Subject: [vnfpool] Will mutliple instances for one Network function be physically located together?

From: Linda Dunbar <[email-masked]>
Date: Tue, 17 Sep 2013 16:06:16 +0000

Conventional method is to lump multiple instances of one network function in one subnet for ease of management or convenience. Do people agree?

If yes, are those instances for one network function placed in close proximity, i.e. under one server rack (under one ToR switch)?

Linda Dunbar

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 17 Sep 2013 17:12:25 +0100

Hi Linda,
 
Important question, but made ambiguous by your use of "Network function". Maybe
there is a definition somewhere that would help me.
 
My original view of this was that we probably wanted to place in scope of
VNFpool any "service function" that might be chained (cf. NSC/SFC work). In this
case, there are definitely services that might be placed in different DCs or on
different isolated servers, so the best we can do is know that they're accessed
through different IP addresses.
 
Cheers,
Adrian
 
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Linda Dunbar
Sent: 17 September 2013 17:06
To: [email-masked]
Subject: [vnfpool] Will mutliple instances for one Network function be
physically located together?

Conventional method is to lump multiple instances of one network function in one
subnet for ease of management or convenience. Do people agree?
 
If yes, are those instances for one network function placed in close proximity,
i.e. under one server rack (under one ToR switch)?
 
Linda Dunbar

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 17 Sep 2013 16:35:45 +0000

Adrian,

Good question!

I am actually thinking of functions performed by today's Network Appliances. Here is the definition I would suggest:

Service Function (most commonly Layer 4-7 service functions):  a functional module that performs Layer 4 to 7 functions, such as Firewall, DPI, TCP accelerator, NAT, etc.

There could be multiple instances for FW function, multiple instances for Web Acceleration function, etc. For any given service, i.e. data flow to be performed by a chain of those service functions, it is really the chain of instances of those functions.

We also need to differentiate from the NSC (or the Service Function Chain) initiative. NSC is about how to create  proper header to connect the service functions together, whereas "vnfpool" is about mechanism to select which instance of the function and protocol between instances pool managers of different functions.

Linda

From: Adrian Farrel [mailto:[email-masked]]
Sent: Tuesday, September 17, 2013 11:12 AM
To: Linda Dunbar; [email-masked]
Subject: RE: [vnfpool] Will mutliple instances for one Network function be physically located together?

Hi Linda,

Important question, but made ambiguous by your use of "Network function". Maybe there is a definition somewhere that would help me.

My original view of this was that we probably wanted to place in scope of VNFpool any "service function" that might be chained (cf. NSC/SFC work). In this case, there are definitely services that might be placed in different DCs or on different isolated servers, so the best we can do is know that they're accessed through different IP addresses.

Cheers,
Adrian

From: [email-masked] [mailto:[email-masked]] On Behalf Of Linda Dunbar
Sent: 17 September 2013 17:06
To: [email-masked]
Subject: [vnfpool] Will mutliple instances for one Network function be physically located together?

Linda Dunbar

---

From: Melinda Shore <[email-masked]>
Date: Tue, 17 Sep 2013 09:13:24 -0800

On 9/17/13 8:35 AM, Linda Dunbar wrote:
> I am actually thinking of functions performed by today’s Network 
> Appliances.

"Network appliances" - it's terminology all the way down.
I'd probably stick with something that's already fairly well-
understood.  In your examples:

> *Service Function (most commonly Layer 4-7 service functions):  a 
> functional module that performs Layer 4 to 7 functions, such as 
> Firewall, DPI, TCP accelerator, NAT, etc. *

These are all functions that are currently performed
by what we call "middleboxes," which is a well-defined
term (in fact, there's an RFC: 3234).  However, I think
this is the time to be asking whether or not there's
an intent to limit the scope to middleboxes and network
intermediaries, or if there's an interest in using it
for things lower in the stack (and I'd argue that if so,
doing this would be orthogonal to i2rs and not redundant
with it).

Melinda

-- 
Melinda Shore
No Mountain Software
[email-masked]

"Software longa, hardware brevis."

---

From: Thomas Narten <[email-masked]>
Date: Tue, 17 Sep 2013 16:12:03 -0400

Linda Dunbar <[email-masked]> writes:
              
> Conventional method is to lump multiple instances of one network
>  function in one subnet for ease of management or convenience. Do
>  people agree?

This is a common practice in existing networks. I.e., a tight coupling
between the service and the physical network (i.e, so that the data
plane forwarding can be used to steer traffic that needs to go through
the service to the service).

However, this model (tight coupling between service deployment and
underlying physical network) is increasingly problematic.  Indeed, NSC
is all about moving away from the older model.

So, when we talk about services instance, I do not think we want
assume or require that they be on the same subnet.

Thomas

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 17 Sep 2013 22:52:41 +0000

Thomas, 

Thanks for the feedback. 
Questions inserted below:

> -----Original Message-----
> 

[Linda] With NVO3, instances of one subnet don't have to be collocated. 
The scenario that I am thinking of is multiple instances for the same function. For example, there are 100 FireWall (FW) instances in the network. May be 2~4 FW instances are designated for Client #i. Could those 2~4 instances for one client be in one subnet?  

The same client could also have 3~4 instances of Web Optimization. Are those 3~4 instances in one subnet.  What matters to "vnfpool" is the range of instances in one pool. Are those instances for same function? 

Linda

---

From: Qin Wu <[email-masked]>
Date: Wed, 18 Sep 2013 01:16:33 +0000

I guess "network function" quoted by Linda is referred to in line service ,e.g., firewall, load balancer, but may be not limited to inline box,.e.g, L3 function providing forwarding service.

I think the advantage of putting multiple instances for one inline service together in the same box or several boxes that are close to each other provides high reliability or more resilience since when
any instance fails or breakdown, the downtime could be very few and recover could be very quick.

however the downside of this layout is causing all the instances share the risk, e.g., once the server host all these instances fails, all the active instance
And standby instance are not available.

Regards!
-Qin
From: [email-masked] [mailto:[email-masked]] On Behalf Of Adrian Farrel
Sent: Wednesday, September 18, 2013 12:12 AM
To: Linda Dunbar; [email-masked]
Subject: Re: [vnfpool] Will mutliple instances for one Network function be physically located together?

Hi Linda,

Cheers,
Adrian

Linda Dunbar

---

From: Thomas Narten <[email-masked]>
Date: Wed, 18 Sep 2013 07:18:31 -0400

Linda,

> [Linda] With NVO3, instances of one subnet don't have to be
> collocated.  The scenario that I am thinking of is multiple
> instances for the same function. For example, there are 100 FireWall
> (FW) instances in the network. May be 2~4 FW instances are
> designated for Client #i. Could those 2~4 instances for one client
> be in one subnet?

Sure they could. But we shouldn't assume they MUST be (or even will
be). If folk want to put them into the same subnet (for whatever
reason), that should be allowed. But we shouldn't assume this will
always be done and then bake such an assumption into the architecture
or protocols.

> The same client could also have 3~4 instances of Web
> Optimization. Are those 3~4 instances in one subnet.

Maybe, maybe not. (Same argument as above.)

Thomas