Subject: [spring] Servide Chaining in draft-filsfils-rtgwg-segment-routing-use-cases-02

From: Yuantao Zhang <[email-masked]>
Date: Tue, 4 Mar 2014 01:40:23 +0000

Dear all

1.       In "5.  Service chaining" example, is there risk that the segment header gets lost along the service chain when passing through a Service Node like D? Or we have to require all the service nodes to support segment routing?

2.       If the ingress node I put the segment header, that means the service chain for P has been fixed when it leave I. What if a service along the route needs to change the P service chain in the middle of the P's journey? For example, a DPI service may change the P service chain depends on the content of P. DPI may direct some of the flows to another service like Firewall, some flows bypass Firewall.  So the DPI service needs to have segment routing capability and maintaining per-flow state like I?

Thanks
Yuantao

---

From: "Stefano Previdi (sprevidi)" <[email-masked]>
Date: Thu, 6 Mar 2014 14:22:14 +0000

On Mar 4, 2014, at 2:40 AM, Yuantao Zhang wrote:
> Dear all
>  
> 1.       In “5.  Service chaining“ example, is there risk that the segment header gets lost along the service chain when passing through a Service Node like D? Or we have to require all the service nodes to support segment routing?

that specific example assumes that the application preserves/ignore either 
the label stack (SR-MPLS) or the IPv6 Segment Routing Header (SR-IPv6).

> 
> 2.       If the ingress node I put the segment header, that means the service chain for P has been fixed when it leave I. What if a service along the route needs to change the P service chain in the middle of the P’s journey? For example, a DPI service may change the P service chain depends on the content of P. DPI may direct some of the flows to another service like Firewall, some flows bypass Firewall.  So the DPI service needs to have segment routing capability

yes.

> and maintaining per-flow state like I?

DPI would maintain state (configuration/policy?) based on what services 
are to be applied to which flow. This is orthogonal to the method you 
use (or could use) in order to implement service chaining.

E.g.: in segment routing, the outcome of the DPI decision would be a 
label stack (SR-MPLS) or a IPv6 segment routing header (SR-IPV6).

s.

>  
> Thanks
> Yuantao
>  
>  
> _______________________________________________
> spring mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spring

---

From: Yuantao Zhang <[email-masked]>
Date: Wed, 12 Mar 2014 01:17:58 +0000

Hi Stefano

Thanks for the reply. 

I have only one service node with DPI and Content Filtering function in my lab and I gave it a try. The server can not preserves MPLS label. The MPLS labels get lost when the packets pass through the service node. Can you please name a commercial service node or application can preserves MPLS labels? And do you think SR-MPLS is pure networking job and it is extra requirement for an application to preserves MPLS labels? Normally PE or P strips MPLS labels before the application receive them. 

DPI can decide next services for this packet (like pass through or bypass firewall) but it is burden to decide the exact route (label stack). The whole route for this packet depends on some other requirements like latency, bandwidth, jitter, reliability, traffic load, policy, cost and so on, in addition to the next services. If DPI decision is label stack, that means the exact route, isn't it? Is the requirement for DPI too high?

How does to use SR to realize service chaining compares with to use SDN to realize service chaining? Looks SDN is more flexible in this case and does not put extra requirements on service nodes. Do you think SR service chaining is interim solution until SDN becomes a general practice?

Thanks
Yuantao

-----Original Message-----
From: Stefano Previdi (sprevidi) [mailto:[email-masked]] 
Sent: Thursday, March 06, 2014 10:22 PM
To: Yuantao Zhang
Cc: [email-masked]
Subject: Re: [spring] Servide Chaining in draft-filsfils-rtgwg-segment-routing-use-cases-02

> 1.       In "5.  Service chaining" example, is there risk that the segment header gets lost along the service chain when passing through a Service Node like D? Or we have to require all the service…

that specific example assumes that the application preserves/ignore either the label stack (SR-MPLS) or the IPv6 Segment Routing Header (SR-IPv6).

> 
> 2.       If the ingress node I put the segment header, that means the service chain for P has been fixed when it leave I. What if a service along the route needs to change the P service chain in the middle of the P's journey? For example, a DPI service may change the P service chain depends on the content of P. DPI may direct some of the flows to another service like Firewall, some flows bypass Firewall.  So the DPI service needs to have segment routing capability

yes.

> and maintaining per-flow state like I?

DPI would maintain state (configuration/policy?) based on what services are to be applied to which flow. This is orthogonal to the method you use (or could use) in order to implement service chaining.

E.g.: in segment routing, the outcome of the DPI decision would be a label stack (SR-MPLS) or a IPv6 segment routing header (SR-IPV6).

s.

---

From: Robert Raszuk <[email-masked]>
Date: Wed, 12 Mar 2014 02:47:49 +0100

Hello Zhang,

You are perhaps right that MPLS header is lost at your service node.
However I do think that IPv6 header would not be lost therefor SR could
still be used just fine to either pass through such service node or get
redirected via standard redirection mechanism .. usually new encapsulation
or forwarding via different directly connected interface or tee like
behavior.

It really does not matter if you are stuck to using MPLS for some reason if
the label comes from the far away edge or magic SDN controller imposing it
on the return traffic from your service node. As a matter of fact you can
do the same operation on the edge connecting your vanilla service node. But
I would rather use IPv6 encapsulation ;)

Best,
R.

On Wed, Mar 12, 2014 at 2:17 AM, Yuantao Zhang
<[email-masked]>wrote:

> Hi Stefano
>
> Thanks for the reply.
>
> I have only one service node with DPI and Content Filtering function in my
> lab and I gave it a try. The server can not preserves MPLS label. The MPLS
> labels get lost when the packets pass through the service node. Can you
> please name a commercial service node or application can preserves MPLS
> labels? And do you think SR-MPLS is pure networking job and it is extra
> requirement for an application to preserves MPLS labels? Normally PE or P
> strips MPLS labels before the application receive them.
>
> DPI can decide next services for this packet (like pass through or bypass
> firewall) but it is burden to decide the exact route (label stack). The
> whole route for this packet depends on some other requirements like
> latency, bandwidth, jitter, reliability, traffic load, policy, cost and so
> on, in addition to the next services. If DPI decision is label stack, that
> means the exact route, isn't it? Is the requirement for DPI too high?
>
> How does to use SR to realize service chaining compares with to use SDN to
> realize service chaining? Looks SDN is more flexible in this case and does
> not put extra requirements on service nodes. Do you think SR service
> chaining is interim solution until SDN becomes a general practice?
>
> Thanks
> Yuantao
>
> Subject: Re: [spring] Servide Chaining in
> draft-filsfils-rtgwg-segment-routing-use-cases-02
>
> > 1.       In "5.  Service chaining" example, is there risk that the
> segment header gets lost along the service chain when passing through a
> Service Node like D? Or we have to require all the service nodes to support
> segment routing?
>
>
> > 2.       If the ingress node I put the segment header, that means the
> service chain for P has been fixed when it leave I. What if a service along
> the route needs to change the P service chain in the middle of the P's
> journey? For example, a DPI service may change the P service chain depends
> on the content of P. DPI may direct some of the flows to another service
> like Firewall, some flows bypass Firewall.  So the DPI service needs to
> have segment routing capability
>
>
> yes.
>
>
> are to be applied to which flow. This is orthogonal to the method you use
> (or could use) in order to implement service chaining.
>
> E.g.: in segment routing, the outcome of the DPI decision would be a label
> stack (SR-MPLS) or a IPv6 segment routing header (SR-IPV6).
>
> s.
>
>
> >
> > Thanks
> > Yuantao
> >
> >