1. Dynamic Virtual Networks (DVNE) Margaret Wasserman & Paddy Nallur November 11, 2010 IETF 79 -- Beijing, China

2. Two Drafts DVNE Framework –https://datatracker.ietf.org/doc/draft-mrw-dvne-fw/https://datatracker.ietf.org/doc/draft-mrw-dvne-fw/ –Explains how Dynamic Virtual Networks are constructed DVNE Protocol –https://datatracker.ietf.org/doc/draft-mrw-dvne-prot/https://datatracker.ietf.org/doc/draft-mrw-dvne-prot/ –Describes a provisioning protocol to dynamically provision a Dynamic Virtual Networks

3. Static Virtual Networks B2 A1 Internet NAT B1 A2 A4 A3 B3 CGN B4 NATNAT

4. Issues to Address Node-to-Node Virtual Networks –Connectivity can be hard to establish due to NATs, IPv4-to- IPv6 coexistence technologies, firewalls, etc. –Large Virtual Networks are unmanageable due to need to configure virtual network parameters on every node. Remote endpoint addresses, credentials, etc. –Each node maintains state for every other node in the network, even if they never communicate Site-to-Site Virtual Networks –No consistent end-to-end security –Security depends on physical topology No support for flexible, centralized administration and provisioning

5. Functional Elements B2 DVNE Mediator VN Node Edge Network

6. Basic Operation of Mediator Client desires DVNE connection to another host in the VN, asks mediator Mediator authenticates client Mediator provisions both end of the connection –Local IP addrss, address list for peer, STUN server address, credentials for secure tunnel, etc. VPN connection is established by endpoints –Using IPsec tunnel or DTLS –May use ICE, STUN or other mechanisms as needed to establish connectivity

7. Dynamic, On-Demand Connection B2 DVNE Mediator Node B Node A VN Node Edge Network - Node A requests connection to Node B - Mediator provisions Node A & Node B - Secure connection from Node A to Node B

8. Dynamic Virtual Network A1 Internet NAT B1 A2 A4 A3 B3 CGN B4 NA T B2

9. Current IETF Solutions Used Various VPN/secure tunnel solutions –Such as IPsec or DTLS TLS for authentication ICE/STUN for NAT traversal The DVNE protocol does not replace these technologies, it provisions nodes with the information to use them

10. Missing Piece IETF has no generic service provisioning protocol to use for Client-to-Mediator communication Existing management protocols have different model –“Configure yourself”, rather than “provision me” –No ability to trigger provisioning of service across multiple nodes Existing data models (MIBs, Yang modules) could be used to hold data

11. Status of DVNE Work Current work focuses on a DVNE protocol for network authentication and DVNE service provisioning and virtual network set-up Work underway on national Standard in China for DVNE Framework –Combined work of Huawei Symantec, ZTE, and China Mobile Prototype code up and running

12. Specific vs. General in IETF Specific need for a Dynamic Virtual Network provisioning protocol IETF may have more general need for a generic Service Provisioning protocol that could be applied to this space and others. Which should we pursue in the IETF?

13. Questions Should we work on this topic in the IETF? Should we pursue a specific or general solution? –Specific: DVNE protocol to provision VNs –Generic: Generic service provisioning protocol, PLUS data model for provisioning VNs. Should we do the work here in the Ops Area WG? In separate Ops/NM WG? Elsewhere?