| I2RS working group | S. Hares |
| Internet-Draft | Huawei |
| Intended status: Standards Track | S. Kini |
| Expires: April 30, 2015 | Ericsson |
| A. Ghanwani | |
| Dell | |
| R. Krishnan | |
| Brocade | |
| Q. Wu | |
| Huawei | |
| D. Bogdanovic | |
| Juniper Networks | |
| October 27, 2014 |
An Information Model for Basic Network Policy
draft-hareskini-i2rs-pbr-info-model-00
This document defines the I2RS Policy-Based Routing (PBR) policy information model describing I2RS interactions with the PBR in a routing system. The PBR IM uses Policy Core Information Model (PCIM) framework (RFC3060, RFC3460, and RFC3644) to specify the ordered route list within the PBR RIB adapted to I2RS.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 30, 2015.
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The Interface to the Routing System (I2RS) [I-D.ietf-i2rs-architecture] architecture calls out for read and write access to the information and state within the routing elements. The I2RS client interacts with the I2RS agent in one or more network routing systems.
This I2RS Policy-Based Routing (PBR) Information model defined in this document describes the I2RS interaction with PBR within a routing element.
The PBR requires an ordered list of policy. This PBR informational model uses the Policy Core Information Model (PCIM) framework as described in [RFC3060] with its extensions in [RFC3460] and QOS model in [RFC3644]. The adaptation of the PCIM model to I2RS use is described in [I-D.hares-i2rs-bnp-info-model].
Policy Based Routing (PBR) is a widely used term in the industry to describe a a technique used to make packet forwarding decisions decisions based on policies set by the network administrator. PBR enables network administrator to forward the packet based on other criteria than the destination address in the packet, which is used to lookup an entry in the routing table.
The PBR problem can be viewed as a resource allocation problem that incorporates business decision with routing. PBR may be used to provide many benefits, including better resource allocation, load balancing and QoS.
Routing decisions in PBR are based on several criteria beyond destination address, such as application, IP protocol used, identity of the end system, and even packet size. Policy actions are typically applied before applying QoS constraints since policy actions may overrides QoS constraint.
The I2RS use cases which benefit from PBR are: Protocol independent Use cases and large flow use cases described in [I-D.hares-i2rs-usecase-reqs-summary]
The PBR policies are specified in most routers/switches as an ordered set of rules. Each policy rule has a set of match conditions, and a set of actions which may include forwarding actions and QoS actions. Since policy rules, groups of policy, and ordered sets of policy are used in other protocols (BGP or MPLS), these policy rules have been abstracted into a basic network policy instantiation of the PCIM ([RFC3060], [RFC3460], and [RFC3644]). This instantiation include in the ordered policy rule the references to other policy match-action conditions such as the ACLs ([I-D.bogdanovic-netmod-acl-model]), and Prefix list ([I-D.zhdankin-netmod-bgp-cfg]).
A PBR IM can be considered in either a top-down view examining the policy which controls the data flow or from a bottom-up view which considers the data plane. A top-down view considers how policies control protocols (BGP or IGPs (ISIS/OSPF)) transfer of routes to determine how data flows. The bottoms-up view considers the forwarding data planes that must be supported. In this view,the match filters must consider IP [both IPv4 and IPv6], but may also consider MPLS and encapsulated protocols such as TCP [RFC0793], UDP [RFC0768], STCP [RFC4960], ICMP [RFC0792]. This draft takes the bottoms-up viewpoint which looks at how the PBR RIB controls the data plane.
This draft considers match and action filters for the data-planes using IP (both IPv4 [RFC0791] and IPV6 [RFC2460]).
A PBR-RIB is an entity that contains an ordered set of policy routes and is analogous to a RIB defined in [I-D.ietf-i2rs-rib-info-model]. An ordered set of policy routes implies that the insertion into a PBR-RIB must allow for inserting of a PBR route at any specific position and deleting a route at a specific position. The ability to change a policy rule at a specific position combines these two functions (deleting an existing policy rule and adding a new policy rule).
Each PBR-RIB is contained within a routing instance, but one routing instance (named by an INSTANCE_NAME) can contain multiple PBR RIBs. Each routing instance is associated with a set of interfaces, a router-id a PBR default-RIB, and list of PBR-RIBs. Only some of the interfaces associated with a routing instance may be associated with a PBR-RIB. Each interface can be associated with at most one PBR RIB.
Packets arriving on an interface associated with a PBR-RIB will be forwarded based on a PBR-RIB in the list or PBR Default RIB (if no matches occur). The policy processing within the PBR process within the routing system is expected to do the following:
+-------------------------------+
| routing instance |
+--|--------|---------------+---+
* | |
| | |
+-----------+ +-------------+ +-----------+
|interface* | |PBR_RIB *list| |PBR-Default|
| list | | | |-RIB |
+-----------+ +--|----------+ +---|-------+
| RIB (RIB-info IM)
^
/|\
+-----------^-----------+
| PBR RIB* list |
+-----------|-----------+
|
+-----------------------+
| BNP Policy Set | [Note: This layer
| | can be skipped if
|(nested ordered policy | groups are not nested.]
| from RFC3466) |
+----------|------------+
|
+-----------------------+
| BNP-Policy-Group* |
| |
|(list of ordered groups|
| RFC3466 policy group |
| augmented with I2RS |
| scope) |
+-----------|-----------+
|
+-----------------------+
| BNP-Policy-Rule* |
| |
| (ordered list of |
| RFC3466 policy rules) |
| augmented with |
| policy-order, status, |
| and refcnt) with ACL |
| and other condition- |
| action matches |
+-----------------------+
Figure 1: Routing instance with PBR RIB
The PBR entries associated with each PBR in a routing instance are:
module: PBR
+--PRB-RIB-module
+--rw pbr-instance-name
+--rw pbr-router-id uint32
+--rw pbr-interface*
| +--rw pbr-interface interface-ref-id
+--rw PBR-Default-RIB
+--rw PBR-RIB
+--rw PBR-RIB-Name
+--rw PBR-RIB-AFI
+--rw PBR-RIB-intf*
+--rw PBR-status-info
| +--rw pbr-update-ref uint64
+--rw PBR-Ordered-Route-Policy
+--rw pbr-group-policy* [group-policy-ref]
| +--rw group-policy-ref uint16
| +--rw group-policy-name string
| +--ro group-policy-status-info
| | +--ro group-policy-status
| | +--ro group-policy-inactive-reason
| +--rw policy-rule* [policy-rule-ref]
| +--rw policy-rule-ref
| +--ro policy-rule-status-info
| | +--ro policy-rule-status enumeration
| | +--ro policy-rule-inactive-reason
| +--rw pbr-match-filter* [nr-policy-match]
| +--rw pbr-match-term
| | +--rw pbr-match-condition
| | | +--rw nr-policy-match
| | | +--rw pbr-ipv4-matches
| | | +--rw pbr-ipv6-matche
| | | +--rw pbr-transport-matches
| | | +--rw pbr-combo-operator
| | +--rw pbr-rule-action
| | +--rw pbr-QOS-acts [nbr-act]
| | +--rw npbr-act
| | +--rw set-in-ipv4-packet
| | | ...
| | +--rw set-in-ipv6-packet
| | | ...
| | +--rw set-vendor
| | | . . .
| +--rw pbr-forwarding-actions
| | +--rw pbr-std-fwd enumeration
| | +--rw pbr-vendor-fw enumeration
+--rw pbr-policy-set[policy-set-name]
+--rw policy-set-name
+ . . .
Figure 2: PBR RIB Yang Structure
The Top-level Yang structure for the PBR RIB is:
Each PBR RIB has the following:
Initially, it is expected the simply group policy list will be sufficient. (See [I-D.hares-i2rs-bnp-info-model] for an examples of the policy rules can contain ACL policy, Prefix-list policy, and more complex (match/set) policy.)
+-----------------------+
| Policy Rule |
| (PBR usage) |
+--|-----------------|--+
: : .......
: : : :
+--------V-------+ +-------V-------+ :
| PBR Condition | | PBR Action |<...
+----------------+ +-+----------+--+
/|\ /|\
"extends"| | "extends"
+---+ +--------+
| |
+-------^-------+ +-----^---------+
| QoS Action | |Forward Action |
+---------------+ +---------------+
: : : : : :
....: : :..... .....: : :.....
: : : : : :
+----V---+ +---V----+ +--V---+ +-V------++--V-----++--V-----+
|Set | |QoS | |QoS | |Forward ||Next Hop||Next Hop|
|Operator| |Variable| |Value | |Operator||Variable||Value |
+--------+ +--------+ +------+ +--------++--+-----++--------+
/|\
| "extends"
+---^----+
|Next Hop|
|Type |
+--------+
Figure 3: Policy Rules for PBR routing
A PBR policy rule used by has the following general architecture.
The policy-rule contains the following:
The I2RS client-agent pair PBR process within a routing process to add ephemeral these changes to the PBR State so that
PBR-running = PBR-config + PBR-I2RS-ephemeral
The I2RS ephemeral state will not survive a reboot of the machine. Upon a reboot, the I2RS client must reload the I2RS Agent with the I2RS PBR RIB state lost in the reboot.
The PBR RIB module must allow both the I2RS client-agent to to read the PBR IM as as query or as a notification stream. The pbr-update-ref parameter of the PBR-status-info provides an update count for the PBR configuration to indicate if the PBR has been updated with additions or deletions of the PBR policy rules. This provides the I2RS interface a quick way to check for changes by other entities to the PBR route list.
The RIB in a router with I2RS is the following:
running RIB = configured-RIB + routes-installed-from-protocols + I2RS-ephemeral-state
As described in [I-D.ietf-i2rs-rib-info-model], the I2RS ephemeral RIB information in routing instance contains a collection of RIBs, interfaces, and routing parameters including the following:
PBR RIB and RIB can not be used at the same time, which means:
This section record the issues with the initials of the person who recorded it.
This draft includes no request to IANA.
TBD.
| [I-D.bogdanovic-netmod-acl-model] | Bogdanovic, D., Sreenivasa, K., Huang, L. and D. Blair, "Network Access Control List (ACL) YANG Data Model", Internet-Draft draft-bogdanovic-netmod-acl-model-02, October 2014. |
| [I-D.hares-i2rs-bnp-info-model] | Hares, S. and Q. Wu, "An Information Model for Basic Network Policy", Internet-Draft draft-hares-i2rs-bnp-info-model-00, September 2014. |
| [I-D.hares-i2rs-usecase-reqs-summary] | Hares, S., "Summary of I2RS Use Case Requirements", Internet-Draft draft-hares-i2rs-usecase-reqs-summary-00, July 2014. |
| [I-D.ietf-i2rs-architecture] | Atlas, A., Halpern, J., Hares, S., Ward, D. and T. Nadeau, "An Architecture for the Interface to the Routing System", Internet-Draft draft-ietf-i2rs-architecture-00, August 2013. |
| [I-D.ietf-i2rs-rib-info-model] | Bahadur, N., Folkes, R., Kini, S. and J. Medved, "Routing Information Base Info Model", Internet-Draft draft-ietf-i2rs-rib-info-model-01, October 2013. |
| [I-D.zhdankin-netmod-bgp-cfg] | Alex, A., Patel, K. and A. Clemm, "Yang Data Model for BGP Protocol", Internet-Draft draft-zhdankin-netmod-bgp-cfg-01, October 2014. |
| [RFC0768] | Postel, J., "User Datagram Protocol", STD 6, RFC 768, August 1980. |
| [RFC0791] | Postel, J., "Internet Protocol", STD 5, RFC 791, September 1981. |
| [RFC0792] | Postel, J., "Internet Control Message Protocol", STD 5, RFC 792, September 1981. |
| [RFC0793] | Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981. |
| [RFC2119] | Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. |
| [RFC2460] | Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998. |
| [RFC3060] | Moore, B., Ellesson, E., Strassner, J. and A. Westerinen, "Policy Core Information Model -- Version 1 Specification", RFC 3060, February 2001. |
| [RFC3460] | Moore, B., "Policy Core Information Model (PCIM) Extensions", RFC 3460, January 2003. |
| [RFC3644] | Snir, Y., Ramberg, Y., Strassner, J., Cohen, R. and B. Moore, "Policy Quality of Service (QoS) Information Model", RFC 3644, November 2003. |
| [RFC4960] | Stewart, R., "Stream Control Transmission Protocol", RFC 4960, September 2007. |