RFC 7920
Problem Statement for the Interface to the Routing System
Problem Statement for the Interface to the Routing System ✨
Internet Engineering Task Force (IETF) 🎀 Series: RFC 7920 🦋
Okay bestie, this is the doc that kicks off the whole I2RS vibe! 💖 The authors are A. Atlas, Ed. from Juniper Networks, T. Nadeau, Ed. from Brocade, and D. Ward from Cisco Systems. 🧚 It was published in June 2016 📅 and its category is Informational, so it's not a Standards Track spec, just a "here's what we're thinking" kind of doc 💅 Its ISSN is 2070-1721. It doesn't obsolete or update any other RFCs, so it's a totally fresh start! 🌸
Abstract
Okay so, routing systems have traditionally used routing and signaling (like MPLS 🌈) to control how traffic moves through a network. Route computation has mostly been steered by pretty static policies that set link cost, route cost, or import and export routing policies. 🍓 But now there are big new needs to manage and program routing systems more dynamically 🔥 Think highly dynamic data-center networking, on-demand WAN services, dynamic policy-driven traffic steering and service chaining, real-time security threat responsiveness through traffic control, and separating policy-based decision-making from the router itself 👑 These needs should let you control routing information and traffic paths, and also pull out network topology information, traffic statistics, and other network analytics from routing systems. ✨
This document proposes meeting this need via an Interface to the Routing System (I2RS). 🫶
Status of This Memo
This document is not an Internet Standards Track specification; it is published for informational purposes. 💀
This document is a product of the Internet Engineering Task Force (IETF). 🎀 It represents the consensus of the IETF community, and it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every document the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 7841 for more on that. 💜
Information about the current status of this document, any errata, and how to give feedback on it can be found at http://www.rfc-editor.org/info/rfc7920. 🦋
Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 🌈
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these carefully, because they describe your rights and restrictions with respect to this document. 🍓 Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 💅
Table of Contents 🧚
1. Introduction ....................................................3
2. I2RS Model and Problem Area for the IETF ........................4
3. Standard Data Models of Routing State for Installation ..........6
4. Learning Router Information .....................................7
5. Aspects to be Considered for an I2RS Protocol ...................8
6. Security Considerations .........................................9
7. References .....................................................10
7.1. Normative References ......................................10
7.2. Informative References ....................................10
Appendix A. Existing Management Interfaces .......................11
Acknowledgements ..................................................12
Authors' Addresses ................................................121. Introduction 🌸
Okay so routing systems have traditionally used routing and signaling (e.g., MPLS) to control traffic forwarding in a network. Route computation has been run by pretty static policies that define link cost, route cost, or import and export routing policies. ✨ Then the advent of highly dynamic data-center networking, on-demand WAN services, dynamic policy-driven traffic steering and service chaining, the need for real-time security threat responsiveness via traffic control, and separating policy-based decision-making from the router itself 👑 created the need to manage and program routing systems way more dynamically, so you can control routing information and traffic paths and extract network topology information, traffic statistics, and other network analytics from routing systems. It's giving main character energy 🎀
As modern networks keep growing in scale and complexity, and desired policy gets more complex and dynamic, there's a need to support rapid control and analytics. 🚀 The scale of modern networks and data centers, plus the operational expense that comes with it, is what drives the need to automate even the simplest operations. 💅 Being able to quickly do more complex operations to support dynamic policy is even more critical. 🔥
In order to let network applications access and control information in different vendors' routing systems, a publicly documented interface is required. 🦋 The interface needs to support real-time, asynchronous interactions using efficient data models and encodings that are based on and extend those previously defined. 🍓 Furthermore, the interface must be tailored to provide a solid base on which a variety of use cases can be supported. 🫶
To support the requirements of orchestration software and automated network applications that dynamically modify the network, there's a need to learn topology, network analytics, and existing state from the network, as well as to create or modify routing information and network paths. 🧚 A feedback loop is needed so that changes made can be verified and so these applications can learn and react to network changes. 💖
Proprietary solutions that partially support the requirements above have been developed for specific situations and needs. 🌈 Standardizing an interface to the routing system will make it easier to integrate into a network. 💜 Because there are already proprietary partial solutions, standardizing a common interface should be feasible. ✨
Quick note: in this document, the term "applications" is used. It refers to an executable program of some sort that has access to a network, such as an IP or MPLS network, via a routing system. 💀
2. I2RS Model and Problem Area for the IETF ✨
okay so managing a network of systems that run a bunch of routing protocols and/or offer extra services (think forwarding, classification and policing, firewalling) means lots of components inside those systems have to coordinate 💬. Some of these systems or parts might be virtualized, squished together in the same physical box, or spread out everywhere. Either way, it's sooo desirable to let network applications manage and control the services from many, if not all, of these components 🦋. Just with authenticated and authorized access and policies 🔐. Security with main character energy!
A data-model-driven interface to the routing system is needed 💅. That lets people read and control more information, and it keeps things flexible for later. At least one companion protocol with clearly defined operations is needed too. The suitable protocol(s) can be identified and expanded to meet what an Interface to the Routing System (I2RS) needs. These solutions must be designed to make rapid, isolated, secure, and dynamic changes to a device's routing system possible 🔥. And that would make it way easier to deploy interoperable applications and routing systems at wide scale 🌈.
The I2RS model and problem area for IETF work is illustrated in Figure 1. This document uses terminology defined in [RFC7921]. The I2RS agent is tied to a routing element, which may or may not be co-located with a data plane 🧚. The I2RS client could be built right into a network application, or it could be controlled and used by one or more separate network applications. For example, an I2RS client could come from a network controller or a network orchestration system. That system offers a non-I2RS interface to network applications and an I2RS interface to I2RS agents on the systems being managed 🫶. The scope of the data models used by I2RS stretches across the entire routing system and the selected protocol(s) for I2RS.
As shown in Figure 1, the I2RS client and I2RS agent in a routing system are objects within the I2RS scope. The selected protocol(s) for I2RS run between the I2RS client and I2RS agent. Everything else in Figure 1 is outside the I2RS scope for standardization 🙈.
+***************+ +***************+ +***************+
* Application * * Application * * Application *
+***************+ +***************+ +***************+
| I2RS Client | ^ ^
+---------------+ * *
^ * ****************
| * *
| v v
| +---------------+ +-------------+
| | I2RS Client |<------->| Other I2RS |
| +---------------+ | Agents |
| ^ +-------------+
|________________ |
| | <== I2RS Protocol
| |
...........................|..|..................................
. v v .
. +*************+ +---------------+ +****************+ .
. * Policy * | | * Routing & * .
. * Database *<***>| I2RS Agent |<****>* Signaling * .
. +*************+ | | * Protocols * .
. +---------------+ +****************+ .
. ^ ^ ^ ^ .
. +*************+ * * * * .
. * Topology * * * * * .
. * Database *<*******+ * * v .
. +*************+ * * +****************+ .
. * +********>* RIB Manager * .
. * +****************+ .
. * ^ .
. v * .
. +*******************+ * .
. * Subscription & * * .
. * Configuration * v .
. * Templates for * +****************+ .
. * Measurements, * * FIB Manager * .
. * Events, QoS, etc. * * & Data Plane * .
. +*******************+ +****************+ .
.................................................................
<--> interfaces inside the scope of I2RS Protocol
+--+ objects inside the scope of I2RS-defined behavior
<**> interfaces NOT within the scope of I2RS Protocol
+**+ objects NOT within the scope of I2RS-defined behavior
<== used to point to the interface where the I2RS Protocol
would be used
.... boundary of a router supporting I2RS
Figure 1: I2RS Model and Problem AreaThe protocol(s) that carry messages between I2RS clients and I2RS agents should provide the key features listed in Section 5 💖.
I2RS will use a set of meaningful data models for information in the routing system and in a topology database 📚. Each data model should describe the meaning and relationships of the things it models. The data models should be separable across different features of the managed components, versioned, and extendable ✨. As Figure 1 shows, I2RS needs to interact with several logical components of the routing element: the policy database, the topology database, subscription and configuration for dynamic measurements and events, routing and signaling protocols, and the Routing Information Base (RIB) manager 🌸. This interaction goes both ways. It's for writing (like to policy databases or the RIB manager) and for reading (like dynamic measurements or the topology database) 👑. An application should be able to combine data from individual routing elements to provide network-wide data model(s) 🦋.
The data models should translate into a concise transfer syntax, sent via the I2RS protocol, that's straightforward for applications to use (for example, a web services design paradigm) 🍓. The information transfer should use existing transport protocols to provide the reliability, security, and timeliness appropriate for the particular data 🔒.
3. Standard Data Models of Routing State for Installation
as we said in Section 1, there's a real need to precisely control routing and signaling state based on policy or external measures 💅. One set of data models that I2RS should focus on is for interacting with the RIB layer (for example, the RIB, the Label Information Base (LIB), the multicast RIB, and policy-based routing) so you get flexibility and routing abstractions 🎀. As an example, the routing and signaling state you want could range from simple static routes all the way to policy-based routing and static multicast replication and routing state 🌈. This means that, to model next hops in a useful way, the data model needs to handle next-hop indirection and recursion (e.g., a prefix X is routed like prefix Y) as well as different types of tunneling and encapsulation 🧚.
Efforts to get this level of control have focused on standardizing data models that describe the forwarding plane (e.g., Forwarding and Control Element Separation (ForCES) [RFC3746]). But I2RS recognizes that the routing system and a router's OS already provide useful mechanisms that applications could harness to hit application-level goals 😭. Using routing indirection, recursion, and common routing abstractions (e.g., tunnels, Label Switched Paths (LSPs), etc.) gives you way more flexibility and functionality than squashing everything down to individual routes in the Forwarding Information Base (FIB). Those individual routes would otherwise each need to be modified one by one whenever something changes 💀.
On top of interfaces for controlling the RIB layer, there's also a need to dynamically configure policies and parameter values for the various routing and signaling protocols, based on application-level policy decisions 🦋.
4. Learning Router Information
a router has information that applications may need so they can understand the network, verify that programmed state is installed, measure how various flows behave, and understand the existing configuration and state of the router 👀. I2RS should provide a framework so applications can register for asynchronous notifications and make specific requests for information 💜.
Even though there are efforts to extend the topological information available, even the best of them (e.g., BGP-LS [RFC7752]) still only provide the current active state as seen at the IGP and BGP layers 😤. Applications need more detailed topological state than just functional status (like active paths and links). Missing info includes paths or links that are potentially available (e.g., administratively down) or unknown (e.g., to peers or customers) to the routing topology 🙃.
For applications to have a feedback loop that includes awareness of the relevant traffic, an application must be able to request measurement and timely, scalable reporting of data 📊. A mechanism like IP Flow Information Export (IPFIX) [RFC5470] may be the thing that actually delivers the data, but being able to dynamically ask for measurements to be taken and data to be delivered is a big deal 🌟.
There's a wide range of events applications could use to verify router state before other network state changes (e.g., that a route has been installed), and to respond in time when relevant routes change because of others or because of router events (e.g., link up/down) 🚨. A few of these (like link up/down) may already be available through MIB notifications today, but the full range isn't (e.g., route installed, route changed, primary LSP changed, etc.) 🥺
5. Aspects to be Considered for an I2RS Protocol ✨
okay bestie, this section is the wishlist 🧚 It describes the things an I2RS protocol needs to be good at. Whether we extend what already exists or build something totally new is still up for investigation, so nothing's decided yet 💅
Here are the key aspects an interface to the routing system needs:
- Multiple Simultaneous Asynchronous Operations: A single application should be able to send multiple independent atomic operations via I2RS. It shouldn't have to wait for each one to finish before sending the next one 🏃♀️💨
- Very Fine Granularity of Data Locking for Writing: When an I2RS operation gets processed, the data locked for writing is required to be very granular (for example, one particular prefix and route) instead of extremely coarse, which is how writing configuration works. This should improve the number of concurrent I2RS operations that are feasible and reduce blocking delays. no more everyone waiting in line behind one giant lock 🙅♀️
- Multi-Headed Control: Multiple applications may talk to the same I2RS agent in a minimally coordinated way. The I2RS agent needs to be able to handle multiple requests in a well-known, policy-based way. Data that's written can be owned by different I2RS clients at different times, and data may even get overwritten by a different I2RS client. The details of how this should be handled are described in [RFC7921] 🫶
- Duplex: Communication can be started by either the I2RS client (the thing that lives inside the application, or that the application uses to talk to the I2RS agent) or by the I2RS agent. Events, acknowledgements, failures, operations, and so on can be sent at any time by both the router and the application. The I2RS is not a pure pull model where only the application queries to pull responses. two-way street, bestie 🛣️💖
- High Throughput: At a minimum, the I2RS agent and its associated router should be able to handle a considerable number of operations per second (for example, 10,000 per second, so many individual subscriber routes can change at the same time). that is a LOT of routes 😭🔥
- Low Latency: Within a sub-second timescale, it should be possible to complete simple operations (for example, reading or writing a single prefix route). fast and snappy, no lag ⚡
- Multiple Channels: It should be possible for information to be communicated through the interface from different components in the router without having to go through a single channel. For example, for scaling, some exported data or events may be better sent directly from the forwarding plane, while other interactions may come from the control plane. One channel, with authorization and authentication, may be considered primary. Only an authorized client can then request that information be delivered on a different channel. Writes from a client are only expected on channels that provide authorization and authentication. channels with no ID check are a hard no 🙅♀️
- Scalable, Filterable Information Access: To extract information in a scalable way that applications can use more easily, the ability to specify filtering constructs in an operation that requests data, or in a request for an asynchronous notification, is super valuable 🌈
- Secure Control and Access: Any ability to manipulate routing state must be subject to authentication and authorization. Sensitive routing information may also need to be provided through secure access back to the I2RS client. Those communications must be integrity protected, and most communications will also require confidentiality. locking the vault, obviously 🔐🎀
- Extensibility and Interoperability: Both the I2RS protocol and its models must be extensible, and they must interoperate between different versions of protocols and models. futureproofing is everything 🦋
6. Security Considerations 🔐
okay this part is SERIOUS, so pay attention 🙈
Security is a key aspect of any protocol that allows state installation and extraction of detailed router state. The need for secure control and access is mentioned in Section 5. More architectural security considerations are discussed in [RFC7921].
Briefly, the I2RS agent is assumed to have a separate authentication and authorization channel. Through that channel, it can validate both the identity and the permissions associated with an I2RS client. Mutual authentication between the I2RS agent and I2RS client is required. Different levels of integrity, confidentiality, and replay protection are relevant for different aspects of I2RS.
⚠️ bestie, the takeaway is: the agent and the client have to check each other, and the level of protection depends on which part of I2RS you're looking at. no shortcuts 💀
7. References 📚
7.1. Normative References
[RFC7921] Atlas, A., Halpern, J., Hares, S., Ward, D., and T.
Nadeau, "An Architecture for the Interface to the Routing
System", RFC 7921, DOI 10.17487/RFC7921, June 2016,
<http://www.rfc-editor.org/info/rfc7921>.7.2. Informative References
[RFC3746] Yang, L., Dantu, R., Anderson, T., and R. Gopal,
"Forwarding and Control Element Separation (ForCES)
Framework", RFC 3746, DOI 10.17487/RFC3746, April 2004,
<http://www.rfc-editor.org/info/rfc3746>.
[RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek,
"Architecture for IP Flow Information Export", RFC 5470,
DOI 10.17487/RFC5470, March 2009,
<http://www.rfc-editor.org/info/rfc5470>.
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<http://www.rfc-editor.org/info/rfc6241>.
[RFC7752] Gredler, H., Ed., Medved, J., Previdi, S., Farrel, A., and
S. Ray, "North-Bound Distribution of Link-State and
Traffic Engineering (TE) Information Using BGP", RFC 7752,
DOI 10.17487/RFC7752, March 2016,
<http://www.rfc-editor.org/info/rfc7752>.Appendix A. Existing Management Interfaces 🗂️
this appendix is the tour of the old-school ways people already manage routers. some are iconic, some are... not 💅
This section looks at the combination of the abstract data models, their representation in a data language, and the transfer protocol commonly used with them as one single entity. Other combinations of these existing standard technologies are possible, but the ones described here are the ones with significant deployment.
There are three basic ways that routers get managed. The most popular is the command-line interface (CLI), which allows both configuration and learning of device state. It's a proprietary interface that looks like a UNIX shell, and it allows for very customized control and observation of a device and, specifically of interest here, its routing system. Some form of this interface exists on almost every device, virtual or otherwise. Processing the information returned to the CLI (called "screen scraping") is a burdensome activity, because the data is normally formatted for a human operator and because the layout can vary from device to device and between different software versions. Despite being everywhere, this interface has never been standardized and is unlikely to ever be standardized. CLI standardization is not considered as a candidate solution for the problems motivating I2RS 🙃
The second most popular interface for checking a device's state, statistics, and configuration is the Simple Network Management Protocol (SNMP), along with a set of relevant standards-based and proprietary Management Information Base (MIB) modules. SNMP has a strong history of being used by network managers to gather statistical and state information about devices, including their routing systems. However, SNMP is very rarely used to configure a device or any of its systems, for reasons that depend on the network operator. Some example reasons include complexity, the lack of desired configuration semantics (for example, configuration rollback, sandboxing, or configuration versioning), and the difficulty of using the semantics (or lack thereof) defined in the MIB modules to configure device features. Therefore, SNMP is not considered as a candidate solution for the problems motivating I2RS 💀
Finally, the IETF's Network Configuration Protocol (NETCONF) [RFC6241] has made many strides at overcoming most of the configuration limitations just described ✨ However, as a new technology, and with the initial lack of standard data models, adoption of NETCONF has been slow. As needed, I2RS will identify and define information and data models to support I2RS applications. Additional extensions to handle multi-headed control may need to be added to NETCONF and/or appropriate data models. so the glow-up is still in progress 🌸
Acknowledgements 🫶
The authors would like to thank Ken Gray, Ed Crabbe, Nic Leymann, Carlos Pignataro, Kwang-koog Lee, Linda Dunbar, Sue Hares, Russ Housley, Eric Grey, Qin Wu, Stephen Kent, Nabil Bitar, Deborah Brungard, and Sarah Banks for their suggestions and review. thank you, legends 💜
Authors' Addresses 💌
Alia Atlas (editor)
Juniper Networks
Email: akatlas@juniper.net
Thomas D. Nadeau (editor)
Brocade
Email: tnadeau@lucidvision.com
Dave Ward
Cisco Systems
Email: wardd@cisco.com📦 where this page comes from
- ietf: rfc7920 2016-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms