Subject: Re: [pcp] New Version Notification for draft-vinapamula-flow-ha-00.txt

From: Suresh Kumar Vinapamula Venkata <[email-masked]>
Date: Tue, 5 Nov 2013 19:02:42 +0000

Hi All, 

This draft talks about issues with checkpointing flows in current
deployment, and how they can be addressed and handled efficiently with PCP.
Please review and share your comments.

Thanks
Suresh

On 10/14/13 1:05 AM, "Suresh Kumar Vinapamula Venkata"
<[email-masked]> wrote:

>Dear All, 
>
>We submitted a new draft that sketches flow high availability through PCP.
>Please review.
>
>-Suresh
>
>On 10/14/13 12:56 AM, "[email-masked]"
><[email-masked]> wrote:
>
>>
>>A new version of I-D, draft-vinapamula-flow-ha-00.txt
>>has been successfully submitted by Suresh Vinapamula and posted to the
>>IETF repository.
>>
>>Filename:	 draft-vinapamula-flow-ha
>>Revision:	 00
>>Title:		 Flow high availability through PCP
>>Creation date:	 2013-10-14
>>Group:		 Individual Submission
>>Number of pages: 5
>>URL:             
>>http://www.ietf.org/internet-drafts/draft-vinapamula-flow-ha-00.txt
>>Status:          http://datatracker.ietf.org/doc/draft-vinapamula-flow-ha
>>Htmlized:        http://tools.ietf.org/html/draft-vinapamula-flow-ha-00
>>
>>
>>Abstract:
>>   This document describes a mechanism for a host signal Network Address
>>   Translator's (NAT) High Availability (HA) module to checkpoint
>>   interested connections.
>>
>>                 
>>        
>>
>>
>>Please note that it may take a couple of minutes from the time of
>>submission
>>until the htmlized version and diff are available at tools.ietf.org.
>>
>>The IETF Secretariat
>>
>>
>>
>

---

From: "Reinaldo Penno (repenno)" <[email-masked]>
Date: Tue, 5 Nov 2013 20:01:15 +0000

Interesting extension, a few comments:

- You mention *flow* checkpointing but a many flows can match a MAP
mapping. So, should a device checkpoint all flows matching a MAP mapping
or only the mapping itself?
- Do you need a new error code when checkpointing can not be honored or
can you refuse an existing one? I prefer the latter, but irrespective,
draft need those details.
  - This should be a long lifetime error since if, for example, PCP Server
does not support checkpointing, you do not want client to keep requesting
HA constantly.
- It would be good if this mechanism is totally decoupled from NAT so, for
example, it could be used for FLOWDATA extension. It seems that way, but
worth mentioning.

Thanks,

Reinaldo

On 11/5/13 11:02 AM, "Suresh Kumar Vinapamula Venkata"
<[email-masked]> wrote:

>>>Status:         
>>>http://datatracker.ietf.org/doc/draft-vinapamula-flow-ha
>_______________________________________________
>pcp mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pcp

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Tue, 5 Nov 2013 21:27:24 +0000

Thanks for the comments, please see inline.

>or only the mapping itself?

All flows matching a MAP mapping need to be checkpointed.

>draft need those details.

Ok, will do in the next rev.

>does not support checkpointing, you do not want client to keep requesting

Agree.

>example, it could be used for FLOWDATA extension. It seems that way, but

Right, it is that way, except the abstract :-), we will wordsmith in the
next rev.

Thanks
Senthil

---

From: Suresh Kumar Vinapamula Venkata <[email-masked]>
Date: Wed, 6 Nov 2013 00:57:18 +0000

Reinaldo,

Thanks for your comments. Please see inline. 

Suresh

> On Nov 5, 2013, at 12:01 PM, "Reinaldo Penno (repenno)" <[email-masked]> wrote:
> 
Good question. We can checkpoint all flows associated with that mapping. I am just thinking on applicability, where mapping is check pointed but all flows need not be check pointed. For example, a free subscription (don't checkpoint) but a paid subscription (checkpoint) of a service (exposed through same mapping)? 
We will get this addressed in the next version. 

> draft need those details.
Sure, will be addressed in next version. 
> does not support checkpointing, you do not want client to keep requesting
Agreed
> example, it could be used for FLOWDATA extension. It seems that way, but
Yes it should work for other extensions, and even other applications, and that is the intention. Will be updated in the next revision.

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 14 Nov 2013 15:21:03 +0000

Hi Suresh,

My initial comments

1)Why cannot the problem be solved for example by the PCP client sending PEER with a long lifetime and if the lifetime is higher than a particular threshold only those connections are synced implicitly ?

2)HA is applicable for both NAT and Firewall devices. I would suggest not to restrict the draft to only NAT scenarios.

3)In Active-Standby HA, switch-over is triggered not just because of Active rebooting but also because of WAN-link failures. Are you assuming HA deployments with provider-independent or provider-dependent addresses ?

4)

a) PCP third-party authorization (draft-wing-pcp-third-party-authz) could also be one way of telling the network that it's for a business critical application and connection can be synced implicitly without explicit signaling. 

b) Other possible ways could be checkpoint based on destination port/address (For example HTTPS flows are more critical than HTTP).

5)How does PCP ANNOUNCE work in this deployment ?
I mean some connections on the host need to know that PCP-aware NAT/Firewall has rebooted but other connections may not because their states are check-pointed.

6) How does an application developer know if syncing the state is required or not ?
The problem could be that if every application says it's connections need to be check-pointed then there is no benefit.

Cheers,
-Tiru.

> -----Original Message-----
> From: Suresh Kumar Vinapamula Venkata [mailto:[email-masked]]
> Sent: Wednesday, November 06, 2013 12:33 AM
> To: [email-masked]
> Subject: Re: [pcp] New Version Notification for draft-vinapamula-flow-ha-
> 00.txt
> 
> Hi All,
>

---

From: Suresh Kumar Vinapamula Venkata <[email-masked]>
Date: Thu, 14 Nov 2013 18:03:20 +0000

Hi Tiru, 

Thanks for your comments. Please see inline for responses.

On 11/14/13 7:21 AM, "Tirumaleswar Reddy (tireddy)" <[email-masked]>
wrote:

>Hi Suresh,
>
>My initial comments
>
>1)Why cannot the problem be solved for example by the PCP client sending
>PEER with a long lifetime and if the lifetime is higher than a particular
>threshold only those connections are synced implicitly ?
How would application know what is the threshold life time for it to
request life time greater than that? What if a connection is critical but
is short lived than the configured HA life time? Similarly, what if a
connection is not business critical, but its life time greater than
configured HA life time?
>
>2)HA is applicable for both NAT and Firewall devices. I would suggest not
>to restrict the draft to only NAT scenarios.
Yes, the intention is to not restrict to NAT only service.
>
>3)In Active-Standby HA, switch-over is triggered not just because of
>Active rebooting but also because of WAN-link failures. Are you assuming
>HA deployments with provider-independent or provider-dependent addresses ?
I am not sure what you meant by provider-independent or provider-dependent
addresses. Please clarify for my response.
>
>4)
>
>a) PCP third-party authorization (draft-wing-pcp-third-party-authz) could
>also be one way of telling the network that it's for a business critical
>application and connection can be synced implicitly without explicit
>signaling.
Even without authorization also, if flows are to be check pointed, they
will be check pointed with this option.
> 
>
>b) Other possible ways could be checkpoint based on destination
>port/address (For example HTTPS flows are more critical than HTTP).
Admin can always configure that. This option gives more flexibility.
>I mean some connections on the host need to know that PCP-aware
>NAT/Firewall has rebooted but other connections may not because their
>states are check-pointed.
I will get back to you on this.
>The problem could be that if every application says it's connections need
>to be check-pointed then there is no benefit.
It is application and user dependent. Please refer section 7 in the draft.
>> >>Htmlized:     
>>http://tools.ietf.org/html/draft-vinapamula-flow-ha-00
>> >>
>> >>
>> >>Abstract:

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Sat, 16 Nov 2013 03:57:19 +0000

Hi Suresh,

Please see inline

> Sent: Thursday, November 14, 2013 11:33 PM
> To: Tirumaleswar Reddy (tireddy); [email-masked]
> is short lived than the configured HA life time? 

Good point. we don't want short-lived business critical sessions to set long lifetime just for HA.

> Similarly, what if a

The problem is how does the network know that the mapping is for a business critical application or not ?
Network needs a mechanism to distinguish b/w the applications.

> addresses. Please clarify for my response.

Refer to http://tools.ietf.org/html/rfc4116 on PI and PA.

> will be check pointed with this option.

With third party authorization, PCP-aware server knows that the mapping is for business critical applications and hence can sync the state.

> I will get back to you on this.

Ok.

> It is application and user dependent. Please refer section 7 in the draft.

The problem is every App developer would think that his application is important and asks for HA. A set of guidelines is probably needed in the draft for application developers to help decide when to ask for HA or not ?

-Tiru.

---

From: Suresh Kumar Vinapamula Venkata <[email-masked]>
Date: Sun, 17 Nov 2013 22:48:20 +0000

Hi Tiru, 

Thanks for your followup questions. Please see responses inline.

>Network needs a mechanism to distinguish b/w the applications.
A bit in the PCP header indicates that it is critical right? An
application can use PCP medium to communicate to network about this.
>Refer to http://tools.ietf.org/html/rfc4116 on PI and PA.
Oh, you meant provider aggregatable and provider independent. Are you
talking in the context of multihoming?
Isn't this taken care at link level or route level redundancy/update? If
not, sorry, I am trying to understand your question.
>With third party authorization, PCP-aware server knows that the mapping
>is for business critical applications and hence can sync the state.
AFAIU, this draft doesn't talk that third party authorization is for
business critical applications only. Please let me know if I am missing
something?
>> I will get back to you on this.
I feel all connections should refresh their mappings just as how they do
on seeing PCP ANNOUNCE.
For the mappings that are already check pointed, applications are
guaranteed to receive previous state of the mappings.
For the mappings that are not check pointed, depending on availability
they will be honored on first come first serve basis.
Is there an issue with this, so that I can update in the next version.
>The problem is every App developer would think that his application is
>important and asks for HA. A set of guidelines is probably needed in the
>draft for application developers to help decide when to ask for HA or not
>?
Ok, I will include the guide lines in the next draft. But, note for some
set of applications, an application that is critical to one user may not
be critical to another user. That is where both user/application have to
determine if it is critical. And as a security consideration, admin may
configure max checkpoints per user. Please comment, so I will update it in
the next version of draft.
>> >> deployment, and how they can be addressed and handled efficiently
>>with
>> >>PCP.
>> >> >We submitted a new draft that sketches flow high availability
>>through
>> >>PCP.
>> >> >Please review.
>> >> >
>> >> >-Suresh
>> >> >

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 19 Nov 2013 01:53:04 +0000

Hi Suresh,

Please see inline

> Sent: Monday, November 18, 2013 4:18 AM
> A bit in the PCP header indicates that it is critical right ? An

The problem is any application can set this bit. How does the network distinguish b/w applications ?

> talking in the context of multi-homing ?

Yes.

> not, sorry, I am trying to understand your question.

If you could add to the Appendix the deployment scenarios you had considered that would help.
I was thinking of (Active-Standby) with multiple WAN links (Primary and Backup).

> something ?

One application may be business critical in one domain and may not be another domain. For example let's say WebRTC calls to Stark Industries may be business critical in one Enterprise but there is no business tie-up for Stark in another Enterprise and hence not business critical.

How does the PCP client set/reset this flag based on which network the BYOD device is attached to ?

> guaranteed to receive previous state of the mappings.

So check-pointed application will ignore PCP ANNOUNCE ?

> Is there an issue with this, so that I can update in the next version.

This may work, you may want to explicitly mention the above information in the draft.

> determine if it is critical.

I think there is one more aspect to consider, if the application can survive PCP server crash. For example if application based on PCP ANNOUNCE can do state resumption or application is using multiple paths (MPTCP) that though it is a business critical application but does not need to ask for check-pointing the connection.

> And as a security consideration, admin may
> configure max checkpoints per user. 

Does that mean PCP auth (draft-ietf-pcp-authentication) is mandatory for the PCP server to identify a user ?

-Tiru.

> Please comment, so I will update it in

---

From: Suresh Kumar Vinapamula Venkata <[email-masked]>
Date: Tue, 19 Nov 2013 19:27:15 +0000

Hi Tiru, 

Please see inline.

>distinguish b/w applications ?
Yes, any application can set, but user also has to honor it right?
>
>> >
>> >> >
>> >> >2)HA is applicable for both NAT and Firewall devices. I would
>>suggest
>> >>not
Yes, I can include some of the deployment scenarios. But I am still trying
to understand your question in the current context. If it is link level
redundancy with same provider, then it is taken care at the link level it
self right? If with multiple providers, it is taken care at routing right?
>One application may be business critical in one domain and may not be
>another domain. For example let's say WebRTC calls to Stark Industries
>may be business critical in one Enterprise but there is no business
>tie-up for Stark in another Enterprise and hence not business critical.
>
Yes, this is the same usage I was giving in my previous mail.
In that case, application user will determine if it is critical for him,
when the application is launched.
>So check-pointed application will ignore PCP ANNOUNCE ?
Here is where I have two thoughts and WG can comment on them.
1) Application is given feedback that state is check pointed and PCP
Announce may be ignored, by those applications.
2) Application/PCP client on seeing ANNOUNCE, initiate requests for state
reconstruction on PCP. If the state is check pointed, then a success
response is received for the requests. If the success is not received,
then Applications can cleanup.
>This may work, you may want to explicitly mention the above information
Sure.
>I think there is one more aspect to consider, if the application can
>survive PCP server crash. For example if application based on PCP
>ANNOUNCE can do state resumption or application is using multiple paths
>(MPTCP) that though it is a business critical application but does not
>need to ask for check-pointing the connection.
If an application can survive PCP server crash, and if there is HA, then
it can still continue to use that path if state is check pointed right?
>the PCP server to identify a user ?
Are you saying in the context of rogue user or application?
>> >> >> >>has been successfully submitted by Suresh Vinapamula and posted
>>to
>> >>the
>> >> >> >>IETF repository.
>> >> >> >>

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Wed, 20 Nov 2013 04:30:32 +0000

Hi Suresh,

Please see inline

> Sent: Wednesday, November 20, 2013 12:57 AM
> Yes, any application can set, but user also has to honor it right ?

Are you referring to some GUI option where the user will select HA is required or not ?

> self right? If with multiple providers, it is taken care at routing right ?

I am referring to a use case where two routers are used for Active-Standby with multiple WAN links one primary and other backup. 
For HA, it will only work with PI addresses.

> when the application is launched.

Are you referring to a user knob where for each application, user has to enter critical or not (Something like High, Medium, Low priority) or input that that application needs HA or not. I am not sure if user in all cases will be aware if application needs HA or not.

> then Applications can cleanup.

Option 1 will reduce the chatter of check-pointed applications not initiating state resumption. 

> it can still continue to use that path if state is check pointed right ?

But the goal is to check-point only few connections. The above category of applications though business-critical do not need check-pointing.

> Are you saying in the context of rogue user or application ?

PCP authentication ensures only valid users gain access to use the PCP servers and not rouge users. This will also help to enforce user-based policy limits like number of mapping to checkpoint per user.

-Tiru.

---

From: Suresh Kumar Vinapamula Venkata <[email-masked]>
Date: Wed, 20 Nov 2013 05:55:52 +0000

Hi Tiru, 

Please see inline.

On 11/19/13 8:30 PM, "Tirumaleswar Reddy (tireddy)" <[email-masked]>
wrote:

>> >> >> request life time greater than that? What if a connection is
>>critical
>> >> >>but
>> >> >Good point. we don't want short-lived business critical sessions to
>>set
>> >> >long lifetime just for HA.
>> >> >
>> >> >> Similarly, what if a
Shouldn't this be left to implementation? For example, it could be at
installation also.
>I am referring to a use case where two routers are used for
>Active-Standby with multiple WAN links one primary and other backup.
I still don't understand this. When two routers belong to same provider,
now sure why it has to be PI addresses only. Also, when they are with
different providers, how do you expect state to be check pointed across
routers? 
>
>> >
>> >> >
>> >> >> >
>> >> >> >4)
>> >> >> >
>> >> >> >a) PCP third-party authorization
>>(draft-wing-pcp-third-party-authz)
>> >> >>could
>Are you referring to a user knob where for each application, user has to
>enter critical or not (Something like High, Medium, Low priority) or
>input that that application needs HA or not. I am not sure if user in all
>cases will be aware if application needs HA or not.
Yes, it is not for all applications. That is why I said it is for some set
of applications this may be required.
>initiating state resumption.
Yes, but if we consider back to back failure scenario it _may_ have to
respond to ANNOUNCE.
>> >> >> >The problem could be that if every application says it's
>>connections
>> >> >>need
>> >> >> It is application and user dependent. Please refer section 7 in
>>the
>> >> >>draft.
>> >> >
>> >> >draft for application developers to help decide when to ask for HA
>>or
>> >>not
>> >> >?
>But the goal is to check-point only few connections. The above category
>of applications though business-critical do not need check-pointing.
Is it because if one path fails, other path provides service continuity?
Having HA at each path level is not a bad thing right? Anyway, if
application doesn't require HA it need not initiate HA. I feel the goal is
to check point any critical application that requested HA.
>> >Does that mean PCP auth (draft-ietf-pcp-authentication) is mandatory
>>for
>> >the PCP server to identify a user ?
>PCP authentication ensures only valid users gain access to use the PCP
>servers and not rouge users. This will also help to enforce user-based
>policy limits like number of mapping to checkpoint per user.
Yes, PCP authentication ensures that only valid users gain access to PCP
servers and not rogue user. But, that doesn't mean that every application
that does PCP authentication require HA and every application that doesn't
do PCP auth doesn't require HA, as Authentication and HA are addressing
two different issues. Or am I missing something? Note, the approach that
is suggested in the draft would work in both PCP authentication case and
non authentication case.
>> >> >> >> >>   This document describes a mechanism for a host signal
>>Network
>> >> >> >>Address
>> >> >> >> >>Please note that it may take a couple of minutes from the
>>time
>> >>of
>> >> >> >> >>submission

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Wed, 20 Nov 2013 08:04:49 +0000

> Sent: Wednesday, November 20, 2013 11:26 AM
> Shouldn't this be left to implementation ? For example, it could be at
> installation also.

That will be static configuration. 

> routers ?

Each vendor has its proprietary technique to sync Firewall and NAT states. 

> two different issues. Or am I missing something ? 

PCP Authentication can be done once and used by all the PCP-aware applications on the endpoint.

-Tiru.

> Note, the approach that

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Wed, 20 Nov 2013 16:13:29 +0000

<snip>
>> >> >> >
>> >> >> >The problem is how does the network know that the mapping is for
>>a
>> >> >> >business critical application or not ?
>> >> >The problem is any application can set this bit. How does the
>>network
>> >> >distinguish b/w applications ?

I am not sure what the "user" is referred to here, but the operator who
controls the
PCP server and the middleboxes will have an administrative policy whether
to honor 
the HA/Checkpoint required flag. So the application can request all it
wants, but the 
authoritative control will reside in the network. The policy can allow all
applications for a given user,
Only certain applications or only certain flows or certain number of flow
per application etc.

Senthil

>> >> >> >> >Active rebooting but also because of WAN-link failures. Are
>>you
>> >> >> >>assuming
>> >> >I was thinking of (Active-Standby) with multiple WAN links (Primary
>>and
>> >> >Backup).
>> >> redundancy with same provider, then it is taken care at the link
>>level
>> >>it
>> >> >> >> >also be one way of telling the network that it's for a
>>business
>> >> >> >>critical
>> >> >> >> Even without authorization also, if flows are to be check
>>pointed,
>> >> >>they
>> >> >How does the PCP client set/reset this flag based on which network
>>the
>> >> >BYOD device is attached to ?
>> >> >> >> >NAT/Firewall has rebooted but other connections may not
>>because
>> >> >>their
>> >> >This may work, you may want to explicitly mention the above
>>information
>> >> >in the draft.
>> >> Sure.
>> >> >
>> >> >> >
>> >> >> >> >
>> >> >> >> >6) How does an application developer know if syncing the
>>state is
>> >> >> >> >required or not ?
>> >> >> >The problem is every App developer would think that his
>>application
>> >>is
>> >> >> >important and asks for HA. A set of guidelines is probably
>>needed in
>> >> >>the
>> >> >> Ok, I will include the guide lines in the next draft. But, note
>>for
>> >>some
>> >> >> set of applications, an application that is critical to one user
>>may
>> >>not

---

From: Suresh Kumar Vinapamula Venkata <[email-masked]>
Date: Thu, 21 Nov 2013 17:53:56 +0000

Please see inline.

On 11/20/13 12:04 AM, "Tirumaleswar Reddy (tireddy)" <[email-masked]>
wrote:

>> >> >> >> >1)Why cannot the problem be solved for example by the PCP
>>client
>> >> >> >>sending
>> >> >> >> How would application know what is the threshold life time for
>>it
>> >>to
Yes, for certain applications, it can be static. For certain applications,
user intervention may not be required. For certain applications, user
intervention is required, every time an application is started. I feel it
should be application specific. Please let me know if you think otherwise.
>Each vendor has its proprietary technique to sync Firewall and NAT states.
Yes, but across providers' routers do you expect sync to happen?
>applications on the endpoint.
Ok. Just to clarify my point, HA doesn't mandate authentication.