Subject: [OPSAWG] VPN4DC work will move forward in L3VPN

From: "So, Ning" <[email-masked]>
Date: Tue, 4 Oct 2011 17:03:10 -0400

Just want to let you know that Routing Area ADs have instructed VPN4DC work previously held in this WG to progress through L3VPN WG.  Please join L3VPN WG mail list for discussions and draft updates if you are interested in the work.  The scope of work has been significantly narrowed.  I have posted the new scope in L3VPN already, so please pardon me if you have seen the information below already.

The purpose of VPN4DC is to define requirements and solutions for hosts and applications in Data Centers to automatically join or leave an IP VPN which interconnects multiple customer premises and data centers.

Today when two or more data centers are inter-connected through VPNs or any WAN networks, hosts or VMs within data centers are managed separately from the VPN provider's management system.  The provisioning process for services provided by Service Providers' data centers to join enterprise VPNs, is often manual, and thus has long turn up time. Security, scalability, and operational efficiency are issues due to lack of standardized automation procedure for hosts in provider data centers to join VPN.

Modern data-centers require multi-tenant support for applications. For security and administrative reasons it is desirable to isolate the resources associated with a particular tenant in a VPN. VPN4DC will define requirements and protocol solutions to enable hosts in a data center to join a specific layer 3 VPN automatically through control protocols, using IP VPN to provide secure any to any connections. The VPN Gateway function which provides seamless VPN connectivity between the segments of the networks will be defined.

There are two ways for hosts/applications within a data center to join a specific VPN which interconnect multiple sites: via Management plane or via in-band data plane.

1.            Management Plane: i.e. having the wide area VPN's management system communicate with data center management system to allow a group of hosts or applications to join a specific VPN.

If the two management systems can communicate directly to allow a group of VMs in a Data Center to join a VPN, then the automation can be achieved without any new protocol work for IETF.

2.            In-band data plane: However, several service providers have indicated that their VPN management system can't communicate with Data Center management system automatically. They want the automation to go through in-band signal between DC gateway and VPN PEs. Then new protocol work is needed for IETF: like request to join (or leave), authentication, etc.

The design principle for the protocols and solution development is to leverage existing layer 3 VPN technologies already defined in IETF whenever possible, including various IP and MPLS VPN technologies. This work supports the creation of new protocols, extension to existing protocols, and solutions proposed to use new and existing protocols.

Best regards,

Ning So
Verizon Corporate Technology
(office) 972-729-7905
(Cell) 972-955-0914