A Framework for Network Slices in Networks Built from IETF Technologies

4.1. Definition and Scope of IETF Network Slice

The term "Slice" refers to a set of characteristics and behaviors that differentiate one type of user-traffic from another within a network. An IETF Network Slice is a logical partition of a network that uses IETF technology. An IETF Network Slice assumes that an underlay network is capable of changing the configurations of the network devices on demand, through in-band signaling, or via controllers.¶

An IETF Network Slice enables connectivity between a set of SDPs with specific Service Level Objectives (SLOs) and Service Level Expectations (SLEs) (see Section 5) over a common underlay network. The SLOs and SLEs characterize the performance of the underlay network between a sending SDP and a set of receiving SDPs. Thus, an IETF Network Slice delivers a service to a customer by meeting connectivity resource requirements and associated network capabilities such as bandwidth, latency, jitter, and network functions with other resource behaviors such as compute and storage availability.¶

IETF Network Slices may be combined hierarchically, so that a network slice may itself be sliced. They may also be combined sequentially so that various different networks can each be sliced and the network slices placed into a sequence to provide an end-to-end service. This form of sequential combination is utilized in some services such as in 3GPP's 5G network [TS23501].¶

RFC EDITOR NOTE: Please replace XXXX in the paragraph that follows with the RFC number assigned to this document, and remove this note.¶

It is intended that the term "IETF Network Slice" is used only this document. Other documents that need to indicate the type of network slice described in this document can use the term "RFC XXXX Network Slice".¶

4.2. IETF Network Slice Service

A service provider delivers an IETF Network Slice Service for a customer by realizing an IETF Network Slice in the underlay network. The IETF Network Slice Service is agnostic to the technology of the underlay network, and its realization may be selected based upon multiple considerations including its service requirements and the capabilities of the underlay network. This allows an IETF Network Slice Service customer to describe their network connectivity and relevant objectives in a common format, independent of the underlay technologies used.¶

The IETF Network Slice Service is specified in terms of a set of SDPs, a set of one or more connectivity constructs between subsets of these SDPs, and a set of SLOs and SLEs (see Section 5) for each SDP sending to each connectivity construct. A communication type (point-to-point (P2P), point-to-multipoint (P2MP), or any-to-any (A2A)) is specified for each connectivity construct. That is, in a given IETF Network Slice Service there may be one or more connectivity constructs of the same or different type, each connectivity construct may be between a different subset of SDPs, for a given connectivity construct each sending SDP has its own set of SLOs and SLEs, and the SLOs and SLEs in each set may be different. Note that different connectivity constructs can be specified in the service request, but the service provider may decide how many connectivity constructs per IETF Network Slice Service it wishes to support such that an IETF Network Slice Service may be limited to one connectivity construct or may support many.¶

An IETF Network Slice Service customer may provide IETF Network Slice Services to other customers in a mode sometimes referred to as "carrier's carrier" (see Section 9 of [RFC4364]). In this case, the relationship between IETF Network Slice Service providers may be internal to a commercial organization, or may be external through service provision contracts. As noted in Section 5.3, network slices may be composed hierarchically or serially.¶

Section 5.2 provides a description of SDPs as endpoints in the context of IETF network slicing. For a given IETF Network Slice Service, the customer and provider agree, on a per-SDP basis which end of the attachment circuit provides the SDP (i.e., whether the attachment circuit is inside or outside the IETF Network Slice Service). This determines whether the attachment circuit is subject to the set of SLOs and SLEs at the specific SDP.¶

RFC EDITOR NOTE: Please replace XXXX in the paragraph that follows with the RFC number assigned to this document, and remove this note.¶

It is intended that the term "IETF Network Slice Service" is used only this document. Other documents that need to indicate the type of network slice service described in this document can use the term "RFC XXXX Network Slice Service".¶

5.2. IETF Network Slice Service Demarcation Points

As noted in Section 4.1, an IETF Network Slice provides connectivity between sets of SDPs with specific SLOs and SLEs. Section 4.2 goes on to describe how the IETF Network Slice Service is composed of a set of one or more connectivity constructs that describe connectivity between the Service Demarcation Points (SDPs) across the underlay network.¶

The characteristics of IETF Network Slice SDPs are as follows.¶

• An SDP is the point of attachment to an IETF Network Slice Service. As such, SDPs serve as the IETF Network Slice ingress/egress points.¶
• An SDP is identified by a unique identifier in the context of an IETF Network Slice Service customer.¶
• The provider associates each SDP with a set of provider-scope identifiers such as IP addresses, encapsulation-specific identifiers (e.g., VLAN tag, MPLS Label), interface/port numbers, node ID, etc.¶

• SDPs are mapped to endpoints of services/tunnels/paths within the IETF Network Slice during its initialization and realization.¶

  • A combination of the SDP identifier and SDP provider-network-scope identifiers define an SDP in the context of the Network Slice Controller (NSC) (see Section 6.3).¶
  • The NSC will use the SDP provider-network-scope identifiers as part of the process of realizing the IETF Network Slice.¶

Note that an ancillary CE (see Section 4.2.3) is the endpoint of a connectivity construct and so is an SDP in this discussion.¶

For a given IETF Network Slice Service, the customer and provider agree where the SDP is located. This determines what resources at the edge of the network form part of the IETF Network Slice and are subject to the set of SLOs and SLEs for a specific SDP.¶

Figure 1 shows different potential scopes of an IETF Network Slice that are consistent with the different SDP locations. For the purpose of this discussion and without loss of generality, the figure shows customer edge (CE) and provider edge (PE) nodes connected by attachment circuits (ACs). Notes after the figure give some explanations.¶

         |<---------------------- (1) ---------------------->|
         |                                                   |
         | |<-------------------- (2) -------------------->| |
         | |                                               | |
         | |        |<----------- (3) ----------->|        | |
         | |        |                             |        | |
         | |        |  |<-------- (4) -------->|  |        | |
         | |        |  |                       |  |        | |
         V V   AC   V  V                       V  V   AC   V V
     +-----+   |    +-----+                 +-----+    |   +-----+
     |     |--------|     |                 |     |--------|     |
     | CE1 |   |    | PE1 |. . . . . . . . .| PE2 |    |   | CE2 |
     |     |--------|     |                 |     |--------|     |
     +-----+   |    +-----+                 +-----+    |   +-----+
        ^              ^                       ^              ^
        |              |                       |              |
        |              |                       |              |
     Customer       Provider                Provider       Customer
     Edge 1         Edge 1                  Edge 2         Edge 2

Explanatory notes for Figure 1 are as follows:¶

1. If the CE is operated by the IETF Network Slice Service provider, then the edge of the IETF Network Slice may be within the CE. In this case the IETF Network Slicing process may utilize resources from within the CE such as buffers and queues on the outgoing interfaces.¶
2. The IETF Network Slice may be extended as far as the CE, to include the AC, but not to include any part of the CE. In this case, the CE may be operated by the customer or the provider. Slicing the resources on the AC may require the use of traffic tagging (such as through Ethernet VLAN tags) or may require traffic policing at the AC link ends.¶
3. The SDPs of the IETF Network Slice are the customer-facing ports on the PEs. This case can be managed in a way that is similar to a port-based VPN: each port (AC) or virtual port (e.g., VLAN tag) identifies the IETF Network Slice and maps to an IETF Network Slice SDP.¶
4. Finally, the SDP may be within the PE. In this mode, the PE classifies the traffic coming from the AC according to information (such as the source and destination IP addresses, payload protocol and port numbers, etc.) in order to place it onto an IETF Network Slice.¶

The choice of which of these options to apply is entirely up to the network operator. It may limit or enable the provisioning of particular managed services and the operator will want to consider how they want to manage CEs and what control they wish to offer the customer over AC resources.¶

Note that Figure 1 shows a symmetrical positioning of SDPs, but this decision can be taken on a per-SDP basis through agreement between the customer and provider.¶

In practice, it may be necessary to map traffic not only onto an IETF Network Slice, but also onto a specific connectivity construct if the IETF Network Slice supports more than one with a source at the specific SDP. The mechanism used will be one of the mechanisms described above, dependent on how the SDP is realized.¶

Finally, note (as described in Section 3.2) that an SDP is an abstract endpoint of an IETF Network Slice Service and as such may be a device, interface, or software component. An ancillary CE (Section 4.2.3) should also be thought of as an SDP.¶

5.3. IETF Network Slice Composition

Operationally, an IETF Network Slice may be composed of two or more IETF Network Slices as specified below. Decomposed network slices are independently realized and managed.¶

• Hierarchical (i.e., recursive) composition: An IETF Network Slice can be further sliced into other network slices. Recursive composition allows an IETF Network Slice at one layer to be used by the other layers. This type of multi-layer vertical IETF Network Slice associates resources at different layers.¶
• Sequential composition: Different IETF Network Slices can be placed into a sequence to provide an end-to-end service. In sequential composition, each IETF Network Slice would potentially support different dataplanes that need to be stitched together.¶

6.1. IETF Network Slice Stakeholders

An IETF Network Slice and its realization involve the following stakeholders.¶

Orchestrator:

An orchestrator is an entity that composes different services, resource, and network requirements. It interfaces with the IETF NSC when composing a complex service such as an end-to-end network slice.¶

IETF Network Slice Controller (NSC):

The NSC realizes an IETF Network Slice in the underlay network, and maintains and monitors the run-time state of resources and topologies associated with it. A well-defined interface is needed to support interworking between different NSC implementations and different orchestrator implementations.¶

Network Controller:

The Network Controller is a form of network infrastructure controller that offers network resources to the NSC to realize a particular network slice. This may be an existing network controller associated with one or more specific technologies that may be adapted to the function of realizing IETF Network Slices in a network.¶

The IETF Network Slice Service customer and IETF Network Slice Service provider (see Section 3.2) are also stakeholders. Clearly the service provider operates the network that is sliced to provide the IETF Network Slice Service to the customer. The Network Controller and NSC are management components used by the service provider to operate their networks and deliver IETF Network Slice Services. As indicated in Figure 2 and Figure 3, the Orchestrator may be a component in the customer environment that requests and coordinates IETF Network Slice Services from one or more service providers. In other circumstances, however, the Orchestrator may be a component used by the service provider to request and administer IETF Network Slices to deliver them to customers or to construct an infrastructure to deliver other services to the customer.¶

6.2. Expressing Connectivity Intents

An IETF Network Slice Service customer communicates with the NSC using the IETF Network Slice Service Interface.¶

An IETF Network Slice Service customer may be a network operator who, in turn, uses the IETF Network Slice to provide a service for another IETF Network Slice Service customer.¶

Using the IETF Network Slice Service Interface, a customer expresses requirements for a particular slice by specifying what is required rather than how that is to be achieved. That is, the customer's view of a slice is an abstract one. Customers normally have limited (or no) visibility into the provider network's actual topology and resource availability information.¶

This should be true even if both the customer and provider are associated with a single administrative domain, in order to reduce the potential for adverse interactions between IETF Network Slice Service customers and other users of the underlay network infrastructure.¶

The benefits of this model can include the following.¶

• Security: The underlay network components are less exposed to attack because the underlay network (or network operator) does not need to expose network details (topology, capacity, etc.) to the IETF Network Slice Service customers.¶
• Layered Implementation: The underlay network comprises network elements that belong to a different layer network than customer applications. Network information (advertizements, protocols, etc.) that a customer cannot interpret or respond to is not exposed to the customer. (Note - a customer should not rely network information not exposed directly by to the customer by the network operator, such as via the IETF Network Slice Service Interface.)¶
• Scalability: Customers do not need to know any information concerning network topology, capabilities, or state beyond that which is exposed via the IETF Network Slice Service Interface. This protects the customer site from having to hold and process extra information, and from receiving frequent updates about the status of the network.¶

The general issues of abstraction in a Traffic Engineered (TE) network are described more fully in [RFC7926].¶

This framework document does not assume any particular technology layer at which IETF Network Slices operate. A number of layers (including virtual L2, Ethernet, or IP connectivity) could be employed.¶

Data models and interfaces are needed to set up IETF Network Slices, and specific interfaces may have capabilities that allow creation of slices within specific technology layers.¶

Layered virtual connections are comprehensively discussed in other IETF documents. See, for instance, GMPLS-based networks [RFC5212] and [RFC4397], or Abstraction and Control of TE Networks (ACTN) [RFC8453] and [RFC8454]. The principles and mechanisms associated with layered networking are applicable to IETF Network Slices.¶

There are several IETF-defined mechanisms for expressing the need for a desired logical network. The IETF Network Slice Service Interface carries data either in a protocol-defined format, or in a formalism associated with a modeling language.¶

For instance:¶

• The Path Computation Element (PCE) Communication Protocol (PCEP) [RFC5440] and GMPLS User-Network Interface (UNI) using RSVP-TE [RFC4208] use a TLV-based binary encoding to transmit data.¶
• The Network Configuration Protocol (NETCONF) [RFC6241] and RESTCONF Protocol [RFC8040] use XML and JSON encoding.¶
• gRPC/GNMI [I-D.openconfig-rtgwg-gnmi-spec] uses a binary encoded programmable interface. ProtoBufs can be used to model gRPC and GNMI data.¶
• For data modeling, YANG ([RFC6020] and [RFC7950]) may be used to model configuration and other data for NETCONF, RESTCONF, and GNMI, among others.¶

While several generic formats and data models for specific purposes exist, it is expected that IETF Network Slice management may require enhancement or augmentation of existing data models. Further, it is possible that mechanisms will be needed to determine the feasibility of service requests before they are actually made.¶

6.3. IETF Network Slice Controller (NSC)

An IETF NSC takes requests for IETF Network Slice Services and implements them using a suitable underlay technology. An IETF NSC is the key component for control and management of the IETF Network Slice. It provides the creation/modification/deletion, monitoring, and optimization of IETF Network Slices in a multi-domain, multi-technology, and multi-vendor environment.¶

The main task of an IETF NSC is to map abstract IETF Network Slice Service requirements to concrete technologies and establish required connectivity ensuring that resources are allocated to the IETF Network Slice as necessary.¶

The IETF Network Slice Service Interface is used for communicating details of an IETF Network Slice Service (configuration, selected policies, operational state, etc.), as well as information about status and performance of the IETF Network Slice. The details for this IETF Network Slice Service Interface are not in scope for this document, but further considerations of the requirements are discussed in [I-D.ietf-teas-ietf-network-slice-use-cases].¶

The controller provides the following functions.¶

• Exposes an IETF Network Slice Service Interface for creation/modification/deletion of the IETF Network Slices that is agnostic to the technology of the underlay network. This API communicates the Service Demarcation Points of the IETF Network Slice, SLO parameters (and possibly monitoring thresholds), applicable input selection (filtering) and various policies. If SLEs have been agreed between the customer and the network operator, and if they are supported for the IETF Network Slice Service, the API will also allow SLEs to be selected for the IETF Network Slice, and will allow any associated parameters to be set. The API also provides a way to monitor the slice.¶
• Determines an abstract topology connecting the SDPs of the IETF Network Slice that meets criteria specified via the IETF Network Slice Service Interface. The NSC also retains information about the mapping of this abstract topology to underlay components of the IETF Network Slice as necessary to monitor IETF Network Slice status and performance.¶

• Supports "Mapping Functions" for the realization of IETF Network Slices. In other words, it will use the mapping functions that:¶

  • Map IETF Network Slice Service Interface requests that are agnostic to the technology of the underlay network to technology-specific network configuration interfaces.¶
  • Map filtering/selection information to entities in the underlay network so that those entities are able to identify what traffic is associated with which connectivity construct and IETF network slice.¶
  • Depending on the realization solution, map to entities in the underlay network according to how traffic should be treated to meet the SLOs and SLEs of the connectivity construct.¶
• Collects telemetry data (e.g., OAM results, statistics, states, etc.) via a network configuration interface for all elements in the abstract topology used to realize the IETF Network Slice.¶
• Evaluates the current performance against IETF Network Slice SLO parameters using telemetry data from the underlying realization of an IETF Network Slice (e.g., services/paths/tunnels). Exposes this performance to the IETF Network Slice Service customer via the IETF Network Slice Service Interface. The IETF Network Slice Service Interface may also include the capability to provide notifications if the IETF Network Slice performance reaches threshold values defined by the IETF Network Slice Service customer.¶

     +------------------------------------------+
     | Customer higher level operation system   |
     |  (e.g., E2E network slice orchestrator,  |
     |     customer network management system)  |
     +------------------------------------------+
                          A
                          | IETF Network Slice Service Interface
                          V
     +------------------------------------------+
     |    IETF Network Slice Controller (NSC)   |
     +------------------------------------------+
                          A
                          | Network Configuration Interface
                          V
     +------------------------------------------+
     |           Network Controllers            |
     +------------------------------------------+

      --------------
     | Network      |
     | Slice        |
     | Orchestrator |
      --------------
       | IETF Network Slice
       | Service Request
       |                       Customer view
   ....|................................
      -v-------------------    Operator view
     |Controller           |
     |  ------------       |
     | | IETF       |      |
     | | Network    |      |--> Virtual Network
     | | Slice      |      |
     | | Controller |      |
     | | (NSC)      |      |
     |  ------------       |
   ..|     | Network       |............
     |     | Configuration |   Underlay Network
     |     v               |
     |  ------------       |
     | | Network    |      |
     | | Controller |      |
     | | (NC)       |      |
     |  ------------       |
      ---------------------
       | Device Configuration
       v

7.1. An Architecture to Realize IETF Network Slices

The architecture described in this section is deliberately at a high level. It is not intended to be prescriptive: implementations and technical solutions may vary freely. However, this approach provides a common framework that other documents may reference in order to facilitate a shared understanding of the work.¶

Figure 4 shows the architectural components of a network managed to provide IETF Network Slices. The customer's view is of individual IETF Network Slice Services with their SDPs, and connectivity constructs. Requests for IETF Network Slice Services are delivered to an NSC.¶

The figure shows, without loss of generality, the CEs, ACs, and PEs, that exist in the network. The SDPs are not shown and can be placed in any of the ways described in Section 5.2.¶

                       --      --      --
                      |CE|    |CE|    |CE|
                       --      --      --
                     AC :    AC :    AC :
                     ----------------------       -------
                    ( |PE|....|PE|....|PE| )     ( IETF  )
   IETF Network    (   --:     --     :--   )   ( Network )
   Slice Service   (     :............:     )   (  Slice  )
   Request          (  IETF Network Slice  )     (       )  Customer
     v               ----------------------       -------     View
     v        ............................\........./...............
     v                                     \       /        Provider
     v    >>>>>>>>>>>>>>>  Grouping/Mapping v     v           View
     v   ^             -----------------------------------------
     v   ^            ( |PE|.......|PE|........|PE|.......|PE|  )
    ---------        (   --:        --         :--         --    )
   |         |       (     :...................:                 )
   |   NSC   |        (        Network Resource Partition       )
   |         |         -----------------------------------------
   |         |                             ^
   |         |>>>>>  Resource Partitioning |
    ---------        of Filtered Topology  |
     v   v                                 |
     v   v            -----------------------------      --------
     v   v           (|PE|..-..|PE|... ..|PE|..|PE|)    (        )
     v   v          ( :--  |P|  --   :-:  --   :--  )  (  Filter  )
     v   v          ( :.-   -:.......|P|       :-   )  ( Topology )
     v   v          (  |P|...........:-:.......|P|  )   (        )
     v   v           (  -    Filtered Topology     )     --------
     v   v            -----------------------------       ^
     v    >>>>>>>>>>>>  Topology Filter ^                /
     v        ...........................\............../...........
     v                                    \            /  Underlay
    ----------                             \          /  (Physical)
   |          |                             \        /    Network
   | Network  |    ----------------------------------------------
   |Controller|   ( |PE|.....-.....|PE|......    |PE|.......|PE| )
   |          |  (   --     |P|     --      :-...:--     -..:--   )
    ----------  (    :       -:.............|P|.........|P|        )
        v       (    -......................:-:..-       -         )
         >>>>>>> (  |P|.........................|P|......:        )
     Program the  (  -                           -               )
       Network     ----------------------------------------------

The network itself (at the bottom of the figure) comprises an underlay network. This could be a physical network, but may be a virtual network. The underlay network is provisioned through network controllers [RFC8309] that may, themselves, utilize device controllers.¶

The underlay network may optionally be filtered or customized by the network operator to produce a number of network topologies that we call Filtered Topologies. Customization is just a way of selecting specific resources (e.g., nodes and links) from the underlay network according to their capabilities and connectivity in the underlay network. Filtering and customization are configuration options or operator policies that preselect links and nodes with certain performance characteristics to enable easier construction of Network Resource Partition (NRPs, see below) that can reliably support specific IETF Network Slice SLAs: for example, preselection of links with certain security characteristics, preselection of links with specific geographic properties, or mapping to colored topologies. The resulting topologies can be used as candidates to host IETF Network Slices and provide a useful way for the network operator to know in advance that all of the resources they are using to plan an IETF Network Slice would be able to meet specific SLOs and SLEs. The creation of a Filtered Topology could be an offline planning activity or could be performed dynamically as new demands arise. The use of Filtered Topologies is entirely optional in the architecture, and IETF Network Slices could be hosted directly on the underlay network.¶

Recall that an IETF Network Slice is a service requested by / provided for the customer. The IETF Network Slice Service is expressed in terms of one or more connectivity constructs. An implementation or operator is free to limit the number of connectivity constructs in an IETF Network Slice to exactly one. Each connectivity construct is associated within the IETF Network Slice Service request with a set of SLOs and SLEs. The set of SLOs and SLEs does not need to be the same for every connectivity construct in the IETF Network Slice, but an implementation or operator is free to require that all connectivity constructs in an IETF Network Slice have the same set of SLOs and SLEs.¶

An NRP is a subset of the buffer/queuing/scheduling resources and associated policies on each of a connected set of links in the underlay network (for example, as achieved in [I-D.ietf-spring-resource-aware-segments]). The connected set of links could be the entire set of links with all of their buffer/queuing/scheduling resources and behaviors in the underlay network and in this case there would be just one NRP supported in the underlay network. The amount and granularity of resources allocated in an NRP is flexible and depends on the operator's policy. Some NRP realizations may build NRPs with dedicated topologies, while other realizations may use a shared topology for multiple NRPs. Realizations of an NRP may be built on a range of existing or new technologies, and this document does not constrain solution technologies.¶

One or more connectivity constructs from one or more IETF Network Slices are mapped to an NRP. A single connectivity construct is mapped to only one NRP (that is, the relationship is many to one). Thus, all traffic flows in a connectivity construct assigned to an NRP are assigned to that NRP. Further, all PEs connected by a connectivity construct must be present in the NRP to which that connectivity construct is assigned.¶

An NRP may be chosen to support a specific connectivity construct because of its ability to support a specific set of SLOs and SLEs, or its ability to support particular connectivity constructs, or for any administrative or operational reason. An implementation or operator is free to map each connectivity construct to a separate NRP, although there may be scaling implications depending on the solution implemented. Thus, the connectivity constructs from one slice may be mapped to one or more NRPs. By implication from the above, an implementation or operator is free to map all the connectivity constructs in a slice to a single NRP, and to not share that NRP with connectivity constructs from another slice.¶

An NRP may use work-conserving schedulers, non-work conserving schedulers, or both (see Section 2 of [RFC3290]) according to the function that it needs to deliver. The choice of how network resources are allocated and managed for an NRP, and whether a work-conserving scheduling approach or a non-work conserving scheduling approach is adopted, is technology specific: an implementation or operator is free to choose the set of techniques for NRP realization.¶

The process of determining the NRP may be made easier if the underlay network topology is first filtered into a Filtered Topology in order to be aware of the subset of network resources that are suitable for specific NRPs. In this case, each Filtered Topology is treated as an underlay network on which NRPs can be constructed. The stage of generating Filtered Topologies is optional within this framework.¶

The steps described here can be applied in a variety of orders according to implementation and deployment preferences. Furthermore, the steps may be iterative so that the components are continually refined and modified as network conditions change and as service requests are received or relinquished, and even the underlay network could be extended if necessary to meet the customers' demands.¶

7.2. Procedures to Realize IETF Network Slices

There are a number of different technologies that can be used in the underlay, including physical connections, MPLS, time-sensitive networking (TSN), Flex-E, etc.¶

An IETF Network Slice can be realized in a network, using specific underlay technology or technologies. The creation of a new IETF Network Slice will be realized with following steps:¶

• An NSC exposes the network slicing capabilities that it offers for the network it manages so that the customer can determine whether to request services and what features are in scope.¶
• The customer may issue a request to determine whether a specific IETF Network Slice Service could be supported by the network. An NSC may respond indicating a simple yes or no, and may supplement a negative response with information about what it could support were the customer to change some requirements.¶
• The customer requests an IETF Network Slice Service. An NSC may respond that the slice has or has not been created, and may supplement a negative response with information about what it could support were the customer to change some requirements.¶
• When processing a customer request for an IETF Network Slice Service, an NSC maps the request to the network capabilities and applies provider policies before creating or supplementing the NRP.¶

Regardless of how an IETF Network Slice is realized in the network (e.g., using tunnels of different types), the definition of the IETF Network Slice Service does not change at all. The only difference is how the slice is realized. The following sections briefly introduce how some existing architectural approaches can be applied to realize IETF Network Slices.¶

7.3. Applicability of ACTN to IETF Network Slices

Abstraction and Control of TE Networks (ACTN - [RFC8453]) is a management architecture and toolkit used to create virtual networks (VNs) on top of a TE underlay network. The VNs can be presented to customers for them to operate as private networks.¶

In many ways, the function of ACTN is similar to IETF network slicing. Customer requests for connectivity-based overlay services are mapped to dedicated or shared resources in the underlay network in a way that meets customer guarantees for service level objectives and for separation from other customers' traffic. [RFC8453] describes the function of ACTN as collecting resources to establish a logically dedicated virtual network over one or more TE networks. Thus, in the case of a TE-enabled underlay network, the ACTN VN can be used as a basis to realize IETF network slicing.¶

While the ACTN framework is a generic VN framework that can be used for VN services beyond the IETF Network Slice, it is also a suitable basis for delivering and realizing IETF Network Slices.¶

Further discussion of the applicability of ACTN to IETF Network Slices including a discussion of the relevant YANG models can be found in [I-D.ietf-teas-applicability-actn-slicing].¶

7.4. Applicability of Enhanced VPNs to IETF Network Slices

An enhanced VPN (VPN+) is designed to support the needs of new applications, particularly applications that are associated with 5G services. The approach is based on existing VPN and TE technologies, but adds characteristics that specific services require over and above those previously associated with VPN services.¶

An enhanced VPN can be used to provide enhanced connectivity services between customer sites and can be used to create the infrastructure to underpin an IETF Network Slice Service.¶

It is envisaged that enhanced VPNs will be delivered using a combination of existing, modified, and new networking technologies.¶

[I-D.ietf-teas-enhanced-vpn] describes the framework for Enhanced Virtual Private Network (VPN+) services.¶

7.5. Network Slicing and Aggregation in IP/MPLS Networks

Network slicing provides the ability to partition a physical network into multiple logical networks of varying sizes, structures, and functions so that each slice can be dedicated to specific services or customers. The support of resource preemption between IETF network slices is deployment specific.¶

Many approaches are currently being worked on to support IETF Network Slices in IP and MPLS networks with or without the use of Segment Routing. Most of these approaches utilize a way of marking packets so that network nodes can apply specific routing and forwarding behaviors to packets that belong to different IETF Network Slices. Different mechanisms for marking packets have been proposed (including using MPLS labels and Segment Routing segment IDs) and those mechanisms are agnostic to the path control technology used within the underlay network.¶

These approaches are also sensitive to the scaling concerns of supporting a large number of IETF Network Slices within a single IP or MPLS network, and so offer ways to aggregate the connectivity constructs of slices (or whole slices) so that the packet markings indicate an aggregate or grouping where all of the packets are subject to the same routing and forwarding behavior.¶

At this stage, it is inappropriate to cite any of these proposed solutions that are currently work in progress and not yet adopted as IETF work.¶

7.6. Network Slicing and Service Function Chaining (SFC)

A customer may request an IETF Network Slice Service that involves a set of service functions (SFs) together with the order in which these SFs are invoked. Also, the customer can specify the service objectives to be met by the underlay network (e.g., one-way delay to cross a service function path, one-way delay to reach a specific SF). These SFs are considered as ancillary CEs and are possibly placeholders (i.e., the SFs are identified, but not their locators).¶

Service Function Chaining (SFC) [RFC7665] techniques can be used by a provider to instantiate such an IETF Network Slice Service. An NSC may proceed as follows.¶

• Expose a set of ancillary CEs that are hosted in the underlay network.¶
• Capture the SFC requirements (including, traffic performance metrics) from the customer. One or more service chains may be associated with the same IETF Network Slice Service as connectivity constructs.¶
• Execute an SF placement algorithm to decide where to locate the ancillary CEs in order to fulfill the service objectives.¶

• Generate SFC classification rules to identify (part of) the slice traffic that will be bound to an SFC. These classification rules may be the same as or distinct from the identification rules used to bind incoming traffic to the associated IETF Network Slice.¶

  An NSC also generates a set of SFC forwarding policies that govern how the traffic will be forwarded along a service function path (SFP).¶

• Identify the appropriate Classifiers in the underlay network and provision them with the classification rules. Likewise, an NSC communicates the SFC forwarding polices to the appropriate Service Function Forwarders (SFF).¶

The provider can enable an SFC data plane mechanism, such as [RFC8300], [RFC8596], or [I-D.ietf-spring-nsh-sr].¶

8.1. Isolation as a Service Requirement

An IETF Network Slice Service customer may request that the IETF Network Slice delivered to them is such that changes to other IETF Network Slices or to other services do not have any negative impact on the delivery of the IETF Network Slice. The IETF Network Slice Service customer may specify the extent to which their IETF Network Slice Service is unaffected by changes in the provider network or by the behavior of other IETF Network Slice Service customers. The customer may express this via an SLE it agrees with the provider. This concept is termed 'isolation'.¶

In general, a customer cannot tell whether a service provider is meeting an isolation SLE. If the service varies such that an SLO is breached then the customer will become aware of the problem, and if the service varies within the allowed bounds of the SLOs, there may be no noticeable indication that this SLE has been violated.¶

8.2. Isolation in IETF Network Slice Realization

Isolation may be achieved in the underlay network by various forms of resource partitioning ranging from dedicated allocation of resources for a specific IETF Network Slice, to sharing of resources with safeguards. For example, traffic separation between different IETF Network Slices may be achieved using VPN technologies, such as L3VPN, L2VPN, EVPN, etc. Interference avoidance may be achieved by network capacity planning, allocating dedicated network resources, traffic policing or shaping, prioritizing in using shared network resources, etc. Finally, service continuity may be ensured by reserving backup paths for critical traffic and dedicating specific network resources for a selected number of IETF Network Slices.¶

A.1. Multi-Point to Point Service

As described in Section 4.2 an MP2P service can be realized with multiple P2P connectivity constructs. Figure 5 shows a simple MP2P service where traffic is sent from any of CE1, CE2, and CE3, to the receiver which is CE4. The service comprises three P2P connectivity constructs CE1-CE4, CE2-CE4, and CE3-CE4.¶

               CE1
             ___|________
            /    \       \
           (      \______ )
           (             \)
     CE2---(--------------)---CE4
           (      _______/)
           (     /        )
            \___|________/
                |
               CE3

A.2. Service Function Chaining and Ancillary CEs

Section 4.2.3 introduces the concept of ancillary CEs. Figure 6 shows a simple example of IETF Network Slices with connectivity constructs that are used to deliver traffic from CE1 to CE3 taking in a service function along the path.¶

                   CE1         CE2         CE3
                   xo*         * *         *ox
               ____xo*_________*_*_________*ox____
             _/    xo*         * *         *ox    \_
            /      xo*********** ***********ox      \
           (       xo                       ox       )
           (       xooooooooo(ACE1)oooooooooox       )
           (       x                         x       )
           (       x   ------------------    x       )
           (       x  | Service Function |   x       )
           (       x  |  ....(ACE2)....  |   x       )
           (       x  | :              : |   x       )
           (       xxxx.:....(ACE3)....:.xxxxx       )
           (          | :              : |           )
           (          |  ....(ACE4)....  |           )
           (          |                  |           )
           (           ------------------            )
           (                                         )
            \_          Operator Network           _/
              \___________________________________/

A customer may want to utilize a service where traffic is delivered from CE1 to CE3 including a service function sited within the customer's network at CE2. To achieve this, the customer may request an IETF Network Slice Service comprising two P2P connectivity constructs (CE1-CE2 and CE2-CE3 represented as *** in the figure).¶

Alternatively, the service function for the same CE1 to CE3 flow may be hosted at a node within the network operator's infrastructure. This is an ancillary CE in the IETF Network Slice Service that the customer requests. This service contains two P2P connectivity constructs (CE1-ACE1 and ACE1-CE3 represented as ooo in the figure). How the customer knows of the existence of the ancillary CE, and the service functions it offers, is a matter for agreement between the customer and the network operator.¶

Finally, it may be that the customer knows that the network operator is able to provide the service function, but not know the location of the ancillary CE at which the service function is hosted. Indeed, it may be that the service function is hosted at a number of ancillary CEs (ACE2, ACE3, and ACE4 in the figure): the customer may know the identities of the ancillary CEs, but be unwilling or unable to choose one; or the customer may not know about the ancillary CEs. In this case, the IETF Network Slice Service request contains two P2P connectivity constructs (CE1-ServiceFunction and ServiceFunction-CE3 represented as xxx in the figure). It is left as a choice for the network operator which ancillary CE to use and how to realize the connectivity constructs.¶

A.3. Hub and Spoke

Hub and spoke is a popular way to realize any-to-any connectivity in support of multiple P2P traffic flows (where the hub performs routing), or of P2MP flows (where the hub is responsible for replication). In many cases, it is the network operator's choice whether to use hub and spoke to realize a mesh of P2P connectivity constructs or P2MP connectivity constructs: this is entirely their business as the customer is not aware of how the connectivity constructs are supported within the network.¶

However, it may be the case that the customer wants to control the behavior and location of the hub. In this case, the hub appears as an ancillary CE as shown in Figure 7.¶

For the P2P mesh case, the customer does not specify a mesh of P2P connectivity constructs (such as CE1-CE2, CE1-CE3, CE2-CE3 and the equivalent reverse direction connectivity), but connects each CE to the hub with P2P connectivity constructs (as CE1-Hub, CE2-Hub, CE3-Hub and the equivalent reverse direction connectivity). This scales better in terms of provisioning compared to a full mesh, but does require that the hub is capable of routing traffic between connectivity constructs.¶

For the P2MP case, the customer does not specify a single P2MP connectivity construct (in this case, CE3-{CE1+CE2}), but requests three P2P connectivity constructs (as CE3-Hub, Hub-CE1, and Hub-CE2). It is the hub's responsibility to replicate the traffic from CE3 and send it to both CE1 and CE2.¶

                      ------------
                CE1  |    Hub     |   CE2
                ||    ------------    ||
             ___||_____||__||__||_____||___
            /   ||     ||  ||  ||     ||   \
           (     ======    ||   ======      )
           (               ||               )
           (               ||               )
            \______________||______________/
                           ||
                           CE3

A.4. Layer 3 VPN

Layer 3 VPNs are a common service offered by network operators to their customers. They may be modelled as an any-to-any service, but are often realized as a mesh of P2P connections, or if multicast is supported, they may be realized as a mesh of P2MP connections.¶

Figure 8 shows an IETF Network Slice Service with a single A2A connectivity construct between the SDPs CE1, CE2, CE3, and CE4. It is a free choice how the network operator realizes this service. They may use a full mesh of P2P connections, a hub and spoke configuration, or some combination of these approaches.¶

                CE1             CE2
             ____|_______________|____
            /    :...............:    \
           (     :.            . :     )
           (     : ......     .  :     )
           (     :       .....   :     )
          (      :   .... .      :      )
           (     :  .      ....  :     )
           (     : .           . :     )
           (     :...............:     )
            \____:_______________:____/
                 |               |
                CE3             CE4

A.5. Hierarchical Composition of Network Slices

As mentioned in Section 5.3, IETF Network Slices may be arranged hierarchically. There is nothing special or novel about such an arrangement, and it models the hierarchical arrangement of services of virtual networks in many other environments.¶

As shown in Figure 9, an Operator's Controller (NSC) that is requested to provide an IETF Network Slice Service for a customer may, in turn, request an IETF Network Slice Service from another carrier. The Operator's NSC may manage and control the underlay IETF Network Slice by modifying the requested connectivity constructs and changing the SLAs. The customer is entirely unaware of the hierarchy of slices, and the underlay carrier is entirely unaware of how its slice is being used.¶

This "stacking" of IETF Network Slice constructs is not different to the way virtual networks may be arranged.¶

      --------------
     | Network      |
     | Slice        |
     | Orchestrator |
      --------------
       | IETF Network Slice
       | Service Request
       |                    Customer view
   ....|................................
      -v----------------    Operator view
     |Controller        |
     |  ------------    |
     | | IETF       |   |
     | | Network    |---|---
     | | Slice      |   |   |
     | | Controller |   |   |
     | | (NSC)      |   |   |
     |  ------------    |   |
      ------------------    |
                            | IETF Network Slice
                            | Service Request
                            |
   .........................|.....................
                  ----------v-------    Carrier view
                 |Controller        |
                 |  ------------    |
                 | | IETF       |   |
                 | | Network    |   |
                 | | Slice      |   |
                 | | Controller |   |
                 | | (NSC)      |   |
                 |  ------------    |
             ....|  | Network       |............
                 |  | Configuration |   Underlay Network
                 |  v               |
                 |  ------------    |
                 | | Network    |   |
                 | | Controller |   |
                 | | (NC)       |   |
                 |  ------------    |
                  ------------------
                   | Device Configuration
                   v

In this case, the network hierarchy may also be used to provide connectivity between points in the higher layer network as shown in Figure 10. Here, an IETF Network Slice may be requested of the lower layer network to provide the desired connectivity constructs to supplement the connectivity in the higher layer network where this connectivity might be presented as a virtual link.¶

         CE1                                       CE2
          |                                         |
          |                                         |
         _|_________________________________________|_
        ( :                                         : )
       (  :..............             ..............:  )
        (_______________:_____________:_______________)
                      __|_____________|__
                     (  :             :  )
                    (   :.............:   )
                     (___________________)

A.6. Horizontal Composition of Network Slices

It may be that end-to-end connectivity is achieved using a set of cooperating networks as described in Section 5.3. For example, there may be multiple interconnected networks that provide the required connectivity as shown in Figure 11. The networks may utilize different technologies and may be under separate administrative control.¶

         CE1                                       CE2
          |                                         |
         SDP1                                      SDP2
          |                                         |
         _|____       ______       ______       ____|_
        (      )     (      )     (      )     (      )
       (        )---(        )---(        )---(        )
        (______)     (______)     (______)     (______)

In this scenario, the customer (represented by CE1 and CE2) may request an IETF Network Slice Service connecting the CEs. The customer considers the SDPs at the edge (shown as SDP1 and SDP2 in Figure 11) and might not be aware of how the end-to-end connectivity is composed.¶

However, because the various networks may be of different technologies and under separate administrative control, the networks are sliced individually and coordination is necessary to deliver the desired connectivity. The network to network interfaces (NNIs) are present as SDPs for the IETF Network Slices in each network so that each network is individually sliced. In the example in Figure 12, this is illustrated as network 1 (N/w1) being sliced between SDP1 and SDPX, N/w2 being sliced between SDPY and SDPU, etc. The coordination activity involves binding the SDPs, and hence the connectivity constructs, to achieve end-to-end connectivity with the required SLOs and SLEs. In this way, simple and complex end-to-end connectivity can be achieved with a variety of connectivity constructs in the IETF Network Slices of different networks "stitched" together.¶

         CE1                                                CE2
          |                                                  |
         SDP1                                               SDP2
          |                                                  |
         _|____          ______          ______          ____|_
        (      ) SDPX   (      ) SDPU   (      ) SDPS   (      )
       (  N/w1  )------(  N/w2  )------(  N/w3  )------(  N/w4  )
        (______)   SDPY (______)   SDPV (______)   SDPT (______)

The controller/coordinator relationship is shown in Figure 13.¶

      --------------
     | Network      |
     | Slice        |
     | Orchestrator |
      --------------
       | IETF Network Slice
       | Service Request
       |                    Customer view
   ....|................................
      -v----------------    Coordinator view
     |Coordinator       |
     |                  |
      ------------------
       |             |_________________
       |                               |
       |                               |
   ....|.......................    ....|.....................
      -v--------------                -v--------------
     |Controller1     | Operator1    |Controller2     | Operator2
     |  ------------  |              |  ------------  |
     | | IETF       | |              | | IETF       | |
     | | Network    | |              | | Network    | |
     | | Slice      | |              | | Slice      | |
     | | Controller | |              | | Controller | |
     | | (NSC)      | |              | | (NSC)      | |
     |  ------------  |              |  ------------  |
 ....|  | Network     |............  |  | Network     |............
     |  | Config      | Underlay1    |  | Config      | Underlay2
     |  v             |              |  v             |
     |  ------------  |              |  ------------  |
     | | Network    | |              | | Network    | |
     | | Controller | |              | | Controller | |
     | | (NC)       | |              | | (NC)       | |
     |  ------------  |              |  ------------  |
      ----------------                ----------------
       | Device Configuration
       v