| Internet-Draft | IETF Network Slices | June 2022 |
| Farrel, et al. | Expires 1 January 2023 | [Page] |
This document describes network slicing in the context of networks built from IETF technologies. It defines the term "IETF Network Slice" and establishes the general principles of network slicing in the IETF context.¶
The document discusses the general framework for requesting and operating IETF Network Slices, the characteristics of an IETF Network Slice, the necessary system components and interfaces, and how abstract requests can be mapped to more specific technologies. The document also discusses related considerations with monitoring and security.¶
This document also provides definitions of related terms to enable consistent usage in other IETF documents that describe or use aspects of IETF Network Slices.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 1 January 2023.¶
Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
A number of use cases would benefit from a network service that supplements connectivity, such as that offered by a VPN service, with an assurance of meeting a set of specific network performance objectives. This connectivity and resource commitment is referred to as a network slice and is expressed in terms of connectivity constructs (see Section 3) and service objectives (see Section 4). Since the term network slice is rather generic, the qualifying term "IETF" is used in this document to limit the scope of network slice to network technologies described and standardized by the IETF. This document defines the concept of IETF Network Slices that provide connectivity coupled with a set of specific commitments of network resources between a number of endpoints (known as Service Demarcation Points (SDPs) - see Section 2.1 and Section 4.2) over a shared underlay network. The term IETF Network Slice service is also introduced to describe the service requested by and provided to the service provider's customer.¶
Services that might benefit from IETF Network Slices include, but are not limited to:¶
IETF Network Slices are created and managed within the scope of one or more network technologies (e.g., IP, MPLS, optical). They are intended to enable a diverse set of applications with different requirements to coexist over a shared underlay network. A request for an IETF Network Slice service is agnostic to the technology in the underlay network so as to allow a customer to describe their network connectivity objectives in a common format, independent of the underlay technologies used.¶
This document also provides a framework for discussing IETF Network Slices. The framework is intended as a structure for discussing interfaces and technologies.¶
For example, virtual private networks (VPNs) have served the industry well as a means of providing different groups of users with logically isolated access to a common network. The common or base network that is used to support the VPNs is often referred to as an underlay network, and the VPN is often called an overlay network. An overlay network may, in turn, serve as an underlay network to support another overlay network.¶
Note that it is conceivable that extensions to IETF technologies are needed in order to fully support all the capabilities that can be implemented with network slices. Evaluation of existing technologies, proposed extensions to existing protocols and interfaces, and the creation of new protocols or interfaces are outside the scope of this document.¶
The concept of network slicing has gained traction driven largely by needs surfacing from 5G ([NGMN-NS-Concept], [TS23501], and [TS28530]). In [TS23501], a Network Slice is defined as "a logical network that provides specific network capabilities and network characteristics", and a Network Slice Instance is defined as "A set of Network Function instances and the required resources (e.g. compute, storage and networking resources) which form a deployed Network Slice." According to [TS28530], an end-to-end network slice consists of three major types of network segments: Radio Access Network (RAN), Transport Network (TN) and Core Network (CN). An IETF Network Slice provides the required connectivity between different entities in RAN and CN segments of an end-to-end network slice, with a specific performance commitment (for example, serving as a TN slice). For each end-to-end network slice, the topology and performance requirement on a customer's use of an IETF Network Slice can be very different, which requires the underlay network to have the capability of supporting multiple different IETF Network Slices.¶
While network slices are commonly discussed in the context of 5G, it is important to note that IETF Network Slices are a narrower concept with a broader usage profile, and focus primarily on particular network connectivity aspects. Other systems, including 5G deployments, may use IETF Network Slices as a component to create entire systems and concatenated constructs that match their needs, including end-to-end connectivity.¶
An IETF Network Slice could span multiple technologies and multiple administrative domains. Depending on the IETF Network Slice customer's requirements, an IETF Network Slice could be isolated from other, often concurrent IETF Network Slices in terms of data, control and management planes.¶
The customer expresses requirements for a particular IETF Network Slice service by specifying what is required rather than how the requirement is to be fulfilled. That is, the IETF Network Slice customer's view of an IETF Network Slice is an abstract one.¶
Thus, there is a need to create logical network structures with required characteristics. The customer of such a logical network can require a degree of isolation and performance that previously might not have been satisfied by overlay VPNs. Additionally, the IETF Network Slice customer might ask for some level of control of their virtual networks, e.g., to customize the service paths in a network slice.¶
This document specifies definitions and a framework for the provision of an IETF Network Slice service. Section 6 briefly indicates some candidate technologies for realizing IETF Network Slices.¶
The following abbreviations are used in this document.¶
The meaning of these abbreviations is defined in greater details in the remainder of this document.¶
The following terms are presented here to give context. Other terminology is defined in the remainder of this document.¶
The point at which an IETF Network Slice service is delivered by a service provider to a customer. Depending on the service delivery model (see Section 4.2) this may be a CE or a PE, and could be a device, a software component, or an abstract virtual function supported within the provider's network. Each SDP must have a unique identifier (e.g., an IP address or MAC address) within a given IETF Network Slice service and may use the same identifier in multiple IETF Network Slice services.¶
An SDP may be abstracted as a Service Attachment Point (SAP) [I-D.ietf-opsawg-sap] for the purpose of generalizing the concept across multiple service types and representing it in management and configuration systems.¶
IETF Network Slices are created to meet specific requirements, typically expressed as bandwidth, latency, latency variation, and other desired or required characteristics. Creation of an IETF Network Slice is initiated by a management system or other application used to specify network-related conditions for particular traffic flows in response to an actual or logical IETF Network Slice service request.¶
Once created, these slices can be monitored, modified, deleted, and otherwise managed.¶
Applications and components will be able to use these IETF Network Slices to move packets between the specified end-points of the service in accordance with specified characteristics.¶
A clear distinction should be made between the "IETF Network Slice service" which is the function delivered to the customer (see Section 3.2) and which is agnostic to the technologies and mechanisms used by the service provider, and the "IETF Network Slice" which is the realization of the service in the provider's network achieved by partitioning network resources and by applying certain tools and techniques within the network (see Section 3.1 and Section 6).¶
The term "Slice" refers to a set of characteristics and behaviors that differentiate one type of user-traffic from another within a network. An IETF Network Slice is a partition of a network that uses IETF technology. An IETF Network Slice assumes that an underlay network is capable of changing the configurations of the network devices on demand, through in-band signaling, or via controllers.¶
An IETF Network Slice enables connectivity between a set of Service Demarcation Points (SDPs) with specific Service Level Objectives (SLOs) and Service Level Expectations (SLEs) (see Section 4) over a common underlay network. The SLOs and SLEs characterize the performance of the underlay network between a sending SDP and a set of receiving SDPs. Thus, an IETF Network Slice delivers a service to a customer by meeting connectivity resource requirements and associated network capabilities such as bandwidth, latency, jitter, and network functions with other resource behaviors such as compute and storage availability.¶
IETF Network Slices may be combined hierarchically, so that a network slice may itself be sliced. They may also be combined sequentially so that various different networks can each be sliced and the network slices placed into a sequence to provide an end-to-end service. This form of sequential combination is utilized in some services such as in 3GPP's 5G network [TS23501].¶
A service provider delivers an IETF Network Slice service for a customer by realizing an IETF Network Slice. The IETF Network Slice service is agnostic to the technology of the underlay network, and its realization may be selected based upon multiple considerations including its service requirements and the capabilities of the underlay network. This allows an IETF Network Slice service customer to describe their network connectivity and relevant objectives in a common format, independent of the underlay technologies used.¶
The IETF Network Slice service is specified in terms of a set of SDPs, a set of one or more connectivity constructs between subsets of these SDPs, and a set of SLOs and SLEs (see Section 4) for each SDP sending to each connectivity construct. A communication type (point-to-point (P2P), point-to-multipoint (P2MP), or any-to-any (A2A)) is specified for each connectivity construct. That is, in a given IETF Network Slice service there may be one or more connectivity constructs of the same or different type, each connectivity construct may be between a different subset of SDPs, for a given connectivity construct each sending SDP has its own set of SLOs and SLEs, and the SLOs and SLEs in each set may be different. Note that different connectivity constructs can be specified in the service request but the service provider may decide how many connectivity constructs per IETF Network Slice service it wishes to support such that an IETF Network Slice service may be limited to one connectivity construct or may support many.¶
This approach results in the following possible connectivity constructs:¶
With an A2A connectivity construct, any sending SDP may send to any one receiving SDP or any set of receiving SDPs in the construct. There is an implicit level of routing in this connectivity construct that is not present in the other connectivity constructs because the provider's network must determine to which receiving SDPs to deliver each packet. This construct may be used to support P2P traffic between any pair of SDPs, or to support multicast or broadcast traffic from one SDP to a set of other SDPs. In the latter case, whether the service is delivered using multicast within the provider's network or using "ingress replication" or some other means is out of scope of the specification of the service. A service provider may choose to support A2A constructs, but to limit the traffic to unicast.¶
The SLOs/SLEs in an A2A connectivity construct apply to individual sending SDPs regardless of the receiving SDPs, and there is no linkage between sender and receiver in the specification of the connectivity construct. A sending SDP may be "disappointed" if the receiver is over-subscribed. If a customer wants to be more specific about different behaviors from one SDP to another SDP, they should use P2P connectivity constructs.¶
A customer traffic flow may be unicast or multicast, and various network realizations are possible:¶
From the above, it can be seen that the SLOs of the senders define the SLOs for the receivers on any connectivity construct. That is, and in particular, the network may be expected to handle the traffic volume from a sender to all destinations. This extends to all connectivity constructs in an IETF Network Slice service.¶
Note that the realization of an IETF Network Slice service does not need to map the connectivity constructs one-to-one onto underlying network constructs (such as tunnels, etc.). The service provided to the customer is distinct from how the provider decides to deliver that service.¶
If a CE has multiple attachment circuits to a PE within a given IETF Network Slice service and they are operating in single-active mode, then all traffic between the CE and its attached PEs transits a single attachment circuit; if they are operating in all-active mode, then traffic between the CE and its attached PEs is distributed across all of the active attachment circuits.¶
A given sending SDP may be part of multiple connectivity constructs within a single IETF Network Slice service, and the SDP may have different SLOs and SLEs for each connectivity construct to which it is sending. Note that a given sending SDP's SLOs and SLEs for a given connectivity construct apply between it and each of the receiving SDPs for that connectivity construct.¶
An IETF Network Slice service provider may freely make a deployment choice as to whether to offer a 1:1 relationship between IETF Network Slice service and connectivity construct, or to support multiple connectivity constructs in a single IETF Network Slice service. In the former case, the provider might need to deliver multiple IETF Network Slice services to achieve the function of the second case.¶
It should be noted that per Section 9 of [RFC4364] an IETF Network Slice service customer may actually provide IETF Network Slice services to other customers in a mode sometimes referred to as "carrier's carrier". In this case, the underlying IETF Network Slice service provider may be owned and operated by the same or a different provider network. As noted in Section 4.3, network slices may be composed hierarchically or serially.¶
Section 4.2 provides a description of endpoints in the context of IETF network slicing. These are known as Service Demarcation Points (SDPs). For a given IETF Network Slice service, the customer and provider agree, on a per-SDP basis which end of the attachment circuit provides the SDP (i.e., whether the attachment circuit is inside or outside the IETF Network Slice service). This determines whether the attachment circuit is subject to the set of SLOs and SLEs at the specific SDP.¶
It may be the case that the set of SDPs needs to be supplemented with additional senders or receivers. An additional sender could be, for example, an IPTV or DNS server either within the provider's network or attached to it, while an extra receiver could be, for example, a node reachable via the Internet. This is modelled as a set of ancillary CEs which supplement the other SDPs in one or more connectivity constructs, or which have their own connectivity constructs. Note that an ancillary CE can either have a resolvable address, e.g., an IP address or MAC address, or the SDP may be a placeholder, e.g., IPTV or DNS server, which is resolved within the provider's network when the IETF Network Slice service is instantiated.¶
Thus, an ancillary CE may be a node within the provider network (i.e., not a customer edge). An example is a node that provides a service function. Another example is a node that acts as a hub. There will be times when the customer wishes to explicitly select one of these. Alternatively, an ancillary CE may be a service function at an unknown point in the provider's network. In this case, the function may be a placeholder that has its addressed resolved as part of the realization of the slice service.¶
The following subsections describe the characteristics of IETF Network Slices in addition to the list of SDPs, the connectivity constructs, and the technology of the ACs.¶
An IETF Network Slice service is defined in terms of quantifiable characteristics known as Service Level Objectives (SLOs) and unquantifiable characteristics known as Service Level Expectations (SLEs). SLOs are expressed in terms Service Level Indicators (SLIs), and together with the SLEs form the contractual agreement between service customer and service provider known as a Service Level Agreement (SLA).¶
The terms are defined as follows:¶
SLOs define a set of measurable network attributes and characteristics that describe an IETF Network Slice service. SLOs do not describe how an IETF Network Slice service is implemented or realized in the underlying network layers. Instead, they are defined in terms of dimensions of operation (time, capacity, etc.), availability, and other attributes.¶
An IETF Network Slice service may include multiple connectivity constructs that associate sets of endpoints (SDPs). SLOs apply to a given connectivity construct and apply to a specific direction of traffic flow. That is, they apply to a specific sending SDP and the set of receiving SDPs.¶
SLOs can be described as 'Directly Measurable Objectives': they are always measurable. See Section 4.1.2 for the description of Service Level Expectations which are unmeasurable service-related requests sometimes known as 'Indirectly Measurable Objectives'.¶
Objectives such as guaranteed minimum bandwidth, guaranteed maximum latency, maximum permissible delay variation, maximum permissible packet loss rate, and availability are 'Directly Measurable Objectives'. Future specifications (such as IETF Network Slice service YANG models) may precisely define these SLOs, and other SLOs may be introduced as described in Section 4.1.1.2.¶
The definition of these objectives are as follows:¶
Additional SLOs may be defined to provide additional description of the IETF Network Slice service that a customer requests. These would be specified in further documents.¶
If the IETF Network Slice service is traffic aware, other traffic specific characteristics may be valuable including MTU, traffic-type (e.g., IPv4, IPv6, Ethernet or unstructured), or a higher-level behavior to process traffic according to user-application (which may be realized using network functions).¶
SLEs define a set of network attributes and characteristics that describe an IETF Network Slice service, but which are not directly measurable by the customer (e.g. diversity, isolation, and geographical restrictions). Even though the delivery of an SLE cannot usually be determined by the customer, the SLEs form an important part of the contract between customer and provider.¶
Quite often, an SLE will imply some details of how an IETF Network Slice service is realized by the provider, although most aspects of the implementation in the underlying network layers remain a free choice for the provider. For example, activating unicast or multicast capabilities to deliver an IETF Network Slice service could be explicitly requested by a customer or could be left as an engineering decision for the service provider based on capabilities of the network and operational choices.¶
SLEs may be seen as aspirational on the part of the customer, and they are expressed as behaviors that the provider is expected to apply to the network resources used to deliver the IETF Network Slice service. Of course, over time, it is possible that mechanisms will be developed that enable a customer to verify the provision of an SLE, at which point it effectively becomes an SLO.¶
An IETF Network Slice service may include multiple connectivity constructs that associate sets of endpoints (SDPs). SLEs apply to a given connectivity construct and apply to specific directions of traffic flow. That is, they apply to a specific sending SDP and the set of receiving SDPs. However, being more general in nature than SLOs, SLEs may commonly be applied to all connectivity constructs in an IETF Network Slice service.¶
SLEs can be described as 'Indirectly Measurable Objectives': they are not generally directly measurable by the customer.¶
Security, geographic restrictions, maximum occupancy level, and isolation are example SLEs as follows.¶
A customer may request that the provider applies encryption or other security techniques to traffic flowing between SDPs of a connectivity construct within an IETF Network Slice service. For example, the customer could request that only network links that have MACsec [MACsec] enabled are used to realize the connectivity construct.¶
This SLE may include a request for encryption (e.g., [RFC4303]) between the two SDPs explicitly to meet the architectural recommendations in [TS33.210] or for compliance with [HIPAA] or [PCI].¶
Whether or not the provider has met this SLE is generally not directly observable by the customer and cannot be measured as a quantifiable metric.¶
A customer may request that certain geographic limits are applied to how the provider routes traffic for the IETF Network Slice service. For example, the customer may have a preference that its traffic does not pass through a particular country for political or security reasons.¶
Whether or not the provider has met this SLE is generally not directly observable by the customer and cannot be measured as a quantifiable metric.¶
The maximal occupancy level specifies the number of flows to be admitted and optionally a maximum number of countable resource units (e.g., IP or MAC addresses) an IETF Network Slice service can consume. Because an IETF Network Slice service may include multiple connectivity constructs, this SLE should state whether it applies to all connectivity constructs, a specified subset of them, or an individual connectivity construct.¶
Again, a customer may not be able to fully determine whether this SLE is being met by the provider.¶
As described in Section 7, a customer may request that its traffic within its IETF Network Slice service is isolated from the effects of other network services supported by the same provider. That is, if another service exceeds capacity or has a burst of traffic, the customer's IETF Network Slice service should remain unaffected and there should be no noticeable change to the quality of traffic delivered.¶
In general, a customer cannot tell whether a service provider is meeting this SLE. They cannot tell whether the variation of an SLI is because of changes in the underlay network or because of interference from other services carried by the network. If the service varies within the allowed bounds of the SLOs, there may be no noticeable indication that this SLE has been violated.¶
A customer may request that different connectivity constructs use different underlay network resources. This might be done to enhance the availability of the connectivity constructs within an IETF Network Slice service.¶
While availability is a measurable objective (see Section 4.1.1.1) this SLE requests a finer grade of control and is not directly measurable (although the customer might become suspicious if two connectivity constructs fail at the same time).¶
As noted in Section 3.1, an IETF Network Slice provides connectivity between sets of SDPs with specific SLOs and SLEs. Section 3.2 goes on to describe how the IETF Network Slice service is composed of a set of one or more connectivity constructs that describe connectivity between the Service Demarcation Points (SDPs) across the underlay network.¶
The characteristics of IETF Network Slice SDPs are as follows.¶
SDPs are mapped to endpoints of services/tunnels/paths within the IETF Network Slice during its initialization and realization.¶
Note that an ancillary CE (see Section 3.2.1) is the endpoint of a connectivity construct and so should be considered as an SDP in this discussion.¶
For a given IETF Network Slice service, the IETF Network Slice customer and provider agree where the SDP is located. This determines what resources at the edge of the network form part of the IETF Network Slice and are subject to the set of SLOs and SLEs for a specific SDP.¶
Figure 1 shows different potential scopes of an IETF Network Slice that are consistent with the different SDP locations. For the purpose of this discussion and without loss of generality, the figure shows customer edge (CE) and provider edge (PE) nodes connected by attachment circuits (ACs). Notes after the figure give some explanations.¶
|<---------------------- (1) ---------------------->|
| |
| |<-------------------- (2) -------------------->| |
| | | |
| | |<----------- (3) ----------->| | |
| | | | | |
| | | |<-------- (4) -------->| | | |
| | | | | | | |
V V AC V V V V AC V V
+-----+ | +-----+ +-----+ | +-----+
| |--------| | | |--------| |
| CE1 | | | PE1 |. . . . . . . . .| PE2 | | | CE2 |
| |--------| | | |--------| |
+-----+ | +-----+ +-----+ | +-----+
^ ^ ^ ^
| | | |
| | | |
Customer Provider Provider Customer
Edge 1 Edge 1 Edge 2 Edge 2
Explanatory notes for Figure 1 are as follows:¶
The choice of which of these options to apply is entirely up to the network operator. It may limit or enable the provisioning of particular managed services and the operator will want to consider how they want to manage CEs and what control they wish to offer the customer over AC resources.¶
Note that Figure 1 shows a symmetrical positioning of SDPs, but this decision can be taken on a per-SDP basis through agreement between the customer and provider.¶
In practice, it may be necessary to map traffic not only onto an IETF Network Slice, but also onto a specific connectivity construct if the IETF Network Slice supports more than one with a source at the specific SDP. The mechanism used will be one of the mechanisms described above, dependent on how the SDP is realized.¶
Finally, note (as described in Section 2.1) that an SDP is an abstract endpoint of an IETF Network Slice service and as such may be a device, interface, or software component. An ancillary CE (Section 3.2.1) should also be thought of as an SDP.¶
Operationally, an IETF Network Slice may be composed of two or more IETF Network Slices as specified below. Decomposed network slices are independently realized and managed.¶
A number of IETF Network Slice services will typically be provided over a shared underlay network infrastructure. Each IETF Network Slice consists of both the overlay connectivity and a specific set of dedicated network resources and/or functions allocated in a shared underlay network to satisfy the needs of the IETF Network Slice customer. In at least some examples of underlay network technologies, the integration between the overlay and various underlay resources is needed to ensure the guaranteed performance requested for different IETF Network Slices.¶
An IETF Network Slice and its realization involves the following stakeholders. The IETF Network Slice customer and IETF Network Slice provider (see Section 2.1) are also stakeholders.¶
An IETF Network Slice customer communicates with the NSC using the IETF Network Slice Service Interface.¶
An IETF Network Slice customer may be a network operator who, in turn, uses the IETF Network Slice to provide a service for another IETF Network Slice customer.¶
Using the IETF Network Slice Service Interface, a customer expresses requirements for a particular slice by specifying what is required rather than how that is to be achieved. That is, the customer's view of a slice is an abstract one. Customers normally have limited (or no) visibility into the provider network's actual topology and resource availability information.¶
This should be true even if both the customer and provider are associated with a single administrative domain, in order to reduce the potential for adverse interactions between IETF Network Slice customers and other users of the underlay network infrastructure.¶
The benefits of this model can include the following.¶
The general issues of abstraction in a TE network are described more fully in [RFC7926].¶
This framework document does not assume any particular technology layer at which IETF Network Slices operate. A number of layers (including virtual L2, Ethernet or, IP connectivity) could be employed.¶
Data models and interfaces are needed to set up IETF Network Slices, and specific interfaces may have capabilities that allow creation of slices within specific technology layers.¶
Layered virtual connections are comprehensively discussed in other IETF documents. See, for instance, GMPLS-based networks [RFC5212] and [RFC4397], or Abstraction and Control of TE Networks (ACTN) [RFC8453] and [RFC8454]. The principles and mechanisms associated with layered networking are applicable to IETF Network Slices.¶
There are several IETF-defined mechanisms for expressing the need for a desired logical network. The IETF Network Slice Service Interface carries data either in a protocol-defined format, or in a formalism associated with a modeling language.¶
For instance:¶
While several generic formats and data models for specific purposes exist, it is expected that IETF Network Slice management may require enhancement or augmentation of existing data models. Further, it is possible that mechanisms will be needed to determine the feasibility of service requests before they are actually made.¶
The IETF NSC takes abstract requests for IETF Network Slices and implements them using a suitable underlay technology. An IETF NSC is the key component for control and management of the IETF Network Slice. It provides the creation/modification/deletion, monitoring and optimization of IETF Network Slices in a multi-domain, a multi-technology and multi-vendor environment.¶
The main task of the IETF NSC is to map abstract IETF Network Slice requirements to concrete technologies and establish required connectivity ensuring that resources are allocated to the IETF Network Slice as necessary.¶
The IETF Network Slice Service Interface is used for communicating details of an IETF Network Slice (configuration, selected policies, operational state, etc.), as well as information about status and performance of the IETF Network Slice. The details for this IETF Network Slice Service Interface are not in scope for this document.¶
The controller provides the following functions.¶
Provides "Mapping Functions" for the realization of IETF Network Slices. In other words, it will use the mapping functions that:¶
The interworking and interoperability among the different stakeholders to provide common means of provisioning, operating and monitoring the IETF Network Slices is enabled by the following communication interfaces (see Figure 2).¶
These interfaces can be considered in the context of the Service Model and Network Model described in [RFC8309] and, together with the Device Configuration Interface used by the Network Controllers, provides a consistent view of service delivery and realization.¶
+------------------------------------------+
| Customer higher level operation system |
| (e.g E2E network slice orchestrator, |
| customer network management system) |
+------------------------------------------+
A
| IETF Network Slice Service Interface
V
+------------------------------------------+
| IETF Network Slice Controller (NSC) |
+------------------------------------------+
A
| Network Configuration Interface
V
+------------------------------------------+
| Network Controllers |
+------------------------------------------+
The IETF Network Slice Controller provides an IETF Network Slice Service Interface that allows customers to request and monitor IETF Network Slices. Customers operate on abstract IETF Network Slices, with details related to their realization hidden.¶
The IETF Network Slice Service Interface is also independent of the type of network functions or services that need to be connected, i.e., it is independent of any specific storage, software, protocol, or platform used to realize physical or virtual network connectivity or functions in support of IETF Network Slices.¶
The IETF Network Slice Service Interface uses protocol mechanisms and information passed over those mechanisms to convey desired attributes for IETF Network Slices and their status. The information is expected to be represented as a well-defined data model, and should include at least SDP and connectivity information, SLO/SLE specification, and status information.¶
The management architecture described in Figure 2 may be further decomposed as shown in Figure 3. This should also be seen in the context of the component architecture shown in Figure 4 and corresponds to the architecture in [RFC8309].¶
Note that the customer higher level operation system of Figure 2 and the Network Slice Orchestrator of Figure 3 may be considered equivalend to the Service Management & Orchestration (SMO) of [ORAN].¶
--------------
| Network |
| Slice |
| Orchestrator |
--------------
| IETF Network Slice
| Service Request
| Customer view
....|................................
-v------------------- Operator view
|Controller |
| ------------ |
| | IETF | |
| | Network | |--> Virtual Network
| | Slice | |
| | Controller | |
| | (NSC) | |
| ------------ |
..| | Network |............
| | Configuration | Underlay Network
| v |
| ------------ |
| | Network | |
| | Controller | |
| | (NC) | |
| ------------ |
---------------------
| Device Configuration
v
Realization of IETF Network Slices is out of scope of this document. It is a mapping of the definition of the IETF Network Slice to the underlying infrastructure and is necessarily technology-specific and achieved by the NSC over the Network Configuration Interface. However, this section provides an overview of the components and processes involved in realizing an IETF Network Slice.¶
The architecture described in this section is deliberately at a high level. It is not intended to be prescriptive: implementations and technical solutions may vary freely. However, this approach provides a common framework that other documents may reference in order to facilitate a shared understanding of the work.¶
Figure 4 shows the architectural components of a network managed to provide IETF Network Slices. The customer's view is of individual IETF Network Slices with their SDPs, and connectivity constructs. Requests for IETF Network Slices are delivered to the NSC.¶
The figure shows, without loss of generality, the CEs, ACs, and PEs, that exist in the network. The SDPs are not shown and can be placed in any of the ways described in Section 4.2.¶
-- -- --
|CE| |CE| |CE|
-- -- --
AC : AC : AC :
---------------------- -------
( |PE|....|PE|....|PE| ) ( IETF )
IETF Network ( --: -- :-- ) ( Network )
Slice Service ( :............: ) ( Slice )
Request ( IETF Network Slice ) ( ) Customer
v ---------------------- ------- View
v ............................\........./...............
v \ / Provider
v >>>>>>>>>>>>>>> Grouping/Mapping v v View
v ^ -----------------------------------------
v ^ ( |PE|.......|PE|........|PE|.......|PE| )
--------- ( --: -- :-- -- )
| | ( :...................: )
| NSC | ( Network Resource Partition )
| | -----------------------------------------
| | ^
| |>>>>> Resource Partitioning |
--------- of Filter Topology |
v v |
v v ----------------------------- --------
v v (|PE|..-..|PE|... ..|PE|..|PE|) ( )
v v ( :-- |P| -- :-: -- :-- ) ( Filter )
v v ( :.- -:.......|P| :- ) ( Topology )
v v ( |P|...........:-:.......|P| ) ( )
v v ( - Filter Topology ) --------
v v ----------------------------- ^
v >>>>>>>>>>>> Topology Filter ^ /
v ...........................\............../...........
v \ / Underlay
---------- \ / (Physical)
| | \ / Network
| Network | ----------------------------------------------
|Controller| ( |PE|.....-.....|PE|...... |PE|.......|PE| )
| | ( -- |P| -- :-...:-- -..:-- )
---------- ( : -:.............|P|.........|P| )
v ( -......................:-:..- - )
>>>>>>> ( |P|.........................|P|......: )
Program the ( - - )
Network ----------------------------------------------
The network itself (at the bottom of the figure) comprises an underlay network. This could be a physical network, but may be a virtual network. The underlay network is provisioned through network controllers that may utilize device controllers [RFC8309].¶
The underlay network may optionally be filtered or customized by the network operator to produce a number of network topologies that we call Filter Topologies. Customization is just a way of selecting specific resources (e.g., nodes and links) from the underlay network according to their capabilities and connectivity in the underlay network. These actions are configuration options or operator policies. The resulting topologies can be used as candidates to host IETF Network Slices and provide a useful way for the network operator to know in advance that all of the resources they are using to plan an IETF Network Slice would be able to meet specific SLOs and SLEs. The creation of a Filter Topology could be an offline planning activity or could be performed dynamically as new demands arise. The use of Filter Topologies is entirely optional in the architecture, and IETF Network Slices could be hosted directly on the underlay network.¶
Recall that an IETF Network Slice is a service requested by / provided for the customer. The IETF Network Slice service is expressed in terms of one or more connectivity constructs. An implementation or operator is free to limit the number of connectivity constructs in an IETF Network Slice to exactly one. Each connectivity construct is associated within the IETF Network Slice service request with a set of SLOs and SLEs. The set of SLOs and SLEs does not need to be the same for every connectivity construct in the IETF Network Slice, but an implementation or operator is free to require that all connectivity constructs in an IETF Network Slice have the same set of SLOs and SLEs.¶
A Network Resource Partition (NRP) is a collection of resources (bufferage, queuing, scheduling, etc.) in the underlay network. The amount and granularity of resources allocated in an NRP is flexible and depends on the operator's policy. Some NRP realizations may build NRPs with dedicated topologies, while some other realizations may use a shared topology for multiple NRPs; one possible realization is of a single NRP using all of the resources of the entire underlay network topology. Thus, an NRP consists of a subset of the buffer/queuing/scheduling resources on each of a connected set of links in the underlay network. The connected set of links can be the entire set of links in the underlay network and in this case there can be a single NRP and it has all of the buffer/queuing/scheduling resources for each of the links in the underlay network.¶
One or more connectivity constructs from one or more IETF Network Slices are mapped to an NRP. A single connectivity construct is mapped to only one NRP (that is, the relationship is many to one). Thus, all traffic flows in a connectivity construct assigned to an NRP are assigned to that NRP. Further, all PEs connected by a connectivity construct must be present in the NRP to which that connectivity construct is assigned.¶
An NRP may be chosen to support a specific connectivity construct because of its ability to support a specific set of SLOs and SLEs, or its ability to support particular connectivity types, or for any administrative or operational reason. An implementation or operator is free to map each connectivity construct to a separate NRP, although there may be scaling implications depending on the solution implemented. Thus, the connectivity constructs from one slice may be mapped to one or more NRPs. By implication from the above, an implementation or operator is free to map all the connectivity constructs in a slice to a single NRP, and to not share that NRP with connectivity constructs from another slice. By default, NRPs are work conserving.¶
The process of determining the NRP may be made easier if the underlay network topology is first filtered into a Filter Topology in order to be aware of the subset of network resources that are suitable for specific NRPs. In this case, each Filter Topology is treated as an underlay network on which NRPs can be constructed. The stage of generating Filter Topoloies is optional within this framework.¶
The steps described here can be applied in a variety of orders according to implementation and deployment preferences. Furthermore, the steps may be iterative so that the components are continually refined and modified as network conditions change and as service requests are received or relinquished, and even the underlay network could be extended if necessary to meet the customers' demands.¶
There are a number of different technologies that can be used in the underlay, including physical connections, MPLS, time-sensitive networking (TSN), Flex-E, etc.¶
An IETF Network Slice can be realized in a network, using specific underlay technology or technologies. The creation of a new IETF Network Slice will be realized with following steps:¶
Regardless of how IETF Network Slice is realized in the network (i.e., using tunnels of different types), the definition of the IETF Network Slice service does not change at all. The only difference is how the slice is realized. The following sections briefly introduce how some existing architectural approaches can be applied to realize IETF Network Slices.¶
Abstraction and Control of TE Networks (ACTN - [RFC8453]) is a management architecture and toolkit used to create virtual networks (VNs) on top of a TE underlay network. The VNs can be presented to customers for them to operate as private networks.¶
In many ways, the function of ACTN is similar to IETF network slicing. Customer requests for connectivity-based overlay services are mapped to dedicated or shared resources in the underlay network in a way that meets customer guarantees for service level objectives and for separation from other customers' traffic. [RFC8453] describes the function of ACTN as collecting resources to establish a logically dedicated virtual network over one or more TE networks. Thus, in the case of a TE-enabled underlay network, the ACTN VN can be used as a basis to realize IETF network slicing.¶
While the ACTN framework is a generic VN framework that can be used for VN services beyond the IETF Network Slice, it also a suitable basis for delivering and realizing IETF Network Slices.¶
Further discussion of the applicability of ACTN to IETF Network Slices including a discussion of the relevant YANG models can be found in [I-D.ietf-teas-applicability-actn-slicing].¶
An enhanced VPN (VPN+) is designed to support the needs of new applications, particularly applications that are associated with 5G services, by utilizing an approach that is based on existing VPN and TE technologies and adds characteristics that specific services require over and above VPNs as they have previously been specified.¶
An enhanced VPN can be used to provide enhanced connectivity services between customer sites and can be used to create the infrastructure to underpin a IETF Network Slice service.¶
It is envisaged that enhanced VPNs will be delivered using a combination of existing, modified, and new networking technologies.¶
[I-D.ietf-teas-enhanced-vpn] describes the framework for Enhanced Virtual Private Network (VPN+) services.¶
Network slicing provides the ability to partition a physical network into multiple logical networks of varying sizes, structures, and functions so that each slice can be dedicated to specific services or customers. The support of resource preemption between IETF network slices is deployment specific.¶
Many approaches are currently being worked on to support IETF Network Slices in IP and MPLS networks with or without the use of Segment Routing. Most of these approaches utilize a way of marking packets so that network nodes can apply specific routing and forwarding behaviors to packets that belong to different IETF Network Slices. Different mechanisms for marking packets have been proposed (including using MPLS labels and Segment Routing segment IDs) and those mechanisms are agnostic to the path control technology used within the underlay network.¶
These approaches are also sensitive to the scaling concerns of supporting a large number of IETF Network Slices within a single IP or MPLS network, and so offer ways to aggregate the connectivity constructs of slices (or whole slices) so that the packet markings indicate an aggregate or grouping where all of the packets are subject to the same routing and forwarding behavior.¶
At this stage, it is inappropriate to mention any of these proposed solutions that are currently work in progress and not yet adopted as IETF work.¶
A customer may request an IETF Network Slice service that involves a set of service functions (SFs) together with the order in which these SFs are invoked. Also, the customer can specify the service objectives to be met by the underly network (e.g., one-way delay to cross a service function path, one-way delay to reach a specific SF). These SFs are considered as ancillary CEs and are possibly placeholders (i.e., the SFs are identified, but not their locators).¶
Service Function Chaining (SFC) [RFC7665] techniques can be used by a provider to instantiate such an IETF Network Service Slice. The NSC may proceed as follows.¶
Generate SFC classification rules to identify (part of) the slice traffic that will be bound to an SFC. These classification rules may be the same as or distinct from the identification rules used to bind incoming traffic to the associated IETF Network Slice.¶
The NSC also generates a set of SFC forwarding policies that govern how the traffic will be forwarded along a service function path (SFP).¶
The provider can enable an SFC data plane mechanism, such as [RFC8300], [RFC8596], or [I-D.ietf-spring-nsh-sr].¶
An IETF Network Slice customer may request that the IETF Network Slice delivered to them is such that changes to other IETF Network Slices or to other services do not have any negative impact on the delivery of the IETF Network Slice. The IETF Network Slice customer may specify the degree to which their IETF Network Slice is unaffected by changes in the provider network or by the behavior of other IETF Network Slice customers. The customer may express this via an SLE it agrees with the provider. This concept is termed 'isolation'.¶
In general, a customer cannot tell whether a service provider is meeting an isolation SLE. If the service varies such that an SLO is breached then the customer will become aware of the problem, and if the service varies within the allowed bounds of the SLOs, there may be no noticeable indication that this SLE has been violated.¶
Isolation may be achieved in the underlay network by various forms of resource partitioning ranging from dedicated allocation of resources for a specific IETF Network Slice, to sharing of resources with safeguards. For example, traffic separation between different IETF Network Slices may be achieved using VPN technologies, such as L3VPN, L2VPN, EVPN, etc. Interference avoidance may be achieved by network capacity planning, allocating dedicated network resources, traffic policing or shaping, prioritizing in using shared network resources, etc. Finally, service continuity may be ensured by reserving backup paths for critical traffic, dedicating specific network resources for a selected number of IETF Network Slices.¶
IETF Network Slice realization needs to be instrumented in order to track how it is working, and it might be necessary to modify the IETF Network Slice as requirements change. Dynamic reconfiguration might be needed.¶
The various management interfaces and components are discussed in Section 5.¶
This document specifies terminology and has no direct effect on the security of implementations or deployments. In this section, a few of the security aspects are identified.¶
Note: See [NGMN_SEC] on 5G network slice security for discussion relevant to this section.¶
IETF Network Slices might use underlying virtualized networking. All types of virtual networking require special consideration to be given to the separation of traffic between distinct virtual networks, as well as some degree of protection from effects of traffic use of underlay network (and other) resources from other virtual networks sharing those resources.¶
For example, if a service requires a specific upper bound of latency, then that service can be degraded by added delay in transmission of service packets caused by the activities of another service or application using the same resources.¶
Similarly, in a network with virtual functions, noticeably impeding access to a function used by another IETF Network Slice (for instance, compute resources) can be just as service-degrading as delaying physical transmission of associated packet in the network.¶
Privacy of IETF Network Slice service customers must be preserved. It should not be possible for one IETF Network Slice customer to discover the presence of other customers, nor should sites that are members of one IETF Network Slice be visible outside the context of that IETF Network Slice.¶
In this sense, it is of paramount importance that the system use the privacy protection mechanism defined for the specific underlay technologies that support the slice, including in particular those mechanisms designed to preclude acquiring identifying information associated with any IETF Network Slice customer.¶
This document makes no requests for IANA action.¶
The entire TEAS Network Slicing design team and everyone participating in related discussions has contributed to this document. Some text fragments in the document have been copied from the [I-D.ietf-teas-enhanced-vpn], for which we are grateful.¶
Significant contributions to this document were gratefully received from the contributing authors listed in the "Contributors" section. In addition we would like to also thank those others who have attended one or more of the design team meetings, including the following people not listed elsewhere:¶
Further useful comments were received from Daniele Ceccarelli, Uma Chunduri, Pavan Beeram, Tarek Saad, Kenichi Ogaki, Oscar Gonzalez de Dios, Xiaobing Niu, Dan Voyer, Igor Bryskin, Luay Jalil, Joel Halpern, John Scudder, John Mullooly, and Krzysztof Szarkowicz.¶
This work is partially supported by the European Commission under Horizon 2020 grant agreement number 101015857 Secured autonomic traffic management for a Tera of SDN flows (Teraflow).¶
The following authors contributed significantly to this document:¶
Eric Gray (The original editor of the foundation documents) Independent Email: ewgray@graiymage.com Jari Arkko Ericsson Email: jari.arkko@piuha.net Mohamed Boucadair Orange Email: mohamed.boucadair@orange.com Dhruv Dhody Huawei, India Email: dhruv.ietf@gmail.com Jie Dong Huawei Email: jie.dong@huawei.com Xufeng Liu Volta Networks Email: xufeng.liu.ietf@gmail.com¶
This appendix contains realisation examples. This is mot intended to be a complete set of possible deployments. Nor does it provide definitive ways to realise these deployments.¶
The examples shown here must not be considered to be normative. The descriptions of terms and concepts in the body of the document take precedence. The examples¶
As described in Section 3.2 an MP2P service can be realized with multiple P2P connectivity constructs. Figure 5 shows a simple MP2P service where traffic is sent from any of CE1, CE2, and CE3, to the receiver which is CE4. The service comprises three P2P connectivity constructs CE1-CE4, CE2-CE4, and CE3-CE4.¶
CE1
___|________
/ \ \
( \______ )
( \)
CE2---(--------------)---CE4
( _______/)
( / )
\___|________/
|
CE3
Section 3.2.1 introduces the concept of ancillary CEs. Figure 6 shows a simple example of IETF Network Slices with connectivity constructs that are used to deliver traffic from CE1 to CE3 taking in a service function along the path.¶
CE1 CE2 CE3
xo* * * *ox
____xo*_________*_*_________*ox____
_/ xo* * * *ox \_
/ xo*********** ***********ox \
( xo ox )
( xooooooooo(ACE1)oooooooooox )
( x x )
( x ------------------ x )
( x | Service Function | x )
( x | ....(ACE2).... | x )
( x | : : | x )
( xxxx.:....(ACE3)....:.xxxxx )
( | : : | )
( | ....(ACE4).... | )
( | | )
( ------------------ )
( )
\_ Operator Network _/
\___________________________________/
A customer may want to provide a service where traffic is delivered from CE1 to CE3 including a service function sited within the customer's network at CE2. To achieve this, the customer may request an IETF Network Slice Service comprising two P2P connectivity constructs (CE1-CE2 and CE2-CE3 represented as *** in the figure).¶
Alternatively, the service function for the same CE1 to CE3 flow may be hosted at a node within the network operator's. This is an ancillary CE in the IETF Network Slice Service that the customer requests. This service contains two P2P connectivity constructs (CE1-ACE1 and ACE1-CE3 represented as ooo in the figure). How the customer know of the existence of the ancillary CE and the service functions it offers is a matter for agreement between the customer and the network operator.¶
Finally, it may be that the customer knows that the network operator is able to provide the service function, but not know the location of the ancillary CE at which the service funciton is hosted. Indeed, it may be that the service function is hosted at a number of ancillary CEs (ACE2, ACE3, and ACE4 in the figure): the customer may or know the identities of the ancillary CEs, but be unwilling or unable to choose one; or the customer may not know about the ancillary CEs. In this case, the IETF Network Slice Service request contains two P2P connectivity constructs (CE1-ServiceFunction and ServiceFunction to CE3 represented as xxx in the figure). It is left as a choice for the network operator which ancillary CE to use and how to realise the connectivity constructs.¶
Hub and spoke is a popular way to realise any-to-any connectivity in support of multiple P2P traffic flows (where the hub performs routing), or of P2MP flows (where the hub is responsible for replication). In many case, it is the network operator's choice whether to use hub and spoke to realise a mesh of P2P connectivity constructs or P2MP connectivity constructs: this is entirely their business as the customer is not aware of how the connectivity constructs are supported within the network.¶
However, it may be the case that the customer wants to control the behavior and location of the hub. In this case, the hub appears as an ancillary CE as shown in Figure 7.¶
For the P2P mesh case, the customer does not specify a mesh of P2P connectivity constructs (such as CE1-CE2, CE1-CE3, CE2-CE3 and the equivalent reverse direction connectivity), but connects each CE to the hub with P2P connectivity constructs (as CE1-Hub, CE2-Hub, CE3-Hub and the equivalent reverse direction connectivity). This scales better in terms of provisioning compared to a full mesh, but does require that the hub is capable of routing traffic between connectivity constructs.¶
For the P2MP case, does nor specify a single P2MP connectivity construct (in this case, CE3-{CE1+CE2}), but requests three P2P connectivity constructs (as CE3-Hub, Hub-CE1, and Hub-CE2). It is the hub's responsiblity to replicate the traffic from CE3 and send it to both CE1 and CE2.¶
------------
CE1 | Hub | CE2
|| ------------ ||
___||_____||__||__||_____||___
/ || || || || || \
( ====== || ====== )
( || )
( || )
\______________||______________/
||
CE3
Layer 3 VPNs are a common service offered by network operators to their customers. They may be modelled as an any-to-any service, but are often realised as a mesh of P2P connections, or if multicast is supported, they may be realised as a mesh of P2MP connections.¶
Figure 8 shows an IETF Network Slice Service with a single A2A connectivity construct between the SDPs CE1, CE2, CE3, and CE4. It is a free choice how the network operator realises this service. They may use a full mesh of P2P connections, a hub and spoke configuration, or some combination of these approaches.¶
CE1 CE2
____|_______________|____
/ :...............: \
( :. . : )
( : ...... . : )
( : ..... : )
( : .... . : )
( : . .... : )
( : . . : )
( :...............: )
\____:_______________:____/
| |
CE3 CE4