Service Chain Use Cases

Security Micro-Segmentation

Environment: Datacenter/Enterprise/Private/Public Cloud
Problem Statement: A large number of successful attacks are enabled not by a direct attack on a system containing sensitive information but rather start at a weak point in the organization and then the attackers move laterally through the organization (east-west) to reach the sensitive system(s). To detect and prevent this type of attack it is necessary to apply a zero trust policy through-out the organization. This requires inserting security between most applications to restrict access and detect anomalous behavior.
Solution Requirements: Ability to seamlessly insert security virtual network functions into the traffic flow. As workloads are dynamically changing the solution must be able to be inserted and removed in an arbitrary order, with applications as they are deployed and removed.
Performance Requirements: <=10G
VNFs Used: L7-Firewall, L7-IPS, L7-IDS
Flow Classification Required:For security it is typical to inspect all traffic so the classification is simply the host port that is to be protected.
Primary Flow Direction: BI-Directional
References: 1,3

vCPE [Mini Private Cloud]

Environment: Enterprise/Customer Edge
User Problem Statement: Service providers are replacing dedicated hardware (routers, wireless gateways, firewalls) with VNF running on standard x86 hardware. The virtual CPE is a small cloud of VNF that can be re-configured by the service provider to deliver updated or new services without the need for on site visits which are very expensive.
Solution Requirements: Ability to service chain a collection of VNFs, automatic updates, automated scaling and deployment of new VNFs
Performance Requirements: < 1G
VNFs Used: L7-Firewall, L7-IPS, L7-IDS, Router, WAN Optimizer, IPSec Gateway
Flow Classification Required:This is a gateway use case so all traffic should go through the security VNF, however if there are function specific VNFs in the vCPE some additional flow classification could be required.
Primary Flow Direction: Bi-Directional
References: 10,11

vPE [Large Private Cloud]

Environment:Private Cloud/Service ProviderEdge
User Problem Statement: Service providers are replacing dedicated hardware (routers, wireless gateways, firewalls) with VNF running on standard x86 hardware. The virtual PE is a large cloud of VNFs that can be re-configured by the service provider to deliver updated or new services from their data centers. The footprint on the customer premises is significantly reduced. The challenges for the service provider is providing the scale, flexibility, with a high SLA.
Solution Requirements: Ability to service chain a collection of VNFs, automatic updates and automated scaling. Large scale hosting of multi-tenant service.
Performance Requirements: <1G per link, aggregate may go to 100G.
VNFs Used: L7-Firewall, L7-IPS, L7-IDS, WAN Optimizer, CGNAT, IPSec Gateway, LI
Flow Classification Required: Depending on the services offered there can be a set of chains that are minimal classification leading into function specific VNF chains.
Flow Direction: Bi-Directional for ingress/egress.
References: 12

VNF as a Service [Public or Private Cloud Service]

Environment: Cloud private and public
Problem Statement: Cloud providers want to offer specific VNF’s as a service. To optimize use of VNF’s they are clustered together on a set of racks that are provisions and managed by the cloud provider. They are allocated on demand to customers and traffic is steered through the VNFs according to customer needs.
Solution Requirements: Very flexible traffic steering for multiple tenants, ability to scale VNF or load balance VNFs.
Performance Requirements: <=10 G
VNFs Used: L7-Firewall, L7-IPS, L7-IDS, Load Balancer, Video Optimizer
Flow Classification Required:Depending on the VNF provided there can be a variety of classification. Security services will be very coarse grained classification, while a video service will be defined by at minimum port based classification.
Primary Flow Direction: Bi-Directional
References: 4

Security VNF Gateway

Environment: Datacenter/Enterprise/Private and Public Cloud
Problem Statement: When a new “cloud” network is created it is necessary to deploy security to protect the network. The security may be a VPN termination and a firewall. As the “cloud” scales then a load balancer needs to be deployed. As the application hosted in the cloud is built out it needs to be secured and scaled. In classic three tier architectures have a security device as a gateway between tiers as a standard practice. When a tier is deployed a security VNF must be deployed with the tier to inspect and traffic entering and leaving the tier, as the load increases the security service needs to be scaled, typically through a load-balacner. The tier segmentation can either be L2 or L3.
Solution Requirements: Capable of scaling with system load
Performance Requirements: < 1G per link aggregate >10G
VNFs Used: L7 Firewall, L7 IPS, L7 IDS, Load Balancer, VNF
Flow Classification Required: Typically coarse grained, inspect all traffic.
Primary Flow Direction: Bi-Directional
References: 6

Traffic Enhancement Service Chain

Environment: Evolved Packet Core/Cloud [Public or Private]
Problem Statement:In classic three tier architectures have a security device as a gateway between tiers is a standard practice. As these workloads are being moved to private and public clouds running on virtualized infrastructure there is a need to enable a virtual solution. When a tier is deployed a security VNF must be deployed with the tier to inspect and traffic entering and leaving the tier. The tier segmentation can either be L2 or L3
Solution Requirements: Capable of scaling with system load
Performance Requirements: <=10G per link , depending on deployments aggregate can reach 100G
VNFs Used: L7-IPS, L7-Firewall, Video-Optimizer, CGNAT,
Flow Classification Required:Could be very varied and flexible.
Primary Flow Direction: Uni-Directional
References: 2

Potential VNFs

Monitoring VNFs

Monitoring
L7 IDS
Billing and Charging Functions

In-Line VNFs

L7 Firewall
L7 IPS
Load Balancer
CGNAT (Carrier Grade NAT)
Video Optimizer
Deep Packet Inspection
LI (Lawful Intercept)
IPSEC Gateway
WAN Optimizer
Session Border Controller
Router
HTTP Insertion

SFC Encapsulation / SFC Graphs

Use case status: not yet supported.

SFC Encapsulation is an architectural principle of Service Function Chaining, as described in the respective published RFCs so far [5, 13]. The concept decouples the forwarding plane from the service plane and, besides being able to carry metadata, enables truly dynamic service chains by having them being composed of multiple SFPs (Service Function Paths) that can selected throughout the chain based on classification criteria (instead of pre-selected based on classification criteria, somewhat like pre-defining an RSP [Rendered Service Path]). The only approved, but not yet released, SFC Encapsulation protocol is NSH [14].

The networking-sfc team has stated its intent to support NSH, consequently embracing SFC Encapsulation. To fully leverage this concept, however, a few changes more changes to the project are necessary. The following links contain discussion and information relevant to understand and achieve this use case (or use case enabler): [15, 16].

If the networking-sfc team is welcoming of this proposal, a Proof of Concept based on networking-sfc will be developed to show this feature, based on the latest OVS NSH patches: [17].

A few examples of more concrete use cases that can be achieved with SFC Encapsulation and SFC Graphs:

Encrypted Tunnel Termination, when we don't yet know what is classification of the encrypted traffic but will need to branch depending on that classification (when known).
Video Optimization chain with L7 classifications detected by a DPI classifier, where we will need to branch depending on whether video traffic is detected (but not by an initial classifier) - IETF SFC Mobility use case presented in [18].

More information regarding this use case(s) can be obtained by watching the respective presentation at the OpenStack Summit Barcelona: Empower your NFV Services through Service Function Chaining and SFC Graphs.

Assignee: Igor Duarte Cardoso.