Subject: if-map schema for l3vpn

From: Pedro Marques <[email-masked]>
Date: Thu, 3 Nov 2011 09:58:36 -0700

Robert,
Thank you for your questions.

On Thu, Nov 3, 2011 at 12:36 AM, Robert Raszuk <[email-masked]> wrote:

>>                       IF-MAP schema for IP VPNs.
>>                   draft-marques-sndp-l3vpn-schema-00
>
> Few questions on this one ...
>
> - How are you define choice of PE-CE routing protocol used to exchange
> reachability information ?

I apologize in advance if i'm not answering the right question. I
understanding this question as: in the traditional SP-centric l3vpn
application, how does a provisioning system configure parameters such
as the PE-CE protocol. The answer to that would be by defining extra
elements in the "binding" metadata element.

>
> - How do you envision scale of MAP server ? How about communication between
> MAP servers especially in case of distributed ones ?

For reasons of resiliency and scale MAP servers should be distributed.
It is desirable to have the server-to-server protocol(s) be publicly
documented. There are multiple possible implementation strategies for
a distributed MAP server implementation. It would be reasonable to
have more than one publicly documented server-to-server protocol,
exporting the same API to clients.

>
> - How about discussion of MAP server failure cases ?

>From a client's perspective the MAP server is assumed to be resilient
/ persistent.

>
> - How one would go about negotiating with given VPN instance various per VPN
> security parameters (vrf-route-limit, prefix-limit etc ...)

These would be optional elements in the metadata elements.

>
> - Do you expect MAP server to be used to manage just single administrative
> domain leaving any form of inter-as or inter-provider out of scope (manual
> provisioning) ?

inter-as inter-provider is likely to have very different requirements.
It would be possible to use a similar approach for communicating
operational data (e.g. customer name to route-target mappings) but for
requests that modify state the current web based API approach seems to
be better suited.

>
>>   A MAP server implementation SHOULD support access controls on a per
>>   metadata element basis such that it is possible to restrict write
>>   access to a set of metadata elements to a specific list of
>>   certificates.
>
> This perhaps leaves a door a bit open to allow customer management of their
> VPN instance. That is great. However how do you envision possible extranets
> provisioning when applicable ?
>

The focus is on provider provisioned VPNs, specially when it comes to
controlling the membership of the VPN. This is not an API that is
appropriate for the end-user application to interact with the network.
For the later i'd recommend looking at the work of the ALTO working
group.

  Pedro.

---

From: Robert Raszuk <[email-masked]>
Date: Thu, 03 Nov 2011 23:18:05 +0100

Hi Pedro,

 > I apologize in advance if i'm not answering the right question.

Actually you have answered precisely the questions .. except one .. 
where those missing pieces of metadata elements are going to be defined? 
In other words don't you think that l3vpn schema should define them 
apriori ?

Best regards,
R.

> On Thu, Nov 3, 2011 at 12:36 AM, Robert Raszuk<[email-masked]>  wrote:
>

---

From: "Luyuan Fang (lufang)" <[email-masked]>
Date: Thu, 3 Nov 2011 17:21:06 -0500

Would that be the reason this is on sdnp list as well?
Luyuan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Robert Raszuk
> Sent: Thursday, November 03, 2011 6:18 PM
> To: Pedro Marques
> Cc: [email-masked]; [email-masked]
> Subject: Re: if-map schema for l3vpn
> 
> Hi Pedro,
> 
> >> - How one would go about negotiating with given VPN instance
various
> per VPN

---

From: Pedro Marques <[email-masked]>
Date: Thu, 3 Nov 2011 16:22:39 -0700

Yes. I believe commonly used config elements should be documented in
this document (or a document that supersedes it). This is just a draft
pre-00 intended to explain the approach.

  Pedro.

On Thu, Nov 3, 2011 at 3:18 PM, Robert Raszuk <[email-masked]> wrote:
> Actually you have answered precisely the questions .. except one .. where
> those missing pieces of metadata elements are going to be defined? In other
> words don't you think that l3vpn schema should define them apriori ?
>
> Best regards,
> R.
>
>
>> Robert,