Subject: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

From: Linda Dunbar <[email-masked]>
Date: Wed, 15 Jun 2016 15:40:18 +0000

Dear Authors:

The term "Capability Layer" defined by the "draft-ietf-i2nsf-terminology-00" carries different  meaning than the "Capability Layer" used by the I2NSF charter.

"draft-ietf-i2nsf-terminology-00":
Capability: Defines a set of features that are available from a managed entity (see also I2NSF Capability).

Capability Layer: Defines an abstraction layer that exposes a set of capabilities of the I2NSF system.

I2NSF Charter:
I2NSF will specify interfaces at two functional levels for the control and monitoring of network security functions:
The I2NSF Capability Layer specifies how to control and monitor NSFs at a functional implementation level. The term "Functional Implementation" is used to emphasize that the rules (for control and monitor) of NSFs have to be implementable by most NSFs. I2NSF will standardize a set of interfaces by which a security controller can invoke, operate, and monitor NSFs.

The I2NSF Service Layer defines how clients' security policies may be expressed to a security controller. The controller implements its policies according to the various capabilities provided by the I2NSF Capability Layer. The I2NSF Service Layer also allows the client to monitor the client specific policies.

If we use the definitions by the "draft-ietf-i2nsf-terminology-00", we should create a different terminology to represent the "South bound Interface" between Controller and NSF.

Thanks, Linda

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 16 Jun 2016 03:47:08 +0000

Hi Linda,
Frankly, I don’t see the essential difference for the meaning of terminology “capability” between  them.  We just need to make some modification in two places to keep consistence.
We can do it during the update of I2NSF terminology draft.

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]] 代表 Linda Dunbar
发送时间: 2016年6月15日 23:40
收件人: John Strassner; Susan Hares; DIEGO LOPEZ GARCIA ([email-masked])
抄送: [email-masked]
主题: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Dear Authors:

The term “Capability Layer” defined by the “draft-ietf-i2nsf-terminology-00” carries different  meaning than the “Capability Layer” used by the I2NSF charter.

“draft-ietf-i2nsf-terminology-00”:
Capability: Defines a set of features that are available from a managed entity (see also I2NSF Capability).

I2NSF Charter:

If we use the definitions by the “draft-ietf-i2nsf-terminology-00”, we should create a different terminology to represent the “South bound Interface” between Controller and NSF.

Thanks, Linda

---

From: John Strassner <[email-masked]>
Date: Wed, 15 Jun 2016 22:58:02 -0700

HI Linda,

I don't see the conflict in the two definitions. If I substitute the first
(within braces) into the second, I get:

*Capability Layer: Defines an abstraction layer that exposes a set of
{**features
that are available from a managed entity} **of the I2NSF system.*

When I look at the Charter's Capability Layer, I think we're still OK - the
Charter "...specifies how to control and monitor NSFs at a functional
level...", and Capabilities (the features that are available) are essential
for planning how to control and monitor NSFs.

Features (i.e., capabilities) are independent of interface (northbound or
southbound). Would you like us to add that point to the terminology I-D?

best regards,
John

On Wed, Jun 15, 2016 at 8:40 AM, Linda Dunbar <[email-masked]>
wrote:

> Dear Authors:
>
>
>
> The term “Capability Layer” defined by the
> “draft-ietf-i2nsf-terminology-00” carries different  meaning than the
> “Capability Layer” used by the I2NSF charter.
>
>
>
> *Capability: Defines a set of features that are available from a managed
> entity (see also I2NSF Capability).*
>
>
>
> *Capability Layer: Defines an abstraction layer that exposes a set of
> capabilities of the I2NSF system.*
>
>
>
> I2NSF Charter:
>
> *I2NSF will specify interfaces at two functional levels for the control
> and monitoring of network security functions:*
>
>
>
> *The I2NSF Capability Layer specifies how to control and monitor NSFs at a
> functional implementation level. The term "Functional Implementation" is
> used to emphasize that the rules (for control and monitor) of NSFs have to
> be implementable by most NSFs. I2NSF will standardize a set of interfaces
> by which a security controller can invoke, operate, and monitor NSFs. The
> I2NSF Service Layer defines how clients' security policies may be expressed
> to a security controller. The controller implements its policies according
> to the various capabilities provided by the I2NSF Capability Layer. The
> I2NSF Service Layer also allows the client to monitor the client specific
> policies.*
>
>
>
> If we use the definitions by the “draft-ietf-i2nsf-terminology-00”, we
> should create a different terminology to represent the “South bound
> Interface” between Controller and NSF.
>
>
>
> Thanks, Linda
>
>
>
>
>

-- 
regards,
John

---

From: Linda Dunbar <[email-masked]>
Date: Fri, 17 Jun 2016 09:10:21 +0000

John,

My thinking maybe too simplistic.
I picture a “Controller” having two ports,

-        one port connecting to clients (which can be another domain controller or Overlay network controller), interface from this port is “Service layer interface”

-        another port connecting to NSFs, the interface from this port is “capability layer interface”.

So I thought that the Service Layer interface is the North Bound interface to the Controller, the capability interface is the south bound to the controller.

What extra meaning does it carry with the wording “abstraction Layer” ?
Capability Layer: Defines an abstraction layer that exposes a set of {features that are available from a managed entity} of the I2NSF system.
Thank you.

Linda

From: John Strassner [mailto:[email-masked]]
Sent: Thursday, June 16, 2016 12:58 AM
To: Linda Dunbar; John Strassner
Cc: Susan Hares; DIEGO LOPEZ GARCIA ([email-masked]); [email-masked]
Subject: Re: questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

HI Linda,

I don't see the conflict in the two definitions. If I substitute the first (within braces) into the second, I get:

Capability Layer: Defines an abstraction layer that exposes a set of {features that are available from a managed entity} of the I2NSF system.

When I look at the Charter's Capability Layer, I think we're still OK - the Charter "...specifies how to control and monitor NSFs at a functional level...", and Capabilities (the features that are available) are essential for planning how to control and monitor NSFs.

Features (i.e., capabilities) are independent of interface (northbound or southbound). Would you like us to add that point to the terminology I-D?

best regards,
John

On Wed, Jun 15, 2016 at 8:40 AM, Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:
Dear Authors:

I2NSF Charter:

Thanks, Linda

--
regards,
John

---

From: "Ganduri, Rajasekhar" <[email-masked]>
Date: Fri, 17 Jun 2016 15:07:31 +0000

Hey,

I am a novice in I2NSF IETF group and its capabilities but I am a regular follower of the current activities of I2NSF. According to my understanding, the term "abstraction layer" is used to specify that the end user/client need not have the complete visibility of the working or implementation of how the I2NSF controller communicates with the NSFs. This is what interested me in I2NSF, as this opens up to a new set of end users who need not have complete understanding of how a network operates. I implemented this in my research, where a web application tool is built that can be used by "any" end user to give simple natural language inputs through Interface1 (Service Layer) to the controller (or Openstack Cloud controller in my case) and the controller translates and transfers the security commands to the IDS and firewalls through Interface2(Capability layer). The way in which the controller transfers to the NSFs is hidden from the end user (or the end user need not know, details being hidden or abstracted) but the end user will have the authority over Interface2 in his/her own network.

Please let me know if I understood wrongly.

Thanks  and Regards,

Rajasekhar

________________________________
From: Linda Dunbar <[email-masked]>
Sent: Friday, June 17, 2016 4:10 AM
To: John Strassner
Cc: [email-masked]; DIEGO LOPEZ GARCIA ([email-masked]); Susan Hares
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

John,

Thank you.

Linda

HI Linda,

best regards,

John

Dear Authors:

I2NSF Charter:

Thanks, Linda

--

regards,

John

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Sat, 18 Jun 2016 12:54:50 +0000

--Apple-Mail=_1EFF15CC-95EA-4A35-8535-3E217B94E3CA
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
        charset=utf-8

Hi Linda,

The abstraction layer here is the one =E2=80=9Con top=E2=80=9D the NSFs, =
that expose their features as capabilities that are manageable by the =
controller. Using an analogy with OpenFlow, the OpenFlow protocol =
provides an abstraction layer so the forwarding elements can translate =
their status and events in terms of the protocol commands and responses.

Be goode,
=20
> On 17 Jun 2016, at 11:10 , Linda Dunbar <[email-masked]> =
wrote:
>=20
> =20
> I picture a =E2=80=9CController=E2=80=9D having two ports,
> -        one port connecting to clients (which can be another domain =
controller or Overlay network controller), interface from this port is =
=E2=80=9CService layer interface=E2=80=9D
> -        another port connecting to NSFs, the interface from this port =
is =E2=80=9Ccapability layer interface=E2=80=9D.
> =20
> So I thought that the Service Layer interface is the North Bound =
interface to the Controller, the capability interface is the south bound =
to the controller.
> =20
> What extra meaning does it carry with the wording =E2=80=9Cabstraction =
Layer=E2=80=9D ?
> Capability Layer: Defines an abstraction layer that exposes a set of =
{features that are available from a managed entity} of the I2NSF system.
> Thank you.
> =20
> Linda
> =20
> From: John Strassner [mailto:[email-masked] =
<mailto:[email-masked]>]=20
> Cc: Susan Hares; DIEGO LOPEZ GARCIA ([email-masked] =
<mailto:[email-masked]>); [email-masked] =
<mailto:[email-masked]>
> Subject: Re: questions about some terminologies defined by =
draft-ietf-i2nsf-terminology-00
> =20
> HI Linda,
> =20
> I don't see the conflict in the two definitions. If I substitute the =
first (within braces) into the second, I get:
> =20
> Capability Layer: Defines an abstraction layer that exposes a set of =
{features that are available from a managed entity} of the I2NSF system.
> =20
> When I look at the Charter's Capability Layer, I think we're still OK =
- the Charter "...specifies how to control and monitor NSFs at a =
functional level...", and Capabilities (the features that are available) =
are essential for planning how to control and monitor NSFs.
> =20
> Features (i.e., capabilities) are independent of interface (northbound =
or southbound). Would you like us to add that point to the terminology =
I-D?
> =20
> best regards,
> John
> =20
> =20
> On Wed, Jun 15, 2016 at 8:40 AM, Linda Dunbar <[email-masked] =
<mailto:[email-masked]>> wrote:
> Dear Authors:
> =20
> The term =E2=80=9CCapability Layer=E2=80=9D defined by the =
=E2=80=9Cdraft-ietf-i2nsf-terminology-00=E2=80=9D carries different  =
meaning than the =E2=80=9CCapability Layer=E2=80=9D used by the I2NSF =
charter.
> =20
> =E2=80=9Cdraft-ietf-i2nsf-terminology-00=E2=80=9D:
> Capability: Defines a set of features that are available from a =
managed entity (see also I2NSF Capability).
> =20
> Capability Layer: Defines an abstraction layer that exposes a set of =
capabilities of the I2NSF system.
> =20
> I2NSF Charter:
> I2NSF will specify interfaces at two functional levels for the control =
and monitoring of network security functions:
>=20
> The I2NSF Capability Layer specifies how to control and monitor NSFs =
at a functional implementation level. The term "Functional =
Implementation" is used to emphasize that the rules (for control and =
monitor) of NSFs have to be implementable by most NSFs. I2NSF will =
standardize a set of interfaces by which a security controller can =
invoke, operate, and monitor NSFs.
>=20
> The I2NSF Service Layer defines how clients' security policies may be =
expressed to a security controller. The controller implements its =
policies according to the various capabilities provided by the I2NSF =
Capability Layer. The I2NSF Service Layer also allows the client to =
monitor the client specific policies.
>=20
> =20
> If we use the definitions by the =
=E2=80=9Cdraft-ietf-i2nsf-terminology-00=E2=80=9D, we should create a =
different terminology to represent the =E2=80=9CSouth bound Interface=E2=80=
=9D between Controller and NSF.
> =20
> =20
> =20
>=20
>=20
>=20
> --=20

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

--Apple-Mail=_1EFF15CC-95EA-4A35-8535-3E217B94E3CA
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
        charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D"">Hi Linda,<div class=3D""><br class=3D""></div><div =
class=3D"">The abstraction layer here is the one =E2=80=9Con top=E2=80=9D =
the NSFs, that expose their features as capabilities that are manageable =
by the controller. Using an analogy with OpenFlow, the OpenFlow protocol =
provides an abstraction layer so the forwarding elements can translate =
their status and events in terms of the protocol commands and =
responses.</div><div class=3D""><br class=3D""></div><div class=3D"">Be =
goode,</div><div class=3D"">&nbsp;<br class=3D""><div><blockquote =
type=3D"cite" class=3D""><div class=3D"">On 17 Jun 2016, at 11:10 , =
Linda Dunbar &lt;<a href=3D"mailto:[email-masked]" =
class=3D"">[email-masked]</a>&gt; wrote:</div><br =
class=3D"Apple-interchange-newline"><div class=3D""><div =
class=3D"WordSection1" style=3D"page: WordSection1; font-family: =
LucidaGrande; font-size: 11px; font-style: normal; font-variant: normal; =
font-weight: normal; letter-spacing: normal; line-height: normal; =
orphans: auto; text-align: start; text-indent: 0px; text-transform: =
none; white-space: normal; widows: auto; word-spacing: 0px; =
-webkit-text-stroke-width: 0px;"><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" class=3D""><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">John,<o:p class=3D""></o:p></span></div><div=
 style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><span style=3D"font-size: 11pt; =
font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" =
class=3D"">&nbsp;</span></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" class=3D""><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">My thinking maybe too simplistic.<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" class=3D""><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">I picture a =E2=80=9CController=E2=80=9D =
having two ports,<o:p class=3D""></o:p></span></div><div style=3D"margin: =
0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', =
serif; text-indent: -0.25in;" class=3D""><span style=3D"font-size: 11pt; =
font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" =
class=3D""><span class=3D"">-<span style=3D"font-style: normal; =
font-variant: normal; font-weight: normal; font-size: 7pt; line-height: =
normal; font-family: 'Times New Roman';" =
class=3D"">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span =
class=3D"Apple-converted-space">&nbsp;</span></span></span></span><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">one port connecting to clients (which can =
be another domain controller or Overlay network controller), interface =
from this port is =E2=80=9CService layer interface=E2=80=9D<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0in 0in 0.0001pt =
0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; =
text-indent: -0.25in;" class=3D""><span style=3D"font-size: 11pt; =
font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" =
class=3D""><span class=3D"">-<span style=3D"font-style: normal; =
font-variant: normal; font-weight: normal; font-size: 7pt; line-height: =
normal; font-family: 'Times New Roman';" =
class=3D"">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span =
class=3D"Apple-converted-space">&nbsp;</span></span></span></span><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">another port connecting to NSFs, the =
interface from this port is =E2=80=9Ccapability layer interface=E2=80=9D.<=
o:p class=3D""></o:p></span></div><div style=3D"margin: 0in 0in =
0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D""><span style=3D"font-size: 11pt; font-family: Calibri, =
sans-serif; color: rgb(31, 73, 125);" class=3D"">&nbsp;</span></div><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><span style=3D"font-size: 11pt; =
font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=3D"">So =
I thought that the Service Layer interface is the North Bound interface =
to the Controller, the capability interface is the south bound to the =
controller.<o:p class=3D""></o:p></span></div><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D""><span style=3D"font-size: 11pt; font-family: Calibri, =
sans-serif; color: rgb(31, 73, 125);" class=3D"">&nbsp;</span></div><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><span style=3D"font-size: 11pt; =
font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" =
class=3D"">What extra meaning does it carry with the wording =
=E2=80=9Cabstraction Layer=E2=80=9D ?<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0in 0in 0.0001pt =
0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D""><em class=3D""><span style=3D"font-size: 9pt; font-family: =
'PT Serif', serif; color: rgb(34, 34, 34);" class=3D"">Capability Layer: =
Defines an abstraction layer that exposes a set of {features that are =
available from a managed entity} of the I2NSF system.</span></em><o:p =
class=3D""></o:p></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" class=3D""><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">Thank you.<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" class=3D""><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">&nbsp;</span></div><div style=3D"margin: =
0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D""><span style=3D"font-size: 11pt; font-family: Calibri, =
sans-serif; color: rgb(31, 73, 125);" class=3D"">Linda<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" class=3D""><span =
style=3D"font-size: 11pt; font-family: Calibri, sans-serif; color: =
rgb(31, 73, 125);" class=3D"">&nbsp;</span></div><div =
style=3D"border-style: solid none none; border-top-color: rgb(181, 196, =
223); border-top-width: 1pt; padding: 3pt 0in 0in;" class=3D""><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><b class=3D""><span style=3D"font-size: =
10pt; font-family: Tahoma, sans-serif;" class=3D"">From:</span></b><span =
style=3D"font-size: 10pt; font-family: Tahoma, sans-serif;" =
class=3D""><span class=3D"Apple-converted-space">&nbsp;</span>John =
Strassner [<a href=3D"mailto:[email-masked]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email-masked]</a>]<span =
class=3D"Apple-converted-space">&nbsp;</span><br class=3D""><b =
class=3D"">Sent:</b><span =
class=3D"Apple-converted-space">&nbsp;</span>Thursday, June 16, 2016 =
12:58 AM<br class=3D""><b class=3D"">To:</b><span =
class=3D"Apple-converted-space">&nbsp;</span>Linda Dunbar; John =
Strassner<br class=3D""><b class=3D"">Cc:</b><span =
class=3D"Apple-converted-space">&nbsp;</span>Susan Hares; DIEGO LOPEZ =
GARCIA (<a href=3D"mailto:[email-masked]" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">[email-masked]</a>);<span =
class=3D"Apple-converted-space">&nbsp;</span><a =
href=3D"mailto:[email-masked]" style=3D"color: purple; text-decoration: =
underline;" class=3D"">[email-masked]</a><br class=3D""><b =
class=3D"">Subject:</b><span =
class=3D"Apple-converted-space">&nbsp;</span>Re: questions about some =
terminologies defined by draft-ietf-i2nsf-terminology-00<o:p =
class=3D""></o:p></span></div></div><div style=3D"margin: 0in 0in =
0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D""><o:p class=3D"">&nbsp;</o:p></div><div class=3D""><div =
class=3D""><div style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; =
font-family: 'Times New Roman', serif;" class=3D"">HI Linda,<o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D""><o:p class=3D"">&nbsp;</o:p></div></div><div class=3D""><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D"">I don't see the conflict in the two =
definitions. If I substitute the first (within braces) into the second, =
I get:<o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><o:p =
class=3D"">&nbsp;</o:p></div></div><div class=3D""><div style=3D"margin: =
0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D""><em class=3D""><span style=3D"font-size: 9pt; =
font-family: 'PT Serif', serif; color: rgb(34, 34, 34);" =
class=3D"">Capability Layer: Defines an abstraction layer that exposes a =
set of {features that are available from a managed entity} of the I2NSF =
system.</span></em><o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><o:p =
class=3D"">&nbsp;</o:p></div></div><div class=3D""><div style=3D"margin: =
0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D"">When I look at the Charter's Capability Layer, I =
think we're still OK - the Charter "...specifies how to control and =
monitor NSFs at a functional level...", and Capabilities (the features =
that are available) are essential for planning how to control and =
monitor NSFs.<o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><o:p =
class=3D"">&nbsp;</o:p></div></div><div class=3D""><div style=3D"margin: =
0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D"">Features (i.e., capabilities) are independent of =
interface (northbound or southbound). Would you like us to add that =
point to the terminology I-D?<o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; =
font-family: 'Times New Roman', serif;" class=3D""><o:p =
class=3D"">&nbsp;</o:p></div></div><div class=3D""><div style=3D"margin: =
0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D"">best regards,<o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; =
font-family: 'Times New Roman', serif;" class=3D"">John<o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in =
0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D""><o:p class=3D"">&nbsp;</o:p></div></div></div><div =
class=3D""><div style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; =
font-family: 'Times New Roman', serif;" class=3D""><o:p =
class=3D"">&nbsp;</o:p></div><div class=3D""><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">On Wed, Jun 15, 2016 at 8:40 AM, Linda Dunbar &lt;<a =
href=3D"mailto:[email-masked]" target=3D"_blank" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">[email-masked]</a>&gt; wrote:<o:p =
class=3D""></o:p></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D"">Dear Authors:<o:p =
class=3D""></o:p></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">&nbsp;<o:p class=3D""></o:p></div><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">The term =E2=80=9CCapability Layer=E2=80=9D defined by the =
=E2=80=9Cdraft-ietf-i2nsf-terminology-00=E2=80=9D carries different =
&nbsp;meaning than the =E2=80=9CCapability Layer=E2=80=9D used by the =
I2NSF charter.<o:p class=3D""></o:p></div><div style=3D"margin: 0in 0in =
0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D""><span style=3D"font-size: 10pt; font-family: Courier;" =
class=3D"">&nbsp;</span><o:p class=3D""></o:p></div><div style=3D"margin: =
0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D"">=E2=80=9Cdraft-ietf-i2nsf-terminology-00=E2=80=9D:<o:p =
class=3D""></o:p></div><div style=3D"margin: 0in 0in 0.0001pt 0.5in; =
font-size: 12pt; font-family: 'Times New Roman', serif;" class=3D""><i =
class=3D""><span style=3D"font-size: 9pt; font-family: 'PT Serif', =
serif; color: rgb(34, 34, 34);" class=3D"">Capability: Defines a set of =
features that are available from a managed entity (see also I2NSF =
Capability).</span></i><o:p class=3D""></o:p></div><div style=3D"margin: =
0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', =
serif;" class=3D""><i class=3D""><span style=3D"font-size: 9pt; =
font-family: 'PT Serif', serif; color: rgb(34, 34, 34);" =
class=3D"">&nbsp;</span></i><o:p class=3D""></o:p></div><div =
style=3D"margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: =
'Times New Roman', serif;" class=3D""><i class=3D""><span =
style=3D"font-size: 9pt; font-family: 'PT Serif', serif; color: rgb(34, =
34, 34);" class=3D"">Capability Layer: Defines an abstraction layer that =
exposes a set of capabilities of the I2NSF system.</span></i><o:p =
class=3D""></o:p></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">&nbsp;<o:p class=3D""></o:p></div><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">I2NSF Charter:<o:p class=3D""></o:p></div><p =
class=3D"MsoNormal" style=3D"margin: 0in 0in 6.3pt 0.5in; font-size: =
12pt; font-family: 'Times New Roman', serif;"><i class=3D""><span =
style=3D"font-size: 9pt; font-family: 'PT Serif', serif; color: rgb(34, =
34, 34);" class=3D"">I2NSF will specify interfaces at two functional =
levels for the control and monitoring of network security =
functions:</span></i><o:p class=3D""></o:p></p><p class=3D"MsoNormal" =
style=3D"margin: 0in 0in 6.3pt 0.5in; font-size: 12pt; font-family: =
'Times New Roman', serif;"><i class=3D""><span style=3D"font-size: 9pt; =
font-family: 'PT Serif', serif; color: rgb(34, 34, 34);" class=3D"">The =
I2NSF Capability Layer specifies how to control and monitor NSFs at a =
functional implementation level. The term "Functional Implementation" is =
used to emphasize that the rules (for control and monitor) of NSFs have =
to be implementable by most NSFs. I2NSF will standardize a set of =
interfaces by which a security controller can invoke, operate, and =
monitor NSFs.<br class=3D""><br class=3D"">The I2NSF Service Layer =
defines how clients' security policies may be expressed to a security =
controller. The controller implements its policies according to the =
various capabilities provided by the I2NSF Capability Layer. The I2NSF =
Service Layer also allows the client to monitor the client specific =
policies.</span></i><o:p class=3D""></o:p></p><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">&nbsp;<o:p class=3D""></o:p></div><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">If we use the definitions by the =
=E2=80=9Cdraft-ietf-i2nsf-terminology-00=E2=80=9D, we should create a =
different terminology to represent the =E2=80=9CSouth bound Interface=E2=80=
=9D between Controller and NSF.<o:p class=3D""></o:p></div><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D"">&nbsp;<o:p class=3D""></o:p></div><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D"">Thanks, Linda<o:p =
class=3D""></o:p></div><div style=3D"margin: 0in 0in 0.0001pt; =
font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">&nbsp;<o:p class=3D""></o:p></div><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">&nbsp;<o:p class=3D""></o:p></div></div></div></div><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D""><br class=3D""><br clear=3D"all" =
class=3D""><br class=3D"">--<span =
class=3D"Apple-converted-space">&nbsp;</span><o:p =
class=3D""></o:p></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times =
New Roman', serif;" class=3D"">regards,<o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in =
0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" =
class=3D"">John</div></div></div></div></div></div></blockquote></div><br =
class=3D""><div apple-content-edited=3D"true" class=3D"">
<div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; orphans: =
auto; text-align: start; text-indent: 0px; text-transform: none; =
white-space: normal; widows: auto; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D"">--<br class=3D"">"Esta vez no fallaremos, Doctor Infierno"<br =
class=3D""><br class=3D"">Dr Diego R. Lopez<br class=3D"">Telefonica =
I+D<br class=3D""><a href=3D"http://people.tid.es/diego.lopez/" =
class=3D"">http://people.tid.es/diego.lopez/</a><br class=3D""><br =
class=3D"">e-mail: [email-masked]<br class=3D"">Tel: =
&nbsp; &nbsp;+34 913 129 041<br class=3D"">Mobile: +34 682 051 091<br =
class=3D"">----------------------------------</div>

</div>
<br class=3D""></div></body></html>=

--Apple-Mail=_1EFF15CC-95EA-4A35-8535-3E217B94E3CA--

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Sat, 18 Jun 2016 12:55:01 +0000

Hi Linda,

As I said in a previous message, I don’t see the difference in the meaning, and probably the apparent conflict could be solved by incorporating part of the charter text into the definition in the terminology draft:

Capability Layer: Defines an abstraction layer that exposes a set of capabilities of the I2NSF system. Through this layer it is possible to control and monitor NSFs at a functional implementation level.

Does it sounds better to you?

Be goode,

On 15 Jun 2016, at 17:40 , Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:

Dear Authors:

I2NSF Charter:

Thanks, Linda

Dr Diego R. Lopez
Telefonica I+D

---

From: Linda Dunbar <[email-masked]>
Date: Sat, 18 Jun 2016 16:23:26 +0000

John,

I see your point now.

Is my following understanding correct?

Controller’s North Bound Interface and the South Bound Interface are referring to the Controller’s physical interfaces, whereas the “Capability Layer” is about the functions that NSF can perform.

Yes, it would be helpful to add those explanation to the Terminology draft.

Does the “Service Layer” in the Terminology draft means a “software, like a management system or controller”?

Service Layer: Software that enables clients to manage security
policies for their specific flows. This is also called the
Client-Facing Interface.

Thanks, Linda

HI Linda,

best regards,
John

I2NSF Charter:

Thanks, Linda

--
regards,
John

---

From: Linda Dunbar <[email-masked]>
Date: Sat, 18 Jun 2016 16:33:39 +0000

Rajasekhar,

Your explanation of "abstraction layer" makes great sense. Thank  you.

Your implementation sounds quite interesting. Is it possible for you to write a high level description and share with the group?

Thanks, Linda

From: Ganduri, Rajasekhar [mailto:[email-masked]]
Sent: Friday, June 17, 2016 10:08 AM
To: Linda Dunbar; John Strassner
Cc: [email-masked]; DIEGO LOPEZ GARCIA ([email-masked]); Susan Hares
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hey,

Thanks  and Regards,

Rajasekhar

________________________________
From: Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Sent: Friday, June 17, 2016 4:10 AM
To: John Strassner
Cc: [email-masked]<mailto:[email-masked]>; DIEGO LOPEZ GARCIA ([email-masked]<mailto:[email-masked]>); Susan Hares
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

John,

I picture a "Controller" having two ports,

-        one port connecting to clients (which can be another domain controller or Overlay network controller), interface from this port is "Service layer interface"

-        another port connecting to NSFs, the interface from this port is "capability layer interface".

What extra meaning does it carry with the wording "abstraction Layer" ?

Thank you.

Linda

Cc: Susan Hares; DIEGO LOPEZ GARCIA ([email-masked]<mailto:[email-masked]>); [email-masked]<mailto:[email-masked]>

HI Linda,

best regards,

John

Dear Authors:

I2NSF Charter:

Thanks, Linda

--

regards,

John

---

From: John Strassner <[email-masked]>
Date: Sun, 19 Jun 2016 14:01:37 +0900

Hi Linda,

>  one port connecting to clients ..., interface from this port is “Service
layer interface”

> another port connecting to NSFs, the interface from this port is
“capability layer interface”.

I think this could be a bit ambiguous.

When I think of "southbound interface", I think of a programming interface.
The Capability Layer Interface is not a pure programming interface; rather,
it is an interface that advertises the set of functions available. It does
not define how to program those functions.

> What extra meaning does it carry with the wording “abstraction Layer” ?

from my last note, I posited that we did not have an abstraction **layer**
- indeed, I'm not sure I know what that means. Rather, we have a **set of
abstractions** (which are, of course, the capabilities, which represent a
(sub)set of all possible features in the NSFs in a vendor-neutral way).

Here is the text of the last note; Diego and Dacheng liked the second of my
proposed definitions.

On 16 Jun 2016, at 15:05 , John Strassner <[email-masked]> wrote:

Hi Dacheng,

I agree that "I2NSF system" is not well defined. Your definition is better,
but it should apply for all NSFs (not 'the NSF'). In addition, the
Capability Layer is not an abstraction *layer*, it a simply a collection of
abstractions (the capabilities). So how about:

*    Capability Layer:  Defines the set of capabilities available to the
Controller for the set of NSFs that the Controller manages.*

or

*    Capability Layer:  Defines the set of features available to the
Controller for the set of NSFs that the Controller manages.*

On Fri, Jun 17, 2016 at 6:10 PM, Linda Dunbar <[email-masked]>
wrote:

> -        one port connecting to clients (which can be another domain
> controller or Overlay network controller), interface from this port is
> “Service layer interface”
>
> So I thought that the Service Layer interface is the North Bound interface
> to the Controller, the capability interface is the south bound to the
> controller.
>
>
>
> {features that are available from a managed entity} of the I2NSF system.*
>
> Thank you.
>
>
>
> Linda
>
>
>
> *From:* John Strassner [mailto:[email-masked]]
> *Sent:* Thursday, June 16, 2016 12:58 AM
> *To:* Linda Dunbar; John Strassner
> *Cc:* Susan Hares; DIEGO LOPEZ GARCIA ([email-masked]);
> [email-masked]
> *Subject:* Re: questions about some terminologies defined by
> {features that are available from a managed entity} of the I2NSF system.*
>
>
>
> When I look at the Charter's Capability Layer, I think we're still OK -
> the Charter "...specifies how to control and monitor NSFs at a functional

-- 
regards,
John

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 20 Jun 2016 01:45:11 +0000

Hi John,
My comments inline:

发件人: I2nsf [mailto:[email-masked]] 代表 John Strassner
发送时间: 2016年6月19日 13:02
收件人: Linda Dunbar; John Strassner
抄送: [email-masked]; Dacheng Zhang; DIEGO LOPEZ GARCIA ([email-masked]); Susan Hares
主题: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi Linda,

these are two different questions:

>  one port connecting to clients ..., interface from this port is “Service layer interface”
> another port connecting to NSFs, the interface from this port is “capability layer interface”.

When I think of "southbound interface", I think of a programming interface. The Capability Layer Interface is not a pure programming interface; rather, it is an interface that advertises the set of functions available. It does not define how to program those functions.
[Frank]: About the programming interface, I think the capability interface does have this ability. The capability interface can program what security capabilities should be enabled and how they are used by “Event-Condition-Action” (ECA) modeling. In summary, we try to acquire a balance between making the controller to have the largest and most fine-grain control over NSFs and hiding the implementation details that cannot be standardized.

> What extra meaning does it carry with the wording “abstraction Layer” ?

from my last note, I posited that we did not have an abstraction **layer** - indeed, I'm not sure I know what that means. Rather, we have a **set of abstractions** (which are, of course, the capabilities, which represent a (sub)set of all possible features in the NSFs in a vendor-neutral way).

Here is the text of the last note; Diego and Dacheng liked the second of my proposed definitions.
[Frank]: For the following definitions, I personally think the first definition is more consistent, but I don’t oppose the second one if most of us think it’s better.

On 16 Jun 2016, at 15:05 , John Strassner <[email-masked]<mailto:[email-masked]>> wrote:

Hi Dacheng,

I agree that "I2NSF system" is not well defined. Your definition is better, but it should apply for all NSFs (not 'the NSF'). In addition, the Capability Layer is not an abstraction layer, it a simply a collection of abstractions (the capabilities). So how about:

    Capability Layer:  Defines the set of capabilities available to the Controller for the set of NSFs that the Controller manages.

or

    Capability Layer:  Defines the set of features available to the Controller for the set of NSFs that the Controller manages.

On Fri, Jun 17, 2016 at 6:10 PM, Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:
John,

Linda

From: John Strassner [mailto:[email-masked]<mailto:[email-masked]>]

HI Linda,

best regards,
John

I2NSF Charter:

Thanks, Linda

--
regards,
John

--
regards,
John

---

From: John Strassner <[email-masked]>
Date: Mon, 20 Jun 2016 12:17:42 +0900

Hi Rajasekhar,

please see my last reply to Linda.

For me, I don't think that an abstraction **layer** makes sense. A layer
should be used to abstract a common set of functionality - otherwise, you
have a set of abstractions of different functions that mean different
things.

best regards,
John

On Sat, Jun 18, 2016 at 12:07 AM, Ganduri, Rajasekhar <
[email-masked]> wrote:

> Hey,
>
>
> I am a novice in I2NSF IETF group and its capabilities but I am a regular
> follower of the current activities of I2NSF. According to my understanding,
> the term "abstraction layer" is used to specify that the end user/client
> need not have the complete visibility of the working or implementation of
> how the I2NSF controller communicates with the NSFs. This is what
> interested me in I2NSF, as this opens up to a new set of end users who need
> not have complete understanding of how a network operates. I implemented
> this in my research, where a web application tool is built that can be used
> by "any" end user to give simple natural language inputs through Interface1
> (Service Layer) to the controller (or Openstack Cloud controller in my
> case) and the controller translates and transfers the security commands to
> the IDS and firewalls through Interface2(Capability layer). The way in
> which the controller transfers to the NSFs is hidden from the end user (or
> the end user need not know, details being hidden or abstracted) but the end
> user will have the authority over Interface2 in his/her own network.
>
> ------------------------------
> *From:* Linda Dunbar <[email-masked]>
> *Sent:* Friday, June 17, 2016 4:10 AM
> *To:* John Strassner
> *Cc:* [email-masked]; DIEGO LOPEZ GARCIA ([email-masked]);
> Susan Hares
> *Subject:* Re: [I2nsf] questions about some terminologies defined by

-- 
regards,
John

---

From: John Strassner <[email-masked]>
Date: Mon, 20 Jun 2016 14:21:40 +0900

HI Frank,

[Frank]: About the programming interface, I think the capability interface
does have this ability. The capability interface can program what security
capabilities should be enabled and how they are used by
“Event-Condition-Action” (ECA) modeling. In summary, we try to acquire a
balance between making the controller to have the largest and most
fine-grain control over NSFs and hiding the implementation details that
cannot be standardized.
<jcs>
I disagree.
Capabilities represent functions that are advertised to another entity.
They connote: "here is what I can do". A Capability could be a simple set
of keywords. In contrast, a programming interface is explicitly designed
for programming. Keywords would not constitute a programming interface.
</jcs>

regards,
John

On Mon, Jun 20, 2016 at 10:45 AM, Xialiang (Frank) <
[email-masked]> wrote:

> Hi John,
>
> My comments inline:
>
>
>
> *发件人:* I2nsf [mailto:[email-masked]] *代表 *John Strassner
> *发送时间:* 2016年6月19日 13:02
> *收件人:* Linda Dunbar; John Strassner
> *抄送:* [email-masked]; Dacheng Zhang; DIEGO LOPEZ GARCIA (
> [email-masked]); Susan Hares
> *主题:* Re: [I2nsf] questions about some terminologies defined by
> When I think of "southbound interface", I think of a programming
> interface. The Capability Layer Interface is not a pure programming
> interface; rather, it is an interface that advertises the set of functions
> available. It does not define how to program those functions.
>
> [Frank]: About the programming interface, I think the capability interface
> does have this ability. The capability interface can program what security
> capabilities should be enabled and how they are used by
> “Event-Condition-Action” (ECA) modeling. In summary, we try to acquire a
> balance between making the controller to have the largest and most
> fine-grain control over NSFs and hiding the implementation details that
> cannot be standardized.
>
>
>
> [Frank]: For the following definitions, I personally think the first
> definition is more consistent, but I don’t oppose the second one if most of
> us think it’s better.
>
>
>
>
>
> I agree that "I2NSF system" is not well defined. Your definition is
> better, but it should apply for all NSFs (not 'the NSF'). In addition, the
> Capability Layer is not an abstraction *layer*, it a simply a collection
> of abstractions (the capabilities). So how about:
>
>
>

-- 
regards,
John

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 20 Jun 2016 08:26:30 +0000

John,

Do you mean that “Capability Layer” can be used over the “North Bound Interface” of the Controller and the “Source Bound Interface” of the Controller?

Thanks, Linda

From: John Strassner [mailto:[email-masked]]
Sent: Monday, June 20, 2016 12:22 AM
To: Xialiang (Frank)
Cc: Linda Dunbar; [email-masked]; Dacheng Zhang; DIEGO LOPEZ GARCIA ([email-masked]); Susan Hares
Subject: Re: 答复: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

HI Frank,

When I think of "southbound interface", I think of a programming interface. The Capability Layer Interface is not a pure programming interface; rather, it is an interface that advertises the set of functions available. It does not define how to program those functions.
[Frank]: About the programming interface, I think the capability interface does have this ability. The capability interface can program what security capabilities should be enabled and how they are used by “Event-Condition-Action” (ECA) modeling. In summary, we try to acquire a balance between making the controller to have the largest and most fine-grain control over NSFs and hiding the implementation details that cannot be standardized.
<jcs>
I disagree.
Capabilities represent functions that are advertised to another entity. They connote: "here is what I can do". A Capability could be a simple set of keywords. In contrast, a programming interface is explicitly designed for programming. Keywords would not constitute a programming interface.
</jcs>

regards,
John

On Mon, Jun 20, 2016 at 10:45 AM, Xialiang (Frank) <[email-masked]<mailto:[email-masked]>> wrote:
Hi John,
My comments inline:

发件人: I2nsf [mailto:[email-masked]<mailto:[email-masked]>] 代表 John Strassner
发送时间: 2016年6月19日 13:02
收件人: Linda Dunbar; John Strassner
抄送: [email-masked]<mailto:[email-masked]>; Dacheng Zhang; DIEGO LOPEZ GARCIA ([email-masked]<mailto:[email-masked]>); Susan Hares
主题: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi Linda,

Hi Dacheng,

or

Linda

HI Linda,

best regards,
John

I2NSF Charter:

Thanks, Linda

--
regards,
John

--
regards,
John

--
regards,
John

---

From: "Ganduri, Rajasekhar" <[email-masked]>
Date: Mon, 20 Jun 2016 13:58:56 +0000

Hi John,

Thanks for the note about the capability layer. I understand your point and I feel that abstraction may be more precise than abstraction layer. In your second definition of "Capability Layer", what can be the "set of features available to the Controller", for eg., in IDS or Firewall. I visualized the capability interface as the commanding interface which gives a set of instructions to the NSFs on what to do and receives feedback from the NSFs once the set of instructions are implemented.

Regards,

Rajasekhar

________________________________
From: John Strassner <[email-masked]>
Sent: Sunday, June 19, 2016 10:17:42 PM
To: Ganduri, Rajasekhar
Cc: Linda Dunbar; [email-masked]; DIEGO LOPEZ GARCIA ([email-masked]); Susan Hares
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi Rajasekhar,

For me, I don't think that an abstraction **layer** makes sense. A layer should be used to abstract a common set of functionality - otherwise, you have a set of abstractions of different functions that mean different things.

best regards,
John

On Sat, Jun 18, 2016 at 12:07 AM, Ganduri, Rajasekhar <[email-masked]<mailto:[email-masked]>> wrote:

Hey,

Thanks  and Regards,

Rajasekhar

John,

Thank you.

Linda

HI Linda,

best regards,

John

Dear Authors:

I2NSF Charter:

Thanks, Linda

--

regards,

John

--
regards,
John

---

From: John Strassner <[email-masked]>
Date: Tue, 21 Jun 2016 03:31:51 +0900

Hi Rajasekhar,

the Capability Interface is used to announce the set of functions that are
available. We haven't specified further details yet, though I assume that
such functions would be limited to a common administrative domain. In that
sense, Firewall, Anti-Virus, IDP, and others would be available.

However, I do not think that the Capability Interface should be overloaded
and turned into a programming interface. Precedence exists in, for example,
OMA and other systems, where there are separate capability and programming
interfaces. We should do the same in I2NSF.

best regards,
John

On Mon, Jun 20, 2016 at 10:58 PM, Ganduri, Rajasekhar <
[email-masked]> wrote:

> Hi John,
>
>
> Thanks for the note about the capability layer. I understand your point
> and I feel that abstraction may be more precise than abstraction layer. In
> your second definition of "Capability Layer", what can be the "set of
> features available to the Controller", for eg., in IDS or Firewall. I
> visualized the capability interface as the commanding interface which gives
> a set of instructions to the NSFs on what to do and receives feedback from
> the NSFs once the set of instructions are implemented.
>
>
> Regards,
>
> Rajasekhar
> *From:* John Strassner <[email-masked]>
> *Sent:* Sunday, June 19, 2016 10:17:42 PM
> *To:* Ganduri, Rajasekhar
> *Cc:* Linda Dunbar; [email-masked]; DIEGO LOPEZ GARCIA (
>> So I thought that the Service Layer interface is the North Bound
>> interface to the Controller, the capability interface is the south bound to
>> the controller.
>>
>>
>>
>> I don't see the conflict in the two definitions. If I substitute the
>> *The I2NSF Capability Layer specifies how to control and monitor NSFs at
>> a functional implementation level. The term "Functional Implementation" is

-- 
regards,
John

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Mon, 20 Jun 2016 18:50:06 +0000

+1

Let's foster different APIs derived from (or relying on) the capability interface. That would the support of different use cases and help create diversity, so scarce in these days of one-OpenStack-fits-all...

--
Likely to be brief and not very
elaborate as sent from my mobile
Diego R. Lopez
Telefonica I+D

On 20 Jun 2016, at 20:32, John Strassner <[email-masked]<mailto:[email-masked]>> wrote:

Hi Rajasekhar,

the Capability Interface is used to announce the set of functions that are available. We haven't specified further details yet, though I assume that such functions would be limited to a common administrative domain. In that sense, Firewall, Anti-Virus, IDP, and others would be available.

However, I do not think that the Capability Interface should be overloaded and turned into a programming interface. Precedence exists in, for example, OMA and other systems, where there are separate capability and programming interfaces. We should do the same in I2NSF.

best regards,
John

On Mon, Jun 20, 2016 at 10:58 PM, Ganduri, Rajasekhar <[email-masked]<mailto:[email-masked]>> wrote:

Hi John,

Regards,

Rajasekhar

________________________________
From: John Strassner <[email-masked]<mailto:[email-masked]>>
Sent: Sunday, June 19, 2016 10:17:42 PM
To: Ganduri, Rajasekhar
Cc: Linda Dunbar; [email-masked]<mailto:[email-masked]>; DIEGO LOPEZ GARCIA ([email-masked]<mailto:[email-masked]>); Susan Hares
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi Rajasekhar,

best regards,
John

Hey,

Thanks  and Regards,

Rajasekhar

John,

Thank you.

Linda

HI Linda,

best regards,

John

Dear Authors:

I2NSF Charter:

Thanks, Linda

--

regards,

John

--
regards,
John

--
regards,
John