Geneve network service interfaces option class

Abstract

This specification defines a new Geneve Option Class and a registration procedure for corresponding option types that can be used for the exchange of metadata between network service domains. The metadata enables implementation of coordinated network service functionality across domains by carrying extra context.¶

1. Introduction

Following the publication of [RFC8926], IANA created a registry [IANA-GENEVE-CLASSES] to manage the option class space. The option classes so far have been reserved for private use by different organizations from the "First come first served" range.¶

As enterprises evolve their network to span carriers, co-locations and public clouds, there is a desire to integrate with best-of-the- breed network services in a flexible and interoperable fashion. In many cases, these network service functionalities are offered as a managed service, which is usually hosted in a separate and independent network. This is a departure from the traditional model of enterprise network administrators managing service appliances within their premises.¶

Geneve is increasingly being adopted as the encapsulation protocol to tie these disparate networks together and offer coordinated services. At the point where a service needs to be applied to an enterprise's traffic, network elements encapsulate the traffic over an on-demand Geneve overlay to a service endpoint while ensuring tenant isolation for the enterprise consuming the services. Geneve options carry extra context across domains to be used while applying the service.¶

This specification proposes a standard option class subrange under the "IETF review" range for such purposes, called "Network service interfaces Option Class". It enables an "implement once and offer everywhere" approach that vendors and providers can leverage.¶

2. Use cases

Below is a sample topology where Geneve tunnel is used to carry the traffic from a cloud provider to a network security service provider to apply security and get the traffic back to the destination.¶

                 +----------------------+
                 |    Security service  |
                 |      provider        |
                 +----------------------+
                         ('')
                         |  |
                         |  | Geneve
                         |  | tunnel
                     [3] |  |
                         |  | [4]
                         (,,)
                 +------------------------------+
                 |Public         [5]            |
                 |Cloud        .----------~     |
                 |             |Enterprise|     |
                 |             |resources |     |
                 |             `----------'     |
                 +------------------------------+
                          ||
                          || [2]
      +----------+     +--------+
      |Enterprise| [1] |Co-     |
      | Network  |=====|Location|
      +----------+     +--------+

Below is another topology that demonstrates tenant isolation, along with the presence of enterprise network footprint across cloud providers. Each enterprise's network traffic is carried in separate Geneve tunnel, ensuring isolation.¶

                Network services provider domain
                +-------------------------------------------+
                |           .                               |
                |         .   .                             |
                +--------.-----.----------------------------+
                     ||  .     .Geneve
                     ||  .     .Tunnel
                     ||  .     .
                     ||  .     .
            +-------------\----/--------+     +------------------------+
            |    Cloud provider 1       |     |    Cloud provider 2    |
            |               : :         |     |                        |
            | +----------+ +----------+ |     | +----------+           |
            | |enterprise| |enterprise| |     | |enterprise|           |
            | |  1       | |   2      | |<--->| |  2       |           |
            | |virtual   | |virtual   | |     | |virtual   |           |
            | |network   | |network   | |     | |network   |           |
            | +--|-------+ +--|-------+ |     | +----------+           |
            +----|------------|---------+     +------------------------+
                 |            |
            +----+-----+  +---+------+
            |enterprise|  |enterprise|
            |  1       |  |  2       |
            |on-prem   |  |on-prem   |
            |network   |  |network   |
            +----------+  +----------+

3. Options

This specification defines a new Option Class called "Network service interfaces Option Class" to carry extra context across domains that offer network services to enterprises. The new class will be structured as a subrange.¶

Under the first option class in "network service interfaces option class" subrange, this specification defines the following option types.¶

        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |  Option Class = [TBD]         |   Type = 1    |R|R|R| Len = 1 |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              ISO-3166-2 country/subdivision code              |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

4. Deployment and Operational Considerations

7. References