Subject: [Ibnemo] How to group/reuse definitions

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Thu, 5 Nov 2015 18:41:29 +0900

During the IETF94 Hackaton, we got some discussion on how much
detail we want to allow or need in the Intent Language when
reusing definitions. For example, let us assume that you

- define a router
- define a firewall
- define a loadbalancer
- define a l2 switch
- etc

And that later on you want to define something like a DMZ and
inside that DMZ you want to use the defined router, firewall, l2 switch, etc.

The end-user/customer would want to just express his/her intent to have
an internet connection with a DMZ I guess.

The network administrator of the ISP (operator) needs to then express that the
DMZ consists of let us say a router, a firewall, a l2switch etc.
Do we want/need the network administrator to have to (or to be able to) specify
the details on how these nodes get connected? Or would we rather see that the
Intent Engine generates the proper connections?

I suggest that those who have proto-type implementations express their approach
and that network operators express their wants/needs for such a scenario.

Bert

---

From: Zhoutianran <[email-masked]>
Date: Mon, 9 Nov 2015 07:46:11 +0000

It's really useful to group a set of atomic components and provide the whole as a micro/template, just like the DMZ example. The hierarchy enables the reusability.
To describe a DMZ, I can see two ways.
1. One is to describe the exact connectivity among those atomic components. I think the switch and router are what we want to eliminate. It seems too detail with the intent concept. I hope they can be auto generated by the intent engine.
2. The other way I would prefer is to define DMZ as a layer 2 group, in which by default all the components are connected by a logic switch(which do not need to explicitly describe again). Or we can define DMZ as a layer 3 group with a  router. In this way, we can put any number of components in easily with fully flexibility.

That's my 2 cents.

Best,
Tianran

> -----Original Message-----
> From: Ibnemo [mailto:[email-masked]] On Behalf Of Bert Wijnen
> (IETF)
> Sent: Thursday, November 05, 2015 5:41 PM
> To: [email-masked]
> Subject: [Ibnemo] How to group/reuse definitions
> 
> During the IETF94 Hackaton, we got some discussion on how much detail we
> want to allow or need in the Intent Language when reusing definitions. For
> example, let us assume that you
> 
> - define a router
> - define a firewall
> - define a loadbalancer
> - define a l2 switch
> - etc
> 
> And that later on you want to define something like a DMZ and inside that
> DMZ you want to use the defined router, firewall, l2 switch, etc.
> 
> The network administrator of the ISP (operator) needs to then express that
> the DMZ consists of let us say a router, a firewall, a l2switch etc.
> Do we want/need the network administrator to have to (or to be able to)
> specify the details on how these nodes get connected? Or would we rather
> see that the Intent Engine generates the proper connections?
> 
> I suggest that those who have proto-type implementations express their
> approach and that network operators express their wants/needs for such a
> scenario.
> 
> Bert
> 
> _______________________________________________
> Ibnemo mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ibnemo

---

From: PEDRO ANDRES ARANDA GUTIERREZ <[email-masked]>
Date: Tue, 10 Nov 2015 06:49:02 +0000

Hi,

Answers inline… line of thought:
1. Recursion needs to be supported in a generalised way
2. there are use cases where connectivity matters

BR,/PA
---
Dr. Pedro A. Aranda Gutiérrez

Technology Exploration -
Network Innovation & Virtualisation
email: pedroa d0t aranda At telefonica d0t com
Telefónica, Investigación y Desarrollo
C/ Zurbarán,12
28010 Madrid, Spain

Fragen sind nicht da, um beantwortet zu werden.
Fragen sind da, um gestellt zu werden.
Georg Kreisler

-----Mensaje original-----
De: Ibnemo <[email-masked]> en nombre de Zhoutianran <[email-masked]>
Fecha: lunes, 9 de noviembre de 2015, 8:46
Para: "Bert Wijnen (IETF)" <[email-masked]>, "[email-masked]" <[email-masked]>
Asunto: Re: [Ibnemo] How to group/reuse definitions

>It's really useful to group a set of atomic components and provide the whole as a micro/template, just like the DMZ example. The hierarchy enables the reusability.

OK with that from the very beginning of all this discussion

>1. One is to describe the exact connectivity among those atomic components.

We need that as we climb in the hierarchy.

>I think the switch and router are what we want to eliminate. It seems too detail with the intent concept. I hope they can be auto generated by the intent engine.

It may seem too detailed if you are looking at routers, switches, etc. But once you have building blocks like DMZ, interior, exterior, etc. then suddenly you start needing expressing the connectivity. In our use case, how else would you be expressing that you have an exterior zone connected to the Internet and two DMZs, one of which serves 3 interior zones while the other serves just one interior zone. I know, I have been using _simple_ examples up until now, but believe me, things can get pretty complex out there.

>2. The other way I would prefer is to define DMZ as a layer 2 group, in which by default all the components are connected by a logic switch(which do not need to explicitly describe again). Or we can…

Again, that depends a lot on the use case. I think the ‘connectivity paradigm’ may be helpful for people doing networking. Saying that I have a connection between two elements may have a different implementation depending on the elements and their location. However, the logical interpretation of the connection (i.e. its intent) is always going to be that packets treated by one block should be sent to another.

>> approach and that network operators express their wants/needs for such a

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "zhangyali (D)" <[email-masked]>
Date: Fri, 13 Nov 2015 07:48:05 +0000

Hi Pedro,

Thanks for your reflections about recursion in NEMO, and I think it's an important feature will be implemented in the next stage.

As you have said, operators may reuse the services zone many times, we need a simple solution to satisfy this requirement. Learning from the traditional programming language, just as, C, C++, function seems a perfect solution to solve recursion problem.

Take DMZ as an example:

NodeModel DMZ(x,y,z,I,j):
	Node n1 Type fw Property x;
	Node n2 Type nat Property y;
	Node n3 Type host Property z;
	Connection c1 Type p2p Endnodes n1,n2 Property I;
	Connection c2 Type p2p Endnodes n2,n3 Property j;

With this expression, we create a new node type named DMZ, and its properties can be adjusted according to users' requirement. It can be called whenever you want to create a DMZ node, just like a function in C. For example:

CREATE Node dmz1 Type DMZ(property(dmz1-n1), property(dmz1-n2), property(dmz1-n3), property(dmz1-c1), property(dmz1-c2));
CREATE Node dmz2 Type DMZ(property(dmz2-n1), property(dmz2-n2), property(dmz2-n3), property(dmz2-c1), property(dmz2-c2));
...

In this way, users could create many DMZ zones with very refined scripts, and we don't need to express internal details again and again.

Do you think this way is a good solution to the recursion problem, and could work in many use cases? Looking forward to your suggestions.

Best Regards,
Yali
-----邮件原件-----
发件人: Ibnemo [mailto:[email-masked]] 代表 PEDRO ANDRES ARANDA GUTIERREZ
发送时间: 2015年11月10日 14:49
收件人: Zhoutianran; Bert Wijnen (IETF); [email-masked]
主题: Re: [Ibnemo] How to group/reuse definitions

Hi,

Answers inline… line of thought:
1. Recursion needs to be supported in a generalised way 2. there are use cases where connectivity matters

BR,/PA
---

Technology Exploration -
Network Innovation & Virtualisation
email: pedroa d0t aranda At telefonica d0t com Telefónica, Investigación y Desarrollo C/ Zurbarán,12
28010 Madrid, Spain

-----Mensaje original-----
De: Ibnemo <[email-masked]> en nombre de Zhoutianran <[email-masked]>
Fecha: lunes, 9 de noviembre de 2015, 8:46
Para: "Bert Wijnen (IETF)" <[email-masked]>, "[email-masked]" <[email-masked]>
Asunto: Re: [Ibnemo] How to group/reuse definitions

>> During the IETF94 Hackaton, we got some discussion on how much detail 
>> we want to allow or need in the Intent Language when reusing 
>> definitions. For example, let us assume that you
>>
>> - define a router
>> - define a firewall
>> - define a loadbalancer
>> - define a l2 switch
>> - etc
>>
>> And that later on you want to define something like a DMZ and inside 
>> that DMZ you want to use the defined router, firewall, l2 switch, etc.
>>
>> The end-user/customer would want to just express his/her intent to 
>> have an internet connection with a DMZ I guess.
>>
>> The network administrator of the ISP (operator) needs to then express 
>> that the DMZ consists of let us say a router, a firewall, a l2switch etc.
>> Do we want/need the network administrator to have to (or to be able 
>> to) specify the details on how these nodes get connected? Or would we 
>> rather see that the Intent Engine generates the proper connections?
>>
>> I suggest that those who have proto-type implementations express 
>> their approach and that network operators express their wants/needs 
>> for such a scenario.
>>
>> Bert
>>

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição _______________________________________________
Ibnemo mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ibnemo

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Wed, 18 Nov 2015 11:07:16 +0200

> CREATE Node dmz2 Type DMZ(property(dmz2-n1), property(dmz2-n2), property(dmz2-n3), property(dmz2-c1), property(dmz2-c2));
Mmmm... do I have to read this literally?
"property(dmz1-c1)" means what? Just that you want to use Connection c1 as defined
in the NodeModel??

When I read the Nodemodel, I was expecting you would specify I for the property
of connection c1. Am I misunderstanding here?

Bert

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Wed, 18 Nov 2015 11:12:38 +0200

Inline

> 1. One is to describe the exact connectivity among those atomic components. I think the switch and router are what we want to eliminate. It seems too detail with the intent concept. I hope they can…
So, does this mean that a DMZ node will ALWAYS have the same set
of components, predefined by the NEMO engine?
If so, that seems to make the NEMO engine less complex.
But it puts limits on the flexibility for the user of the NEMO language, does it not?
> 2. The other way I would prefer is to define DMZ as a layer 2 group, in which by default all the components are connected by a logic switch(which do not need to explicitly describe again). Or we ca…

So how would the user define which and how many components get put in?
Or will it be a predefined set by the NEMO Engine?

Another question that comes up in my mind: Will this always be a logical/virtual network?
How/when is the translation made to a physical network, or is that not needed?

Maybe I am just showing a not-so-good-understanding of the NEMO concepts yet.
But then I would appreciate to be eductaed some more.

Bert