Subject: [Anima] Fwd: I-D Action: draft-carpenter-anima-l2acp-scenarios-00.txt

From: Brian E Carpenter <[email-masked]>
Date: Thu, 28 Feb 2019 08:55:31 +1300

Hi,

Here is a new draft for ANIMA to consider. We believe it is useful
to explore the idea of an autonomic control plane constructed at
the link layer. Comments please!

    Brian and Bing

-------- Forwarded Message --------
Subject: I-D Action: draft-carpenter-anima-l2acp-scenarios-00.txt
Date: Wed, 27 Feb 2019 11:51:27 -0800
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : Scenarios and Requirements for Layer 2 Autonomic Control Planes
        Authors         : Brian Carpenter
                          Bing Liu
	Filename        : draft-carpenter-anima-l2acp-scenarios-00.txt
	Pages           : 6
	Date            : 2019-02-27

Abstract:
   This document discusses scenarios and requirements for Autonomic
   Control Planes (ACPs) constructed and secured at Layer 2.  These
   would be alternatives to an ACP constructed and secured at the
   network layer.  A secure ACP is required as the substrate for the
   Generic Autonomic Signaling Protocol (GRASP) used by Autonomic
   Service Agents.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-carpenter-anima-l2acp-scenarios/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-carpenter-anima-l2acp-scenarios-00
https://datatracker.ietf.org/doc/html/draft-carpenter-anima-l2acp-scenarios-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Michael Richardson <[email-masked]>
Date: Wed, 27 Feb 2019 20:22:45 -0500

> the link layer. Comments please!

Does this mean it transports L2 packets (a la spanning-tree or TRILL), or
does this mean it uses L2 technologies like MACSEC to create a tunnel
for L3 packets?

i.e. does L3 multicast appear to just work because it more layer-2 tricks?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 28 Feb 2019 14:40:14 +1300

> does this mean it uses L2 technologies like MACSEC to create a tunnel

Well, I don't think the draft in its present form should attempt to
answer that question. In my mind I was thinking of a conventional
LAN set up, i.e. spanning tree, but that doesn't have to be the
only way. In practice that usually needs MLDv2 snooping as well.
 
> i.e. does L3 multicast appear to just work because it more layer-2 tricks?

L3 multicast works automatically if L2 multicast works, surely (remembering
that there is no router). How L2 multicast works is another question, of
course. I don't mean to say it's unimportant, just that it's not in scope
for this particular draft.

    Brian

---

From: Michael Richardson <[email-masked]>
Date: Wed, 27 Feb 2019 21:01:39 -0500

> only way. In practice that usually needs MLDv2 snooping as well.

okay, so you were thinking about the first part.
Yes, you need MLDv2 snooping.

    > for this particular draft.

In other words, more IPv4-inspired L2-tricks to maintain the illusion there
is a big-blue cable with AUI taps on it.  And continued inability to see L2
switches, or creatively route around L2 failures :-)

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 28 Feb 2019 15:15:31 +1300

> switches, or creatively route around L2 failures :-)

I'd be happy enough to see that done too, but that's a much bigger step
than what we're suggesting, which is a way to get the ANI deployed
in smaller shops than will run a full BRSKI/ACP setup.

As for emulating classic Ethernet, yes, that is how the world works
today in many places.

     Brian

---

From: Michael Richardson <[email-masked]>
Date: Wed, 27 Feb 2019 21:28:32 -0500

> in smaller shops than will run a full BRSKI/ACP setup.

If you don't do BRSKI, then how do you set up the secure L2?

If you do BRSKI, then it's just about replacing IPsec with MACsec or another
encrypted L2VPN protocol which is already in silicon, right?

    > As for emulating classic Ethernet, yes, that is how the world works

Yes.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 28 Feb 2019 15:53:02 +1300

> If you don't do BRSKI, then how do you set up the secure L2?

Um... the draft tries to talk about that.

> encrypted L2VPN protocol which is already in silicon, right?

Yes, I assume so, but that isn't really in the intended scope (for now).

   Brian