Software-Defined Networking (SDN)-based IPsec Flow Protection
draft-abad-i2nsf-sdn-ipsec-flow-protection-01

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03

I2NSF                                                     R. Marin-Lopez
Internet-Draft                                           G. Lopez-Millan
Intended status: Experimental                       University of Murcia
Expires: May 3, 2017                                         S. Varadhan
                                                                  Oracle
                                                        October 30, 2016

     Software-Defined Networking (SDN)-based IPsec Flow Protection
             draft-abad-i2nsf-sdn-ipsec-flow-protection-01

Abstract

   This document describes the use case of providing IPsec-based flow
   protection by means of a Software-Defined Network (SDN) controller
   and raises the requirements to support this service.  It considers
   two main scenarios: (i) gateway-to-gateway and (ii) host-to-gateway
   (Road Warrior).  For the gateway-to-gateway scenario, this document
   describes a mechanism to support the distribution of IPsec
   information to flow-based Network Security Functions (NSFs) that
   implements IPsec to protect data traffic.  between network resources
   to protect data traffic with IPsec and IKE, in intra and inter-SDN
   cases.  The host-to-gateway case defines a mechanism to distribute
   IPsec information to the NSF to protect data with IPsec between an
   end user's device (host) and a gateway.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on May 3, 2017.

Copyright Notice

   Copyright (c) 2016 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

Marin-Lopez, et al.        Expires May 3, 2017                  [Page 1]
Internet-Draft     SDN IPsec Flow Protection Services       October 2016

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Requirements Language . . . . . . . . . . . . . . . . . . . .   4
   3.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   4
   4.  Objectives  . . . . . . . . . . . . . . . . . . . . . . . . .   5
   5.  Case 1: IKE/IPsec in the NSF  . . . . . . . . . . . . . . . .   5
     5.1.  Requirements  . . . . . . . . . . . . . . . . . . . . . .   6
   6.  Case 2: IPsec (no IKE) in the NSF . . . . . . . . . . . . . .   7
     6.1.  Requirements  . . . . . . . . . . . . . . . . . . . . . .   8
   7.  Abstract interface (NSF facing interface) . . . . . . . . . .   8
   8.  Data model  . . . . . . . . . . . . . . . . . . . . . . . . .  11
   9.  Scaling considerations  . . . . . . . . . . . . . . . . . . .  13
   10. Use cases examples  . . . . . . . . . . . . . . . . . . . . .  13
     10.1.  Gateway-to-gateway under the same controller . . . . . .  13
     10.2.  Gateway-to-gateway under different SDN controllers . . .  16
     10.3.  Host-to-gateway  . . . . . . . . . . . . . . . . . . . .  18
   11. Security Considerations . . . . . . . . . . . . . . . . . . .  20
   12. Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  20
   13. References  . . . . . . . . . . . . . . . . . . . . . . . . .  20
     13.1.  Normative References . . . . . . . . . . . . . . . . . .  20
     13.2.  Informative References . . . . . . . . . . . . . . . . .  21
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  22

1.  Introduction

   Software-Defined Networking (SDN) is an architecture that enables
   users to directly program, orchestrate, control and manage network
   resources through software.  SDN paradigm relocates the control of
   network resources to a dedicated network element, namely SDN
   controller.  The SDN controller manages and configures the
   distributed network resources and provides an abstracted view of the
   network resources to the SDN applications.  The SDN application can