Subject: [nvo3] I-D Action: draft-ietf-nvo3-nve-nva-cp-req-02.txt

From: [email-masked]
Date: Wed, 23 Apr 2014 20:08:58 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Network Virtualization Overlays Working Group of the IETF.

        Title           : Network Virtualization NVE to NVA Control Protocol Requirements
        Authors         : Lawrence Kreeger
                          Dinesh Dutt
                          Thomas Narten
                          David Black
	Filename        : draft-ietf-nvo3-nve-nva-cp-req-02.txt
	Pages           : 12
	Date            : 2014-04-23

Abstract:
   The document "Problem Statement: Overlays for Network Virtualization"
   discusses the needs for network virtualization using overlay networks
   in highly virtualized data centers.  The problem statement outlines a
   need for control protocols to facilitate running these overlay
   networks.  This document outlines the high level requirements to be
   fulfilled by the control protocols related to building and managing
   the mapping tables and other state information used by the Network
   Virtualization Edge to transmit encapsulated packets across the
   underlying network.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-nvo3-nve-nva-cp-req/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-nvo3-nve-nva-cp-req-02

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-nvo3-nve-nva-cp-req-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Tom Herbert <[email-masked]>
Date: Fri, 25 Apr 2014 10:07:50 -0700

Here are some comments on security section, some of this reiterates my
comments about data plane requirements.

Allowing packets to be directed to the wrong VM is fundamentally
breaks the isolation requirement of network virtualization. If VN ID
is sent in the data packet it should be protected for integrity and
have verifiable authenticity. I would envision that at least L2TP
style cookies are used, but HMAC over some fields should be be allowed
for strong security. In either case, it seems appropriate to pass
shared keys in the control plane protocol along with the address
mappings.

I really would like to see a stronger advocacy for the use of IPsec if
this is the answer for packet security. Some reasons: 1) Allowing
third party untrusted VMs significantly alters the security landscape
within data centers 2) Snowden revelations demonstrated that private
links between data centers are being targeted, if not data centers
themselves. 3) MACsec is being used in private networks in several
critical segments (healthcare, defense, etc.) in some cases to meet
regulatory requirements. IPsec is often not used for performance
reasons. 4) Security concerns are still being touted as an argument
against network virtualization and cloud, strong security could
mitigate some of these arguments.

In the case of network virtualization, packet security via IPsec
should be provided in the underlying network (between physical hosts)
as mentioned in the draft. I would expect that we'd want to offer
customers the option of strong security for their packets (assuming
there is a tradeoff in cost or performance). This seems like a policy
that could be expressed in the control plane.

Note that use of IPsec doesn't necessarily obviate the need for
securing the VN ID. The stated security model could authenticate
between physical hosts not necessarily between the virtual hosts.
Besides, there is motivation to keep the VN ID outside of any IPsec
payload in order to keep it visible to network devices.

Thanks,
Tom

On Wed, Apr 23, 2014 at 8:08 PM,  <[email-masked]> wrote:
> _______________________________________________
> nvo3 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nvo3