1. State Migration Draft-gu-opsawg-policies-migration-01 Yingjie Gu

2. Network Architecture Example CE1 Agg. Switch TOR FW1 TOR MPLS GW IP:192.168.1.0/16 GW:192.168.0.1 L2 Network FW2 Internet Gateway2 Virtual Gateway 192.168.0.1/16 VRRP IP:192.168.2.0/16 GW:192.168.0.1 IP:192.168.1.0/16 GW:192.168.0.1 VPLS-PE2VPLS-PE1 Internet Gateway1 Virtual Gateway 192.168.0.1/16 TOR CE2 Agg. Switch VM1VM2 VM8 … VM41VM42 VM21VM22 VM28 … VM1 : 192.168.1.1VM21 : 192.168.2.21

3. Use Case 1: Intra-communication TOR MPLS GW IP:192.168.1.0/16 GW:192.168.0.1 L2 Network Internet Gateway2 Virtual Gateway 192.168.0.1/16 VRRP IP:192.168.2.0/16 GW:192.168.0.1 IP:192.168.1.0/16 GW:192.168.0.1 VPLS-PE2VPLS-PE1 Internet Gateway1 Virtual Gateway 192.168.0.1/16 TOR CE2 VM1 VM41VM42 VM21 Session Table VM21->VM1 Status (1) CE1 Session Table No VM21->VM1 Record (2) VM Live Migration (3) Routed to new location

4. Use Case 2: Extra-communication CE1 Agg. Switch TOR FW1 TOR MPLS GW IP:192.168.1.0/16 GW:192.168.0.1 L2 Network FW2 Internet Gateway2 Virtual Gateway 192.168.0.1/16 VRRP IP:192.168.2.0/16 GW:192.168.0.1 IP:192.168.1.0/16 GW:192.168.0.1 VPLS-PE2VPLS-PE1 Internet Gateway1 Virtual Gateway 192.168.0.1/16 TOR CE2 Agg. Switch VM1 … VM41VM42 Session Table VM21->VM1 Status (1) (2) VM Live Migration Session Table No VM21->VM1 Record

5. Scope State Migration – To migrate flow-coupled state on Firewall, e.g. Session Table, while the specific flow is still running. – Currently, we consider state migration in the following scenarios: the source and destination Firewall are 1) within the same DC, same administration domain, and same/different subnets; 2) belong to different DCs, which is under different administration domains and same/different subnets;

6. Analyze the Problem Coordinator Notification of VM Migration event: VM Identity (IP Address or VMID) Source VM Location Destination VM Location Stage of VM Live Migration Communication for State Migration: Firewall Capability Source Firewall Location Destination Firewall Location VM IP Address And State Transfer Firewall VM migration notifier

7. Gap analysis is made on MIDCOM, ForCES, and PCP Got feeling that ForCES could provide a basic mechanism for state migration. Coordinator Firewall Notification of VM Migration event Firewall Capability VM IP Address Source Firewall Location Destination Firewall Location Gap analysis with existing protocols Flow-coupled state LIVE migration Blue: ForCES can support Green: New features ForCES lacks State Migration ForCES We solicit ForCES Experts to join us to figure out how much we can reuse ForCES.

8. Backup slide

9. Characteristic of Flow-coupled State Live migration Best time to Final-copy Firewall State Flow-coupled state keep changing during the moment Time to pre- copy Firewall state