October 2011 - Nsi-wg - lists.ogf.org

Re: [Nsi-wg] Issue 28 in ogf-nsi-project: Security
by ogf-nsi-project＠googlecode.com 25 Oct '11

25 Oct '11

Comment #5 on issue 28 by thost...(a)gmail.com: Security http://code.google.com/p/ogf-nsi-project/issues/detail?id=28 I'd like to try and get SAML out of the WSDL before the SC11 demo. SAML is typically used in single sign on between identity provider and service providers. It does not really fit into NSI. We may have the need to have something like sessionSecurityAttr, though often these attributes are not related to security, but are typically request meta-data. Perhaps we could just call them sessionAttributes. Anyay I think the scheme with Name/Value in the protocol spec. e.g.: <sessionAttribute> <name> ... </name> <value> ... </value> </sessionAttribute> and a slighly more real example: <sessionAttribute> <name>requesterIdentity</name> <value>nsiuser(a)example.com</value> </sessionAttribute> The idea here is to have a place for connection information. What it should NOT be used for is any authentication or authorization, and ideally the attributs can be stripped without any reprocussions. If possible I would like to use this for SC11 visualization query tool, which could add something like: <sessionAttribute> <name>requesterIdentity</name> <value>NSIVisualizationTool</value> </sessionAttribute> Which would indicate to the NSI agent, that it should return all connections in the query made. This can of course be combined with proper authentication/authorization when we have that, but right we don't. Well there is the IP address, which can be made available from the MTL / protocol layer.

1 5

FIA-Topo-v1.4c.owl
by Jerry Sobieski 25 Oct '11

25 Oct '11

Changes: - corrected urn.ogf.network to be urn:ogf:network... J

1 0

FIA topo 1.4b
by Jerry Sobieski 25 Oct '11

25 Oct '11

- Changed comment markers to correctly comment out netherlight stps for 1780. Jerry

1 0

FIA Topo v1.4a
by Jerry Sobieski 25 Oct '11

25 Oct '11

Hi all - yet another topo mod.. - Changed the interfaces at StarLight and Amsterdam to reflect that valn 1780 was no longer available on the AMS-CHI IRNc link... The new pdf shows the mapping now. Jerry

1 0

FIA-Topo-v1.4.owl
by Jerry Sobieski 25 Oct '11

25 Oct '11

New topo file Changes: - modified pionier.ets:ams-80 to be SDP with aist.ets:chi-80 i.e. vlan 1780 is statically configured thru CHI and AMS so Pionier and AISt are adjacent on that VLAN. Jerry

1 0

Updates for FIA demo efforts and tasks for Monday night/Tuesday morning...
by Jerry Sobieski 25 Oct '11

25 Oct '11

Hi all- the demos are struggling... So here is the plan of attack: GEANT, Pionier, AIST are all working with the new WSDL and have hardware control. We are close with OpenNSA/Argia interface for StarLight, and OpenDRAC at Netherlight is using HTTPS which while conformant to the spec seems to be problematic. So, we will continue to address these issues, but we need to pare down the demo field to get the *NSI* demo to work. 1. We need to statically configure vlan 1780 thru NetherLight (from PSNC port to StarLight/IRNC port) (John MacCauley and/or Gerben?) 2. We need to statically configure vlan 1780 thru StarLight (from Netherlight/irnc port13 to the JGNX port24) (Scott Campbell and Henrik Thostrup Jensen) This will provide a direct link from Pionier to AIST over VLAN 1780. 3. We will use AutoBAHN Pionier as the aggregator for a Reservation: geant.ets:ps-80 -> aist.ets:ps-80. The connectionID and/or Global ID will be registered with the Query Agent. (Michal B. and Jeroen vdH) 4. The QA will query AB pionier for the path info, and pass the location info to a) the Automated Earth and b) the AIST display agent. ( Jeroen van der Ham and Takatoshi Ikeda (AE) and Tomohiro Kudoh? (AIST) ) 5. Everyone, Pionier, GEANT, and AIST especially, please post your perfSonar server IP addresses so that I can add them to the diagram. And make sure your perfSonar servers have the subinterfaces for the 1780-83 VLANs configured with the corresponding IP subnet and host address. And its off to the races... Remember all - we are demonstrating _/*NSI*/_ so its ok to pare things back a bit. THis is complex stuff, we'll continue to get things running, but for now we want to have a successful demo showing circuits being set up across the world, across domains. Thanks! Jerry

2 1

FIA demo
by Radek Krzywania 24 Oct '11

24 Oct '11

Hi all, I need your quick help with the FIA demo. It seems that everything is down, and we will not show NSI glory at all. I would like to ask all NSI domains to put their agents up and ready, and use newer version of NSI protocol if possible. I would also like to know all IP addresses of the servers attached to the end of circuits. Currently I have neither control plane nor dataplane ready. Could you please help with sorting this out. The FIA is already in progress and I was hoping to have the demo working by today morning. Best regards Radek ________________________________________________________________________ Radoslaw Krzywania Network Research and Development Poznan Supercomputing and radek.krzywania(a)man.poznan.pl Networking Center +48 61 850 25 26 http://www.man.poznan.pl ________________________________________________________________________

3 4

FIA Topo v1.2.owl
by Jerry Sobieski 24 Oct '11

24 Oct '11

Hi all- Here is version 1.3 of the topo file. Changes: - Converted uppercase urns to all lowercase (note- did not change the rdf:types...ex: NSNetwork types remain) - Added "locatedAt" relation to nsnetwork objects. These point to location objects with URN of: urn:ogf:network:nsnetwork:<NSNetwork>:location ex: urn:ogf:network:nsnetwork:geant.ets:location - Added "location" objects with the lat lon of each network - Changed KDDI Labs from Tokyo to Fujimino (changes the STP names in KDDI and Starlight respectively) Please, everyone validate their portion and let me know of any mistakes... as I did not run it through the SNE editor... Jerry

1 1

New OGF document "Firewall Traversal Protocol" in public comment
by Niederberger, Ralph 24 Oct '11

24 Oct '11

Dear all, The document " Firewall Traversal Protocol (FiTP)" has begun public comment on 2011-10-18. Description: Firewalls control traffic flows between internal and external communication partners. Mostly traffic from inside to outside is allowed, but traffic coming from outside must be explicitly configured. The rules which packets may traverse the firewall and which not are normally configured manually by firewall administrators. To speed up such kind of access list changes, it would be desirable to dynamically signal access requests and automatically change those access lists. Though some protocols are inspectable by firewalls already like FTP, SIP and H.323, a general protocol, which could be used for signaling dynamically required access rules, is not available until now. This paper proposes a standard protocol, which would allow such signaling in a secure manner. Firewalls which have installed a corresponding inspection module could be configured automatically, which would ease the configuration of such systems a lot. Please visit: http://www.ogf.org/gf/docs/comment.php?id=381 and consider reading and providing feedback. A brief affirmation is very useful to demonstrate community input and support. More detailed analysis is also, of course, welcome. All documents in public comment are accessible here: http://www.ogf.org/gf/docs/?public_comment Please also feel free to forward this email to further interested people, so that a maximum of feedback can be gained. Best regards Ralph Niederberger *************************************************** Ralph Niederberger Juelich Supercomputing Centre Institute for Advanced Simulation Phone: +49 2461 61-4772 Fax: +49 2461 61-6656 E-Mail: r.niederberger(a)fz-juelich.de WWW: http://www.fz-juelich.de/jsc/ JSC is the coordinator of the John von Neumann Institute for Computing and member of the Gauss Centre for Supercomputing *************************************************** Forschungszentrum Jülich GmbH 52425 Jülich Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDirig Dr. Karl Eugen Huthmacher Geschäftsführung: Prof. Dr. Achim Bachem (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ***************************************************

1 0

Demo at FIA
by Radek Krzywania 24 Oct '11

24 Oct '11

Hi all, I am already at FIA in Poznan, finalising demo stuff. Could someone send me the visualisation interface address for Google Earth? I would like to put it on the main screen. Best regards Radek ________________________________________________________________________ Radoslaw Krzywania Network Research and Development Poznan Supercomputing and radek.krzywania(a)man.poznan.pl Networking Center +48 61 850 25 26 http://www.man.poznan.pl ________________________________________________________________________

1 0