Subject: [sfc] EW/NS traffic: comments on draft-ietf-sfc-dc-use-cases-00

From: Dave Hood <[email-masked]>
Date: Fri, 9 May 2014 20:30:07 +0000

Sorry to join the conversation late; despite good intentions wrt its predecessors, I only just read this draft.

I am accustomed to think of E-W and N-S dimensions as applicable to control or signaling traffic, but not in the data plane. The ideas are used pretty widely in this draft, so I was interested to understand what they really meant.

NS traffic is initially introduced with the idea that it terminates somewhere outside the DC. Already, this raises my eyebrows:

1.    It forces our view of DCs to be physical rather than virtual. Also true of endpoints.

2.    It feels as if it violates layering. At the layer implied by item 1, an endpoint will usually be external from the DC, but once the external VPN is properly connected, I would expect that the endpoint would now be inside <some> trust domain.
Then further on, we talk about EW traffic, and the distinction appears to be that NS crosses trust domain boundaries, while EW traffic remains within a single trust domain.

3.    By that interpretation, our given user flow is going to change direction after it gets through the access firewall.

4.    But we also show several FWs in the service chain, which recognizes that trust domains may be nested. What direction do we assume for flows through intermediate trust domains?
I see nothing in the text that relies heavily on a distinction. But if the distinction between EW and NS is really important to the model, could we have a crisp definition, please? And if not, could we consider eliminating the concept?

Thanks,
Dave