Subject: Re: [sfc] EW/NS traffic: comments on draft-ietf-sfc-dc-use-cases-00

From: "Surendra Kumar (smkumar)" <[email-masked]>
Date: Tue, 24 Jun 2014 18:32:41 +0000

Dave,

E-W and N-S are widely used terms in DCs to refer to traffic that is coming into the DC vs. traffic that is flowing within the DC. One may trigger the other.

Some more comments Inline.

Rgds,
Surendra.
PS: Apologies for the really fast response.

From: Dave Hood <[email-masked]<mailto:[email-masked]>>
Date: Friday, May 9, 2014 1:30 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [sfc] EW/NS traffic: comments on draft-ietf-sfc-dc-use-cases-00

Sorry to join the conversation late; despite good intentions wrt its predecessors, I only just read this draft.

I am accustomed to think of E-W and N-S dimensions as applicable to control or signaling traffic, but not in the data plane. The ideas are used pretty widely in this draft, so I was interested to understand what they really meant.

NS traffic is initially introduced with the idea that it terminates somewhere outside the DC. Already, this raises my eyebrows:

1.    It forces our view of DCs to be physical rather than virtual. Also true of endpoints.

SK> The draft nowhere assumes or implies this. On the contrary, virtual environment is called out explicitly.

2.    It feels as if it violates layering. At the layer implied by item 1, an endpoint will usually be external from the DC, but once the external VPN is properly connected, I would expect that the endpoint would now be inside <some> trust domain.

SK> The reality of traffic originating from outside the DC and the services requirement do not change for such traffic, irrespective.

Then further on, we talk about EW traffic, and the distinction appears to be that NS crosses trust domain boundaries, while EW traffic remains within a single trust domain.

3.    By that interpretation, our given user flow is going to change direction after it gets through the access firewall.

4.    But we also show several FWs in the service chain, which recognizes that trust domains may be nested. What direction do we assume for flows through intermediate trust domains?

SK> Security policies change from coarse-grain at the lower layers to fine grain and application specific at the upper layers. The example noted is that of the three tiered architecture where the web-server interacts with application server, which in turn may interact with DB server. Each of these tiers have their own security and scaling requirements hence the service functions depicted.

I see nothing in the text that relies heavily on a distinction. But if the distinction between EW and NS is really important to the model, could we have a crisp definition, please? And if not, could we consider eliminating the concept?

Thanks,
Dave