Subject: [I2nsf] A question about the information model

From: "Dacheng Zhang" <[email-masked]>
Date: Thu, 11 Jun 2015 16:51:30 +0800

Hi, 

Xialiang and I are working on the information model of i2nsf and discussing
whether we should add policy based routing in the information model.

PBR is not a security function, but it is an essential function of many
security devices and closely related with security. For instance, a manager
may need to use PBR steer the packets to the next security devices in the
same security service chain. So, basically we suggest to add PBR into the
model.

Comments?

Cheers

Dacheng

---

From: "Susan Hares" <[email-masked]>
Date: Thu, 11 Jun 2015 09:37:02 -0400

Dacheng: 

Can you define what you mean by policy based routing? In I2RS we are using
filter-based RIBs.  I suspect you may want to consider that you are
generating filter-based RIBs.  

Sue 

From: I2nsf [mailto:[email-masked]] On Behalf Of Dacheng Zhang
Sent: Thursday, June 11, 2015 4:52 AM
To: [email-masked]
Subject: [I2nsf] A question about the information model

Hi, 

Comments?

Cheers

Dacheng

---

From: "Dacheng Zhang" <[email-masked]>
Date: Fri, 12 Jun 2015 09:43:49 +0800

The definition of PBR can be found as follows:

http://en.wikipedia.org/wiki/Policy-based_routing

发件人:  Susan Hares <[email-masked]>
日期:  2015年6月11日 星期四 下午9:37
至:  dacheng de <[email-masked]>, <[email-masked]>
主题:  Re: [I2nsf] A question about the information model

Dacheng: 

Hi, 

Comments?

Cheers

Dacheng
 
_______________________________________________ I2nsf mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/i2nsf

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Sun, 14 Jun 2015 12:38:33 +0000

Hi,

This is something I think need further discussion. PBR, as defined in general terms, goes well beyond security policies. I am not sure it would be a feasible approach to try to include any technology potentially applicable as part of an information model for security functions.

Be goode,

On 12 Jun 2015, at 03:43 , Dacheng Zhang <[email-masked]<mailto:[email-masked]>> wrote:

发件人: Susan Hares <[email-masked]<mailto:[email-masked]>>
日期: 2015年6月11日 星期四 下午9:37
至: dacheng de <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>
主题: Re: [I2nsf] A question about the information model

Dacheng:
Can you define what you mean by policy based routing? In I2RS we are using filter-based RIBs.  I suspect you may want to consider that you are generating filter-based RIBs.
Sue
From: I2nsf [mailto:[email-masked]] On Behalf Of Dacheng Zhang
Sent: Thursday, June 11, 2015 4:52 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [I2nsf] A question about the information model

Hi,

Xialiang and I are working on the information model of i2nsf and discussing whether we should add policy based routing in the information model.

PBR is not a security function, but it is an essential function of many security devices and closely related with security. For instance, a manager may need to use PBR steer the packets to the next security devices in the same security service chain. So, basically we suggest to add PBR into the model.

Comments?

Cheers

Dacheng

_______________________________________________ I2nsf mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/i2nsf _______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "Dacheng Zhang" <[email-masked]>
Date: Tue, 16 Jun 2015 19:15:36 +0800

Hi，Diego：
 
Thanks a lot for your comments. I understand your point. We should not
extend the scope of this work arbitrarily。
 
My concern is that packet forwarding is a part of security policies. If PBR
is not included in this work, the controller will have to use another
interface to tell the NSF how to forwarded it after the packet has been
processed. A new problem will be raised then. The NSF needs to generate and
maintain mappings between packet processing policies and packet forwarding
policies (which uses PBR). This makes the system complex.

Cheers

Dacheng

发件人:  DIEGO LOPEZ GARCIA <[email-masked]>
日期:  2015年6月14日 星期日 下午8:38
至:  dacheng de <[email-masked]>
抄送:  Susan Hares <[email-masked]>, "[email-masked]" <[email-masked]>
主题:  Re: [I2nsf] A question about the information model

Hi, 

This is something I think need further discussion. PBR, as defined in
general terms, goes well beyond security policies. I am not sure it would be
a feasible approach to try to include any technology potentially applicable
as part of an information model for security functions.

Be goode,

On 12 Jun 2015, at 03:43 , Dacheng Zhang <[email-masked]>
wrote:

> filter-based RIBs.  I suspect you may want to consider that you are generating
> filter-based RIBs.
> Sue
> 
> may need to use PBR steer the packets to the next security devices in the same
> security service chain. So, basically we suggest to add PBR into the model.
> 
>  
> 
> Comments?
> 
>  
> 
> Cheers
> 
>  
> 
> Dacheng
>  
> [email-masked]

Dr Diego R. Lopez
Telefonica I+D

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario,
puede contener información privilegiada o confidencial y es para uso
exclusivo de la persona o entidad de destino. Si no es usted. el
destinatario indicado, queda notificado de que la lectura, utilización,
divulgación y/o copia sin autorización puede estar prohibida en virtud de la
legislación vigente. Si ha recibido este mensaje por error, le rogamos que
nos lo comunique inmediatamente por esta misma vía y proceda a su
destrucción.

The information contained in this transmission is privileged and
confidential information intended only for the use of the individual or
entity named above. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution or
copying of this communication is strictly prohibited. If you have received
this transmission in error, do not read it. Please immediately reply to the
sender that you have received this communication in error and then delete
it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário,
pode conter informação privilegiada ou confidencial e é para uso exclusivo
da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário
indicado, fica notificado de que a leitura, utilização, divulgação e/ou
cópia sem autorização pode estar proibida em virtude da legislação vigente.
Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique
imediatamente por esta mesma via e proceda a sua destruição

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 30 Jun 2015 13:00:07 +0000

Hi Dacheng,

Why another interface? It would only have to reuse another existing information model, that I assume would be defined. What I2NSF could do is to profile that information model to its needs.

Be goode,

On 16 Jun 2015, at 13:15 , Dacheng Zhang <[email-masked]<mailto:[email-masked]>> wrote:

Hi，Diego：

Thanks a lot for your comments. I understand your point. We should not extend the scope of this work arbitrarily。

My concern is that packet forwarding is a part of security policies. If PBR is not included in this work, the controller will have to use another interface to tell the NSF how to forwarded it after the packet has been processed. A new problem will be raised then. The NSF needs to generate and maintain mappings between packet processing policies and packet forwarding policies (which uses PBR). This makes the system complex.

Cheers

Dacheng

发件人: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
日期: 2015年6月14日 星期日 下午8:38
至: dacheng de <[email-masked]<mailto:[email-masked]>>
抄送: Susan Hares <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
主题: Re: [I2nsf] A question about the information model

Hi,

Be goode,

Dacheng:

Hi,

Comments?

Cheers

Dacheng

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]<mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

Dr Diego R. Lopez
Telefonica I+D