Framework for IETF Network Slices

1.1. Background

Driven largely by needs surfacing from 5G, the concept of network slicing has gained traction ([NGMN-NS-Concept], [TS23501], [TS28530], and [BBF-SD406]). In [TS23501], a Network Slice is defined as "a logical network that provides specific network capabilities and network characteristics", and a Network Slice Instance is defined as "A set of Network Function instances and the required resources (e.g. compute, storage and networking resources) which form a deployed Network Slice." According to [TS28530], an end-to-end network slice consists of three major types of network segments: Radio Access Network (RAN), Transport Network (TN) and Core Network (CN). An IETF Network Slice provides the required connectivity between different entities in RAN and CN segments of an end-to-end network slice, with a specific performance commitment. For each end-to-end network slice, the topology and performance requirement on a customer's use of IETF Network Slice can be very different, which requires the underlay network to have the capability of supporting multiple different IETF Network Slices.¶

While network slices are commonly discussed in the context of 5G, it is important to note that IETF Network Slices are a narrower concept, and focus primarily on particular network connectivity aspects. Other systems, including 5G deployments, may use IETF Network Slices as a component to create entire systems and concatenated constructs that match their needs, including end-to-end connectivity.¶

A IETF Network Slice could span multiple technologies and multiple administrative domains. Depending on the IETF Network Slice customer's requirements, an IETF Network Slice could be isolated from other, often concurrent IETF Network Slices in terms of data, control and management planes.¶

The customer expresses requirements for a particular IETF Network Slice by specifying what is required rather than how the requirement is to be fulfilled. That is, the IETF Network Slice customer's view of an IETF Network Slice is an abstract one.¶

Thus, there is a need to create logical network structures with required characteristics. The customer of such a logical network can require a degree of isolation and performance that previously might not have been satisfied by traditional overlay VPNs. Additionally, the IETF Network Slice customer might ask for some level of control of their virtual networks, e.g., to customize the service paths in a network slice.¶

This document specifies definitions and a framework for the provision of an IETF Network Slice service. Section 6 briefly indicates some candidate technologies for realizing IETF Network Slices.¶

3.1. Definition and Scope of IETF Network Slice

An IETF Network Slice Service enables connectivity between a set of CEs with specific Service Level Objectives (SLOs) and Service Level Expectations (SLEs) over a common underlay network.¶

An IETF Network Slice combines the connectivity resource requirements and associated network behaviors such as bandwidth, latency, jitter, and network functions with other resource behaviors such as compute and storage availability. The definition of an IETF Network Slice Service is independent of the connectivity and technologies used in the underlay network. This allows an IETF Network Slice Service customer to describe their network connectivity and relevant objectives in a common format, independent of the underlying technologies used.¶

IETF Network Slices may be combined hierarchically, so that a network slice may itself be sliced. They may also be combined sequentially so that various different networks can each be sliced and the network slices placed into a sequence to provide an end-to-end service. This form of sequential combination is utilized in some services such as in 3GPP's 5G network [TS23501].¶

An IETF Network Slice Service is technology-agnostic, and its realization may be selected based upon multiple considerations including its service requirements and the capabilities of the underlay network.¶

The term "Slice" refers to a set of characteristics and behaviours that separate one type of user-traffic from another. An IETF Network Slice assumes that an underlay network is capable of changing the configurations of the network devices on demand, through in-band signaling or via controller(s) and fulfilling all or some of SLOs/SLEs to all of the traffic in the slice or to specific flows.¶

3.2. IETF Network Slice Service

A service provider instantiates an IETF Network Slice service for a customer. The IETF Network Slice service is specified in terms of a set of CEs, a set of one or more connectivity matrices (point-to-point (P2P), point-to-multipoint (P2MP), multipoint-to-point (MP2P), multipoint-to-multipoint (MP2MP), or any-to-any (A2A)) between subsets of these CEs, and a set of SLOs and SLEs for each CE sending to each connectivity matrix. That is, in a given IETF Network Slice service there may be one or more connectivity matrices of the same or different type, each connectivity matrix may be between a different subset of CEs, and for a given connectivity matrix each sending CE has its own set of SLOs and SLEs, and the SLOs and SLEs in each set may be different. Note that it is a service provider's prerogative to decide how many connectivity matrices per IETF Network Slice Service it wishes to offer.¶

This approach results in the following possible connectivity matrices:¶

• For a P2P connectivity matrix, there is one sending CE and one receiving CE. This matrix is like a private wire or a tunnel. All traffic injected at the sending CE is intended to be received by the receing CE. The SLOs and SLEs apply at the sender (and implicitly at the receiver).¶
• A bidirectional P2P connectivity matrix may also be defined, with two CEs each of which may send to the other. There are two sets of SLOs and SLEs which may be different and each of which applies to one of the CEs as a sender.¶
• For a P2MP connectivity matrix, there is only one sending CE and more than one receiving CE. This is like a P2MP tunnel or multi-access VLAN segment. All traffic from the sending CE is intended to be received by all the receiving CEs. There is one set of SLOs and SLEs that apply at the sending CE (and implicitly at all receiving CEs).¶
• An MP2P connectivity matrix has N CEs: there is one receiving CE and (N - 1) sending CEs. This is like a set of P2P connections all with a common receiver. All traffic injected at any sending CE is received by the single receiving CE. Each sending CE has its own set of SLOs and SLEs, and they may all be different (the combination of those SLOs and SLEs gives the implicit SLOs and SLEs for the receiving CE - that is, the receiving CE is expected to receive all traffic from all senders).¶
• In an MP2MP connectivity matrix each of the N CEs can be a sending CE such that its traffic is delivered to all of the other CEs. Each sending CE has its own set of SLOs and SLEs and they may all be different. The combination of those SLOs/SLEs gives the implicit SLOs/SLEs for each/all of the receiving CEs since each receiving CE is expect to receive all traffic from all/any sender.¶
• With an A2A matrix, any sending CE may send to any one receiving CE or any set of receiving CEs. There is an implicit level of routing in this connectivity matrix that is not present in the other connectivity matrices as the matrix must determine to which receiving CEs to deliver each packet. The SLOs/SLEs apply to individual sending CEs and individual receiving CEs, but there is no implicit linkage and a sending CE may be "disappointed" if the receiver is over-subscribed.¶

If a CE has multiple attachment circuits to a given IETF Network Slice Service and they are operating in single-active mode, then all traffic between the CE and its attached PEs transits a single attachment circuit; if they are operating in in all-active mode, then traffic between the CE and its attached PEs is distributed across all of the active attachment circuits.¶

A given sending CE may be part of multiple connectivity matrices within a single IETF Network Slice service, and the CE may have different SLOs and SLEs for each connectivity matrix to which it is sending. Note that a given sending CE's SLOs and SLEs for a given connectivity matrix apply between it and each of the receiving CEs for that connectivity matrix.¶

An IETF Network Slice service provider may freely make a deployment choice as to whether to offer a 1:1 relationship between IETF Network Slice service and connectivity matrix, or to support multiple connectivity matrices in a single IETF Network Slice service. In the former case, the provider might need to deliver multiple IETF Network Slice services to achive the function of the second case.¶

It should be noted that per Section 9 of [RFC4364] an IETF Network Slice service customer may actually provide IETF Network Slice services to other customers in a mode sometimes refered to as "carrier's carrier". In this case, the underlying IETF Network Slice service provider may be owned and operated by the same or a different provider network. As noted in Section 3.1, network slices may be composed hierarchically or serially.¶

Section 4.2 provides a description of endpoints in the context of IETF network slicing. For a given IETF Network Slice service, the IETF Network Slice customer and provider agree, on a per-CE basis which end of the attachment circuit provides the service demarcation point (i.e., whether the attachment circuit is inside or outside the IETF Network Slice service). This determines whether the attachment circuit is subject to the set of SLOs and SLEs for the specific CE.¶

Section 4.2 provides a description of service demarcation endpoints. For a given IETF Network Slice Service, the customer and provider agree, on a per-CE basis, which end of the attachment circuit provides the service demarcation endpoint (i.e., whether the attachment circuit is inside or outside the IETF Network Slice Service). This determines whether the attachment circuit is subject to the set of SLOs and SLEs for the specific CE. This point is illustrated further in Section 4.2.¶

4.2. IETF Network Slice Endpoints

As noted in Section 3.1, an IETF Network Slice is a logical network topology connecting a number of endpoints. Section 3.2 goes on to describe how the IETF Network Slice service is composed of a set of one or more connectivity matrices that describe connectivity between the endoints across the underlying network.¶

The characteristics of IETF Network Slice Endpoints (NSEs) are as follows:¶

• IETF NSEs are conceptual points of connection to an IETF Network Slice. As such, they serve as the IETF Network Slice ingress/ egress points.¶
• Each NSE maps to a device, application, or a network function, such as (but not limited to): routers, switches, firewalls, WAN, 4G/5G RAN nodes, 4G/5G Core nodes, application accelerators, Deep Packet Inspection (DPI) engines, server load balancers, NAT44 [RFC3022], NAT64 [RFC6146], HTTP header enrichment functions, and TCP optimizers.¶
• An NSE is identified by a unique identifier in the context of an IETF Network Slice customer.¶
• Each NSE is associated with a set of provider-scope identifiers such as IP addresses, encapsulation-specific identifiers (e.g., VLAN tag, MPLS Label), interface/port numbers, node ID, etc.¶

• IETF NSEs are mapped to endpoints of services/tunnels/paths within the IETF Network Slice during its initialization and realization.¶

  • A combination of NSE identifier and NSE network-scope identifiers defines an NSE in the context of the NSC.¶
  • The NSC will use the NSE network-scope identifiers as part of the process of realizing the IETF Network Slice.¶

For a given IETF network slice service, the IETF Network Slice customer and provider agree where the endpoint (i.e., the service demarcation point) is located. This determines what resrouces at the edge of the network form part of the IETF Network Slice and are subject to the set of SLOs and SLEs for a specific endpoint.¶

Figure 1 shows different potential scopes of an IETF Network Slice that are consistent with the different endpoint positions. For the purpose of example and without loss of generality, the figure shows customer edge (CE) and provider edge (PE) nodes connected by access circuits (ACs). Notes after the figure give some explanations.¶

         |<---------------------- (1) ---------------------->|
         |                                                   |
         | |<-------------------- (2) -------------------->| |
         | |                                               | |
         | |        |<----------- (3) ----------->|        | |
         | |        |                             |        | |
         | |        |  |<-------- (4) -------->|  |        | |
         | |        |  |                       |  |        | |
         V V   AC   V  V                       V  V   AC   V V
     +-----+   |    +-----+                 +-----+    |   +-----+
     |     |--------|     |                 |     |--------|     |
     | CE1 |   |    | PE1 |. . . . . . . . .| PE2 |    |   | CE2 |
     |     |--------|     |                 |     |--------|     |
     +-----+   |    +-----+                 +-----+    |   +-----+
        ^              ^                       ^              ^
        |              |                       |              |
        |              |                       |              |
     Customer       Provider                Provider       Customer
     Edge 1         Edge 1                  Edge 2         Edge 2

Explanatory notes for Figure 1 are as follows:¶

1. If the CE is operated by the IETF Network Slice service provider, then the edge of the IETF Network Slice may be within the CE. In this case the slicing process may utilize resources from within the CE such as buffers and queues on the outgoing interfaces.¶
2. The IETF Network Slice may be extended as far as the CE, to include the AC, but not to include any part of the CE. In this case, the CE may be operated by the customer or the provider. Slicing the resources on the AC may require the use of traffic tagging (such as through Ethernet VLAN tags) or may require traffic policing at the AC link ends.¶
3. In another model, the enpoints of the IETF Network Slice are the customer-facing ports on the PEs. This case can be managed in a way that is similar to a port-based VPN: each port (AC) or virtual port (e.g., VLAN tag) identifies the IETF Network Slice and maps to an IETF Network Slice endpoint.¶
4. Finally, the endpoint of the IETF Network Slice may be within the PE. In this mode, the PE classifies the traffic coming from the AC according to information (such as the source and desination IP addresses, payload protocol and port numbers, etc.) in order to place it onto an IETF Network Slice.¶

The choice of which of these options to apply is entirely up to the network operator. It may limit or enable the provision of particular managed services and the operator will want to consider how they want to manage CE equipment and what control they wish to offer the customer or AC resources.¶

Note that Figure 1 shows a symmetrical positioning of endpoints, but this decision can be taken on a per-endpoint basis through agreement between the customer and provider.¶

In practice, it may be necessary to map traffic not only onto an IETF Network Slice, but also onto a specific connectivity matrix if the IETF Network Slice supports more than one connectivity matrix with a source at the specific endpoint. The mechanism used will be one of the mechanisms described above, dependent on how the endpoint is realized.¶

Finally, note (as described in Section 2.1) that a CE is an abstract endpoint of an IETF Network Slice Service and as such may be a device or software component and may, in the case of netork functions virtualization (for example), be an abstract function supported within the provider's network.¶

4.3. IETF Network Slice Decomposition

Operationally, an IETF Network Slice may be decomposed in two or more IETF Network Slices as specified below. Decomposed network slices are then independently realized and managed.¶

• Hierarchical (i.e., recursive) composition: An IETF Network Slice can be further sliced into other network slices. Recursive composition allows an IETF Network Slice at one layer to be used by the other layers. This type of multi-layer vertical IETF Network Slice associates resources at different layers.¶
• Sequential composition: Different IETF Network Slices can be placed into a sequence to provide an end-to-end service. In sequential composition, each IETF Network Slice would potentially support different dataplanes that need to be stitched together.¶

5.1. IETF Network Slice Stakeholders

An IETF Network Slice and its realization involves the following stakeholders and it is relevant to define them for consistent terminology. The IETF Network Slice customer and IETF Network Slice provider (see Section 2.1) are also stakeholders.¶

Orchestrator:

An orchestrator is an entity that composes different services, resource and network requirements. It interfaces with the IETF NSC.¶

IETF Network Slice Controller (NSC):

It realizes an IETF Network Slice in the underlying network, maintains and monitors the run-time state of resources and topologies associated with it. A well-defined interface is needed between different types of IETF NSCs and different types of orchestrators. An IETF Network Slice operator (or slice operator for short) manages one or more IETF Network Slices using the IETF NSCs.¶

Network Controller:

is a form of network infrastructure controller that offers network resources to the NSC to realize a particular network slice. These may be existing network controllers associated with one or more specific technologies that may be adapted to the function of realizing IETF Network Slices in a network.¶

5.2. Expressing Connectivity Intents

The NSC northbound interface (NBI) can be used to communicate between IETF Network Slice customers and the NSC.¶

An IETF Network Slice customer may be a network operator who, in turn, provides the IETF Network Slice to another IETF Network Slice customer.¶

Using the NBI, a customer expresses requirements for a particular slice by specifying what is required rather than how that is to be achieved. That is, the customer's view of a slice is an abstract one. Customers normally have limited (or no) visibility into the provider network's actual topology and resource availability information.¶

This should be true even if both the customer and provider are associated with a single administrative domain, in order to reduce the potential for adverse interactions between IETF Network Slice customers and other users of the underlay network infrastructure.¶

The benefits of this model can include:¶

• Security: because the underlay network (or network operator) does not need to expose network details (topology, capacity, etc.) to IETF Network Slice customers the underlay network components are less exposed to attack;¶
• Layered Implementation: the underlay network comprises network elements that belong to a different layer network than customer applications, and network information (advertisements, protocols, etc.) that a customer cannot interpret or respond to (note - a customer should not use network information not exposed via the NSC NBI, even if that information is available);¶
• Scalability: customers do not need to know any information beyond that which is exposed via the NBI.¶

The general issues of abstraction in a TE network is described more fully in [RFC7926].¶

This framework document does not assume any particular layer at which IETF Network Slices operate as a number of layers (including virtual L2, Ethernet or IP connectivity) could be employed.¶

Data models and interfaces are of course needed to set up IETF Network Slices, and specific interfaces may have capabilities that allow creation of specific layers.¶

Layered virtual connections are comprehensively discussed in IETF documents and are widely supported. See, for instance, GMPLS-based networks [RFC5212] and [RFC4397], or Abstraction and Control of TE Networks (ACTN) [RFC8453] and [RFC8454]. The principles and mechanisms associated with layered networking are applicable to IETF Network Slices.¶

There are several IETF-defined mechanisms for expressing the need for a desired logical network. The NBI carries data either in a protocol-defined format, or in a formalism associated with a modeling language.¶

For instance:¶

• Path Computation Element (PCE) Communication Protocol (PCEP) [RFC5440] and GMPLS User-Network Interface (UNI) using RSVP-TE [RFC4208] use a TLV-based binary encoding to transmit data.¶
• Network Configuration Protocol (NETCONF) [RFC6241] and RESTCONF Protocol [RFC8040] use XML and JSON encoding.¶
• gRPC/GNMI [I-D.openconfig-rtgwg-gnmi-spec] uses a binary encoded programmable interface;¶
• For data modeling, YANG ([RFC6020] and [RFC7950]) may be used to model configuration and other data for NETCONF, RESTCONF, and GNMI - among others; ProtoBufs can be used to model gRPC and GNMI data.¶

While several generic formats and data models for specific purposes exist, it is expected that IETF Network Slice management may require enhancement or augmentation of existing data models.¶

5.3. IETF Network Slice Controller (NSC)

The IETF NSC takes abstract requests for IETF Network Slices and implements them using a suitable underlying technology. An IETF NSC is the key building block for control and management of the IETF Network Slice. It provides the creation/modification/deletion, monitoring and optimization of IETF Network Slices in a multi-domain, a multi-technology and multi-vendor environment.¶

The main task of the IETF NSC is to map abstract IETF Network Slice requirements to concrete technologies and establish required connectivity, and ensuring that required resources are allocated to the IETF Network Slice.¶

An NSC northbound interface (NBI) is needed for communicating details of a IETF Network Slice (configuration, selected policies, operational state, etc.), as well as providing information to a slice requester/customer about IETF Network Slice status and performance. The details for this NBI are not in scope for this document.¶

The controller provides the following functions:¶

• Provides a technology-agnostic NBI for creation/modification/deletion of the IETF Network Slices. The API exposed by this NBI communicates the endpoints of the IETF Network Slice, IETF Network Slice SLO parameters (and possibly monitoring thresholds), applicable input selection (filtering) and various policies, and provides a way to monitor the slice.¶
• Determines an abstract topology connecting the endpoints of the IETF Network Slice that meets criteria specified via the NBI. The NSC also retains information about the mapping of this abstract topology to underlying components of the IETF Network Slice as necessary to monitor IETF Network Slice status and performance.¶

• Provides "Mapping Functions" for the realization of IETF Network Slices. In other words, it will use the mapping functions that:¶

  • map technology-agnostic NBI request to technology-specific SBIs¶
  • map filtering/selection information as necessary to entities in the underlay network.¶
• Via an SBI, the controller collects telemetry data (e.g., OAM results, statistics, states, etc.) for all elements in the abstract topology used to realize the IETF Network Slice.¶
• Using the telemetry data from the underlying realization of a IETF Network Slice (i.e., services/paths/tunnels), evaluates the current performance against IETF Network Slice SLO parameters and exposes them to the IETF Network Slice customer via the NBI. The NSC NBI may also include a capability to provide notification in case the IETF Network Slice performance reaches threshold values defined by the IETF Network Slice customer.¶

An IETF Network Slice customer is served by the IETF Network Slice Controller (NSC), as follows:¶

• The NSC takes requests from a management system or other application, which are then communicated via an NBI. This interface carries data objects the IETF Network Slice customer provides, describing the needed IETF Network Slices in terms of topology, applicable service level objectives (SLO), and any monitoring and reporting requirements that may apply. Note that - in this context - "topology" means what the IETF Network Slice connectivity is meant to look like from the customer's perspective; it may be as simple as a list of mutually (and symmetrically) connected endpoints, or it may be complicated by details of connection asymmetry, per-connection SLO requirements, etc.¶
• These requests are assumed to be translated by one or more underlying systems, which are used to establish specific IETF Network Slice instances on top of an underlying network infrastructure.¶
• The NSC maintains a record of the mapping from customer requests to slice instantiations, as needed to allow for subsequent control functions (such as modification or deletion of the requested slices), and as needed for any requested monitoring and reporting functions.¶

                 +------------------------------------------+
                 | Customer higher level operation system   |
                 |   (e.g E2E network slice orchestrator)   |
                 +------------------------------------------+
                                      A
                                      | NSC NBI
                                      V
                 +------------------------------------------+
                 |    IETF Network Slice Controller (NSC)   |
                 +------------------------------------------+
                                      A
                                      | NSC SBI
                                      V
                 +------------------------------------------+
                 |           Network Controllers            |
                 +------------------------------------------+

   --------------
  | Network      |
  | Slice        |
  | Orchestrator |
   --------------
    | IETF Network Slice
    | Service Request
    | NBI               Customer view
  ..|................................
   -v------------       Operator view
  |Controller    |
  |  ----------  |
  | |IETF      | |
  | |Network   | |
  | |Slice     | |
  | |Controller| |
  | |(NSC)     | |
  |  ----------  |--> Virtual Network
  |     | SBI    |
  |     v        |
  |  ----------  |
  | |Network   | |
  | |Controller| |
  | |(NC)      | |
  |  ----------  |
   --------------
  ..|................................
    v                Underlay Network

6.1. Architecture to Realize IETF Network Slices

The architecture described in this section is deliberately at a high level. It is not intended to be prescriptive: implementations and technical solutions may vary freely. However, this approach provides a common framework that other documents may reference in order to facilitate a shared understanding of the work.¶

Figure 5 shows the architectural components of a network managed to provide IETF Network Slices. The customer's view is of individual IETF Network Slices with their endpoint CEs and connectivity matrices. Requests for IETF Network Slices are delivered to the NSC.¶

                       --      --      --
                      |CE|    |CE|    |CE|
                       --      --      --
                     AC :    AC :    AC :
                     ----------------------       -------
                    ( |PE|....|PE|....|PE| )     ( IETF  )
   IETF Network    (   --:     --     :--   )   ( Network )
   Slice Service   (     :............:     )   (  Slice  )
   Request          (  IETF Network Slice  )     (       )  Customer
     v               ----------------------       -------     View
     v        ............................\........./...............
     v                                     \       /        Provider
     v    >>>>>>>>>>>>>>>  Grouping/Mapping v     v           View
     v   ^             -----------------------------------------
     v   ^            ( |PE|.......|PE|........|PE|.......|PE|  )
    ---------        (   --:        --         :--         --    )
   |         |       (     :...................:                 )
   |   NSC   |        (        Network Resource Partition       )
   |         |         -----------------------------------------
   |         |                             ^
   |         |>>>>>  Resource Partitioning |
    ---------          of Filter Topology  |
     v   v                                 |
     v   v            -----------------------------      --------
     v   v           (|PE|..-..|PE|... ..|PE|..|PE|)    (        )
     v   v          ( :--  |P|  --   :-:  --   :--  )  (  Filter  )
     v   v          ( :.-   -:.......|P|       :-   )  ( Topology )
     v   v          (  |P|...........:-:.......|P|  )   (        )
     v   v           (  -    Filter Topology       )     --------
     v   v            -----------------------------       ^
     v    >>>>>>>>>>>>  Topology Filter ^                /
     v        ...........................\............../...........
     v                                    \            /  Underlay
    ----------                             \          /  (Physical)
   |          |                             \        /    Network
   | Network  |    ----------------------------------------------
   |Controller|   ( |PE|.....-.....|PE|......    |PE|.......|PE| )
   |          |  (   --     |P|     --      :-...:--     -..:--   )
    ----------  (    :       -:.............|P|.........|P|        )
        v       (    -......................:-:..-       -         )
         >>>>>>> (  |P|.........................|P|......:        )
     Program the  (  -                           -               )
       Network     ----------------------------------------------

The network itself (at the bottom of the figure) comprises an underlay network. This could be a physical network, but may be a virtual network. The underlay network is provisioned through network controllers.¶

The underlay network may be filtered by the network operator into a number of Filter Topologies. Filter actions may include selection of specific resources (e.g., nodes and links) according to their capabilities, and are based on network-wide policies. The resulting topologies can be used as candidates to host IETF Network Slices and provide a useful way for the network operator to know in advance that all of the resources they are using to plan an IETF Network Slice would be able to meet specific SLOs and SLEs. The filtering procedure could be an offline planning activity or could be performed dynamically as new demands arise. The use of Filter Topologies is entirely optional in the architecture, and IETF Network Slices could be hosted directly on the underlay network.¶

For scalability reasons, IETF Network Slices may be grouped together according to characteristics (including SLOs and SLEs). This grouping allows an operator to host a number of slices on a particular set of resources and so reduce the amount of state information needed in the network. The NSC is responsible for grouping the IETF Network Slice requests.¶

Each group of IETF Network Slices is mapped onto a set of network resources that are available to carry traffic and meet the SLOs and SLEs. These resources are known as a Network Resource Partition and are selected from the Filter Topology (or direct from the underlay network): they may be reserved and dedicated for use by the group of IETF Network Slices, or may be shared between groups depending on the details of the SLOs and SLEs.¶

The steps described here can be applied in a variety of orders according to implementation and deployment preferences. Furthermore, the steps may be iterative so that the components are continually refined and modified as network conditions change and as service requests are received or relinquished, and even the underlay network could be extended if necessary to meet the customers' demands.¶

6.2. Procedures to Realize IETF Network Slices

There are a number of different technologies that can be used in the underlay, including physical connections, MPLS, time-sensitive networking (TSN), Flex-E, etc.¶

An IETF Network Slice can be realized in a network, using specific underlying technology or technologies. The creation of a new IETF Network Slice will be realized with following steps:¶

• The NSC exposes the network slicing capabilities that it offers for the network it manages.¶
• The customer may issue a request to determine whether a specific IETF Network Slice could be supported by the network. The NSC may respond indicating a simple yes or no, and may supplement a negative response with information about what it could support were the customer to change some requirements.¶
• The customer requests an IETF Network Slice. The NSC may respond that the slice has or has not been created, and may supplement a negative response with information about what it could support were the customer to change some requirements.¶
• When processing a customer request for an IETF Network Slice, the NSC maps the request to the network capabilities and applies provider policies before creating or supplementing the resource partition.¶

Regardless of how IETF Network Slice is realized in the network (i.e., using tunnels of different types), the definition of the IETF Network Slice does not change at all. The only difference is how the slice is realized. The following sections briefly introduce how some existing architectural approaches can be applied to realize IETF Network Slices.¶

6.3. Applicability of ACTN to IETF Network Slices

Abstraction and Control of TE Networks (ACTN - [RFC8453]) is a management architecture and toolkit used to create virtual networks (VNs) on top of a TE underlay network. The VNs can be presented to customers for them to operate as private networks.¶

In many ways, the function of ACTN is similar to IETF network slicing. Customer requests for connectivity-based overlay services are mapped to dedicated or shared resources in the underlay network in a way that meets customer guarantees for service level objectives and for separation from other customers' traffic. [RFC8453] the function of ACTN as collecting resources to establish a logically dedicated virtual network over one or more TE networks. Thus, in the case of a TE-enabled underlying network, the ACTN VN can be used as a basis to realize an IETF network slicing.¶

While the ACTN framework is a generic VN framework that can be used for VN services beyond the IETF Network Slice, it also a suitable basis for delivering and realizing IETF Network Slices.¶

Further discussion of the applicability of ACTN to IETF Network Slices including a discussion of the relevant YANG models can be found in [I-D.king-teas-applicability-actn-slicing].¶

6.4. Applicability of Enhanced VPNs to IETF Network Slices

An enhanced VPN (VPN+) is designed to support the needs of new applications, particularly applications that are associated with 5G services, by utilizing an approach that is based on existing VPN and TE technologies and adds characteristics that specific services require over and above traditional VPNs.¶

An enhanced VPN can be used to provide enhanced connectivity services between customer sites (a concept similar to an IETF Network Slice) and can be used to create the infrastructure to underpin network slicing.¶

It is envisaged that enhanced VPNs will be delivered using a combination of existing, modified, and new networking technologies.¶

[I-D.ietf-teas-enhanced-vpn] describes the framework for Enhanced Virtual Private Network (VPN+) services.¶

6.5. Network Slicing and Slice Aggregation in IP/MPLS Networks

Network slicing provides the ability to partition a physical network into multiple isolated logical networks of varying sizes, structures, and functions so that each slice can be dedicated to specific services or customers.¶

Many approaches are currently being worked on to support IETF Network Slices in IP and MPLS networks with or without the use of Segment Routing. Most of these approaches utilize a way of marking packets so that network nodes can apply specific routing and forwarding behaviors to packets that belong to different IETF Network Slices. Different mechanisms for marking packets have been proposed (including using MPLS labels and Segment Rouing segment IDs) and those mechanisms are agnostic to the path control technology used within the underlay network.¶

These approaches are also sensitive to the scaling concerns of supporting a large number of IETF Network Slices within a single IP or MPLS network, and so offer ways to aggregate the slices so that the packet markings indicate an aggregate or grouping of IETF Network Slices where all of the packets are subject to the same routing and forwarding behavior.¶

At this stage, it is inappropriate to mention any of these proposed solutions that are currently work in progress and not yet adopted as IETF work.¶

7.1. Isolation as a Service Requirement

An IETF Network Slice customer may request that the IETF Network Slice delivered to them is delivered such that changes to other IETF Network Slices or services do not have any negative impact on the delivery of the IETF Network Slice. The IETF Network Slice customer may specify the degree to which their IETF Network Slice is unaffected by changes in the provider network or by the behavior of other IETF Network Slice customers. The customer may express this via an SLE it agrees with the provider. This concept is termed 'isolation'¶

7.2. Isolation in IETF Network Slice Realization

Isolation may be achieved in the underlying network by various forms of resource partitioning ranging from dedicated allocation of resources for a specific IETF Network Slice, to sharing of resources with safeguards. For example, traffic separation between different IETF Network Slices may be achieved using VPN technologies, such as L3VPN, L2VPN, EVPN, etc. Interference avoidance may be achieved by network capacity planning, allocating dedicated network resources, traffic policing or shaping, prioritizing in using shared network resources, etc. Finally, service continuity may be ensured by reserving backup paths for critical traffic, dedicating specific network resources for a selected number of IETF Network Slices.¶