Subject: Re: [OPSAWG] draft-deng-opsawg-composed-vpn-sm-requirements-01.txt

From: Randy Bush <[email-masked]>
Date: Tue, 19 Jul 2016 22:56:36 +0200

> Hi Randy, today, at IETF96 in Berlin, we discussed this document in
> the OPSAWG meeting. 
> We would be interested to hear your opinion (from an operator point of
> view) on this document.  It is a short document. Hearing if you think
> this makes sense or not would be great.
> You can send you comments to me directly or (preferably) to the opsawg
> mailing list at [email-masked]

at this level of abstraction, anything can be made to look as if it
would work and be wonderful.  it essentially says that a multi-as vpn is
composed by linking multiple single-as vpn systems.  this is not a deep
insight, and it provides no clues on how to do it.

of the 392 devils to be found in the details, inter-provider
authentication and identification of end-points, billing, ...  the list
goes on and one.

then there are issues such as describing and provisioning the contracted
(with the end customer) privacy constraints across multiple provider
technologies.

fwiw, our customers do use multi-provider vpns; they use ipsec.  we
provide ipsec capable cpe and various management/orchestration systems.

randy

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Wed, 20 Jul 2016 18:58:36 +0200

for you input Randy.

inline

> insight, and it provides no clues on how to do it.
Pls, the idea is to define REQUIREMENTS first. I will agree that the document is not
very good at that yet either. So my real question is,

does it make sense that we (as IETF and operators in IETF) try to define/specify a set
of requirements fo composed VPN, and then, once we have that to try and develop
protocols and interfaces that would allow interoperability. So mainly, I'd like to
understand if operators feel that some IETF work in this space makes sense.
And would operators be willing to help specify the requirements.
> authentication and identification of end-points, billing, ...  the list
And so, that list can possibly be converted into a set of requirements, I would think.
> (with the end customer) privacy constraints across multiple provider
yep, that will indeed be a big problem. But possibly we can find solutions once we
know all the requirements.
> provide ipsec capable cpe and various management/orchestration systems.
So is that enough ? is there no improvements and interoperability improvements we
can try to work on in this space, together with operators.
> randy
Thanks, Bert
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>

---

From: Randy Bush <[email-masked]>
Date: Wed, 20 Jul 2016 19:28:12 +0200

> So is that enough ?

no.  it does not justify 312 internet-drafts, 92 rfcs, and sellimg me a
lot of complex boxes.  end of net predicted.  news at eleven.

randy