about what the security issues are when the APN attribute is used within a limited operator's controlled domain.

Please find the latest version of the key draft, clarifying the scope and the gap analysis.
https://datatracker.ietf.org/doc/html/draft-peng-apn-scope-gap-analysis-01

We have been discussing in the APN mailing list regarding the various aspects of APN. If you have not subscribed, you are very welcome to subscribe. You can also find the archived discussions.
https://datatracker.ietf.org/wg/apn/about/

More information about APN can be found here.
https://github.com/APN-Community

Best Regards,
Shuping