Subject: [I2nsf] minutes of I2NSF Interim meeting to reach consensus on I2NSF charter and clarify the problem space

From: Linda Dunbar <[email-masked]>
Date: Tue, 26 May 2015 22:46:05 +0000

Time: May 26, 2015; 2:30pm - 3:30pm  EST
Participants:
Charif Mahamoudi; Dan Romascanu; Daniel Migault; Ed Lopez; Joe Salowey; Kathleen Moriaty; Myo Zarny; Susan Hares; Linda Dunbar;
Highlight of the discussion:
Problem space discussion:
We went through the bullets listed under the I2NSF problem space. Made clarification on "Profiles" associated with NSFs, and shuffled some issues among the categories. Here is the refined I2NSF problem space (which will be incorporated into the next revision of the I2NSF problem statement)
Challenges Facing Security Service Providers:

-   Diverse types of Security Functions
         No Standard Characterization of NSFs

-   Diverse Interfaces to Control NSFs

-   Diverse Interface to monitor the behavior of NSFs

-   More Distributed NSFs and vNSFs

-   Demand to Control NSFs Dynamically

-   Demand for multi-tenancy of the interfaces to control and monitor NSFs.

Service providers may well require having several operational units to make this control and monitoring, especially when they become distributed and virtualized

-   Lack of Standard Interface for Capability Exchange (between controller and NSFs

-   Lack of Standard Interface to reference external profiles to NSF (e.g. Signatures needed by IPS/IDS, BlackList DB by WebFilter)

o   Different policies might need different Signatures

·       Grouping Signatures for different policies

o   Open Source provided signatures/profiles (e.g. by Snort, others),

o   Focus on the envelop of the format, allow vendors to exchange

      Challenges Facing Customers:

-   Need consistent integration of NSFs over heterogeneous administrative domains

-   Today's Policy Expressions are Vendors Specific

-   Difficulty to Monitor the Execution of Desired Policies

o   Difficulty to Validate Policies across Multiple Domains

I2NSF Charter Discussion:
We discussed the distinction between Configuration and Policy Provisioning. It is emphasized that Configuration is more like the bootstrap for getting NSFs started (like addresses, ports, etc); the Policy Provisioning is for dictating the running behavior. We used the definition from draft-lopez-i2nsf-packet-00:

-   Configuration - deals with the management and configuration of the NSF device itself.

-   Signaling - which represents logging and query functions between the NSF and external systems.

-   Provisioning - used to control the security functions of NSFs.
It is agreed that "capability or resource negotiation" will be added to the draft.
We agreed to elaborate on the "Policies" used by I2NSF in the charter because "Policy" can mean so many different things. I2NSF is not talking about interpretation of policy: e.g. can't make changes out of maintenance window. I2NSF only focuses on the polices that NSFs can implement. Add a description on what kind of policies  are in the scope of I2NSF (Charter).
Is "allowing 3rd party signature/profile" within the configuration domain?
Network Security Function (NSF): functions to ensure integrity, confidentiality and availability of network communications, to detect unwanted activity, and to block it or at least mitigate its effects on the network.

Conflicts to avoid: SACM, SAAS, nfvrg, I2RS, IDR, SDNrg, TRILL, LMAP, XRBLOCK, SUPA, SFC, NVO3

Proper Agenda for the BOF

-          Introduction of I2NSF BOF (Chairs, 10 min)

-          Use cases - Diego (10 min)

-          Problem Space (10 min)

-          Gap analysis -(Potential technologies): Bob Moskowitz/DaChen/Hosnieh Rafiee

o   Is it within IETF scope & expertise? (why not OpenStack, security alliance

§  What specific value IETF can provide

o   Why this WG?

§  Why not done at SACM, I2RS, NETCONF, NETMOD, SFC, ANIMA, PCP...?

-          Potential solutions:

o   Packet-Based Paradigm For Interfaces To NSFs - Ed Lopez

o   Capability layer interface Information Model - Frank Xia

o

-          Charter (30 min)
Hard questions (30 min) (Do people feel like they have sufficient information to answer the following questions?  or is it premature to even ask the questions?)

-          Does the community think that the problem statement is clear, well-scoped, solvable, and useful to solve?

-          Who would be willing to contribute? Writing drafts or source code (e.g. create a branch at IETF Hackathon)?

-          Can I see a show of hands of folk willing to review documents (or comment on the mailing list)

-          Is there support to form a WG with the proposed charter?

o   Does the community think that given the charter revisions discussed during the BOF (subject to review and finalization on the mailing list), a WG should be formed?

-          How many people feel that a WG should not be formed?

Thanks, Linda Dunbar