Subject: [I2nsf] Should I2NSF re-chartering include YANG module of IPsec policies on BGP nodes? (was FW: Comments on re-chartering

From: Linda Dunbar <[email-masked]>
Date: Tue, 29 Mar 2022 21:27:43 +0000

Sue,

Your following question makes me believe that it might be useful for the I2NSF re-chartering to include the YANG module of IPsec policies to functions embedded in nodes that also runs BGP.

      My personal experience in trying to get the IP-SEC model used by BGP model, is that there are differences between the implementation of  IPSEC security boxes and routing box.  For example, RFC8983 is a set of status messages for IPsec. Do all of these message work equivalently for IPsec boxes and  routing boxes?

Comparing with Traditional IPsec node, the IPsec function embedded in the BGP router already has secure channel with each other. Therefore configuration for the additional IPsec tunnels can be greatly simplified, as shown below:

The highlighted attributes of the Traditional IPsec Configuration in the following table are not needed for BGP Controlled IPsec configuration.

What do people think?

Linda Dunbar

-----Original Message-----
From: I2nsf <[email-masked]> On Behalf Of Susan Hares
Sent: Wednesday, March 23, 2022 8:54 AM
To: 'Roman Danyliw' <[email-masked]>; [email-masked]
Subject: Re: [I2nsf] Comments on re-chartering

Roman:

I was imprecise.

You interpretation of the original charter is correct.   The orchestration
was with specific Yang models.

Thanks for responding!

Sue

-----Original Message-----
From: I2nsf [mailto:[email-masked]] On Behalf Of Roman Danyliw
Sent: Wednesday, March 23, 2022 9:51 AM
To: Susan Hares; [email-masked]<mailto:[email-masked]>
Subject: Re: [I2nsf] Comments on re-chartering

Hi Sue!

> -----Original Message-----
> From: Susan Hares <[email-masked]<mailto:[email-masked]>>
> Sent: Wednesday, March 23, 2022 9:27 AM
> To: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
> Subject: RE: [I2nsf] Comments on re-chartering
>
> Roman:
>
> The orchestration in the original charter was seen as "Yang models".

Publishing particular yang modules is definitely in scope.  Respectfully, I don't read the charter to have a scope to support orchestration generically with any yang module.

> I'm
> glad to work the IP-SEC orchestration + Yang models where the work goes.

Wonderful.

Regards,
Roman

> Sue
>
> -----Original Message-----
> From: Roman Danyliw [mailto:[email-masked]]
> Sent: Wednesday, March 23, 2022 9:20 AM
> To: Susan Hares; [email-masked]<mailto:[email-masked]>
> Subject: RE: [I2nsf] Comments on re-chartering
>
> Hi!
>
> What's described below sounds like a great conversation to have. I
> don't sufficiently understand the existing gaps of "IP-SEC model[s] us[ing] BGP"
> to assess the volume or complexity of future work in that area.  With
> an understanding of that scope, where this work should be done could
> also
occur.
>
> Where there is clarity from my perspective is that the current I2NSF
charter
> scope would not cover this kind of work.  RFC9061 is a commendable
> body of work.  However, the flexibility I exercised to ensure that it
> didn't get
orphaned
> when I became the responsible AD of I2NSF does not expand the
> published WG scope.  If there is a desire to do more Yang modeling
> work for IPSec that
would
> take a re-charter or another WG.
>
> Regards,
> Roman
>
>
> > -----Original Message-----
> > From: Susan Hares <[email-masked]<mailto:[email-masked]>>
> > Sent: Wednesday, March 23, 2022 8:46 AM
> > To: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
> > Subject: RE: [I2nsf] Comments on re-chartering
> >
> > Roman:
> >
> > Good question!   By mistake, I responded to just you.
> >
> > Here's the difficulty.  IP-SEC knowledge is key to the restructure.
> > And
> so is Yang
> > models.  My personal experience in trying to get the IP-SEC model
> > used by
> BGP
> > model, is that there are differences between the implementation of
> > IPSEC security boxes and routing box.  For example, RFC8983 is a set
> > of status messages for IPsec.
> >
> > Do all of these message work equivalently for IPsec boxes and
> > routing
> boxes?
> > I know how routing uses these features in securing links, but I am not a
> > security box expert.    I am willing to be "cross-area" participant of
> I2NSF
> > to see that these definitions get thought through by both types of
people.
> >
> > Either I2NSF in OPS/SEC, you need people for phrase 2 who are:
> > yang-experts, security-experts, deployment experts.    If you move this
to
> > OPS, will you get security experts?
> >
> > [Again - I am grateful to Paul and Tom Petch]
> >
> >  Just giving you feedback from the trenches.
> >
> > Sue
> >
> > -----Original Message-----
> > From: I2nsf [mailto:[email-masked]] On Behalf Of Roman
> > Danyliw
> > Sent: Tuesday, March 22, 2022 6:54 AM
> > To: Susan Hares; [email-masked]<mailto:[email-masked]>
> > Subject: Re: [I2nsf] Comments on re-chartering
> >
> > Hi Sue!
> >
> > > -----Original Message-----
> > > From: Susan Hares <[email-masked]<mailto:[email-masked]>>
> > > Sent: Sunday, March 20, 2022 6:35 PM
> > > To: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
> > > Subject: RE: [I2nsf] Comments on re-chartering
> > >
> > > Roman:
> > >
> > > Security has created very few Yang modules.    Therefore, you do not
> have
> > > experience with the lengthy cycle for this work.   Ask Rob Wilton
about
> > the
> > > versioning efforts or ask Alvaro regarding the routing yang models.
Or
> > > look at the BGP model for complexity.
> >
> > ...
> >
> > > For example, I would like to get the I2NSF IP-SEC model adapted so
> > > that we
> > can
> > > use it in the BGP model.  This takes chatting with the folks in
> > > I2NSF who
> > are
> > > experts.
> >
> > I've consulted with my peer-SEC ADs.  If the community has interest
> > to
> more
> > closely align this activity with the larger critical mass of work in
> > Yang
> modules
> > in the IETF, we would be supportive of moving I2NSF to the OPS Area
> > to
> finish
> > the remaining work or evolve it as appropriate.
> >
> > Regards,
> > Roman
> >
> > _______________________________________________
> > I2nsf mailing list
> > [email-masked]<mailto:[email-masked]>
> > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fww
> > w.ietf.org%2Fmailman%2Flistinfo%2Fi2nsf&amp;data=04%7C01%7Clinda.dun
> > bar%40futurewei.com%7Cda4f589a0ea44ebc72c508da0cd4b985%7C0fee8ff2a3b
> > 240189c753a1d5591fedc%7C1%7C1%7C637836405035176964%7CUnknown%7CTWFpb
> > GZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6M
> > n0%3D%7C3000&amp;sdata=dTE9xgHs%2FXbiDDOHlykqyctEWrg0wPotc%2FWDZx5Xy
> > I0%3D&amp;reserved=0
>

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fi2nsf&amp;data=04%7C01%7Clinda.dunbar%40futurewei.com%7Cda4f589a0ea44ebc72c508da0cd4b985%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637836405035176964%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=dTE9xgHs%2FXbiDDOHlykqyctEWrg0wPotc%2FWDZx5XyI0%3D&amp;reserved=0

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fi2nsf&amp;data=04%7C01%7Clinda.dunbar%40futurewei.com%7Cda4f589a0ea44ebc72c508da0cd4b985%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637836405035176964%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=dTE9xgHs%2FXbiDDOHlykqyctEWrg0wPotc%2FWDZx5XyI0%3D&amp;reserved=0

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Wed, 30 Mar 2022 19:00:28 +0900

Hi Linda and Sue,

I agree with Linda that it might be useful for the I2NSF re-chartering to
include the YANG module of IPsec policies to functions embedded in nodes
running BGP.
This is because Security Controller can work within (or along with) SD-WAN
Controller,
and reduce the IPsec configuration process overhead with in RFC 9061
(A YANG Data Model for IPsec Flow Protection Based on Software-Defined
Networking (SDN)).

Thanks.

Best Regards,
Paul

On Wed, Mar 30, 2022 at 6:28 AM Linda Dunbar <[email-masked]>
wrote:

> Sue,
>
> Your following question makes me believe that it might be useful for the
> I2NSF re-chartering to include the YANG module of IPsec policies to
> functions embedded in nodes that also runs BGP.
>
> *My personal experience in trying to get the IP-SEC model used by BGP
> model, is that there are differences between the implementation of  IPSEC
> security boxes and routing box.  For example, RFC8983 is a set of status
> messages for IPsec. Do all of these message work equivalently for IPsec
> boxes and  routin**g** boxes?*
>
> Comparing with Traditional IPsec node, the IPsec function embedded in the
> BGP router already has secure channel with each other. Therefore
> configuration for the additional IPsec tunnels can be greatly simplified,
> as shown below:
>
>
>
> The highlighted attributes of the Traditional IPsec Configuration in the
> following table are not needed for BGP Controlled IPsec configuration.
>
>
>
> What do people think?
>
> Linda Dunbar
>
>
> From: I2nsf [mailto:[email-masked] <[email-masked]>] On
> Behalf Of Roman Danyliw
> To: Susan Hares; [email-masked]
> > From: Susan Hares <[email-masked]>
> > To: Roman Danyliw <[email-masked]>; [email-masked]
> Publishing particular yang modules is definitely in scope.  Respectfully,
> I don't read the charter to have a scope to support orchestration
> generically with any yang module.
>
> > I'm
> > From: Roman Danyliw [mailto:[email-masked] <[email-masked]>]
> > To: Susan Hares; [email-masked]
> > > From: Susan Hares <[email-masked]>
> > > To: Roman Danyliw <[email-masked]>; [email-masked]
> > > From: I2nsf [mailto:[email-masked] <[email-masked]>]
> On Behalf Of Roman
> > > Danyliw
> > > To: Susan Hares; [email-masked]
> > > > From: Susan Hares <[email-masked]>
> > > > To: Roman Danyliw <[email-masked]>; [email-masked]
> > > [email-masked]
> [email-masked]
> [email-masked]
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i2nsf
>