- Nsi-wg - lists.ogf.org

NSI topology document
by John Macauley 01 Jun '17

01 Jun '17

Peoples, Over two years in the making - here is a brain dump on NSI topology. I have spent two days on the Adaptation section trying to figure out how what we documented in the framework document would work. Still need to finish it off but figured I should get it out for Friday. John

1 0

List of NSI2 Issues
by Henrik Thostrup Jensen 26 May '17

26 May '17

Hi I've accumulated a bunch of issues that I've found with the NSI2 CS protocol and NML toplogy, as I've worked with over the last years. * Provision/Release/Terminate At a point in time we removed the provisionFailed, releaseFailed, and terminateFailed messages. I think this was with the reason that these actions weren't really allowed to fail. This is mostly true, with the exception that with security checks the requests can fail. There is no way to signal this back to the client AFAICT. * State machine Due to the above issue, aggregators can be stuck in "Provisioning" and "Releasing", with agents further down not wanting to move into provisioning due to missing credentials. I have solved this by adding loop transitions, so that the following are possible: Provisioning -> Provisioning, on provision request Releasing -> Releasing, on release request A second issue is that on abort/timeout it is possible for the state machine to enter a state where it is not possible to see if resources are allocated or not (rather interesting, as this should really be the main purpose of the state machine - I think we focussed to much in messages, and not resource lifecycle). I solved this by adding an internal flag to indicate if resources are allocated or not. * Security/Identity flaws The NSA identities are not tied to subject names in X.509 certificates, and there is no way to authenticate them. Inventing new ways of identifying services/hosts that isn't strictly tied into a CA or DNS is a bad idea. The whole user/group/organization SAML thing we have is pretty much useless as there is not good way to authenticate them. The only proper security mechanisms I can see is X.509 certificates and tokens ala OAuth2. * No notification mechanism Notification are only provided the requester. All other have to issue query calls. This makes it impossible to get continous updates (long poll / callbacks). This is very relevant for adminstration tools / portals. * Security headers Currently an NSI agent currently has to keep the body of the messages for future inspection (query). Messages (mainly the http header or soap header), can contain credentials such as tokens which should not be kept after they have been verified. We need a statement saying that the HTTP and SOAP header should be discarded. Ideally we just have a log of events, and when they occured and who did it, instead of keeping full message bodies. * Single-label source/destination (and STPS) The idea that source and destination should be modelled as STPs is probably wrong. There is some impedance mismatch at least. If a flow comes in with ethernet+vlan+mpls it should be modelled as such. Not just as having a VLAN xor MPLS. This also makes adaptation quite tricky. * Static Port List The idea that we can list all ports in a network (NML or not) isn't realistic. In GTS/GVS, VMs are spawned dynamically, creating a new interface on the host machine. This is a new STP. Sure it will probably get a VLAN on the circuit of the VM host, but the endpoint is a logical interface, and can have labels on it, e.g. Q-in-Q where vlans of the VM are connected to difference places. This means that topology should not try and model all possible endpoints (because it can't), but only nodes/domains and the connectivity between these. * Unidirectional Circuits I've helped a lot of sites getting OpenNSA up and running, and have typically helped out with configuration, to get them up and runnign. The most recurring issue is the topology configuration. In particular getting the unidirectional ports right is the thing that almost always eats the most time. This combined with the fact that no one uses undirectional circuits means that we have a lot of complexity with zero benefits. * Callbacks This isn't really a design issue, but having SOAP and callbacks is just a huge amount complexity for protocol and state keeping. It is immensely error prone, and makes client implementations quite complicated which is hinder usage tremendously. I've implemented a REST interface in OpenNSA. It doesn't have 100% feature parity, but it implements additional functionality like long-polling for noticiations and auto provision/commit. The protocol stack is roughly 1/10 lines of code compared to the SOAP interface. Best regards, Henrik Henrik Thostrup Jensen <htj at nordu.net> Software Developer, NORDUnet

2 2

NSI meeting at TNC17
by Guy Roberts 11 May '17

11 May '17

Hello All, This is an invitation to attend the NSI meeting at TNC17. The meeting will be from 14:00 to 17:30 on Monday 29th May. Details are here: https://tnc17.geant.org/core/event/5 Agenda is as follows: 1. Update of NSI doc status with Guy Roberts and OGF area director Richard Hughes Jones. (15 minutes) 2. NSI Topology, John MacAuley remote. (15 minutes) 3. Group discussion: a. NSI usage experience and use cases… How is NSI being used? What use cases are there in the community? b. Is there a need to create a simplified REST version of NSI… any interest? c. NSI update to support on-demand services? i.e. turning a service instance on and off rather than time based reservation/calendaring. 4. Potential wrap-up of v.21 working group and next steps. If you are interested in attending please register here: https://eventr.geant.org/events/2656 Regards, Guy Roberts Guy Roberts PhD Senior Network Architect Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 Skype: guy1965 Networks • Services • People Learn more at www.geant.org<http://www.geant.org/> GÉANT is the collective trading name of the GÉANT Association in Amsterdam, NL, and of GEANT Limited in Cambridge, UK GÉANT Vereniging (Association) is registered in the Netherlands with the Chamber of Commerce in Amsterdam<http://www.kvk.nl/english/traderegister/default.asp>. Registration number: 40535155. Registered office: Singel 468 D, Amsterdam 1017 AW, The Netherlands GEANT Limited is registered in England & Wales. Registration number: 2806796. Registered office: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK.

1 0

NSI conf call Wednesday 10th May
by Guy Roberts 10 May '17

10 May '17

The following is dial-in information for Wednesday's NSI call, time: 7:00 PDT 10:00 ET, 15:00 GMT, 16:00 CET, 23:00 JST 1. Dial Toll-Free Number: 866-740-1260 (U.S. & Canada) 2. International participants dial: Toll Number: 303-248-0285 Or International Toll-Free Number: http://www.readytalk.com/intl 3. Enter 7-digit access code 8937606, followed by "#" Agenda: - Prepare for NSI meeting in TNC: agree agenda, finalize remaining docs. - All to provide an update on the progress on document preparation: https://docs.google.com/spreadsheets/d/1IWCltcKtNfh4Z532iGsJgCWygornkx2bH06… Guy Roberts PhD Senior Network Architect Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 Skype: guy1965 Networks • Services • People Learn more at www.geant.org<http://www.geant.org/> GÉANT is the collective trading name of the GÉANT Association in Amsterdam, NL, and of GEANT Limited in Cambridge, UK GÉANT Vereniging (Association) is registered in the Netherlands with the Chamber of Commerce in Amsterdam<http://www.kvk.nl/english/traderegister/default.asp>. Registration number: 40535155. Registered office: Singel 468 D, Amsterdam 1017 AW, The Netherlands GEANT Limited is registered in England & Wales. Registration number: 2806796. Registered office: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK.

2 1

NSI meeting at TNC17
by Guy Roberts 03 Feb '17

03 Feb '17

Hello All, We have a face-to-face NSI meeting scheduled from 14:00-17:30 on Monday 29 May on the day before TNC17. For details see here: https://tnc17.geant.org/core/schedule/list/day/all If people want a longer meeting we can add an informal NSI meeting on the Friday following TNC. Please let me know if you would like to extend the meeting to Friday. Also, please send me any agenda items that you would like to raise at the meeting. Regards, Guy Guy Roberts PhD Senior Network Architect Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 Skype: guy1965 [TNC17_email_banner_earlybird] Networks • Services • People Learn more at www.geant.org<http://www.geant.org/> GÉANT is the collective trading name of the GÉANT Association in Amsterdam, NL, and of GEANT Limited in Cambridge, UK GÉANT Vereniging (Association) is registered in the Netherlands with the Chamber of Commerce in Amsterdam<http://www.kvk.nl/english/traderegister/default.asp>. Registration number: 40535155. Registered office: Singel 468 D, Amsterdam 1017 AW, The Netherlands GEANT Limited is registered in England & Wales. Registration number: 2806796. Registered office: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK.

1 0

NSI CS v2.1 and delta document
by Guy Roberts 17 Dec '16

17 Dec '16

Hello Richard, We have now updated the NSI CS v2.1 document with all necessary changes. We would also like the delta document to be published as an informational document. The two open redmine tracker issues are: Delta document is here: https://redmine.ogf.org/issues/323 NSI CS v2.1 is here: https://redmine.ogf.org/issues/308 Could you please review the changes from v2.0 to v2.1 and let us know if these documents are ready for public comment? Thanks, Guy Guy Roberts PhD Senior Network Architect Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 Skype: guy1965 [TNC17_email_banner_earlybird] Networks • Services • People Learn more at www.geant.org<http://www.geant.org/> GÉANT is the collective trading name of the GÉANT Association in Amsterdam, NL, and of GEANT Limited in Cambridge, UK GÉANT Vereniging (Association) is registered in the Netherlands with the Chamber of Commerce in Amsterdam<http://www.kvk.nl/english/traderegister/default.asp>. Registration number: 40535155. Registered office: Singel 468 D, Amsterdam 1017 AW, The Netherlands GEANT Limited is registered in England & Wales. Registration number: 2806796. Registered office: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK.

1 0

NSI DDS document updates now complete
by Guy Roberts 17 Dec '16

17 Dec '16

Richard, The updates to the DDS document that were agreed in Helsinki have now all be done. Please take a look at the latest version in Redmine: https://redmine.ogf.org/issues/293 Can you please check and confirm that this is now ready to go to public comment? Thanks, Guy Guy Roberts PhD Senior Network Architect Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 Skype: guy1965 [TNC17_email_banner_earlybird] Networks • Services • People Learn more at www.geant.org<http://www.geant.org/> GÉANT is the collective trading name of the GÉANT Association in Amsterdam, NL, and of GEANT Limited in Cambridge, UK GÉANT Vereniging (Association) is registered in the Netherlands with the Chamber of Commerce in Amsterdam<http://www.kvk.nl/english/traderegister/default.asp>. Registration number: 40535155. Registered office: Singel 468 D, Amsterdam 1017 AW, The Netherlands GEANT Limited is registered in England & Wales. Registration number: 2806796. Registered office: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK.

1 0

NSI CS 2.1 document update.
by John MacAuley 16 Dec '16

16 Dec '16

Peoples, I corrected the querySummarySync section that I missed updating with the new schema. I also updated the difference document. Please find attached. John

2 1

FW: TNC17 Meeting Submission
by Guy Roberts 15 Dec '16

15 Dec '16

Hello All, I have tentatively booked an NSI meeting at TNC 17. Please see draft agenda below and let me know if you have any other suggestions for topics. I will advise on the meeting time and location as soon as this becomes available. Regards, Guy From: TNC17 [mailto:tnc17@lists.geant.org] Sent: 14 December 2016 17:47 To: Guy Roberts <guy.roberts(a)geant.org> Subject: TNC17 Meeting Submission This is an automated message. Thank you for your meeting submission. Title: NSI working group meeting Proposer names and affiliations: Guy Roberts and Chin Guok Five keywords: NSI, standards, protocol, working meeting. Meeting format: public meeting with presentations Technical requirements: projector Short introduction: This is a working meeting for the Network Service Interface (NSI) working group in the Open Grid Forum. The meeting is open to all to attend and will focus on discussing the next generation of NSI standards. Draft agenda for the NSI meeting at TNC17: - Future of NSI - Jerry short presentation on GTS (to be confirmed) - Discuss defining a light-weight REST interface - Who and how do people use NSI? Review how it is used. - Jun Bi from CERNET to discuss their East-West bridge (to be confirmed) Intended audience: technical audience interested in NSI protocol development Estimated number of attendees: 10 Duration: 3 hours Budget holder: SA1 Sincerely, TNC17 Event Team

1 0

minutes from today's NSI conf call....
by Guy Roberts 15 Dec '16

15 Dec '16

… are available here: https://redmine.ogf.org/dmsf_files/13547 Guy Roberts PhD Senior Network Architect Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 Skype: guy1965 [TNC17_email_banner_earlybird] Networks • Services • People Learn more at www.geant.org<http://www.geant.org/> GÉANT is the collective trading name of the GÉANT Association in Amsterdam, NL, and of GEANT Limited in Cambridge, UK GÉANT Vereniging (Association) is registered in the Netherlands with the Chamber of Commerce in Amsterdam<http://www.kvk.nl/english/traderegister/default.asp>. Registration number: 40535155. Registered office: Singel 468 D, Amsterdam 1017 AW, The Netherlands GEANT Limited is registered in England & Wales. Registration number: 2806796. Registered office: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK.

1 0