Subject: [I2nsf] Any use cases of Overlay network requesting IPSec connection from the Underlay for a specific time span? (was : Flow Security Policies exchanged over I2NSF service layer interface?

From: Linda Dunbar <[email-masked]>
Date: Tue, 14 Jun 2016 21:02:57 +0000

Christian,

Your feedback seems to suggest that Overlay network Controller may send request to the underlay network controller requesting IPsec connections among overlay nodes. Do I understand you correctly?

Are there any use cases of overlay network needing IPSec among their nodes only for a specific time span? i.e. Time based IPSec connection?

Linda

From: [email-masked] [mailto:[email-masked]]
Sent: Monday, June 13, 2016 11:23 AM
To: Linda Dunbar; BOUCADAIR Mohamed IMT/OLN
Subject: RE: Any feedback on the Protocol Independent Flow Security Policies exchanged over I2NSF service layer interface?

[snip]

Very often, the paths (or links) among nodes of a overlay network are provided by other network operators (a.k.a. "underlay network").  Very much like traditional networks placing FW (Firewall) or IPS (Intrusion Prevention System) on the wire to enforce the flow security rules, I2NSF Protocol Independent Flow Security Policies can be used by overlay networks to request certain flow based security rules to be enforced by its underlay networks, to prevent the unwanted attacks traffic from occupying the physical links and ports to the overlay network nodes, and to avoid the overlay nodes' CPU/Storage/Port utilization being consumed down by the various attacks.  Here is one example of "Overlay Video Communication network" exchange Flow Policies to the Underlay network.

[CJ] The above example clearly shows the necessary interaction between the two PDPs/controllers, to make sure that decisions made by the network controller accommodate the needs of the video customer as possibly expressed towards the video controller: for example, customer demands that the confidentiality of the videoconference needs to be preserved, thereby suggesting the use of the IPsec protocol suite. The video controller may enforce an IPsec design based upon the transport mode, whereas the network controller is solicited to allocate IPsec resources (read for example no AH, ESP in NULL mode) accordingly. This may possibly raise conflicting configuration tasks (the video controller uses AH, the network controller doesn't), thereby leading to inconsistency that may jeopardize the service. Whether BGP FS is used to carry security policy information between the two controllers is hardly the point, imho: what matters is the consistency of the (flow-based security policies enforced by both parties, and which should be derived from the customer's requirements (if any).
The goal of I2NSF is to specify the common information model and data model for the  Protocol Independent Flow Security Policies which can be queried and set between domains.
[CJ] OK.

https://datatracker.ietf.org/doc/draft-fang-i2nsf-inter-cloud-ddos-mitigation-api/ is just the starting point. (needs more work to improve the clarity). We are asking if people to express their opinion on this work to the [email-masked]<mailto:[email-masked]> list.
[CJ] I need to read this draft and will get back to you accordingly, but this may take a couple of weeks as I'm pretty busy for the time being.

I'll let Med further comment as appropriate.

Cheers,

Christian.

Thanks, Linda

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc

pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler

a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,

Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;

they should not be distributed, used or copied without authorisation.

If you have received this email in error, please notify the sender and delete this message and its attachments.

As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.

Thank you.