SDN use case 1: VPN Fengkai Li

Way to carry out SDN related work Work item 3: Customer Facing Services. Multi-Site connection service Parental Control Internet Service Customized “Complex” Services, Service Catalog Work item 2: The way, method, algorithm to orchestrate the SDN basic atomic SDN service to create the customized “complex” service. Orchestration Functionalities Way Moving forward VPN TE Security QoS NAT Work item 1: Standardize the basic/atomic SDN services, as well as some primitive components of basic/atomic SDN service. Basic/Atomic SDN services Basic objects/nodes Basic relationships/operations …… 2018/9/23

Technology Dependent or Independent For the SDN VPN service: Connection, Entity, Gateways, technology independent End user oriented part within in VPN service. Mapping, technology dependent Service provider/Operator oriented part within in VPN service. Generalization: Each SDN service will have two main kinds of components/attributes: Technology independent related for SDN service end user Customer facing requirements, which are from the end users’ point of view SDN service end users do not want to involve in the details, implementations of the service Technology dependent for SDN service provider/operator SDN service providers’ or operators’ configuration, policy, implementation, activation of the service Previous figure, to be modified 2018/9/23

Leverage current work in NFV&SDN Ad Hoc VPN service Constitutions of VPN Service Service holder Technology independent parts: Entities to be connected by VPN service Connection between/among entities Gateway Technology dependent parts: Mapping policy TOSCA simple profile for NFV NSD vld connection_point VLD Connectivity Type Service type Service sub-type How to map the VPN service requirements to the existing design of the document? 2018/9/23

VPN basic concept and SDN VPN service VPN creates a secure network connection over a public network, such as the Internet or a private network owned by a service provider. Target user: Tenants, End users SDN VPN service management and administration: Service provider, Operator Descriptions: For tenants, end users: Connectivity service: Between or among sites Site to DC Site to Internet Self-service for adding/deleting sites, bandwidth adjusting, QoS, etc. Underlay VPN technology independent For service providers, Operators: Specify VPN service implementing underlying techniques, such as VxLAN, GRE, IPSec, etc. VPN service configurations, activations. 2018/9/23

Reorganizing the VPN service attributes Constitutions of VPN Service: VPN Service holder Owner of this VPN service ID/Name/Description, for descriptions of the service and references. Status, both the administrative and operative status Mapping policies for the technology specific implementation of the VPN service. Within the VPN service Entity/entities to be connected by VPN Connections between/among entities Gateway for layer 3 connections VPN Service Technology dependent part Technology independent part Mapping Connection Entity Gateway Figure updated with technology independent and dependent parts 2018/9/23

Connection Properties/attributes: Owner of this VPN service. ID/Name/Description, for descriptions of the service and references. Topology, connection type, P2P, Hub Spoke, Full Mesh. Bandwidth. Entity/Entities connected by the connection. Administrative/operative status. Technology specification, such VxLan, IPSec, GRE, etc. Mapping policy. 2018/9/23

Entity/Entities Properties/attributes: Owner of this Entity/Entities ID/Name/Description, for descriptions. Type of entity/entities, such as subnet, network, router, VLAN, CIDR, VNI, etc. Gateway, for the gateway info for subnet, network, VLAN, CIDR, VNI. Topology Role, for the role concept in the connection, hub|spoke|none. Connection ID, the connection entity/entities belongs to. 2018/9/23

Gateway Properties/attributes: Owner of this gateway. ID/Name/Description, for descriptions. IP address Network element ID, the gateway belongs to. 2018/9/23

Mapping policy Properties/attributes: Owner of this mapping policy. ID/Name/Description, for descriptions. Type, specifying the underlying technology for the VPN implementation. VxLAN parameters: Arp proxy … IPSec parameters: crypto profile …… GRE parameters: Tunnel key …. May some of these be needed by tenants or end users? 2018/9/23

Scenario Suggested by Dmytro Gassanov within the vEPC proposal. Also: P2P VPN connection Suggested by Dmytro Gassanov within the vEPC proposal. Also: VPN is a kind of VL in NSD May refer to ETSI IFA015 for VLD attributes defined. 2018/9/23

Thank you! 2018/9/23