Subject: [nvo3] Follow on comment on draft-ietf-nvo3-overlay-problem-statement

From: Lou Berger <[email-masked]>
Date: Fri, 16 Nov 2012 12:00:04 -0500

Authors,
	I made a comment in last week's meeting on the security considerations
section.  This mail provides some suggestions on how to address my comment.

In summary, my comment is that the problem statement document should at
a minimum identify the security topics (i.e., problems) that must be
addressed by any NVO3 solution.  I agree that this document is not the
right place for any detailed or solution description. I think we have
plenty of text/concepts to leverage from the framework document and
draft-wei-nvo3-security-framework.

So I propose that something along the lines of the following text be
added after the first paragraph of section 10:

    Solutions will need to address both data plane and control
    plane security concerns.  In the data plane, isolation
    between NVO3 domains is the primary concerns. Assurances
    against spoofing, snooping, transit modification and denial
    of service are examples of other important
    considerations. Some limited environments may even require
    confidentially between domains.

    In the control plane, the primary security concern is
    ensuring that unauthorized control information is not
    installed for use in the data plane. The prevention of the
    installation of proper control information, and other forms
    of denial of service are also concerns. Hereto, some
    environments may also be concerned about confidentiality of
    the control plane.

It's clearly possible to go into a lot more detail, but I thing the
above strikes the right balance (or close to it) for the PS document.

Lou

---

From: "[email-masked]" <[email-masked]>
Date: Fri, 16 Nov 2012 14:39:20 -0500

Hi Lou,

There is also a draft on
NVO3 Security Framework (
http://www.ietf.org/id/draft-wei-nvo3-security-framework-01.txt)
Requesting the authors of this draft to provide inputs to
Requirements, Framework and Operations drafts.

Thanks.
Best.
Bhumip

On Fri, Nov 16, 2012 at 12:00 PM, Lou Berger <[email-masked]> wrote:

> _______________________________________________
> nvo3 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nvo3
>

---

From: Melinda Shore <[email-masked]>
Date: Fri, 16 Nov 2012 10:46:55 -0900

On 11/16/12 10:39 AM, [email-masked] wrote:
> There is also a draft on 
> NVO3 Security Framework
> (http://www.ietf.org/id/draft-wei-nvo3-security-framework-01.txt)

Both that draft and Lou's suggested text suffer from being overly
general and not addressing security concerns specific to the nvo3
architecture (which is still a bit unsettled, but still).  Both
could be applied to everything from FTP to VoIP to nvo3, and to
be candid my sense of the Wei draft is that it was intended to knock
a stake in the ground rather than to move the work forward.  I've
been meaning to write up something more specific but haven't
been able to carve out some time.  I intend to soon but that
shouldn't discourage someone else who knows how to write a security
considerations section from taking a whack at it.

Melinda

---

From: "Lou Berger" <[email-masked]>
Date: Fri, 16 Nov 2012 19:54:33 +0000

Sure. I referenced it in my 2nd paragraph. 

Lou
-----Original Message-----
From:  "[email-masked]" <[email-masked]>
Date: Fri, 16 Nov 2012 14:39:20 
To: Lou Berger<[email-masked]>
Cc: <[email-masked]>; [email-masked]<[email-masked]>
Subject: Re: [nvo3] Follow on comment on draft-ietf-nvo3-overlay-problem-statement

Hi Lou,

There is also a draft on

Thanks.
Best.
Bhumip

---

From: "[email-masked]" <[email-masked]>
Date: Fri, 23 Nov 2012 18:57:12 -0500

Lou,

Thanks, and would like to know if you are interested to contribute to
develop this
draft (http://www.ietf.org/id/draft-wei-nvo3-security-framework-01.txt)
further.

Best.

Bhumip

On Fri, Nov 16, 2012 at 2:54 PM, Lou Berger <[email-masked]> wrote:

> **
> ------------------------------
> *From: *"[email-masked]" <[email-masked]>
> *Date: *Fri, 16 Nov 2012 14:39:20 -0500
> *To: *Lou Berger<[email-masked]>
> *Cc: *<[email-masked]>;
> [email-masked]<[email-masked]>
> *Subject: *Re: [nvo3] Follow on comment on
> draft-ietf-nvo3-overlay-problem-statement
>
> Hi Lou,
>
> There is also a draft on