+----+    +-----+  +----------------------+   +-----+
  |    |SC#1| SFF |  |       IBN 1          |   | SFF |
->|    |================*                *===============>
  |    |    +-----+  |  # (in DC 1)      #  |   +-----+
  | CF |             |  V                #  |
  |    |             |+---+            +---+|   Top domain
  |    |    * * * * *||CF | * * * * * *|SFF|| * * * * *
  |    |    *        |+---+            +-+-+|         *
  +----+    *        | | |              | | |    Sub  *
            *        +-o-o--------------o-o-+   domain*
            *     SC#2 | |SC#1          ^ ^       #1  *
            *    +-----+ |              | |           *
            *    |       V              | |           *
            *    |     +---+  +------+  | |           *
            *    |     |SFF|->|SF#1.1|--+ |           *
            *    |     +---+  +------+    |           *
            *    V                        |           *
            *  +---+  +------+  +---+  +------+       *
            *  |SFF|->|SF#2.1|->|SFF|->|SF#2.2|       *
            *  +---+  +------+  +---+  +------+       *
            * * * * * * * * * * * * * * * * * * * * * *
        

*** Sub-domain boundary; === top-level chain; --- low-level chain.

Figure 2: Sub-domain within a higher-level domain

If desired, the pattern can be applied recursively. For example, SF#1.1 in Figure 2 could be a sub-domain of the sub-domain.

3. Internal Boundary Node (IBN)

A network element termed "Internal Boundary Node" (IBN) bridges packets between domains. It looks like an SF to the higher level, and looks like a classifier and end-of-chain to the lower level.

To achieve the benefits of hierarchy, the IBN should be applying more granular traffic classification rules at the lower level than the traffic passed to it. This means that the number of SF Paths within the lower level is greater than the number of SF Paths arriving to the IBN.

The IBN is also the termination of lower-level SF paths. This is because the packets exiting lower-level SF paths must be returned to the higher-level SF paths and forwarded to the next hop in the higher-level domain.

3.1. IBN Path Configuration

An operator of a lower-level SF Domain may be aware of which high-level paths transit their domain, or they may wish to accept any paths.

When packets enter the sub-domain, the Path Identifier and Path Index are re-marked according to the path selected by the classifier.

After exiting a path in the sub-domain, packets can be restored to an upper-level SF path by these methods:

1. Stateful per flow,
2. Pushing path identifier into metadata,
3. Using unique lower-level paths per upper-level path.

3.1.1. Flow-Stateful IBN

An IBN can be flow-aware, returning packets to the correct higher-level SF path on the basis of 5-tuple of packets exiting the lower-level SF paths.

When packets are received by the IBN on a higher-level path, the encapsulated packets are parsed for IP and transport-layer (TCP or UDP) coordinates. State is created, indexed by the 5-tuple of {source-IP, destination-IP, source-port, destination-port and transport protocol}. The state contains critical fields of the encapsulating SFC header (or perhaps the entire header).

The simplest approach has the packets return to the same IBN at the end of the chain that classified the packet at the start of the chain. This is because the required 5-tuple state is rapidly changing and most efficiently kept locally. If the packet is returned to a different IBN for egress, 5-tuple state must be synchronized between the IBNs.

When a packet returns to the IBN at the end of a chain, the SFC header is removed, the packet is parsed for IP and transport-layer coordinates, and state is retrieved by the 5-tuple of the packet. The state contains the information required to forward the packet within the higher-level service chain.

State cannot be created by packets arriving from the lower-level chain; when state cannot be found for such packets, they MUST be dropped.

This stateful approach is limited to use with SFs that retain the 5-tuple of the packet. This approach cannot be used with SFs that modify the 5-tuple (e.g., as done by a NAT) or otherwise create packets for new 5-tuples other than those received (e.g., as an HTTP cache might do to retrieve content on behalf of the original flow). In both cases, the fundamental problem is the inability to forward packets when state cannot be found for the packet 5-tuples.

In the stateful approach, there are issues caused by the state, such as how long the state should be maintained (it MUST time out eventually), as well as whether the state needs to be replicated to other devices to create a highly available network.

It is valid to consider the state disposable after failure, since it can be re-created by each new packet arriving from the higher-level domain. For example, if an IBN loses all flow state, the state is re-created by an end-point retransmitting a TCP packet.

If an SFC domain handles multiple network regions (e.g., multiple private networks), the 5-tuple may be augmented with a 6th parameter, perhaps using some metadata to identify the network region.

In this stateful approach, it is not necessary for the sub-domain's control-plane to modify paths when higher-level paths are changed. The complexity of the higher-level domain does not cause complexity in the lower-level domain.

3.1.2. Encoding Upper-Level Paths in Metadata

An IBN can push the upper-level service path identifier (SPI) and service index (SI) (or encoding thereof) into a metadata field of the lower-level encapsulation (e.g., placing upper-level path information into a metadata field of NSH). When packets exit the lower-level path, the upper-level SPI and SI can be restored from the metadata retrieved from the packet.

This approach requires the SFs in the path to be capable of forwarding the metadata and appropriately attaching metadata to any packets injected for a flow.

Using new metadata may inflate packet size when variable-length metadata (type 2 from NSH [I-D.ietf-sfc-nsh]) is used.

It is conceivable that the MD-type 1 Mandatory Context Header fields of NSH [I-D.ietf-sfc-nsh] are not all relevant to the lower-level domain. In this case, one of the metadata slots of the Mandatory Context Header could be repurposed within the lower-level domain, and restored when leaving.

In this metadata approach, it is not necessary for the sub-domain's controller to modify paths when higher-level paths are changed. The complexity of the higher-level domain does not cause complexity in the lower-level domain.

3.1.3. Using Unique Paths per Upper-Level Path

In this approach, paths within the sub-domain are constrained so that a path identifier (of the sub-domain) unambiguously indicates the egress path (of the upper domain). This allows the original path information to be restored at sub-domain egress from a look-up table using the sub-domain path identifier.

Whenever the upper-level domain provisions a path via the lower-level domain, the lower-level domain controller must provision corresponding paths to traverse the lower-level domain.

A down-side of this approach is that the number of paths in the lower-level domain is multiplied by the number of paths in the higher-level domain that traverse the lower-level domain. I.e., a sub-path must be created for each combination of upper Path identifier and lower path.

3.2. Gluing Levels Together

The path identifier or metadata on a packet received by the IBN may be used as input to reclassification and path selection within the lower-level domain.

In some cases the meanings of the various path IDs and metadata must be coordinated between domains.

One approach is to use well-known identifier values in metadata, communicated by some organizational registry.

Another approach is to use well-known labels for path identifiers or metadata, as an indirection to the actual identifiers. The actual identifiers can be assigned by control-plane systems. For example, a sub-domain classifier could have a policy, "if pathID=classA then chain packet to path 1234"; the higher-level controller would be expected to configure the concrete higher-level pathID for classA.

4. Sub-domain Classifier

Within the sub-domain (referring to Figure 2), after the IBN removes higher-level encapsulation from incoming packets, it sends the packets to the classifier, which selects the encapsulation for the packet within the sub-domain.

One of the goals of the hierarchical approach is to make it easy to have transport-flow-aware service chaining with bidirectional paths. For example, it is desired that for each TCP flow, the client-to-server packets traverse the same SFs as the server-to-client packets, but in the opposite sequence. We call this bidirectional symmetry. If bidirectional symmetry is required, it is the responsibility of the control-plane to be aware of symmetric paths and configure the classifier to chain the traffic in a symmetric manner.

Another goal of the hierarchical approach is to simplify the mechanisms of scaling in and scaling out service functions. All of the complexities of load-balancing among multiple SFs can be handled within a sub-domain, under control of the classifier, allowing the higher-level domain to be oblivious to the existence of multiple SF instances.

Considering the requirements of bidirectional symmetry and load-balancing, it is useful to have all packets entering a sub-domain to be received by the same classifier or a coordinated cluster of classifiers. There are both stateful and stateless approaches to ensuring bidirectional symmetry.

5. Control Plane Elements

Controllers have been mentioned in this document without much explanation. Although control protocols have not yet been standardized, from the point of view of hierarchical service chaining we have these expectations:

• Each control-plane instance manages a single level of hierarchy of a single domain.
• Each control-plane is agnostic about other levels of hierarchy. This aspect allows humans to reason about the system within a single domain and allows control-plane algorithms to use only domain-local inputs. Top-level control does not need visibility to sub-domain policies, nor does sub-domain control need visibility to higher-level policies.
• Sub-domain control-planes are agnostic about control-planes of other sub-domains. This allows both humans and machines to manipulate sub-domain policy without considering policies of other domains.

Recall that the IBN acts as an SF in the higher-level domain (receiving SF instructions from the higher-level control-plane) and as a classifier in the lower-level domain (receiving classification rules from the sub-domain control-plane). In this view, it is the IBN that glues the layers together.

The above expectations are not intended to prohibit network-wide control. A control hierarchy can be envisaged to distribute information and instructions to multiple domains and sub-domains. Control hierarchy is outside the scope of this document.

6. Acknowledgements

The concept of Hierarchical Service Path Domains was introduced in draft-homma-sfc-forwarding-methods-analysis-01 [I-D.homma-sfc-forwarding-methods-analysis] as a means to improve scalability of service chaining in large networks.

The authors would like to thank the following individuals for taking the time to read and provide valuable feedback:

Ron Parker

Christian Jacquenet

Dapeng Liu

7. IANA Considerations

This memo includes no request to IANA.

8. Security Considerations

Hierarchical service chaining makes use of service chaining architecture, and hence inherits the security considerations described in the architecture document.

Furthermore, hierarchical service chaining inherits security considerations of the data-plane protocols (e.g., NSH) and control-plane protocols used to realize the solution.

The systems described in this document bear responsibility for forwarding internet traffic. In some cases the systems are responsible for maintaining separation of traffic in private networks.

This document describes systems within different domains of administration that must have consistent configurations in order to properly forward traffic and to maintain private network separation. Any protocol designed to distribute the configurations must be secure from tampering.

All of the systems and protocols must be secure from modification by untrusted agents.

9. References

9.1. Normative References

9.2. Informative References

Appendix A. Examples of Hierarchical Service Function Chaining

The advantage of hierarchical service function chaining compared with normal or flat service function chaining is that it can reduce the management complexity significantly. This section discusses examples that show the advantage of hierarchical service chaining.

A.1. Simplify SFC management

In this use case, hierarchical service chaining is used to simplify service function chaining management by reducing the number of Service Function Paths.

As shown in Figure 3, there are two domains each with different concerns: a Security Domain that selects Service Functions based on network conditions and an Optimization Domain that selects Service Functions based on traffic protocol.

There are five security functions deployed in the Security Domain. The Security Domain operator wants to enforce the five different security policies, and the Optimization Domain operator wants to apply different optimization (either cache or video optimization to each of these two types of traffic. If we use flat SFC (normal branching), 10 SFPs are needed in each domain. In contrast, if we use hierarchical SFC, only 5 SFPs in Security Domain and 2 SFPs in Optimization Domain will be required, as shown in Figure 4.

In the flat model, the number of SFPs is the product of the number of functions in all of the domains. In the hSFC model, the number of SFPs is the sum of the number of functions. For example, adding a "bypass" path in the Optimization Domain would cause the flat model to require 15 paths (5 more), but cause the hSFC model to require one more path in the Optimization Domain.

           . . . . . . . . . . . .   . . . . . . . . . . . . .
           . Security Domain     .   .  Optimization Domain  .
           .                     .   .                       .
           .    +-1---[     ]----------------->[Cache  ]------->
           .    |     [ WAF ]    .   .                       .
           .    +-2-->[     ]----------------->[Video Opt.]---->
           .    |                .   .                       .    
           .    +-3---[Anti ]----------------->[Cache  ]------->
           .    |     [Virus]    .   .                       .
           .    +-4-->[     ]----------------->[Video Opt.]---->
           .    |                .   .                       .
           .    +-5-->[     ]----------------->[Cache  ]------->
[DPI]--->[CF]---|     [ IPS ]    .   .                       .
           .    +-6-->[     ]----------------->[Video Opt.]---->
           .    |                .   .                       .
           .    +-7-->[     ]----------------->[Cache  ]------->
           .    |     [ IDS ]    .   .                       .
           .    +-8-->[     ]----------------->[Video Opt.]---->
           .    |                .   .                       .
           .    +-9-->[Traffic]--------------->[Cache  ]------->
           .    |     [Monitor]  .   .                       .
           .    +-10->[       ]--------------->[Video Opt.]---->
           . . . . . . . . . . . .   . . . . . . . . . . . . .
        

     . . . . . . . . . . . . . . .     . . . . . . . . . . . . . . .
     .     Security Domain       .     .   Optimization Domain     .
     .                           .     .                           .
[CF]---->[ DPI(Sub-domain GW)]------[CF]->[   Sub-domain GW     ]---->
     .    |                  ^   .     .  |                     ^  .
     .    +----->[ WAF ]-----+   .     .  +-->[ Cache ]---------+  .
     .    |                  |   .     .  |                     |  .
     .    +-->[Anti-Virus]---+   .     .  +-->[Video Opt]-------+  .
     .    |                  |   .     .                           .
     .    +----->[ IPS ]-----+   .     . . . . . . . . . . . . . . .
     .    |                  |   .
     .    +----->[ IDS ]-----+   .
     .    |                  |   .
     .    +-->[ Traffic ]----+   .
     .        [ Monitor ]        .
     . . . . . . . . . . . . . . .