Subject: Re: [OPSAWG] Problem statement on setting up dynamic virtual network

From: Michael Ko <[email-masked]>
Date: Mon, 11 Jul 2011 18:54:20 -0700

Danwei,

TLS, IPsec, or any security protocols, if needed, are used to create a security tunnel between two end points.  The central repository is not involved and hence it will not break the end-to-end connection (NAT traversal aside).  But to create a security tunnel during connection establishment, a network node may need to have access to certificate fingerprint (see RFC 4572), generated keys and security strategy, etc.  These can be facilitated by having a central repository in the virtual network responsible for disseminating the required information.  Security issues by themselves do not justify having a central repository.  But a central repository is useful in a dynamic virtual network environment in faciltating the task of the network administrator.  So instead of relying on a tedious node-by-node management model, where each network node is manually and individually configured, each network node subordinates its discovery and management responsibilities to the central repository.  Each network node, having retrieved the information from the central repository regarding the other network nodes that it is authorized to access, can proceed with the connection process using supported standards.  In other words, the central repository can be viewed as the consolidated configuration point for facilitating the connectivity, security, and management issues for all the network nodes in the virtual network.

Mike
  ----- Original Message ----- 
  From: [email-masked] 
  To: [email-masked] 
  Cc: [email-masked] 
  Sent: Monday, July 11, 2011 6:22 AM
  Subject: Re: [OPSAWG] Problem statement on setting up dynamic virtual network

Hi，Michael
 I have read the draft. I have a question. In section 2.2 Security Problems，as it's said "These can be facilitated by having a central repository in the virtual network responsible for disseminating the required  information. ", as we know, TLS, IPsec are both end-to-end connections, why a central repository is needed here? Will it break the end-to-end connection?Regards，
Danwei Chen -----Original Message-----
From: opsawg-bounces at ietf.org [mailto:opsawg-bounces at ietf.org] On Behalf Of
MichaelKo
Sent: Tuesday, June 14, 2011 10:00 PM
To: opsawg at ietf.org; opsawg at ietf.org
Subject: [OPSAWG] Problem statement on setting up dynamic virtual network

I have submitted a new IETF draft titled "Problem Statement for Setting Up
Dynamic Virtual Networks". 

Link to the draft is here:
http://datatracker.ietf.org/doc/draft-ko-dvn-problem-statement/

The abstract is as follows:

"This document examines the problems and challenges associated with the
process of setting up secure virtual network connections among authorized
network nodes.  The network nodes can be located anywhere in a private or
public network, directly connected or behind one or more levels of NAT.
Setting up a secure virtual network in this environment entails the
resolution of various issues such as authentication, peer discovery, virtual
network address management, and connection parameters determination."

Some background information:  At the OPSAWG meeting in IETF 79, Margaret
Wasserman presented materials related to the IETF drafts (*) that she
co-authored.  She was subsequently asked to produce a problem statement and
to continue the work within OPSAWG.  This IETF draft is a continuation of
that work.

Your comments and suggestions are most welcome.

Mike

(*) "Dynamic Virtual Network Engine (DVNE) Protocol"
(draft-mrw-dvne-prot-00) and "Dynamic Virtual Network Engine (DVNE)
Framework" (draft-mrw-dvne-fw-00)
_______________________________________________
OPSAWG mailing list
OPSAWG at ietf.org
https://www.ietf.org/mailman/listinfo/opsawg

---

From: Michael Ko <[email-masked]>
Date: Mon, 11 Jul 2011 19:13:09 -0700

Songlin,

There are merits in having a central repository to handle the connectivity, security, and management issues in a dynamic virtual network.  But one need not view the central repository as a monolithic entity.  Instead, the information stored therein could be distributed among the repositories.  A protocol would be needed to allow the repositories to maintain synchronicity and to share network information and control.

The current draft is a problem statement that examines the problems and challenges associated with
the process of setting up secure virtual network connections among authorized network nodes.  The detailed scenarios for such dynamic virtual network that you requested was covered in an expired draft titled "Dynamic Virtual Network Engine (DVNE) Framwork" (draft-mrw-dvne-fw-00.txt) by Margaret Wasserman and Paddy Nallur.  I am in the process of updating that draft and will upload it to IETF soon.  Hopefully it will answer your questions in more detail than an e-mail response.

Mike  
  ----- Original Message ----- 
  From: Songlin Bai 
  To: [email-masked] 
  Cc: [email-masked] 
  Sent: Monday, July 11, 2011 8:45 AM
  Subject: Re: [OPSAWG] Problem statement on setting up dynamic virtual network

  Hi，Michael
  It looks a good draft in describing problems in setting virtual network. But I am doubtful whether there is a solution could solve all the three problem--connectivity, security and management. It seems a big thing. One suggestion, could you add a section to describe the detailed senarios? it seems not clear now.

  Regards，

  Songlin Bai

  -----Original Message-----
  From: opsawg-bounces at ietf.org [mailto:opsawg-bounces at ietf.org] On Behalf Of
  MichaelKo
  Sent: Tuesday, June 14, 2011 10:00 PM
  To: opsawg at ietf.org; opsawg at ietf.org
  Subject: [OPSAWG] Problem statement on setting up dynamic virtual network

  Mike