| Internet-Draft | L2 ACP Scenarios | April 2020 |
| Carpenter & Liu | Expires 11 October 2020 | [Page] |
This document discusses scenarios and requirements for Autonomic Control Planes (ACPs) constructed and secured at Layer 2. These would be alternatives to an ACP constructed and secured at the network layer. A secure ACP is required as the substrate for an autonomic network and for the Generic Autonomic Signaling Protocol (GRASP).¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 11 October 2020.¶
Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶
As defined in [I-D.ietf-anima-reference-model], the Autonomic Service Agent (ASA) is the atomic entity of an autonomic function, and it is instantiated on autonomic nodes. When ASAs communicate with each other, they should use the Generic Autonomic Signaling Protocol (GRASP) [I-D.ietf-anima-grasp]. It is essential that such communication is strongly secured to avoid malicious interference with the Autonomic Network Infrastructure (ANI).¶
For this reason, GRASP, and any other autonomic management traffic, must run over a secure substrate that is isolated from regular data plane traffic. This substrate is known as the Autonomic Control Plane (ACP). A method for constructing an ACP at the network layer is described in [I-D.ietf-anima-autonomic-control-plane]. The present document discusses scenarios and requirements for constructing an ACP at layer 2. It is not intended to be a normative specification, since implementation details will depend on individual layer 2 technologies.¶
The ANI design is aimed at managed networks, as explained in the reference model [I-D.ietf-anima-reference-model]. For a wide area network (such as a large campus, a multi-site enterprise network, or a carrier network considered as a whole) it is appropriate to construct the ACP using network layer techniques and network layer security, which is the model described in [I-D.ietf-anima-autonomic-control-plane]. However, in at least two cases an ACP covering a smaller geographical area may be appropriate:¶
In either case, we assume that the L2 ACP may extend into the Network Operations Centre (NOC) so that it can be interfaced to traditional tools for Operations, Administration and Maintenance, as described in [RFC8368]. In the terminology of that document, an L2 ACP is an instance of a Generalized ACP.¶
These requirements are intended to ensure that a layer 2 ACP can meet the needs of all components of the ANI.¶
A specific security protocol that supports both authentication and encryption of layer 2 packets for Ethernet LANs is MACsec, i.e. the IEEE Standard 802.1AE-2018 [MACsec]. For multicast packets, authentication is on a group basis (i.e., the originator is guaranteed to be a member of the group, rather than a specific interface). MACsec applies across all VLANs, but the ACP VLAN can be isolated from the data plane VLAN independently of MACsec. This solution does not extend to wireless networks. For IEEE 802.11 networks, IEEE Standard 802.11-2016 [WiFi] "WPA2" security within a dedicated Basic Service Set (BSS) might be considered adequate.¶
An ACP software module will be needed in each autonomic node, whose job is to provide the GRASP core or other autonomic management protocols with the following information about the L2 ACP:¶
The L2 ACP could in principle be extended across multiple segments or even multiple sites by use of secure L2VPN technology. This topic is out of the scope of the present document.¶
A simple ACP software module emulating that needed for a secure L2 ACP has been implemented, but it does not in fact verify security. It may be found at https://github.com/becarpenter/graspy/blob/master/acp.py and is briefly documented in https://github.com/becarpenter/graspy/blob/master/graspy.pdf.¶
The assumption of this document is that any Layer 2 solution chosen must have adequate security against interlopers and eavesdroppers. It should be noted that (at least in a wired network) this also requires adequate physical security to prevent access by unauthorized persons, including physical intrusion detection.¶
The fact that an IPv6 router is not required in an L2 ACP excludes many Layer 3 vulnerabilities by construction. No outside entity can generate link-local IPv6 packets, and no outside entity can send global scope packets to any autonomic node.¶
This document makes no request of the IANA.¶
Excellent suggestions were made by Michael Richardson and other participants in the ANIMA WG.¶
draft-carpenter-anima-l2acp-scenarios-00, 2019-02-28:¶
draft-carpenter-anima-l2acp-scenarios-01, 2019-10-03:¶
draft-carpenter-anima-l2acp-scenarios-02, 2020-04-09:¶