Applicability of Interfaces to Network Security Functions to Network-Based Security Services
draft-ietf-i2nsf-applicability-18

[Ballot comment]
[Thank you for addressing my discuss.]

This document does provide a little more detailed view (than rfc8329) of the I2NSF Framework in that it does reference the models that make it up. 

In order for this document to be an Applicability Statement, I believe that significant work is needed to go beyond showing where the models fit, I am then ABSTAINing and won't stand in the way of publication.

[Ballot comment]
The use cases (and not an applicability statement) described in the document appear quite hypothetical and rather disconnected from practical network design and engineering principles as seen in the field. The whole document reads more as a marketing functionality demonstration rather than a set of framwework principles and reasoning behind those principles that would be expected to be found in an applicability statement.

[Ballot discuss]
This document does provide a little more detailed view (than rfc8329) of the I2NSF Framework in that it does reference the models that make it up.  However, these references are all Informative.  I am Balloting DISCUSS because if the intent is to explain how the models apply to the scenarios, then their references should be Normative.  I think this is an easy point to address.

Regardless of the type of reference, I agree with others in the fact that this document presents use cases.  While there is a deliverable in the WG Charter related to use cases, I think that was satisfied by rfc8192 (Interface to Network Security Functions (I2NSF): Problem Statement and Use Cases).  My understanding of the Charter is similar to Mirja's from the "Data Models and Applicability Statements" milestone. 

In order for this document to be an Applicability Statement, I believe that significant work is needed.  This point is not part of my DISCUSS, so I will most likely end up ABSTAINing if the document remains in its current form.

[Ballot comment]
I don’t see that this is an applicability statement (see the meaning of that in RFC 2026).  This is describing use cases, which is fine, but is not what it appears to be saying it’s doing, and doesn’t seem to have long-term value.

[Ballot comment]
I largely agree with Mirja. The shepherd write-up says this document is called for in the WG charter, but I don't find that text in the charter. It's unclear why this document needs to be published as an RFC.

[Ballot comment]
I find the title of this document rather misleading as the doc mainly outlines use cases. I would have expected that the boundaries of the applicability of i2nsf to certain scenarios are discussed which is not the case. My understanding from the charter would further be that an applicability statement is connected to a specific data model (and I would also have expected that statement to be published in the same document).

One minor additional comment: I'm surprised to only see a reference to AVANT-GUARD but no mentioning of the IETF DOTS effort....

Shepherd Write-up for draft-ietf-i2nsf-applicability-14

(1) What type of RFC is being requested (BCP, Proposed Standard, Internet Standard, Informational, Experimental, or Historic)? Why is this the proper type of RFC? Is this type of RFC indicated in the title page header?

This document is requested for publication as an Informational RFC.
It is appropriate to be published as “informational RFC” because there is no protocol or extension specified by the draft.

(2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections:

Technical Summary

This document describes the applicability of Interface to Network Security Functions (I2NSF) to network-based security services in Network Functions Virtualization (NFV) environments, such as firewall, deep packet inspection, or attack mitigation engines.

Working Group Summary
Was the document considered in any WG, and if so, why was it not adopted as a work item there? Was there controversy about particular points that caused the WG to not adopt the document?

This document is specifically written for I2NSF WG as one of the milestones specified by the I2NSF Charter. This document is not considered by any other WGs.
There was nothing exceptional in the WG processing for this document.
There was careful debate resulting in merging contents from other drafts into this document. 

Document Quality
Are there existing implementations of the protocol? Have a significant number of vendors indicated their plan to implement the specification? Are there any reviewers that merit special mention as having done a thorough review, e.g., one that resulted in important changes or a conclusion that the document had no substantive issues? If there was a MIB Doctor, Media Type or other expert review, what was its course (briefly)? In the case of a Media Type review, on what date was the request posted?

This applicability document is not directly implementable, but it describes how I2NSF work are used in NFV environment, to achieve software defined security policy enforcement.  At least two organizations are building a system based on the work of the working group and following this approach as an architecture. There has also been experimentation at IETF hackathons that is consistent with the work.

Personnel
Who is the Document Shepherd? Who is the Responsible Area Director?

Linda Dunbar (linda.dunbar@huawei.com) is the document shepherd.
Roman Danyliw (rdd@cert.org) is the responsible AD.

(3) Briefly describe the review of this document that was performed by the Document Shepherd. If this version of the document is not ready for publication, please explain why the document is being forwarded to the IESG.

This revision and the previous revision were reviewed by the document shepherd. All comments arising from the reviews have been addressed.
The document is ready for publication.

(4) Does the document Shepherd have any concerns about the depth or breadth of the reviews that have been performed?

No, The WG is small, but there were a good number of sound reviews. Document shepherd had suggested to include contents from two other drafts.

(5) Do portions of the document need review from a particular or from broader perspective, e.g., security, operational complexity, AAA, DNS, DHCP, XML, or internationalization? If so, describe the review that took place.

Not required, but the content of the document has been shared with Open Network User Group (ONUG) Software Defined Security Service WG.

(6) Describe any specific concerns or issues that the Document Shepherd has with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the interested community has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here.

No. This document is specifically noted as a deliverable in the WG charter.

(7) Has each author confirmed that any and all appropriate IPR disclosures required for full conformance with the provisions of BCP 78 and BCP 79 have already been filed. If not, explain why.

The authors have been explicitly reminded of their responsibilities under BCP 78 and 79. By placing their names as authors of the document they have acknowledged those BCPs and agreed to comply with the terms of the IETF's IP policies.

(8) Has an IPR disclosure been filed that references this document? If so, summarize any discussion and conclusion regarding the IPR disclosures.

No. There is no IPR disclosure being filed in reference to this document.
All authors of the document have confirmed that there is no IPR associated with the draft.

(9) How solid is the consensus of the interested community behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the interested community as a whole understand and agree with it?

Good.
There has been review and supporting positions across the WG.

(10) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is publicly available.)

No.

(11) Identify any ID nits the Document Shepherd has found in this document. (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts Checklist). Boilerplate checks are not enough; this check needs to be thorough.

No.

(12) Describe how the document meets any required formal review criteria, such as the MIB Doctor, media type, and URI type reviews.

Not applicable. There is no MIB specified by the document.

(13) Have all references within this document been identified as either normative or informative?

The document only has informative references.

(14) Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the plan for their completion?

No

(15) Are there downward normative references references (see RFC 3967)? If so, list these downward references to support the Area Director in the Last Call procedure.

No

(16) Will publication of this document change the status of any existing RFCs? Are those RFCs listed on the title page header, listed in the abstract, and discussed in the introduction? If the RFCs are not listed in the Abstract and Introduction, explain why, and point to the part of the document where the relationship of this document to the other RFCs is discussed. If this information is not in the document, explain why the interested community considers it unnecessary.

No

(17) Describe the Document Shepherd's review of the IANA considerations section, especially with regard to its consistency with the body of the document. Confirm that all protocol extensions that the document makes are associated with the appropriate reservations in IANA registries. Confirm that any referenced IANA registries have been clearly identified. Confirm that newly created IANA registries include a detailed specification of the initial contents for the registry, that allocations procedures for future registrations are defined, and a reasonable name for the new registry has been suggested (see RFC 5226).

Not Applicable, as there is no IANA assignments needed by the document.

(18) List any new IANA registries that require Expert Review for future allocations. Provide any public guidance that the IESG would find useful in selecting the IANA Experts for these new registries.

Not Applicable, as there is no IANA assignments needed by the document.

(19) Describe reviews and automated checks performed by to validate sections of the document written in a formal language, such as XML code, BNF rules, MIB definitions, etc.

No such section, no such review.

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

The IANA Functions Operator has reviewed draft-ietf-i2nsf-applicability-13, which is currently in Last Call, and has the following comments:

We understand that this document doesn't require any registry actions.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, we do not object.

If this assessment is not accurate, please respond as soon as possible.

Thank you,

Sabrina Tanamal
Senior IANA Services Specialist

The following Last Call announcement was sent out (ends 2019-07-08):

From: The IESG
To: IETF-Announce
CC: rdd@cert.org, draft-ietf-i2nsf-applicability@ietf.org, i2nsf@ietf.org, Linda.dunbar@huawei.com, Linda Dunbar , i2nsf-chairs@ietf.org
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (Applicability of Interfaces to Network Security Functions to Network-Based Security Services) to Informational RFC


The IESG has received a request from the Interface to Network Security
Functions WG (i2nsf) to consider the following document: - 'Applicability of
Interfaces to Network Security Functions to Network-
  Based Security Services'
  as Informational RFC

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2019-07-08. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract


  This document describes the applicability of Interface to Network
  Security Functions (I2NSF) to network-based security services in
  Network Functions Virtualization (NFV) environments, such as
  firewall, deep packet inspection, or attack mitigation engines.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-i2nsf-applicability/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-i2nsf-applicability/ballot/


No IPR declarations have been submitted directly on this I-D.

Shepherd Write-up for draft-ietf-i2nsf-applicability-7

(1) What type of RFC is being requested (BCP, Proposed Standard, Internet Standard, Informational, Experimental, or Historic)? Why is this the proper type of RFC? Is this type of RFC indicated in the title page header?

This document is requested for publication as an Informational RFC.
It is appropriate to be published as “informational RFC” because there is no protocol or extension specified by the draft.

(2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections:

Technical Summary

This document describes the applicability of Interface to Network Security Functions (I2NSF) to network-based security services in Network Functions Virtualization (NFV) environments, such as firewall, deep packet inspection, or attack mitigation engines.

Working Group Summary
Was the document considered in any WG, and if so, why was it not adopted as a work item there? Was there controversy about particular points that caused the WG to not adopt the document?

This document is specifically written for I2NSF WG as one of the milestones specified by the I2NSF Charter. This document is not considered by any other WGs.
There was nothing exceptional in the WG processing for this document.
There was careful debate resulting in merging contents from other drafts into this document. 

Document Quality
Are there existing implementations of the protocol? Have a significant number of vendors indicated their plan to implement the specification? Are there any reviewers that merit special mention as having done a thorough review, e.g., one that resulted in important changes or a conclusion that the document had no substantive issues? If there was a MIB Doctor, Media Type or other expert review, what was its course (briefly)? In the case of a Media Type review, on what date was the request posted?

This applicability document is not directly implementable, but it describes how I2NSF work are used in NFV environment, to achieve software defined security policy enforcement.  At least two organizations are building a system based on the work of the working group and following this approach as an architecture. There has also been experimentation at IETF hackathons that is consistent with the work.

Personnel
Who is the Document Shepherd? Who is the Responsible Area Director?

Linda Dunbar (linda.dunbar@huawei.com) is the document shepherd.
Eric Rescorla (ekr@rtfm.com) is the responsible AD.

(3) Briefly describe the review of this document that was performed by the Document Shepherd. If this version of the document is not ready for publication, please explain why the document is being forwarded to the IESG.

This revision and the previous revision were reviewed by the document shepherd. All comments arising from the reviews have been addressed.
The document is ready for publication.

(4) Does the document Shepherd have any concerns about the depth or breadth of the reviews that have been performed?

No, The WG is small, but there were a good number of sound reviews. Document shepherd had suggested to include contents from two other drafts.

(5) Do portions of the document need review from a particular or from broader perspective, e.g., security, operational complexity, AAA, DNS, DHCP, XML, or internationalization? If so, describe the review that took place.

Not required, but the content of the document has been shared with Open Network User Group (ONUG) Software Defined Security Service WG.

(6) Describe any specific concerns or issues that the Document Shepherd has with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the interested community has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here.

No. This document is specifically noted as a deliverable in the WG charter.

(7) Has each author confirmed that any and all appropriate IPR disclosures required for full conformance with the provisions of BCP 78 and BCP 79 have already been filed. If not, explain why.

The authors have been explicitly reminded of their responsibilities under BCP 78 and 79. By placing their names as authors of the document they have acknowledged those BCPs and agreed to comply with the terms of the IETF's IP policies.

(8) Has an IPR disclosure been filed that references this document? If so, summarize any discussion and conclusion regarding the IPR disclosures.

No. There is no IPR disclosure being filed in reference to this document.
All authors of the document have confirmed that there is no IPR associated with the draft.

(9) How solid is the consensus of the interested community behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the interested community as a whole understand and agree with it?

Good.
There has been review and supporting positions across the WG.

(10) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is publicly available.)

No.

(11) Identify any ID nits the Document Shepherd has found in this document. (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts Checklist). Boilerplate checks are not enough; this check needs to be thorough.

No.

(12) Describe how the document meets any required formal review criteria, such as the MIB Doctor, media type, and URI type reviews.

Not applicable. There is no MIB specified by the document.

(13) Have all references within this document been identified as either normative or informative?

The document only has informative references.

(14) Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the plan for their completion?

No

(15) Are there downward normative references references (see RFC 3967)? If so, list these downward references to support the Area Director in the Last Call procedure.

No

(16) Will publication of this document change the status of any existing RFCs? Are those RFCs listed on the title page header, listed in the abstract, and discussed in the introduction? If the RFCs are not listed in the Abstract and Introduction, explain why, and point to the part of the document where the relationship of this document to the other RFCs is discussed. If this information is not in the document, explain why the interested community considers it unnecessary.

No

(17) Describe the Document Shepherd's review of the IANA considerations section, especially with regard to its consistency with the body of the document. Confirm that all protocol extensions that the document makes are associated with the appropriate reservations in IANA registries. Confirm that any referenced IANA registries have been clearly identified. Confirm that newly created IANA registries include a detailed specification of the initial contents for the registry, that allocations procedures for future registrations are defined, and a reasonable name for the new registry has been suggested (see RFC 5226).

Not Applicable, as there is no IANA assignments needed by the document.

(18) List any new IANA registries that require Expert Review for future allocations. Provide any public guidance that the IESG would find useful in selecting the IANA Experts for these new registries.

Not Applicable, as there is no IANA assignments needed by the document.

(19) Describe reviews and automated checks performed by to validate sections of the document written in a formal language, such as XML code, BNF rules, MIB definitions, etc.

No such section, no such review.