Subject: Re: [Apn] Policy or forwarding behavior? [Was: Per flow state : [Was: Using IPv6 Flow Label for APN]]

From: "Jeffrey (Zhaohui) Zhang" <[email-masked]>
Date: Tue, 3 Aug 2021 14:27:38 +0000

Hi,

In the APN BoF, drafts, and discussions, the proponents always talk about "policy". I would like to ask if they specifically focus on "policy" as in "SR Policy" or "Firewall Policy", or would "Forwarding Behavior/Treatment" be a better word?

Thanks.
Jeffrey

-----Original Message-----
From: Apn <[email-masked]> On Behalf Of Adrian Farrel
Sent: Tuesday, August 3, 2021 5:24 AM
To: 'Pengshuping (Peng Shuping)' <[email-masked]>; 'Bob Hinden' <[email-masked]>
Cc: 'apn' <[email-masked]>; 'Jari Arkko' <[email-masked]>
Subject: [Apn] Per flow state : [Was: Using IPv6 Flow Label for APN]

[External Email. Be cautious of content]

Hi,

I want to follow up on something Shuping just said because I don't think it cam over clearly in the discussion...

> Regarding the "states" for APN, it does not have to be a per-flow "state". The
> APN attribute is an indicator at the policy enforcement node for indicating
> policies to be enforced in the middle of a tunnel.

What this says is that the mapping of flow to APN attribute is n:1
The attribute is used to instruct the policy enforcement points about what policy they should apply to a packet. Packets from many flows may be subject to the same policy.
In that regard, it takes (some of) the policy decision computation from the policy enforcement nodes, and moves it to the APN edge where the APN attribute is computed.

I think this processing is "similar" to the use of DSCP. That is, there is not a different DSCP code point for each flow.

On the other hand, the value of an entropy indicator (IPv6 flow label, MPLS entropy label) for resolving ECMP decisions relies on:
1. All packets from one flow having the same entropy value.
    I think this holds for the APN attribute.
2. There being sufficient variation in entropy values across flows to enable
    sensible distribution of flows into the different ECMP buckets.
    I believe that for APN attributes this is a function of how the APN edges
    are instructed to create APN attribute values (by the controller/operator),
    but it would be possible for an operator to get this wrong by not introducing
    sufficient variation in the APN attribute values.

Best,
Adrian

--
Apn mailing list
[email-masked]
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/apn__;!!NEt6yMaO-gk!SMEllNP9DvTTdFc4oPuEOxry7goTHw3vByG1kUfG32uDcwGr0YH1GE6QD3LFyXTa$

Juniper Business Use Only

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 3 Aug 2021 15:50:15 +0100

It's a good question, Jeffrey.

"Policy" may be the most abused term in the whole of the Internet.
Far worse than "transport" and that has been pretty badly treated.

Personally (and who am I?) I find "SR policy" to be an outlier! Possibly it
comes from the classification policy used to place traffic on an SR path,
but its usage has grown.

I *think* that the APN proponents use "policy" to mean "any decision made
about how to treat a packet at a tunnel ingress, a transit node, or the
tunnel egress". However, I also believe that they do not intend that every
router on the path of the tunnel would be applying "routing policy." Thus,
as in the figures, the "policy enforcement nodes" are key routers along the
path.

Mayhap it is time to get a concrete list of polices that APN nodes might
enforce.

Cheers,
Adrian

-----Original Message-----
From: Jeffrey (Zhaohui) Zhang <[email-masked]> 
Sent: 03 August 2021 15:28
To: [email-masked]; 'Pengshuping (Peng Shuping)'
<[email-masked]>; 'Bob Hinden' <[email-masked]>
Cc: 'apn' <[email-masked]>; 'Jari Arkko' <[email-masked]>
Subject: RE: [Apn] Policy or forwarding behavior? [Was: Per flow state :
[Was: Using IPv6 Flow Label for APN]]

Hi,

In the APN BoF, drafts, and discussions, the proponents always talk about
"policy". I would like to ask if they specifically focus on "policy" as in
"SR Policy" or "Firewall Policy", or would "Forwarding Behavior/Treatment"
be a better word?

Thanks.
Jeffrey

-----Original Message-----
From: Apn <[email-masked]> On Behalf Of Adrian Farrel
Sent: Tuesday, August 3, 2021 5:24 AM
To: 'Pengshuping (Peng Shuping)' <[email-masked]>; 'Bob Hinden'
<[email-masked]>

Hi,

I want to follow up on something Shuping just said because I don't think it
cam over clearly in the discussion...

What this says is that the mapping of flow to APN attribute is n:1
The attribute is used to instruct the policy enforcement points about what
policy they should apply to a packet. Packets from many flows may be subject
to the same policy.
In that regard, it takes (some of) the policy decision computation from the
policy enforcement nodes, and moves it to the APN edge where the APN
attribute is computed.

I think this processing is "similar" to the use of DSCP. That is, there is
not a different DSCP code point for each flow.

On the other hand, the value of an entropy indicator (IPv6 flow label, MPLS
entropy label) for resolving ECMP decisions relies on:
1. All packets from one flow having the same entropy value.
    I think this holds for the APN attribute.
2. There being sufficient variation in entropy values across flows to enable
    sensible distribution of flows into the different ECMP buckets.
    I believe that for APN attributes this is a function of how the APN
edges
    are instructed to create APN attribute values (by the
controller/operator),
    but it would be possible for an operator to get this wrong by not
introducing
    sufficient variation in the APN attribute values.

Best,
Adrian

--
Apn mailing list
[email-masked]
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/apn__;!!NE
t6yMaO-gk!SMEllNP9DvTTdFc4oPuEOxry7goTHw3vByG1kUfG32uDcwGr0YH1GE6QD3LFyXTa$

---

From: "Jeffrey (Zhaohui) Zhang" <[email-masked]>
Date: Tue, 3 Aug 2021 14:55:04 +0000

Hi Adrian,

So it seems that "Forwarding Behavior/Treatment" is a good way to describe it?

Thanks.
Jeffrety

-----Original Message-----
From: Adrian Farrel <[email-masked]>
Sent: Tuesday, August 3, 2021 10:50 AM
To: Jeffrey (Zhaohui) Zhang <[email-masked]>; 'Pengshuping (Peng Shuping)' <[email-masked]>; 'Bob Hinden' <[email-masked]>
Cc: 'apn' <[email-masked]>; 'Jari Arkko' <[email-masked]>
Subject: RE: [Apn] Policy or forwarding behavior? [Was: Per flow state : [Was: Using IPv6 Flow Label for APN]]

Cheers,
Adrian

-----Original Message-----
From: Jeffrey (Zhaohui) Zhang <[email-masked]>
Sent: 03 August 2021 15:28
To: [email-masked]; 'Pengshuping (Peng Shuping)'

Hi,

Thanks.
Jeffrey

-----Original Message-----
From: Apn <[email-masked]> On Behalf Of Adrian Farrel
Sent: Tuesday, August 3, 2021 5:24 AM
To: 'Pengshuping (Peng Shuping)' <[email-masked]>; 'Bob Hinden'
<[email-masked]>

Hi,

Best,
Adrian

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 3 Aug 2021 16:00:24 +0100

Not sure, to be honest.

Definitely ECMP fits that name.
Also, probably, queuing and drop-precedence.

Do you count Access Control as "forwarding behavior/treatment"? 
What about other security filters?

Potential, I suppose any network function (although I think we draw the line
short of SFC).

Hence why I ask for the list of policies.

A

-----Original Message-----
From: Jeffrey (Zhaohui) Zhang <[email-masked]> 
Sent: 03 August 2021 15:55
To: [email-masked]; 'Pengshuping (Peng Shuping)'

Hi Adrian,

So it seems that "Forwarding Behavior/Treatment" is a good way to describe
it?

Thanks.
Jeffrety

-----Original Message-----
From: Adrian Farrel <[email-masked]>
Sent: Tuesday, August 3, 2021 10:50 AM
To: Jeffrey (Zhaohui) Zhang <[email-masked]>; 'Pengshuping (Peng
Shuping)' <[email-masked]>; 'Bob Hinden' <[email-masked]>
Cc: 'apn' <[email-masked]>; 'Jari Arkko' <[email-masked]>
Subject: RE: [Apn] Policy or forwarding behavior? [Was: Per flow state :
[Was: Using IPv6 Flow Label for APN]]

Cheers,
Adrian

-----Original Message-----
From: Jeffrey (Zhaohui) Zhang <[email-masked]>
Sent: 03 August 2021 15:28
To: [email-masked]; 'Pengshuping (Peng Shuping)'

Hi,

Thanks.
Jeffrey

-----Original Message-----
From: Apn <[email-masked]> On Behalf Of Adrian Farrel
Sent: Tuesday, August 3, 2021 5:24 AM
To: 'Pengshuping (Peng Shuping)' <[email-masked]>; 'Bob Hinden'
<[email-masked]>

Hi,

Best,
Adrian

---

From: "Jeffrey (Zhaohui) Zhang" <[email-masked]>
Date: Tue, 3 Aug 2021 15:29:50 +0000

ECMP is just part of forwarding behavior.
Queuing and drop-preference is covered by forwarding behavior/treatment, as in the DiffServ architecture.
For access control and security filter, I suppose that is the job of APN Edge who puts on the APN ID?

Forwarding behavior/treatment can cover many things that one may desire, including access control, security filter, or other functions. It's good to list all the things that APN wants to do, but all those can have a blanket term like "forwarding behavior/treatment".

Jeffrey

-----Original Message-----
From: Adrian Farrel <[email-masked]>
Sent: Tuesday, August 3, 2021 11:00 AM
To: Jeffrey (Zhaohui) Zhang <[email-masked]>; 'Pengshuping (Peng Shuping)' <[email-masked]>; 'Bob Hinden' <[email-masked]>
Cc: 'apn' <[email-masked]>; 'Jari Arkko' <[email-masked]>
Subject: RE: [Apn] Policy or forwarding behavior? [Was: Per flow state : [Was: Using IPv6 Flow Label for APN]]

Not sure, to be honest.

A

-----Original Message-----
From: Jeffrey (Zhaohui) Zhang <[email-masked]>
Sent: 03 August 2021 15:55
To: [email-masked]; 'Pengshuping (Peng Shuping)'

Hi Adrian,

Thanks.
Jeffrety

-----Original Message-----
From: Adrian Farrel <[email-masked]>
Sent: Tuesday, August 3, 2021 10:50 AM
To: Jeffrey (Zhaohui) Zhang <[email-masked]>; 'Pengshuping (Peng

Cheers,
Adrian

-----Original Message-----
From: Jeffrey (Zhaohui) Zhang <[email-masked]>
Sent: 03 August 2021 15:28
To: [email-masked]; 'Pengshuping (Peng Shuping)'

Hi,

Thanks.
Jeffrey

-----Original Message-----
From: Apn <[email-masked]> On Behalf Of Adrian Farrel
Sent: Tuesday, August 3, 2021 5:24 AM
To: 'Pengshuping (Peng Shuping)' <[email-masked]>; 'Bob Hinden'
<[email-masked]>

Hi,

Best,
Adrian

---

From: "Dongjie (Jimmy)" <[email-masked]>
Date: Wed, 4 Aug 2021 02:07:21 +0000

Agree with Adrian on "Policy may be the most abused term in the whole of the Internet."

So far we have seen: security policy, qos policy, routing policy, SR policy and "slice policy", ..., while each may refer to different traffic treatment at different network positions with different network scope. 

Maybe it would be better to find separate term for each case to avoid the confusion.

Best regards,
Jie

> From: Apn [mailto:[email-masked]] On Behalf Of Adrian Farrel
> Sent: Tuesday, August 3, 2021 10:50 PM
> To: 'Jeffrey (Zhaohui) Zhang' <[email-masked]>; Pengshuping (Peng Shuping)
> Subject: Re: [Apn] Policy or forwarding behavior? [Was: Per flow state : [Was:
> Using IPv6 Flow Label for APN]]
> 
> Personally (and who am I?) I find "SR policy" to be an outlier! Possibly it comes
> from the classification policy used to place traffic on an SR path, but its usage
> has grown.
> 
> about how to treat a packet at a tunnel ingress, a transit node, or the tunnel
> egress". However, I also believe that they do not intend that every router on the
> path of the tunnel would be applying "routing policy." Thus, as in the figures, the
> "policy enforcement nodes" are key routers along the path.
> 
> Mayhap it is time to get a concrete list of polices that APN nodes might enforce.
> 
> Cheers,
> Adrian
> 
> "policy". I would like to ask if they specifically focus on "policy" as in "SR Policy"
> or "Firewall Policy", or would "Forwarding Behavior/Treatment"
> be a better word?
> 
> Thanks.
> Jeffrey
> 
> What this says is that the mapping of flow to APN attribute is n:1 The attribute
> is used to instruct the policy enforcement points about what policy they should
> apply to a packet. Packets from many flows may be subject to the same policy.
> https://www.ietf.org/mailman/listinfo/apn

---

From: Gyan Mishra <[email-masked]>
Date: Tue, 3 Aug 2021 23:33:33 -0400

+1

“Agree with Adrian on "Policy may be the most abused term in the whole of
the Internet."

Good point Jimmy!

The term policy can be vague as it can fall into three buckets in OSI model
which would be L3 “Routing layer policy” which included any routing policy
including policy based routing, SR-TE policy,network slice policy,  or
“Layer 4-7” application based content or sever VIP load balancer, QOS DSCP
marking marking policy, Centralized controller based policy - SD-WAN
policy, SDN/PCE  policy, NFV/MANO policy.

All of the policies mentioned are related in some way to one that would be
related to packet forwarding treatment but at different layers within the
OSI model is the difference.

APN policy enforcement would fall into QOS marking policy category of
policy types, as it provides a similar packet marking for differential  SLA
service level PHB per hop behavior similar to AF / EF DSCP forwarding.

As for terminology maybe “APN classifier” or “APN SLA”.

Kind Regards

Gyan

On Tue, Aug 3, 2021 at 10:07 PM Dongjie (Jimmy) <[email-masked]> wrote:

> So far we have seen: security policy, qos policy, routing policy, SR
> policy and "slice policy", ..., while each may refer to different traffic
> treatment at different network positions with different network scope.
>
> tunnel
> > I want to follow up on something Shuping just said because I don't think
> it cam
> > over clearly in the discussion...
> >
> > > Regarding the "states" for APN, it does not have to be a per-flow
> "state".
> > The
> > I think this processing is "similar" to the use of DSCP. That is, there
> is not a
> > different DSCP code point for each flow.
> >
-- 

<http://www.verizon.com/>

*Gyan Mishra*

*Network Solutions A**rchitect *

*Email [email-masked] <[email-masked]>*

*M 301 502-1347*

---

From: Gyan Mishra <[email-masked]>
Date: Wed, 4 Aug 2021 00:17:38 -0400

Here is a list of policy types sorted a bit better based on where they fall
in the OSI model for forwarding treatment and correlation to APN framework:

1. L3 Network layer:  “Routing layer policy” which included any routing
policy including policy based routing, SR-TE policy,network slice policy,  QOS
DSCP marking marking policy.

2. Layer 4-7: application based content or sever VIP load balancer policy,
Firewalls policy, Content engines policy, Web engines policy.

3. Layer 7: Centralized controller based policy - SD-WAN policy, SDN/PCE
 policy, NFV/MANO policy.

So APN utilizes #3 as it’s a controller based architecture and utilizes #1
for the Edge marking & classification, #1 for APN head end node mapping to
SR-TE steered path snd #2 for policy enforcement which could for any node
among the path.

Kind Regards

Gyan

On Tue, Aug 3, 2021 at 11:33 PM Gyan Mishra <[email-masked]> wrote:

> The term policy can be vague as it can fall into three buckets in OSI
> model which would be L3 “Routing layer policy” which included any routing
> policy including policy based routing, SR-TE policy,network slice policy,
>  or “Layer 4-7” application based content or sever VIP load balancer, QOS
> DSCP marking marking policy, Centralized controller based policy - SD-WAN
>> > I want to follow up on something Shuping just said because I don't
>> think it cam

*Gyan Mishra*

*M 301 502-1347*

---

From: "Pengshuping (Peng Shuping)" <[email-masked]>
Date: Wed, 4 Aug 2021 06:17:35 +0000

APN aims to do the policy enforcement at some policy enforcement points within the network. In most cases, it is not for per hop policy enforcement.

Here the policy means about the rule matching to certain network services based on the apn attribute. The network services include e.g. traffic steering into SR policies, paths and network slices, triggering performance measurement, etc.

Shuping

From: Apn [mailto:[email-masked]] On Behalf Of Gyan Mishra
Sent: Wednesday, August 4, 2021 12:18 PM
To: Dongjie (Jimmy) <[email-masked]>
Cc: Bob Hinden <[email-masked]>; Jeffrey (Zhaohui) Zhang <[email-masked]>; Jari Arkko <[email-masked]>; [email-masked]; apn <[email-masked]>; Pengshuping (Peng Shuping) <[email-masked]>
Subject: Re: [Apn] Policy or forwarding behavior? [Was: Per flow state : [Was: Using IPv6 Flow Label for APN]]

Here is a list of policy types sorted a bit better based on where they fall in the OSI model for forwarding treatment and correlation to APN framework:

1. L3 Network layer:  “Routing layer policy” which included any routing policy including policy based routing, SR-TE policy,network slice policy,  QOS DSCP marking marking policy.

2. Layer 4-7: application based content or sever VIP load balancer policy, Firewalls policy, Content engines policy, Web engines policy.

3. Layer 7: Centralized controller based policy - SD-WAN policy, SDN/PCE  policy, NFV/MANO policy.

So APN utilizes #3 as it’s a controller based architecture and utilizes #1 for the Edge marking & classification, #1 for APN head end node mapping to SR-TE steered path snd #2 for policy enforcement which could for any node among the path.

Kind Regards

Gyan

On Tue, Aug 3, 2021 at 11:33 PM Gyan Mishra <[email-masked]<mailto:[email-masked]>> wrote:

+1

“Agree with Adrian on "Policy may be the most abused term in the whole of the Internet."

Good point Jimmy!

The term policy can be vague as it can fall into three buckets in OSI model which would be L3 “Routing layer policy” which included any routing policy including policy based routing, SR-TE policy,network slice policy,  or “Layer 4-7” application based content or sever VIP load balancer, QOS DSCP marking marking policy, Centralized controller based policy - SD-WAN policy, SDN/PCE  policy, NFV/MANO policy.

All of the policies mentioned are related in some way to one that would be related to packet forwarding treatment but at different layers within the OSI model is the difference.

APN policy enforcement would fall into QOS marking policy category of policy types, as it provides a similar packet marking for differential  SLA service level PHB per hop behavior similar to AF / EF DSCP forwarding.

Kind Regards

Gyan

On Tue, Aug 3, 2021 at 10:07 PM Dongjie (Jimmy) <[email-masked]<mailto:[email-masked]>> wrote:
Agree with Adrian on "Policy may be the most abused term in the whole of the Internet."

Best regards,
Jie

> From: Apn [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Adrian Farrel
> To: 'Jeffrey (Zhaohui) Zhang' <[email-masked]<mailto:[email-masked]>>; Pengshuping (Peng Shuping)
> <[email-masked]<mailto:[email-masked]>>; 'Bob Hinden' <[email-masked]<mailto:[email-masked]>>
> Cc: 'apn' <[email-masked]<mailto:[email-masked]>>; 'Jari Arkko' <[email-masked]<mailto:[email-masked]>>
> From: Jeffrey (Zhaohui) Zhang <[email-masked]<mailto:[email-masked]>>
> To: [email-masked]<mailto:[email-masked]>; 'Pengshuping (Peng Shuping)'
> <[email-masked]<mailto:[email-masked]>>; 'Bob Hinden' <[email-masked]<mailto:[email-masked]>>
> Cc: 'apn' <[email-masked]<mailto:[email-masked]>>; 'Jari Arkko' <[email-masked]<mailto:[email-masked]>>
> From: Apn <[email-masked]<mailto:[email-masked]>> On Behalf Of Adrian Farrel
> To: 'Pengshuping (Peng Shuping)' <[email-masked]<mailto:[email-masked]>>; 'Bob Hinden'
> <[email-masked]<mailto:[email-masked]>>
> Cc: 'apn' <[email-masked]<mailto:[email-masked]>>; 'Jari Arkko' <[email-masked]<mailto:[email-masked]>>
> [email-masked]<mailto:[email-masked]>
> https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/apn__;!!N<https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/apn__;!!N>
> E
> [email-masked]<mailto:[email-masked]>

--
Apn mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/apn
--

[图像已被发件人删除。]<http://www.verizon.com/>

Gyan Mishra

Network Solutions Architect

Email [email-masked]<mailto:[email-masked]>

M 301 502-1347

--

[图像已被发件人删除。]<http://www.verizon.com/>

Gyan Mishra

Network Solutions Architect

Email [email-masked]<mailto:[email-masked]>

M 301 502-1347

---

From: "Dikshit, Saumya" <[email-masked]>
Date: Sat, 14 Aug 2021 06:22:38 +0000

For “policy” ,do we want to align/extend to/the standards defined in other groups/forums.
For example for routing-policies, rtgwg is converging on https://datatracker.ietf.org/doc/html/draft-ietf-rtgwg-policy-model

thanks
Saumya.

From: Apn [mailto:[email-masked]] On Behalf Of Pengshuping (Peng Shuping)
Sent: Wednesday, August 4, 2021 11:48 AM
To: Gyan Mishra <[email-masked]>; Dongjie (Jimmy) <[email-masked]>
Cc: Jeffrey (Zhaohui) Zhang <[email-masked]>; Jari Arkko <[email-masked]>; apn <[email-masked]>; Bob Hinden <[email-masked]>; [email-masked]
Subject: Re: [Apn] Policy or forwarding behavior? [Was: Per flow state : [Was: Using IPv6 Flow Label for APN]]

Shuping

From: Apn [mailto:[email-masked]] On Behalf Of Gyan Mishra
Sent: Wednesday, August 4, 2021 12:18 PM
To: Dongjie (Jimmy) <[email-masked]<mailto:[email-masked]>>
Cc: Bob Hinden <[email-masked]<mailto:[email-masked]>>; Jeffrey (Zhaohui) Zhang <[email-masked]<mailto:[email-masked]>>; Jari Arkko <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; apn <[email-masked]<mailto:[email-masked]>>; Pengshuping (Peng Shuping) <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Apn] Policy or forwarding behavior? [Was: Per flow state : [Was: Using IPv6 Flow Label for APN]]

Kind Regards

Gyan

+1

Good point Jimmy!

Kind Regards

Gyan

Best regards,
Jie

> https://www.ietf.org/mailman/listinfo/apn<https://www.ietf.org/mailman/listinfo/apn>
> E
> https://www.ietf.org/mailman/listinfo/apn<https://www.ietf.org/mailman/listinfo/apn>

--
Apn mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/apn<https://www.ietf.org/mailman/listinfo/apn>
--

Gyan Mishra

M 301 502-1347

--

Gyan Mishra

M 301 502-1347