RFC 9408
A YANG Network Data Model for Service Attachment Points (SAPs)
🎀 RFC 9408: A YANG Network Data Model for Service Attachment Points (SAPs) 🎀
Okay bestie, so this is the Standards Track doc from the IETF (ISSN: 2070-1721) about a YANG data model for SAPs. It was published in June 2023 and it's written by M. Boucadair, Ed. (Orange) with O. Gonzalez de Dios (Telefonica), S. Barguil (Nokia), Q. Wu (Huawei), and V. Lopez (Nokia). 💅 It doesn't obsolete or update any other RFCs, so it's a fresh start, no drama. ✨
The whole point is a model of where services can get plugged into a provider's network, like basic connectivity, VPNs, and network slices. 🦋 It also lets you look up the spots where services are actually being delivered to customers, peer networks included. It augments the ietf-network data model from RFC 8345 by adding SAPs, and both UNI and NNI SAPs are supported. 🧚
Heads up, this is part 1 of 9, so more is coming. 🫶
Status of This Memo
Okay so this one is an Internet Standards Track document. 🌸 It's a product of the IETF, it represents the consensus of the IETF community, it got public review, and the IESG approved it for publication. If you want the scoop on Internet Standards, check out Section 2 of RFC 7841. 💜
You can find the current status, errata, and a way to send feedback at https://www.rfc-editor.org/info/rfc9408. 🔥
Copyright Notice
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stood on the publication date. Read those carefully, bestie, because they spell out your rights and restrictions. 🙈 Also, any Code Components pulled out of this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Revised BSD License. ⭐
Table of Contents
1. Introduction 🌈 2. Terminology 3. Sample SAP Network Model Usage 4. Relationship to Other YANG Data Models 5. SAP Module Tree Structure 6. SAP YANG Module 7. IANA Considerations 8. Security Considerations 9. References 9.1. Normative References 9.2. Informative References Appendix A. A Simplified SAP Network Example Appendix B. A Simple Example of the SAP Network Model: Node Filter Appendix C. An Example of an NNI SAP: Inter-AS VPN Option A Appendix D. Examples of Using the SAP Network Model in Service Creation Acknowledgements Authors' Addresses
1. Introduction 🌸
Okay so service providers offer all kinds of network services to customers. ✨ Think VPNs, SD-WAN overlay networks [BGP-SDWAN-USAGE], and network slices [IETF-NETWORK-SLICES], and that list isn't exhaustive, obsessed. 😭 To keep things running smoothly and automate service provisioning, providers need to keep track of where services can be delivered to customers. 💅 That view can feed an intelligence entity that handles service orders, checks whether a service is feasible, tracks coverage per service, and more (see Section 3.2 of [RFC8969]). So this document introduces the concept of Service Attachment Points (SAPs). 🦋
SAPs are the network reference points where network services can be delivered to customers. 🎀 This concept decides where to attach a service and deliver it in the Layer 3 VPN Service Model (L3SM) [RFC8299] and the Layer 2 VPN Service Model (L2SM) [RFC8466]. It can also show where those services are delivered through the network configuration described in the Layer 3 VPN Network Model (L3NM) [RFC9182] and the Layer 2 VPN Network Model (L2NM) [RFC9291]. 🧚
The document defines a YANG network model (Section 6) for representing, managing, and controlling SAPs. 💜 It augments the ietf-network module [RFC8345] by adding SAPs. Section 3 shows a sample usage, and Section 4 explains the scope and purpose of a SAP network model and how it relates to other models. 🌈
A network can support multiple services, and those services might be different types. ✨ Whether a SAP topology is dedicated to one service type or one individual service, or shared among many services of different types, is up to the deployment. 🫶 This document supports all of these deployment schemes. 👑
This document does not make any assumptions about the services a network provides to its users. 💅 VPN services such as Layer 3 Virtual Private Network (L3VPN) or Layer 2 Virtual Private Network (L2VPN) [RFC4026] are only used for illustration (Appendices A and B). 🌸
User-to-Network Interface (UNI) and Network-to-Network Interface (NNI) are reference points that operators widely use to mark demarcation points when delivering services. 🦋 So both UNI and NNI SAPs are supported here. 🎀 If you want examples of how UNI and NNI reference points get discussed, check out [MEF6], [MEF17], [RFC6004], or [RFC6215]. There's also an NNI VPN example in Appendix C. 🍓
The YANG data model in Section 6 conforms to the Network Management Datastore Architecture (NMDA) [RFC8342]. 💖
2. Terminology 💜
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 🔥
This document assumes you're already familiar with the contents of [RFC6241], [RFC7950], [RFC8345], and [RFC8309], because it uses terms from those RFCs. 🧚 The meanings of the symbols in tree diagrams are defined in [RFC8340]. 🌈
This document uses the term "network model" as defined in Section 2.1 of [RFC8969]. ✨
Here are the terms this document uses:
Service provider: The organization responsible for operating the network that offers a service (e.g., a VPN) to customers. 👑
Attachment Circuit (AC): A channel that connects a Customer Edge (CE) to a Provider Edge (PE). 🔗
Customer Edge (CE): Equipment that is dedicated to a particular customer and is directly connected to one or more PEs via ACs. A CE is usually located at the customer premises. A CE may be dedicated to a single service (e.g., an L3VPN), although it may support multiple VPNs if each one has separate ACs. A CE can be a router, a bridge, a switch, etc. 🏠
Provider Edge (PE): Equipment owned and managed by the service provider that can support multiple services (e.g., VPNs) for different customers. A PE is directly connected to one or more CEs via ACs. 🏢
Service Attachment Points (SAPs): An abstraction of the network reference points (e.g., the PE side of an AC, or the CE side of an AC for a provider-managed CE) where network services can be delivered and/or are delivered to customers. A SAP can be bound to one or multiple ACs. 🦋
Part 1 of 9 is done, bestie. 💖 Say "next" and I'll keep going with Section 3 and friends. 🫶
3. Sample SAP Network Model Usage ✨
okay so bestie, service provider networks can get automated with a bunch of different tools, like YANG-based interfaces 🫶 [RFC8969] [RFC6241] [RFC8040]. 💅 With that in mind, and looking at the setup in Figure 1, this doc's whole goal is to give you a YANG-based way to see an abstracted network view, going from the network controller up to the service orchestration layer. The big focus is on where a service can actually be delivered to customers 🎀. The model can also grab the network reference points where a service is getting delivered 🦋. And if a service needs resources from peer networks, the model can expose NNIs too 🌈.
+-----------------+
| Customer |
+--------+--------+
Customer Service Models |
(e.g., L3SM, L2SM) |
+--------+--------+
| Service |
| Orchestration |
+------+---+------+
Network Models | | SAP Network Model
(e.g., L3NM, L2NM) | |
+------+---+------+
| Network |
| Controller |
+--------+--------+
|
+---------------------+---------------------+
| Network |
+-------------------------------------------+
Figure 1: SAP Network Model UsageIf you want the backstory on the building blocks people usually reach for when they're characterizing a service provider network, peep Section 5 of [RFC4026] 📚🧚.
ngl, the service orchestration layer doesn't need to know every single internal detail of the underlying network 🙈. Like, it doesn't need to care about P nodes (Section 5.3.1 of [RFC4026]) 💀. Figure 2 shows the abstract network view that a service orchestrator sees ✨. BUT, this view isn't enough on its own to give the orchestration layer what it needs to create services in the network 😭. The service topology has to be able to expose the set of nodes, plus the attachment points tied to those nodes, that network services can be grafted onto (delivered) 🌸.
.---------. .---------.
| PE1 | | PE2 |
'---------' '---------'
\ /
\------/
( )
( )
( )
/------\
/ \
.---------. .---------.
| PE3 | | PE4 |
'---------' '---------'
Figure 2: Abstract Network TopologySo, focusing on the UNIs, the service orchestration layer would typically see a set of PEs and a set of client-facing interfaces (physical or logical) that CEs can be connected to, or that are actually connected 🔥. These are also called UNI-N (User-to-Network Interface, Network side) [RFC6215] 🫶. The orchestration layer can use these interfaces to set up the requested services or to commit the delivery of a service 👑. Figure 3 shows a sample SAP network topology that the network controller keeps track of and exposes to the service orchestration 🦋.
.-+-. .-+-. .-+-. .-+-. .-+-.
.-|sap|-|sap|-|sap|-. .-|sap|-------|sap|-.
| '---' '---' '---' | | '---' '---' |
.---. | | |
|sap| PE1 | | PE2 |
'---' | | |
| | | |
'-------------------' '-------------------'
.-------------------. .-------------------.
| | | |
| | | .---.
| PE3 | | PE4 |sap|
| | | '---'
| .---. .---. .---. | | .---. .---. .---. |
'-|sap|-|sap|-|sap|-' '-|sap|-|sap|-|sap|-'
'-+-' '-+-' '-+-' '-+-' '-+-' '-+-'
Figure 3: A SAP Network TopologyA single SAP network topology can serve one service type or several, like L3VPN or Ethernet VPN (EVPN) 💜. The network controller can then expose the service types and their associated interfaces through the SAPs 🧚.
Now, as Figure 4 shows, the service orchestration layer also gets access to a set of customer service models (like the L3SM or the L2SM) on the customer-facing interface 💖. It also gets a set of network models (like the L3NM and network topology data models) on the resource-facing interface 🌈. In this use case, the network controller is assumed to be unaware of what happens beyond the PEs toward the CEs 🙈. It's only responsible for managing and controlling the SAPs and the network between PEs 🫶. To correlate delivery points in service requests with SAPs, the SAP model may include a peer customer point identifier ✨. That identifier can be a CE identifier, a site identifier, and so on 🎀.
.---.
|CE2|
'-+-'
|
.-+-. .-+-. .-+-. .-+-. .-+-.
.-|sap|-|sap|-|sap|-. .-|sap|-------|sap|-.
| '---' '---' '---' | | '---' '---' |
.---. .---. | | |
|CE1+--+sap| PE1 | | PE2 |
'---' '---' | | |
| | | |
'-------------------' '-------------------'
.-------------------. .-------------------.
| | | |
| | | .---. .---.
| PE3 | | PE4 |sap+--+CE5|
| | | '---' '---'
| .---. .---. .---. | | .---. .---. .---. |
'-|sap|-|sap|-|sap|-' '-|sap|-|sap|-|sap|-'
'-+-' '-+-' '-+-' '-+-' '-+-' '-+-'
| | |
.-+-. | .-+-.
|CE3+---------------' |CE4|
'---' '---'
Figure 4: Network Topology with CEs and ACsPeep Appendix A for an example that echoes the topology in Figure 4 🍓.
4. Relationship to Other YANG Data Models ✨
okay so the SAP network model is basically inventory data tied to SAPs 🧾. It keeps an inventory of customer-facing nodes inside a network, and it relies on [RFC8345] for that 🫶.
Figure 5 shows how the SAP network model relates to the other models 💅. The SAP network model augments the network model defined in [RFC8345] and imports the network topology model defined in [RFC8345] 🌸. Meanwhile, other technology-specific topology models augment the network topology model defined in [RFC8345]. Examples are the model for Traffic Engineering (TE) topologies [RFC8795] and the model for Layer 3 topologies [RFC8346] 🦋.
+-------------------------+
| |
| Abstract Network Model |
| |
+------------+------------+
|
+---------+---------+
| |
+------V------+ +------V------+
| Abstract | | Inventory |
| Network | | Models |
| Topology | | (e.g., SAP |
| Model | | Network |
| | | Model) |
+-----+-------+ +-------------+
|
+-----------+-----------+
| | |
+----V----+ +----V----+ +----V----+
|TE Topo | |L3 Topo | |L2 Topo |
| Model | | Model | | Model | ...
+---------+ +---------+ +---------+
Figure 5: Relationship of SAP Network Model to Other ModelsSAPs can be seen as customer-facing termination points (TPs) with specific service provisions 💖. There's one big difference, though: links get terminated by a single TP (Section 4.4.6 of [RFC8345]), while an AC can be terminated by multiple SAPs 🌈. Also, a SAP is neither a tunnel termination point (TTP) (Section 3.6 of [RFC8795]) nor a link 🙈.
Now in the context of Software-Defined Networking (SDN) [RFC7149] [RFC7426] 🧚, the SAP YANG data model can be used to exchange information between control elements. That supports VPN service provision and resource management, as discussed in [RFC9182] and [RFC9291] ✨. Through this data model, the service orchestration layer can learn the available endpoints (i.e., SAPs) of the underlying network's interconnection resources 👑. It can also figure out which interconnection endpoints to add to an L2VPN or L3VPN service 🫶. With help from other data models, like the L3SM [RFC8299] or the L2SM [RFC8466], hierarchical control elements can assess whether end-to-end IP connectivity or L2VPN connectivity is feasible 🔥. From there, they can derive the sequence of domains and the points of interconnection to use 🎀.
Advanced interface-specific data nodes aren't included in the SAP model 😭. But the interface identifiers listed in the SAP model can be used as filters to set or get that data through device models (e.g., [RFC7224]) 💅.
5. SAP Module Tree Structure ✨
okay bestie, so the ietf-sap-ntw module builds on the ietf-network module [RFC8345] 🦋 by augmenting the nodes with SAPs 🌸
The structure of the ietf-sap-ntw module is shown in Figure 6 💅
module: ietf-sap-ntw
augment /nw:networks/nw:network/nw:network-types:
+--rw sap-network!
+--rw service-type* identityref
augment /nw:networks/nw:network/nw:node:
+--rw service* [service-type]
+--rw service-type identityref
+--rw sap* [sap-id]
+--rw sap-id string
+--rw description? string
+--rw parent-termination-point? nt:tp-id
+--rw attachment-interface? string
+--rw interface-type? identityref
+--rw encapsulation-type? identityref
+--rw role? identityref
+--rw allows-child-saps? boolean
+--rw peer-sap-id* string
+--ro sap-status
| +--ro status? identityref
| +--ro last-change? yang:date-and-time
+--rw service-status
+--rw admin-status
| +--rw status? identityref
| +--rw last-change? yang:date-and-time
+--ro oper-status
+--ro status? identityref
+--ro last-change? yang:date-and-timeFigure 6: SAP YANG Module Tree Structure
A SAP network topology can be used for one or multiple service types (service-type) 💖 Examples of supported service types are:
- L3VPN [RFC4364]
- Virtual Private LAN Service (VPLS) [RFC4761] [RFC4762]
- Virtual Private Wire Service (VPWS) [RFC8214]
- BGP MPLS-based Ethernet VPN [RFC7432]
- VPWS in Ethernet VPN [RFC8214]
- Provider Backbone Bridging combined with Ethernet VPN (PBB-EVPN) [RFC7623]
- VXLAN-based EVPN [RFC8365] ("VXLAN" stands for "Virtual eXtensible Local Area Network")
- Virtual Network [RFC8453]
- Enhanced VPN (VPN+) [ENHANCED-VPN]
- Network slice service [IETF-NETWORK-SLICES]
- SD-WAN [BGP-SDWAN-USAGE]
- Basic IP connectivity
These service types build on the types that are already defined in [RFC9181] and on additional types that are defined in this document ✨ Other service types can be defined in future YANG modules (including future revisions of the YANG module defined in this document), if needed 🧚
Leveraging the service types defined in [RFC9181] is meant to ease the correlation between the SAP topology and the corresponding network models that are used to provision a specific service over a provider's network. 🎀
Filters based on the service type can be used to access per-service SAP topology 🔥 An example is depicted in Figure 10 in Appendix B.
A node in the topology can support one or multiple service types (service-type) among those listed under the sap-network container 🌈 A list of SAPs is then bound to each service type that is supported by a given node. Each SAP is characterized as follows 👑
sap-id: Includes an identifier that uniquely identifies a SAP within a node 🫶
The same SAP may appear under distinct service types. In that case, the same identifier is used for a shared SAP for each of these service types.
SAPs that are associated with the interfaces that are directly hosting services, interfaces that are ready to host per-service sub-interfaces (but are not yet activated), or services that are already instantiated on sub-interfaces are listed as SAPs. For illustration purposes, Figure 9 in Appendix B depicts how to indicate interfaces that are capable of hosting per-service sub-interfaces.
For example, sap-id may be the VPN network access identifier defined in Section 7.6 of [RFC9182]. An example that illustrates the use of this attribute during service creation is provided in Appendix D.
description: Includes a textual description of the SAP 🍓parent-termination-point: Includes a reference to the parent termination point to which the SAP is bound 🦋 As per Section 4.2 of [RFC8345], a termination point terminates a link in a node. A termination point can be a physical port, an interface, etc.
The referenced parent termination point is expected to be a customer-facing termination point, not a core-facing termination point.
For example, this attribute is used to associate an interface with its sub-interfaces, as all these interfaces may be listed under the SAPs of a node. It is also used to link a SAP with the physical topology.
For example, this data node can be used to map the IETF Network Slice endpoints [IETF-NETWORK-SLICES] to the service/tunnel/path endpoints in the underlay network.
attachment-interface: Indicates a reference to the interface to which the SAP is bound. The same interface may host multiple services 💜
Whether the attachment identifier echoes the content of the attachment interface is deployment specific.
For example, this reference may be any of the identifiers (l2-termination-point, local-bridge-reference, bearer-reference, or lag-interface-id) defined in Section 7.6.1 of [RFC9182], or l3-termination-point as defined in Section 7.6.2 of [RFC9182]. The controller is responsible for ensuring that consistent references are used in the SAP and underlying device models or any other device inventory mechanism 🧚
interface-type: Indicates whether a SAP is bound to a physical port, a loopback interface, a Link Aggregation Group (LAG) interface [IEEE802.1AX], an Integrated Routing and Bridging (IRB) interface (e.g., [RFC9135]), a local bridge reference, etc. 🌸
The mapping to the detailed interface types as per [RFC7224] is maintained by the controller. That mapping is used, for example, when the controller translates this SAP network model into device models (Section 4.4 of [RFC8969]).
encapsulation-type: Indicates the encapsulation type for the interface indicated in theattachment-interfaceattribute. The types are taken from [RFC9181] 🫶
This data node can be used, for example, to decide whether an existing SAP can be (re)used to host a service or if a new sub-interface has to be instantiated.
role: Specifies the role of a SAP (e.g., a UNI or NNI) 👑
A SAP inherits the role of its parent interface (parent-termination-point).
allows-child-saps: When set totrue, indicates that the attachment interface for this SAP is capable of hosting per-service sub-interfaces 🔥
Whether a service can be directly attached to the parent SAP in addition to child SAPs depends on the service.
peer-sap-id: Includes references to the remote endpoints of an AC. This identifier may or may not be the same as the SAP identifier used in the peer's configuration. Note that the use of identical identifiers eases the correlation between a peer's service request and a local SAP 💖
Examples of such a reference are a site identifier (Section 6.3 of [RFC8299]), a Service Demarcation Point (SDP) identifier (Section 3.2 ("Core Terminology") of [IETF-NETWORK-SLICES]), and the IP address of a peer Autonomous System Border Router (ASBR) 🦋
sap-status: Indicates the operational status of a SAP. Values are taken from the values defined in [RFC9181] ✨
When both a sub-interface and its parent interface are present but the parent interface is disabled, the status of the parent interface takes precedence over the status indicated for the sub-interface 🌈
service-status: Indicates the administrative and operational status of the service for a given SAP 🍓 This information is particularly useful when many services are provisioned for the same SAP but only a subset of these services is activated. As such, the administrativeservice-statusMUST NOT be influenced by the value of the operationalsap-status😭
The service oper-status reflects the operational status of the service only as observed at a specific SAP, not the overall network-level status of the service connecting many SAPs. The network-level service status can be retrieved using specific network models, e.g., those listed in Section 7.3 of [RFC9182] or Section 7.3 of [RFC9291] 🧚
To assess the service delivery status for a given SAP, it is recommended to check both the administrative and operational service status (service-status) in addition to the sap-status. By doing so, a network controller (or operator) can detect anomalies 🕵️♀️ For example, if a service is administratively enabled for a SAP and the sap-status of that SAP is reported as being down, the service oper-status is also expected to be down. Retrieving a distinct service operational status under these conditions can be used as a trigger to detect an anomaly. Likewise, administrative status and operational status can be compared to detect service-specific SAP activation anomalies. For example, a service that is administratively declared as inactive for a SAP but reported as operationally active for that SAP is an indication that some service provision actions are needed to align the observed service status with the expected service status 🔥
6. SAP YANG Module ✨
okay this is the big one bestie 💅 the actual YANG module. it imports types from [RFC6991], [RFC8345], and [RFC9181], and the sap-entry and sap-list pieces are groupings so service-specific YANG modules can reuse these nodes 🧩
<CODE BEGINS> file "ietf-sap-ntw@2023-06-20.yang"
module ietf-sap-ntw {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-sap-ntw";
prefix sap;
import ietf-network-topology {
prefix nt;
reference
"RFC 8345: A YANG Data Model for Network
Topologies, Section 6.2";
}
import ietf-network {
prefix nw;
reference
"RFC 8345: A YANG Data Model for Network
Topologies, Section 6.1";
}
import ietf-vpn-common {
prefix vpn-common;
reference
"RFC 9181: A Common YANG Data Model for Layer 2 and Layer 3
VPNs";
}
import ietf-yang-types {
prefix yang;
reference
"RFC 6991: Common YANG Data Types, Section 3";
}
organization
"IETF OPSA (Operations and Management Area) Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/opsawg/>
WG List: <mailto:opsawg@ietf.org>
Editor: Mohamed Boucadair
<mailto:mohamed.boucadair@orange.com>
Author: Oscar Gonzalez de Dios
<mailto:oscar.gonzalezdedios@telefonica.com>
Author: Samier Barguil
<mailto:samier.barguil_giraldo@nokia.com>
Author: Qin Wu
<mailto:bill.wu@huawei.com>
Author: Victor Lopez
<mailto:victor.lopez@nokia.com>";
description
"This YANG module defines a model for representing, managing,
and controlling the Service Attachment Points (SAPs) in the
network topology.
Copyright (c) 2023 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Revised BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 9408; see the
RFC itself for full legal notices.";
revision 2023-06-20 {
description
"Initial version.";
reference
"RFC 9408: A YANG Network Data Model for Service Attachment
Points (SAPs)";
}
identity virtual-network {
base vpn-common:service-type;
description
"Virtual network. Refers to a logical network instance
that is built over a physical network.";
reference
"RFC 8453: Framework for Abstraction and Control of TE
Networks (ACTN)";
}
identity enhanced-vpn {
base vpn-common:service-type;
description
"Enhanced VPN (VPN+). VPN+ is an approach that is
based on existing VPN and Traffic Engineering (TE)
technologies but adds characteristics that specific
services require over and above conventional VPNs.";
reference
"draft-ietf-teas-enhanced-vpn:
A Framework for Enhanced Virtual Private Network
(VPN+)";
}
identity network-slice {
base vpn-common:service-type;
description
"IETF Network Slice. An IETF Network Slice
is a logical network topology connecting a number of
endpoints using a set of shared or dedicated network
resources that are used to satisfy specific service
objectives.";
reference
"draft-ietf-teas-ietf-network-slices:
A Framework for IETF Network Slices";
}
identity sdwan {
base vpn-common:service-type;
description
"PE-based Software-Defined Wide-Area Network (SD-WAN).";
reference
"draft-ietf-bess-bgp-sdwan-usage:
BGP Usage for SD-WAN Overlay Networks";
}
identity basic-connectivity {
base vpn-common:service-type;
description
"Basic IP connectivity. This is, for example, a plain
form of connectivity offered to enterprises over a
dedicated or shared MPLS infrastructure.";
}
identity interface-role {
description
"Base identity for the network role of an interface.";
}
identity uni {
base interface-role;
description
"User-to-Network Interface (UNI).";
}
identity nni {
base interface-role;
description
"Network-to-Network Interface (NNI).";
}
identity interface-type {
description
"Base identity for the interface type.";
}
identity phy {
base interface-type;
description
"Physical port.";
}
identity loopback {
base interface-type;
description
"Loopback interface.";
}
identity lag {
base interface-type;
description
"Link Aggregation Group (LAG) interface.";
}
identity irb {
base interface-type;
description
"Integrated Routing and Bridging (IRB) interface. An IRB
interface typically connects an IP Virtual Routing and
Forwarding (IP-VRF) entity to a bridge domain.";
}
identity local-bridge {
base interface-type;
description
"A local bridge reference to accommodate (for example)
implementations that require internal bridging.
When such a type is used, a reference to a local
bridge domain is used to identify the interface.";
}
identity logical {
base interface-type;
description
"Refers to a logical sub-interface that is typically
used to bind a service. This type is used only
if none of the other more specific types (i.e.,
'loopback', 'lag', 'irb', or 'local-bridge') can be used.";
}
grouping sap-entry {
description
"Service Attachment Point (SAP) entry information.";
leaf sap-id {
type string;
description
"Indicates an identifier that uniquely identifies
a SAP.";
}
leaf description {
type string;
description
"A textual description of the SAP.";
}
leaf parent-termination-point {
type nt:tp-id;
description
"Indicates the parent termination point to
which the SAP is attached. A termination
point can be a physical port, an interface, etc.";
}
leaf attachment-interface {
type string;
description
"Indicates the interface to which the SAP is bound.";
}
leaf interface-type {
type identityref {
base interface-type;
}
description
"The type of the interface to which the SAP is bound.";
}
leaf encapsulation-type {
type identityref {
base vpn-common:encapsulation-type;
}
description
"Encapsulation type of the interface to which the
SAP is bound.";
}
leaf role {
type identityref {
base interface-role;
}
description
"Indicates the role of a SAP.";
}
leaf allows-child-saps {
type boolean;
description
"Indicates whether the attachment interface of this
SAP is capable of hosting per-service sub-interfaces.";
}
leaf-list peer-sap-id {
type string;
description
"Indicates an identifier of the peer's termination
identifier (e.g., a Customer Edge (CE)). This
information can be used for correlation purposes,
such as identifying the SAP that is attached to
an endpoint that is provided in a service request.";
}
}
grouping sap-list {
description
"SAP information.";
list sap {
key "sap-id";
description
"The SAPs are an abstraction of the points to which
network services such as L3VPNs, L2VPNs, or network
slices can be attached.";
uses sap-entry;
container sap-status {
config false;
description
"Indicates the operational status of the SAP,
independent of any service provisioned over it.";
uses vpn-common:oper-status-timestamp;
}
container service-status {
description
"Indicates the service status.";
container admin-status {
description
"Administrative service status.";
leaf status {
type identityref {
base vpn-common:administrative-status;
}
description
"Administrative status of the service provisioned
at the SAP.";
}
leaf last-change {
type yang:date-and-time;
description
"Indicates the actual date and time of the service
status change.";
}
}
container oper-status {
config false;
description
"Operational status of the service provisioned
at the SAP.";
uses vpn-common:oper-status-timestamp;
}
}
}
}
augment "/nw:networks/nw:network/nw:network-types" {
description
"Introduces a new network type for a SAP network.";
container sap-network {
presence "Indicates the SAP network type.";
description
"The presence of the container node indicates the
SAP network type.";
leaf-list service-type {
type identityref {
base vpn-common:service-type;
}
description
"Indicates the set of supported service types.";
}
}
}
augment "/nw:networks/nw:network/nw:node" {
when '../nw:network-types/sap:sap-network' {
description
"Augmentation parameters apply only for SAP
networks.";
}
description
"SAP parameters for the node level.";
list service {
key "service-type";
description
"A list of supported service types for the node.";
leaf service-type {
type identityref {
base vpn-common:service-type;
}
description
"Indicates a service type.";
}
uses sap-list;
}
}
}
<CODE ENDS>7. IANA Considerations ✨
okay so IANA gets two new registrations from this doc 🎀
first up, the namespace URI goes into the "ns" subregistry inside the "IETF XML Registry" [RFC3688]. the registrant is the IESG, and since it's an XML namespace, the XML column is just N/A:
URI: urn:ietf:params:xml:ns:yang:ietf-sap-ntw
Registrant Contact: The IESG.
XML: N/A; the requested URI is an XML namespace.second, the YANG module gets listed in the "YANG Module Names" subregistry [RFC6020] inside the "YANG Parameters" registry 🦋 here's the entry:
Name: ietf-sap-ntw
Namespace: urn:ietf:params:xml:ns:yang:ietf-sap-ntw
Maintained by IANA? N
Prefix: sap
Reference: RFC 9408that's the whole IANA situation, no extra drama 🌸
8. Security Considerations 🔐
okay bestie, this section is serious business, so let's get into it 💅. The YANG module in this doc is a schema for data that's meant to be reached through network management protocols like NETCONF [RFC6241] or RESTCONF [RFC8040]. NETCONF's bottom layer is the secure transport layer, and the one every implementation has to support is Secure Shell (SSH) [RFC6242]. RESTCONF sits on top of HTTPS, and its mandatory-to-implement secure transport is TLS [RFC8446]. So the locked-down-transport energy is strong here 🔒✨.
The Network Configuration Access Control Model (NACM) [RFC8341] is the bouncer 🚪. It lets you restrict particular NETCONF or RESTCONF users to a preconfigured subset of all the available protocol operations and content. Main character access control, iykyk 👑.
Now the spicy part 🌶️. A bunch of the data nodes in this module are writable, creatable, and deletable (that's config true, which is the default). Those nodes might be sensitive or vulnerable depending on the network, so writes to them (like edit-config) without proper protection can mess with network operations. Not cute 💀. Here's the subtree and why it matters:
/nw:networks/nw:network/nw:node/sap:service/sap:sap: This subtree holds the configuration of the nodes in a SAP network model. If it changes unexpectedly (say, a SAP gets associated with a different parent termination point), you could get service disruption and/or network misbehavior. That misbehavior mostly comes from a config that doesn't match what the operator intended (see Section 4.2.1 of [RFC8969]). Lowkey a whole mess 😭.
Some of the readable data nodes are also potentially sensitive or vulnerable, so controlling read access is important too. That means get, get-config, and notifications all need guarding 🫶. Here's the subtree:
/nw:networks/nw:network/nw:node/sap:service/sap:sap: If unauthorized folks can read this, they can learn the operational state of the nodes in a SAP network model. For example, they could figure out the identity of a customer viapeer-sap-id. That's a privacy nightmare, periodt 🙈.
9. References 📚
9. References
9.1. Normative References
- [RFC2119]: Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI
10.17487/RFC2119, March 1997,https://www.rfc-editor.org/info/rfc2119. 🎀 - [RFC3688]: Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI
10.17487/RFC3688, January 2004,https://www.rfc-editor.org/info/rfc3688. 🌸 - [RFC6020]: Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI
10.17487/RFC6020, October 2010,https://www.rfc-editor.org/info/rfc6020. 🦋 - [RFC6241]: Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI
10.17487/RFC6241, June 2011,https://www.rfc-editor.org/info/rfc6241. 💜 - [RFC6242]: Wasserman, M., "Using the NETCONF Protocol over Secure Shell (SSH)", RFC 6242, DOI
10.17487/RFC6242, June 2011,https://www.rfc-editor.org/info/rfc6242. 🔐 - [RFC6991]: Schoenwaelder, J., Ed., "Common YANG Data Types", RFC 6991, DOI
10.17487/RFC6991, July 2013,https://www.rfc-editor.org/info/rfc6991. ✨ - [RFC7950]: Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI
10.17487/RFC7950, August 2016,https://www.rfc-editor.org/info/rfc7950. 🧚 - [RFC8040]: Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI
10.17487/RFC8040, January 2017,https://www.rfc-editor.org/info/rfc8040. 🍓 - [RFC8174]: Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI
10.17487/RFC8174, May 2017,https://www.rfc-editor.org/info/rfc8174. 🌈 - [RFC8341]: Bierman, A. and M. Bjorklund, "Network Configuration Access Control Model", STD 91, RFC 8341, DOI
10.17487/RFC8341, March 2018,https://www.rfc-editor.org/info/rfc8341. 👑 - [RFC8345]: Clemm, A., Medved, J., Varga, R., Bahadur, N., Ananthakrishnan, H., and X. Liu, "A YANG Data Model for Network Topologies", RFC 8345, DOI
10.17487/RFC8345, March 2018,https://www.rfc-editor.org/info/rfc8345. 🌸 - [RFC8346]: Clemm, A., Medved, J., Varga, R., Liu, X., Ananthakrishnan, H., and N. Bahadur, "A YANG Data Model for Layer 3 Topologies", RFC 8346, DOI
10.17487/RFC8346, March 2018,https://www.rfc-editor.org/info/rfc8346. 🦋 - [RFC8446]: Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI
10.17487/RFC8446, August 2018,https://www.rfc-editor.org/info/rfc8446. 🔒 - [RFC8795]: Liu, X., Bryskin, I., Beeram, V., Saad, T., Shah, H., and O. Gonzalez de Dios, "YANG Data Model for Traffic Engineering (TE) Topologies", RFC 8795, DOI
10.17487/RFC8795, August 2020,https://www.rfc-editor.org/info/rfc8795. 💅 - [RFC9181]: Barguil, S., Gonzalez de Dios, O., Ed., Boucadair, M., Ed., and Q. Wu, "A Common YANG Data Model for Layer 2 and Layer 3 VPNs", RFC 9181, DOI
10.17487/RFC9181, February 2022,https://www.rfc-editor.org/info/rfc9181. 🫶
9.2. Informative References ✨
okay bestie, this is the informative pile 📚 these are the "good to know" refs, so they're not required reading to implement, but they explain the background. every entry is copied exactly as written 💅
[BGP-SDWAN-USAGE]
Dunbar, L., Guichard, J., Sajassi, A., Drake, J., Najem,
B., Banerjee, A., and D. Carrel, "BGP Usage for SD-WAN
Overlay Networks", Work in Progress, Internet-Draft,
draft-ietf-bess-bgp-sdwan-usage-09, 7 April 2023,
<https://datatracker.ietf.org/doc/html/draft-ietf-bess-
bgp-sdwan-usage-09>.
[ENHANCED-VPN]
Dong, J., Bryant, S., Li, Z., Miyasaka, T., and Y. Lee, "A
Framework for Enhanced Virtual Private Network (VPN+)",
Work in Progress, Internet-Draft, draft-ietf-teas-
enhanced-vpn-12, 23 January 2023,
<https://datatracker.ietf.org/doc/html/draft-ietf-teas-
enhanced-vpn-12>.
[IEEE802.1AX]
IEEE, "IEEE Standard for Local and Metropolitan Area
Networks--Link Aggregation", IEEE Std 802.1AX-2020,
DOI 10.1109/IEEESTD.2020.9105034, 2020,
<https://doi.org/10.1109/IEEESTD.2020.9105034>.
[IETF-NETWORK-SLICES]
Farrel, A., Ed., Drake, J., Ed., Rokui, R., Homma, S.,
Makhijani, K., Contreras, L.M., and J. Tantsura, "A
Framework for IETF Network Slices", Work in Progress,
Internet-Draft, draft-ietf-teas-ietf-network-slices-19, 21
January 2023, <https://datatracker.ietf.org/doc/html/
draft-ietf-teas-ietf-network-slices-19>.
[MEF17] The Metro Ethernet Forum, "Technical Specification MEF 17,
Service OAM Requirements & Framework - Phase 1", April
2007, <https://www.mef.net/wp-content/uploads/2015/04/MEF-
17.pdf>.
[MEF6] The Metro Ethernet Forum, "Technical Specification MEF 6,
Ethernet Services Definitions - Phase I", June 2004,
<https://www.mef.net/Assets/Technical_Specifications/PDF/
MEF_6.pdf>.
[RFC4026] Andersson, L. and T. Madsen, "Provider Provisioned Virtual
Private Network (VPN) Terminology", RFC 4026,
DOI 10.17487/RFC4026, March 2005,
<https://www.rfc-editor.org/info/rfc4026>.
[RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private
Networks (VPNs)", RFC 4364, DOI 10.17487/RFC4364, February
2006, <https://www.rfc-editor.org/info/rfc4364>.
[RFC4761] Kompella, K., Ed. and Y. Rekhter, Ed., "Virtual Private
LAN Service (VPLS) Using BGP for Auto-Discovery and
Signaling", RFC 4761, DOI 10.17487/RFC4761, January 2007,
<https://www.rfc-editor.org/info/rfc4761>.
[RFC4762] Lasserre, M., Ed. and V. Kompella, Ed., "Virtual Private
LAN Service (VPLS) Using Label Distribution Protocol (LDP)
Signaling", RFC 4762, DOI 10.17487/RFC4762, January 2007,
<https://www.rfc-editor.org/info/rfc4762>.
[RFC6004] Berger, L. and D. Fedyk, "Generalized MPLS (GMPLS) Support
for Metro Ethernet Forum and G.8011 Ethernet Service
Switching", RFC 6004, DOI 10.17487/RFC6004, October 2010,
<https://www.rfc-editor.org/info/rfc6004>.
[RFC6215] Bocci, M., Levrau, L., and D. Frost, "MPLS Transport
Profile User-to-Network and Network-to-Network
Interfaces", RFC 6215, DOI 10.17487/RFC6215, April 2011,
<https://www.rfc-editor.org/info/rfc6215>.
[RFC7149] Boucadair, M. and C. Jacquenet, "Software-Defined
Networking: A Perspective from within a Service Provider
Environment", RFC 7149, DOI 10.17487/RFC7149, March 2014,
<https://www.rfc-editor.org/info/rfc7149>.
[RFC7224] Bjorklund, M., "IANA Interface Type YANG Module",
RFC 7224, DOI 10.17487/RFC7224, May 2014,
<https://www.rfc-editor.org/info/rfc7224>.
[RFC7426] Haleplidis, E., Ed., Pentikousis, K., Ed., Denazis, S.,
Hadi Salim, J., Meyer, D., and O. Koufopavlou, "Software-
Defined Networking (SDN): Layers and Architecture
Terminology", RFC 7426, DOI 10.17487/RFC7426, January
2015, <https://www.rfc-editor.org/info/rfc7426>.
[RFC7432] Sajassi, A., Ed., Aggarwal, R., Bitar, N., Isaac, A.,
Uttaro, J., Drake, J., and W. Henderickx, "BGP MPLS-Based
Ethernet VPN", RFC 7432, DOI 10.17487/RFC7432, February
2015, <https://www.rfc-editor.org/info/rfc7432>.
[RFC7623] Sajassi, A., Ed., Salam, S., Bitar, N., Isaac, A., and W.
Henderickx, "Provider Backbone Bridging Combined with
Ethernet VPN (PBB-EVPN)", RFC 7623, DOI 10.17487/RFC7623,
September 2015, <https://www.rfc-editor.org/info/rfc7623>.
[RFC7951] Lhotka, L., "JSON Encoding of Data Modeled with YANG",
RFC 7951, DOI 10.17487/RFC7951, August 2016,
<https://www.rfc-editor.org/info/rfc7951>.
[RFC8214] Boutros, S., Sajassi, A., Salam, S., Drake, J., and J.
Rabadan, "Virtual Private Wire Service Support in Ethernet
VPN", RFC 8214, DOI 10.17487/RFC8214, August 2017,
<https://www.rfc-editor.org/info/rfc8214>.
[RFC8299] Wu, Q., Ed., Litkowski, S., Tomotaki, L., and K. Ogaki,
"YANG Data Model for L3VPN Service Delivery", RFC 8299,
DOI 10.17487/RFC8299, January 2018,
<https://www.rfc-editor.org/info/rfc8299>.
[RFC8309] Wu, Q., Liu, W., and A. Farrel, "Service Models
Explained", RFC 8309, DOI 10.17487/RFC8309, January 2018,
<https://www.rfc-editor.org/info/rfc8309>.
[RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
<https://www.rfc-editor.org/info/rfc8340>.
[RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,
and R. Wilton, "Network Management Datastore Architecture
(NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018,
<https://www.rfc-editor.org/info/rfc8342>.
[RFC8365] Sajassi, A., Ed., Drake, J., Ed., Bitar, N., Shekhar, R.,
Uttaro, J., and W. Henderickx, "A Network Virtualization
Overlay Solution Using Ethernet VPN (EVPN)", RFC 8365,
DOI 10.17487/RFC8365, March 2018,
<https://www.rfc-editor.org/info/rfc8365>.
[RFC8453] Ceccarelli, D., Ed. and Y. Lee, Ed., "Framework for
Abstraction and Control of TE Networks (ACTN)", RFC 8453,
DOI 10.17487/RFC8453, August 2018,
<https://www.rfc-editor.org/info/rfc8453>.
[RFC8466] Wen, B., Fioccola, G., Ed., Xie, C., and L. Jalil, "A YANG
Data Model for Layer 2 Virtual Private Network (L2VPN)
Service Delivery", RFC 8466, DOI 10.17487/RFC8466, October
2018, <https://www.rfc-editor.org/info/rfc8466>.
[RFC8969] Wu, Q., Ed., Boucadair, M., Ed., Lopez, D., Xie, C., and
L. Geng, "A Framework for Automating Service and Network
Management with YANG", RFC 8969, DOI 10.17487/RFC8969,
January 2021, <https://www.rfc-editor.org/info/rfc8969>.
[RFC9135] Sajassi, A., Salam, S., Thoria, S., Drake, J., and J.
Rabadan, "Integrated Routing and Bridging in Ethernet VPN
(EVPN)", RFC 9135, DOI 10.17487/RFC9135, October 2021,
<https://www.rfc-editor.org/info/rfc9135>.
[RFC9182] Barguil, S., Gonzalez de Dios, O., Ed., Boucadair, M.,
Ed., Munoz, L., and A. Aguado, "A YANG Network Data Model
for Layer 3 VPNs", RFC 9182, DOI 10.17487/RFC9182,
February 2022, <https://www.rfc-editor.org/info/rfc9182>.
[RFC9291] Boucadair, M., Ed., Gonzalez de Dios, O., Ed., Barguil,
S., and L. Munoz, "A YANG Network Data Model for Layer 2
VPNs", RFC 9291, DOI 10.17487/RFC9291, September 2022,
<https://www.rfc-editor.org/info/rfc9291>.Appendix A. A Simplified SAP Network Example ✨
okay so this one's a little example of a SAP topology that a network controller reports 🦋 it literally echoes the topology from Figure 4, so if you remember that one, you're already halfway there 💅 the vibe is minimal, though. Only a minimum information set is shown for each SAP, so 'parent-termination-point', 'attachment-interface', 'interface-type', 'encapsulation-type', and 'role' are NOT in the example 🙈 (no cap, they're just left out for brevity).
SAPs that can host a service but aren't activated yet are marked with 'sap-status/status' set to 'ietf-vpn-common:op-down' and 'service-status/admin-status/status' set to 'ietf-vpn-common:admin-down' 💤. SAPs that are enabled to deliver a service are marked with 'service-status/admin-status/status' set to 'ietf-vpn-common:admin-up' and 'service-status/oper-status/status' set to 'ietf-vpn-common:op-up' 🌈 so you can spot the working ones instantly.
Quick heads-up: none of the anomalies discussed in Section 5 get detected for these SAPs 👑 so this example is the clean, everything-is-fine version, bestie.
The message body in the figure below is encoded following the JSON encoding of YANG-modeled data as per [RFC7951] 🧚 ✨
{
"ietf-network:networks": {
"network": [
{
"network-types": {
"ietf-sap-ntw:sap-network": {
"service-type": [
"ietf-vpn-common:l3vpn",
"ietf-vpn-common:vpls"
]
}
},
"network-id": "example:an-id",
"node": [
{
"node-id": "example:pe1",
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#11",
"peer-sap-id": ["ce-1"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
},
{
"sap-id": "sap#12",
"sap-status": {
"status": "ietf-vpn-common:op-down"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-down"
}
}
},
{
"sap-id": "sap#13",
"sap-status": {
"status": "ietf-vpn-common:op-down"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-down"
}
}
},
{
"sap-id": "sap#14",
"sap-status": {
"status": "ietf-vpn-common:op-down"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-down"
}
}
}
]
}
]
},
{
"node-id": "example:pe2",
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#21",
"sap-status": {
"status": "ietf-vpn-common:op-down"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-down"
}
}
},
{
"sap-id": "sap#22",
"peer-sap-id": ["ce-2"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
}
]
},
{
"node-id": "example:pe3",
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#31",
"sap-status": {
"status": "ietf-vpn-common:op-down"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-down"
}
}
},
{
"sap-id": "sap#32",
"sap-status": {
"status": "ietf-vpn-common:op-down"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-down"
}
}
},
{
"sap-id": "sap#33",
"peer-sap-id": ["ce-3"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
}
]
},
{
"node-id": "example:pe4",
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#41",
"peer-sap-id": ["ce-3"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
},
{
"sap-id": "sap#42",
"peer-sap-id": ["ce-4"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
},
{
"sap-id": "sap#43",
"sap-status": {
"status": "ietf-vpn-common:op-down"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-down"
}
}
},
{
"sap-id": "sap#44",
"peer-sap-id": ["ce-5"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
}
]
}
]
}
]
}
}Figure 7: A Simplified SAP Network Example 🎀
Appendix B. A Simple Example of the SAP Network Model: Node Filter 🎀
Okay so, in the example from Figure 8, PE1 (with a node-id of example:pe1, like we saw in Figure 7) has two physical interfaces, GE0/6/1 and GE0/6/4. Two sub-interfaces, GE0/6/4.1 and GE0/6/4.2, hang off the physical interface GE0/6/4. Let's say four SAPs are exposed to the service orchestrator and mapped onto these physical interfaces and sub-interfaces. 💖
.-------------------------.
| GE0/6/4 |
| PE1 .----+----.
| |sap#2 |GE0/6/4.1
| | .--+--.
| | |sap#3|
| | '--+--'
| | |GE0/6/4.2
| | .--+--.
| | |sap#4|
| | '--+--'
| | |
| +----+----+
| |
| GE0/6/1|
| .----+----.
| |sap#1 |
| '----+----'
| |
'-------------------------'Figure 8: An Example of a PE and Its Physical/Logical Interfaces
So, no service is turned on yet for the SAP on the physical interface GE0/6/1. ✨ For the SAPs on the physical interface GE0/6/4, though, VPLS and L3VPN services are activated on the sub-interfaces GE0/6/4.1 and GE0/6/4.2, respectively. 🦋 Both sap#1 and sap#2 are tagged as able to host per-service sub-interfaces (allows-child-saps is set to true). It's giving organized, I'm obsessed 😭
Now, a service orchestrator can ask the network controller which services are provided on which SAPs of PE1 by sending a RESTCONF GET request. 🧚 Figure 9 shows what the body of that RESTCONF response looks like.
{
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#1",
"description": "Ready to host SAPs",
"attachment-interface": "GE0/6/1",
"interface-type": "ietf-sap-ntw:phy",
"role": "ietf-sap-ntw:uni",
"allows-child-saps": true,
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#2",
"description": "Ready to host SAPs",
"attachment-interface": "GE0/6/4",
"interface-type": "ietf-sap-ntw:phy",
"role": "ietf-sap-ntw:uni",
"allows-child-saps": true,
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#3",
"description": "A first SAP description",
"parent-termination-point": "GE0/6/4",
"attachment-interface": "GE0/6/4.1",
"interface-type": "ietf-sap-ntw:logical",
"encapsulation-type": "ietf-vpn-common:vlan-type",
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
},
{
"service-type": "ietf-vpn-common:vpls",
"sap": [
{
"sap-id": "sap#1",
"description": "Ready to host SAPs",
"attachment-interface": "GE0/6/1",
"interface-type": "ietf-sap-ntw:phy",
"role": "ietf-sap-ntw:uni",
"allows-child-saps": true,
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#2",
"description": "Ready to host SAPs",
"attachment-interface": "GE0/6/4",
"interface-type": "ietf-sap-ntw:phy",
"role": "ietf-sap-ntw:uni",
"allows-child-saps": true,
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#4",
"description": "Another description",
"parent-termination-point": "GE0/6/4",
"attachment-interface": "GE0/6/4.2",
"interface-type": "ietf-sap-ntw:logical",
"encapsulation-type": "ietf-vpn-common:vlan-type",
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
}
]
}Figure 9: An Example of a Response Body to a Request with a Node Filter
Figure 10 shows the response message body the network controller sends back when the request includes a filter on the service type for a particular node. 🌸 Serving filtered realness!
{
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#1",
"description": "Ready to host SAPs",
"attachment-interface": "GE0/6/1",
"interface-type": "ietf-sap-ntw:phy",
"role": "ietf-sap-ntw:uni",
"allows-child-saps": true,
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#2",
"description": "Ready to host SAPs",
"attachment-interface": "GE0/6/4",
"interface-type": "ietf-sap-ntw:phy",
"role": "ietf-sap-ntw:uni",
"allows-child-saps": true,
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#3",
"description": "A first SAP description",
"parent-termination-point": "GE0/6/4",
"attachment-interface": "GE0/6/4.1",
"interface-type": "ietf-sap-ntw:logical",
"encapsulation-type": "ietf-vpn-common:vlan-type",
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
}
]
}Figure 10: An Example of a Response Body to a Request with a Service Filter
Appendix C. An Example of an NNI SAP: Inter-AS VPN Option A ✨
Okay bestie, this is where we get to see the SAP model doing real inter-AS work 🌐💖. Section 10 of [RFC4364] goes through a bunch of ways to stretch a VPN service past a single Autonomous System (AS) 🦋. For illustration purposes, this appendix zooms in on the so-called "Option A" 👑, but similar examples could be built for the other options too.
In this option, an AS Border Router (ASBR) in one AS is directly connected to an ASBR in a neighboring AS 🫶. These two ASBRs are linked by multiple physical or logical interfaces 🔗. At least one sub-interface is kept on these ASBRs for each VPN whose routes need to get passed from one AS to the other 💅. And each ASBR acts like a PE, treating the other one as if it were a CE 🎀. Main character energy in the border zone, ngl 😭.
Figure 11 shows a simplified (excerpt) topology of two ASes, A and B, with the spotlight on the interconnection links between them ✨.
.--------------------. .--------------------.
| | | |
| A .--+--. .--+--. A |
| S | +================+ | S |
| B | (VRF1)----(VPN1)----(VRF1) | B |
| R | | | | R |
| | (VRF2)----(VPN2)----(VRF2) | |
| a | +================+ | b |
| 1 '--+--' '--+--' 1 |
| AS A | | AS B |
| A .--+--. .--+--. A |
| S | +================+ | S |
| B | (VRF1)----(VPN1)----(VRF1) | B |
| R | | | | R |
| | (VRF2)----(VPN2)----(VRF2) | |
| a | +================+ | b |
| 2 '--+--' '--+--' 2 |
| | | |
'--------------------' '--------------------'
Figure 11: An Example of an Inter-AS VPN (Option A)Figure 12 shows an example of a message body received from the network controller of AS A 🧚. It focuses on the NNIs drawn in Figure 11, so you can see exactly how those interconnects look when they're served up as SAPs 🍓.
{
"ietf-network:networks": {
"network": [
{
"network-types": {
"ietf-sap-ntw:sap-network": {
"service-type": [
"ietf-vpn-common:l3vpn"
]
}
},
"network-id": "example:an-id",
"node": [
{
"node-id": "example:asbr-a1",
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#11",
"description": "parent inter-as link#1",
"role": "ietf-sap-ntw:nni",
"allows-child-saps": true,
"peer-sap-id": ["asbr-b1"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#12",
"description": "parent inter-as link#2",
"role": "ietf-sap-ntw:nni",
"allows-child-saps": true,
"peer-sap-id": ["asbr-b1"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#13",
"description": "vpn1",
"role": "ietf-sap-ntw:nni",
"peer-sap-id": ["asbr-b1"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
},
{
"sap-id": "sap#14",
"description": "vpn2",
"role": "ietf-sap-ntw:nni",
"peer-sap-id": ["asbr-b1"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
}
]
},
{
"node-id": "example:asbr-a2",
"ietf-sap-ntw:service": [
{
"service-type": "ietf-vpn-common:l3vpn",
"sap": [
{
"sap-id": "sap#11",
"description": "parent inter-as link#1",
"role": "ietf-sap-ntw:nni",
"allows-child-saps": true,
"peer-sap-id": ["asbr-b2"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#12",
"description": "parent inter-as link#2",
"role": "ietf-sap-ntw:nni",
"allows-child-saps": true,
"peer-sap-id": ["asbr-b2"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
}
},
{
"sap-id": "sap#21",
"description": "vpn1",
"role": "ietf-sap-ntw:nni",
"peer-sap-id": ["asbr-b2"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
},
{
"sap-id": "sap#22",
"description": "vpn2",
"role": "ietf-sap-ntw:nni",
"peer-sap-id": ["asbr-b2"],
"sap-status": {
"status": "ietf-vpn-common:op-up"
},
"service-status": {
"admin-status": {
"status": "ietf-vpn-common:admin-up"
},
"oper-status": {
"status": "ietf-vpn-common:op-up"
}
}
}
]
}
]
}
]
}
]
}
}
Figure 12: An Example of SAP Usage for an NNIAppendix D. Examples of Using the SAP Network Model in Service Creation 🎀
This appendix walks through examples showing how the SAP model gets used for service creation 💅✨.
An example of a SAP topology is presented in Figure 7 🌸. It includes four PEs with their SAPs, along with the customer information 🧚.
Let's say an operator wants to create an L3VPN service between two PEs (PE3 and PE4) that are serving two CEs (CE6 and CE7) 🦋. To do that, the operator queries the SAP topology and gets back a response similar to what's depicted in Figure 7 👀. That response shows that the SAPs with "sap#31" and "sap#43" as attachment identifiers don't have any installed services 🫶. This is particularly inferred from (1) the administrative 'service-status' set to 'ietf-vpn-common:admin-down' for all the services supported by these two SAPs, and (2) the absence of the anomalies discussed in Section 5 💜. Note that none of the anomalies discussed in Section 5 are detected 🙈. Once the "free" SAPs are identified, the 'interface-type' and 'encapsulation-type' are checked to see whether the requested L3VPN service is compatible with the SAP characteristics 🔍. If they're compatible, the 'attachment-id' value can be used as the VPN network access identifier in an L3NM "create" query 🔥.
A similar process can be followed for creating the so-called "Inter-AS VPN Option A" services 🌈. Unlike the previous example, let's say an operator wants to create an L3VPN service between two PEs (PE3 and PE4), but these PEs are not in the same AS: PE3 belongs to AS A while PE4 belongs to AS B 🍓. The NNIs between these ASes are represented in Figure 11 🌐. The operator of AS A queries the SAP topology through the controller of its AS, and gets not only the information depicted in Figure 7, but also the information shown in Figure 12 representing the NNIs 💖. The operator then creates the service in AS A between PE3 and a free, compatible SAP in ASBR A1 ✨. The same procedure is followed by the operator of AS B to create the service in AS B between a free, compatible SAP in ASBR B1 and PE4 👑. The services can be provisioned in each of these ASes using the L3NM 💅.
Now let's say that, instead of the L3VPN service, the operator wants to set up an L2VPN service 🦋. If the 'interface-type' is a physical port, a new logical SAP can be created using the SAP model to cope with the service's needs (e.g., the 'encapsulation-type' attribute can be set to 'ietf-vpn-common:vlan-type') 🧚. Once the logical SAP is created, the 'attachment-id' of the new SAP is used to create an L2NM instance (Section 7.6 of [RFC9291]) 🎀.
Acknowledgements ✨
Thanks to Adrian Farrel, Daniel King, Dhruv Dhody, Benoit Claise, Bo Wu, Erez Segev, Raul Arco, Joe Clarke, Riyas Valiyapalathingal, Tom Petch, Olga Havel, and Richard Roberts for their comments 🫶💖.
Thanks to Martin Björklund for the YANG Doctors review, Menachem Dodge for the opsdir review, Mach Chen for the rtgdir review, Linda Dunbar for the genart review, and Ivaylo Petrov for the secdir review 🌸.
Special thanks to Adrian Farrel for the Shepherd review and Rob Wilton for the careful AD review 👑.
Thanks to Lars Eggert, Roman Danyliw, and Zaheduzzaman Sarker for their comments during the IESG review 🌈.
Authors' Addresses 💜
Mohamed Boucadair (editor)
Orange
France
Email: mohamed.boucadair@orange.comOscar Gonzalez de Dios
Telefonica
Madrid
Spain
Email: oscar.gonzalezdedios@telefonica.comSamier Barguil
Nokia
Madrid
Spain
Email: samier.barguil_giraldo@nokia.comQin Wu
Huawei
Yuhua District
101 Software Avenue
Nanjing
Jiangsu, 210012
China
Email: bill.wu@huawei.comVictor Lopez
Nokia
Spain
Email: victor.lopez@nokia.com📦 where this page comes from
- ietf: rfc9408 2023-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms