Subject: Discussion of VPN4DC drafts

From: Ben Niven-Jenkins <[email-masked]>
Date: Tue, 25 Oct 2011 00:35:14 +0100

Colleagues,

A number of drafts related to the VPN4DC topic are now available in the Internet-Draft repository. The ones I could fine are listed below.

When the L3VPN session in Taipei was scheduled to discuss VPN4DC it was conditional on the basis that:

1) There needed to be viable -00 drafts before the cutoff.
2) The problem needed to be discussed prior to Taipei on the L3VPN list.

To date there has not been much discussion of VPN4DC on the L3VPN list, possibly because folks were waiting for -00 drafts to be published.

Now that a number of drafts have been published I would encourage those folks interested in the VPN4DC topic to discuss the various drafts on the L3VPN list otherwise you risk having the VPN4DC/L3VPN session in Taipei cancelled.

The VPN4DC related drafts that I could find (there may be others that I've missed) are:

VPN4DC Problem Statement
http://tools.ietf.org/html/draft-dunbar-vpn4dc-problem-statement-00

VPN4DC Problem Statement
http://tools.ietf.org/html/draft-fang-vpn4dc-problem-statement-00

L3VPN automatical interconnection for VPN4DC
http://tools.ietf.org/html/draft-jin-l3vpn-vpn4dc-interconnect-00

Requirements of Layer 3 Virtual Private Network for Data Centers
http://tools.ietf.org/html/draft-so-vpn4dc-00

L3VPN Protocol Gap Analysis for Data Centers
http://tools.ietf.org/html/draft-yong-vpn4dc-protocol-gap-analysis-00

Experiment of Example Solution for VPN4DC
http://tools.ietf.org/html/draft-zeng-vpn4dc-example-solution-00

End-system support for BGP-signaled IP/VPNs.
http://tools.ietf.org/html/draft-marques-l3vpn-end-system-02

Problem Statement for Dynamic Secure Interconnect
http://tools.ietf.org/html/draft-ko-dsi-problem-statement-00

Ben

---

From: Derick Winkworth <[email-masked]>
Date: Mon, 24 Oct 2011 17:12:39 -0700 (PDT)

All:

I think the drafts constitute a great start to addressing this gap.  

My first, perhaps superficial, observation is that much of the language is geared towards "Service-Provider."  I think in the context of VPNs for Data Centers, these drafts apply equally to multi-security zone Data Centers in non-SP networks that have multiple logically isolated network segments.  For instance, multiple DMZs, server farms, storage networks, corporate LANs, guest LANs, etc.  These could very well all be L3VPNs in an MPLS infrastructure that interconnects and extends into the various data centers of an enterprise network.  The kind of security and transparency that the infrastructure provides is adequate for the purpose of passing audits (where the alternative must be physical separation of network resources).  There is certainly more enterprise adoption of MPLS happening in the field today for this purpose.

Another applicable type of environment are "<blank>-service-providers" that provide various IP enabled applications and services to the private networks of external customers.  These environments are not classic service-providers because they do not own transport networks.  They connect to multiple carriers to have reachability to as many potential customers' private networks as possible. In this case they are extending customer's private networks into their data centers in a secure/transparent way, similar to the description in some of the drafts for VPN4DC.

I think it might be possible to generalize VPN4DC so that its inclusive of these situations. To be clear, these scenarios involve companies who are not classic "service-providers" but are running their own MPLS network with P and PE nodes and not just buying L3VPN sevices from an external provider.  Rather than framing everything in a "service-provider" or "enterprise" context, we could just frame it in general networking terms.  

I think there is a sort of Hegelian synthesis happening in the industry between service-provider and enterprise, and VPN4DC is a clear bridge between them.

Thanks.

Derick

________________________________
From: Ben Niven-Jenkins <[email-masked]>
To: L3VPN WG mailing list <[email-masked]>
Sent: Monday, October 24, 2011 6:35 PM
Subject: Discussion of VPN4DC drafts 

Colleagues,

VPN4DC Problem Statement

VPN4DC Problem Statement

Ben

---

From: Michael Ko <[email-masked]>
Date: Mon, 24 Oct 2011 21:28:30 -0700

I haver renamed "Dynamic Secure Interconnect" to "VPN As A Service" to 
better define its scope and have resubmitted the draft as "Problem Statement 
for VPN As A Service".  Here is a link to the draft: 
http://www.ietf.org/internet-drafts/draft-ko-vaas-problem-statement-00.txt

Mike

----- Original Message ----- 
From: Ben Niven-Jenkins
To: L3VPN WG mailing list
Sent: Monday, October 24, 2011 4:35 PM
Subject: Discussion of VPN4DC drafts

Colleagues,

A number of drafts related to the VPN4DC topic are now available in the 
Internet-Draft repository. The ones I could fine are listed below.

When the L3VPN session in Taipei was scheduled to discuss VPN4DC it was 
conditional on the basis that:

To date there has not been much discussion of VPN4DC on the L3VPN list, 
possibly because folks were waiting for -00 drafts to be published.

Now that a number of drafts have been published I would encourage those 
folks interested in the VPN4DC topic to discuss the various drafts on the 
L3VPN list otherwise you risk having the VPN4DC/L3VPN session in Taipei 
cancelled.

The VPN4DC related drafts that I could find (there may be others that I've 
missed) are:

VPN4DC Problem Statement

VPN4DC Problem Statement

Ben

---

From: Lucy yong <[email-masked]>
Date: Tue, 25 Oct 2011 07:20:28 +0000

Hi Derick,

Thank very much for the good comments. You are right. The first version of the  gap analysis just aims on the L3VPN in WAN.   We restricted our first draft to the topic for a clear picture of the L3VPN WAN in VPN4DC.

We did study some DC architectures and had written up a combined draft.  However, earlier reviewers felt the draft should be split into two parts - DC L3VPN and WAN L3VPN for DC.    We published the L3VPN WAN first.

Would you like to review our work on the DC area?  We'd love to work with you.  We'd be glad to sponsor a call  or meet you at IETF.

Best Regards,
Lucy

From: [email-masked] [mailto:[email-masked]] On Behalf Of Derick Winkworth
Sent: Monday, October 24, 2011 7:13 PM
To: Ben Niven-Jenkins; L3VPN WG mailing list
Subject: Re: Discussion of VPN4DC drafts

All:

Thanks.

Derick

Colleagues,

VPN4DC Problem Statement

VPN4DC Problem Statement

Ben

---

From: Michael Ko <[email-masked]>
Date: Fri, 28 Oct 2011 11:39:41 -0700

I have uploaded a revised version of the draft.  You can download it at 
http://tools.ietf.org/html/draft-ko-vaas-problem-statement-01  This is a 
replacement for the "Problem Statement for Dynamic Secure Interconnect" 
draft mentioned in Ben's note.

VPN as a Service (VaaS) is envisioned as a way to either transition or 
complement existing ways of establishing VPN service between a set of sites 
or clients.  There are some fundamental differences between VaaS and the 
various forms of VPN today.  This draft examines the problems and challenges 
associated with the process of setting up secure connections between 
authorized network nodes which can be located anywhere in a private or 
public network, directly connected or behind one or more levels of NAT. 
Setting up a secure connection in this environment entails the resolution of 
various issues such as authentication, peer discovery, virtual network 
address management, routing information exchange and connection parameters 
determination.

I believe this draft is within the scope of VPN4DC and your feedback and 
comments are most welcome.

Mike

----- Original Message ----- 
From: Ben Niven-Jenkins
To: L3VPN WG mailing list
Sent: Monday, October 24, 2011 4:35 PM
Subject: Discussion of VPN4DC drafts

Colleagues,

VPN4DC Problem Statement

VPN4DC Problem Statement

Ben