Subject: [I2nsf] -- Interface to Network Security Functions can be one of the tools for NFVRG

From: Hosnieh Rafiee <[email-masked]>
Date: Thu, 25 Sep 2014 16:44:50 +0000

Hi Linda,

I took a look on your proposal. Please find my questions/comments inline...
 
> The security functions offered by 3rd party need Bi-directional 
> periodic communications between the requesters and the providers for 
> policies negotiation, validation, potentially re-directing traffic to 
> higher level security functions, etc. Therefore, the service requires 
> protocol exchange between multiple entities.
> 
> The proposed protocols between requester and provider can be used for 
> the following scenarios:
> 
> · A Client requests a set of certain network security functions from a 
> provider
> 
> · The provider fulfills the request for example, by instantiating an 
> instance of the service in question, or configures additional rules in 
> an already provisioned service.

I guess the main problem would occur in a case where this client asks for different services from different service providers. In this case the agreement between these service providers needs to be made and this agreement might need the installation of some software on the physical Infrastructure of the other provider. The update and other issue, then, might happen which needs a lot of administrative works and (possibly) paper works between these service providers.
Therefore, in my opinion (I might be wrong) the main problem is not how the customer request a service from different service providers but how these different service providers can follow a single standard to avoid the need of such agreements. 
In ETSI document also focuses on the orchestration problem of different service providers.

I am also not quite sure about the clients. Who are the clients? Are they the end users (companies)? Is your focus is how to offer this service to this clients or how they request this service? 
Doesn’t it work if a company just play the role of intermediate and provide the interface between the customers (such as a web interface) that ask for different services from different providers? (in case service providers need, again, to follow the same standards, having a same interface might not be a problem. Is it?)

I also have a question for you. why are you discussing about VNF while it appears that your focus is more on management part or in the coverage of NFV. NFV also covers the concepts of VNF.

> OpenStack has done a project on FW as a service:
> https://datatracker.ietf.org/doc/draft-dunbar-nsaas-problem-statement/.
> Here is the highlight of the relationship with OpenStack:

In your draft you named openstack as one of industrial open source software and I personally found it a really complete IaaS. I guess it might be good to standardize the communication or how to easily set different parameters on different Network functions that has different providers by using the same protocol. In other word, the Network functions from different providers can talk together and exchange management data via the same language (protocol) would be a good use case.

Thanks,
Best,
Hosnieh