1. draft-maino-gpe-vpn F. Maino, V. Ermagan, J. Evans, H. Miclea IETF 95 – April 2016

2. GPE-VPN LISP-based architecture for SD-WAN – programmable LISP control plane – VXLAN-GPE data plane with optional: ESP encryption NSH-based support for Service Function Chaining Mapping System is dynamically programmed via NorthBound API – Policy rendering via dynamic mapping manipualtion

3. IP (v4 or v6) or MPLS Router A Router B Router C Router E Key Management Server Mapping Server IP Tunnel Auto Configuration, Orchestration, and Policy Resolution Router D NB API Intent-Based Policy Policy Resolution Stateless Stateful Lookup Provisioning Overall Architecture Packet

4. Outer Ethernet Header Outer IP Header Outer UDP Header RRVIPROReservedNext Protocol Virtual Network Identifier (VNI) / Instance ID (IID)Reserved Payload (ethernet, IPv4, IPv6, ESP, NSH, …) Data Plane: GPE Encapsulated Frame GPE Header

5. Outer Ethernet Header Outer IP Header Outer UDP Header RRVIPROReservedNP = ESP Virtual Network Identifier (VNI) / Instance ID (IID)Reserved SPI (32) Sequence Number (32) Payload + Padding NP = IP/Eth ICV GPE ICV Scope Data Plane: GPE with AEAD (ESP-GCM) ESP AAD

6. Outer Ethernet Header Outer IP Header Outer UDP Header RRVIPROReservedNP = ESP Virtual Network Identifier (VNI) / Instance ID (IID)Reserved SPI (32) Sequence Number (32) NSH Base HeaderNP=IP/Eth NSH Service Path Header NSH Context Headers Payload + PaddingNP = NSH ICV AAD ICV Scope Data Plane: GPE+NSH with ESP+GCM ESP Hdr ESP Trailer NSH Hdr Pld Enc Scope

7. Mapping Types GPE-VPN uses various mapping types to provide finer-grain policy control, and to support different policies – Per-destination mapping EID -> RLOC – FlowMapping -> RLOC draft-rodrigueznatal-lisp-multi-tuple-eids – Generic Mapping e.g. -> RLOC draft-ermagan-lisp-nsh draft-rodrigueznatal-lisp-ms-smr

8. Dynamic Policy Rendering Dynamic mapping manipulation (via NB API) enables GPE-VPN generic policy rendering – Forwarding and In-bound load balancing – Overlay Re-encapsulation (via RTR) Virtual topologies Hierarchical VPNs – Group-based Access Control – Support for Service Function Chaining

9. Key Management Services SA provisioning is a trade-off between – time needed to set up the SA on demand – overall security afforded SA provisioning can be done with different mechanisms – Use IKEv2 to negotiate pairwise SAs – Use Group Domain of Interpretation (GDOI) for group key management – Leverage LISP map-request/reply to accelerate on demand provisioning of SA e.g. ietf-lisp-crypto SA Setup Time / Security

10. Q&A Thanks!