Subject: [L3sm] Additional Issues---site's parameter relation with specific vpn

From: "Aijun Wang" <[email-masked]>
Date: Thu, 25 Feb 2016 10:34:25 +0800

Hi, L3SMer:

With the discussion about the current L3VPN yang model, we found there is
another additional issue needed to be solved. This issue will influence the
design of L3SM Yang structure as well.

Issue description: In current L3VPN yang model, we define the site's various
parameters via several container,

such as "location",
"site-diversity","management","vpn-policy","maximum-routes","security","serv
ice","routing-protocol","site-network-accesses" etc. For these containers,
only the "location" is determined and has no relation with the specific vpn
id, other containers are all related with the specific vpn id.

That is to say, if the vpn is different, the
"site-diversity","management","vpn-policy","maximum-routes","security","serv
ice","routing-protocol","site-network-accesses" container will have
different values, but in current Yang model, only the "vpn-policy" has
relationship with the vpn-id.

Solution proposal: Put the site definition or reference within the list
"vpn-svc", please see
https://mailarchive.ietf.org/arch/msg/l3sm/lB4HbUVczwyygAScPeh4tV0EBRo

So, what your consideration for this issue and solution proposal?

Best Regards.

Aijun Wang

China Telecom Corporation Limited Beijing Research Institute 

Network Research and Operation Support Department

---

From: <[email-masked]>
Date: Thu, 25 Feb 2016 08:23:38 +0000

Hi,

Inline comments

From: L3sm [mailto:[email-masked]] On Behalf Of Aijun Wang
Sent: Thursday, February 25, 2016 03:34
To: [email-masked]
Subject: [L3sm] Additional Issues---site's parameter relation with specific vpn

Hi, L3SMer:

With the discussion about the current L3VPN yang model, we found there is another additional issue needed to be solved. This issue will influence the design of L3SM Yang structure as well.

Issue description: In current L3VPN yang model, we define the site's various parameters via several container,
such as "location", "site-diversity","management","vpn-policy","maximum-routes","security","service","routing-protocol","site-network-accesses" etc. For these containers, only the "location" is determined and has no relation with the specific vpn id, other containers are all related with the specific vpn id.
That is to say, if the vpn is different, the "site-diversity","management","vpn-policy","maximum-routes","security","service","routing-protocol","site-network-accesses" container will have different values, but in current Yang model, only the "vpn-policy" has relationship with the vpn-id.
[SLI] I cannot agree, a multiVPN scenario strongly requires that each "VPN attachment" as the same parameter this is by design because all the "VPN attachments" are using the same logical access. Only the vpn-policy plays with the VPN attachment. I think you are confusing with subVPN where you have a logical access per VPN with potential different parameters but this is a different subject that is also under discussion.

Solution proposal: Put the site definition or reference within the list "vpn-svc", please see https://mailarchive.ietf.org/arch/msg/l3sm/lB4HbUVczwyygAScPeh4tV0EBRo

Best Regards.

Aijun Wang

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: "Aijun Wang" <[email-masked]>
Date: Thu, 25 Feb 2016 16:40:01 +0800

Hi,

What we are discussing here is when one site belong to multiple vpn, will
the various site's attribute will be different or definitely same. For
example, one site may be hub-role in one vpn, but may be spoke-role in
another vpn, and the attributes
"site-diversity","management","vpn-policy","maximum-routes","security","serv
ice","routing-protocol","site-network-accesses" will be different for
hub/spoke site.  

Ogaki raised the similar issue for "site-network-accesses", please refer the
thread
https://mailarchive.ietf.org/arch/msg/l3sm/86TbWo1FUsKbzq9uocIv4Oh_vfw and
the following exchange mail.

How do you solve this issue within the current Yang model?

From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, February 25, 2016 4:24 PM
To: Aijun Wang; [email-masked]
Subject: RE: [L3sm] Additional Issues---site's parameter relation with
specific vpn

Hi,

Inline comments

From: L3sm [mailto:[email-masked]] On Behalf Of Aijun Wang
Sent: Thursday, February 25, 2016 03:34
To: [email-masked]
Subject: [L3sm] Additional Issues---site's parameter relation with specific
vpn

Hi, L3SMer:

such as "location",

[SLI] I cannot agree, a multiVPN scenario strongly requires that each "VPN
attachment" as the same parameter this is by design because all the "VPN
attachments" are using the same logical access. Only the vpn-policy plays
with the VPN attachment. I think you are confusing with subVPN where you
have a logical access per VPN with potential different parameters but this
is a different subject that is also under discussion. 

Best Regards.

Aijun Wang

____________________________________________________________________________
_____________________________________________
 
Ce message et ses pieces jointes peuvent contenir des informations
confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu
ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages
electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou
falsifie. Merci.
 
This message and its attachments may contain confidential or privileged
information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and
delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been
modified, changed or falsified.
Thank you.

---

From: <[email-masked]>
Date: Thu, 25 Feb 2016 10:23:10 +0000

Your statement is not true, in multiVPN, you have a single logical access. The role per VPN is defined in vpn-policy and it works fine.

From: L3sm [mailto:[email-masked]] On Behalf Of Aijun Wang
Sent: Thursday, February 25, 2016 09:40
To: LITKOWSKI Stephane SCE/OINIS; [email-masked]
Cc: 'Ogaki, Kenichi'
Subject: Re: [L3sm] Additional Issues---site's parameter relation with specific vpn

Hi,

What we are discussing here is when one site belong to multiple vpn, will the various site's attribute will be different or definitely same. For example, one site may be hub-role in one vpn, but may be spoke-role in another vpn, and the attributes "site-diversity","management","vpn-policy","maximum-routes","security","service","routing-protocol","site-network-accesses" will be different for hub/spoke site.
Ogaki raised the similar issue for "site-network-accesses", please refer the thread https://mailarchive.ietf.org/arch/msg/l3sm/86TbWo1FUsKbzq9uocIv4Oh_vfw and the following exchange mail.

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: Thursday, February 25, 2016 4:24 PM
To: Aijun Wang; [email-masked]<mailto:[email-masked]>
Subject: RE: [L3sm] Additional Issues---site's parameter relation with specific vpn

Hi,

Inline comments

From: L3sm [mailto:[email-masked]] On Behalf Of Aijun Wang
Sent: Thursday, February 25, 2016 03:34
To: [email-masked]<mailto:[email-masked]>
Subject: [L3sm] Additional Issues---site's parameter relation with specific vpn

Hi, L3SMer:

Best Regards.

Aijun Wang

Thank you.

---

From: "Aijun Wang" <[email-masked]>
Date: Thu, 25 Feb 2016 21:07:20 +0800

I discussed not only the role of the site.

From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, February 25, 2016 6:23 PM
To: Aijun Wang; [email-masked]
Cc: 'Ogaki, Kenichi'
Subject: RE: [L3sm] Additional Issues---site's parameter relation with
specific vpn

Your statement is not true, in multiVPN, you have a single logical access.
The role per VPN is defined in vpn-policy and it works fine.

From: L3sm [mailto:[email-masked]] On Behalf Of Aijun Wang
Sent: Thursday, February 25, 2016 09:40
To: LITKOWSKI Stephane SCE/OINIS; [email-masked]
Cc: 'Ogaki, Kenichi'
Subject: Re: [L3sm] Additional Issues---site's parameter relation with
specific vpn

Hi,

 

Hi,

Inline comments

Hi, L3SMer:

such as "location",

 

Best Regards.

Aijun Wang