Sue, Thank you very much for the valuable review. Please see below for the resolutions to your comments.
Linda -----Original Message----- From: Susan Hares via Datatracker <[email protected]> Sent: Monday, April 10, 2023 4:20 PM To: [email protected] Cc: [email protected]; [email protected] Subject: Opsdir early review of draft-ietf-rtgwg-net2cloud-problem-statement-22 Reviewer: Susan Hares Review result: Has Issues I have read this document, sec-dir early review, rtg-dir, and tsv-dir early review. I am not a Cloud or Inter-Cloud expert. I am familiar with BGP and MPLS technology. I have marked this has issues just as the rtg-dir review (Ines Robles) has marked this "has issues" due to missing references. These reviews deal with editorial issues and not substantial technical issues. Technical issues: 1) I think the security issues listed in section 7 should include a reference to section 5 on the scaling. 2) Security issues in section 3 seem to be limited to 3.5 3) operational issues are covered in the remainder of section 3.0 [Linda] changed the reference to 3.5 and 5.1. Editorial issues: The textual issues that the rtg-dir (Ines Robles_ mentioned seem to be mostly editorial issues. My unique editorial comments [hares-comments] are included with the comments from rtg-dir I agree withy: [rtg-dir] Abstract: "today" --> "at the moment of writing this specification" ? [Linda] Changed. [hares] Abstract: /old text: Here are some examples of cloud network functions: Virtual Firewall services, Virtual Private network services, Virtual PBX services including voice and video conferences, etc./ /new text: Examples of cloud network functions are: Virtual Firewall services, Virtual Private network services, or Virtual PBX services including voice and video conferences./ [Linda] Changed. [rtg-dir] Section 1: The abstract mentions that the problems are related to MPLS, but the introduction does not mention it. Furthermore, it would be nice to explain why these 8 problems (Section 3) were selected in relation with MPLS. [Linda] The document is to address problems enterprises face to leverage their existing traditional VPN services for interconnecting to Clouds, not specifically MPLS. changed the "MPLS services" to "VPN services" [rtg-dir] Section 2, VPC: "... Most Cloud operators' VPCs only support...." --> "at the moment of writing this specification, most Cloud operators' VPCs only support...." ? - Section 3: [rtg-dir] * " There are many problems associated with connecting to hybrid Cloud" --> "... connecting to Cloud DCs" ? In this way, it is aligned with the title. [Linda] changed. - Section 3.1: [rtg-dir] * "it MUST ignore..." --> it must ignore ... ? [Linda] changed. [rtg-dir] * "BGP session MUST NOT ..." --> BGP session must not ...? [Hares] Old Text:/ All of these can contribute to increased BGP peering errors, such as capability mismatch, BGP ceasing notification, unwanted route leaks, missed Keepalives, etc. / New Text :/ All of these can contribute to increased BGP peer errors such as capability mismatch, unwanted route leaks, missed Keepalives, and errors causing BGP ceases./ [Linda] changed. - Section 3.2: [rtg-dir]* "BFD" --> Bidirectional Forwarding Detection (BFD) ? [Linda] changed. [rtg-dir]* What means a site capacity goes dark? [hares replacement] old text/dark/ New text/dark (capacity goes to zero)/ [hares edit] Old text/ Site failures include, but not limited to, a site capacity degradation or entire site going down caused by a variety of reasons, such as fiber cut connecting to the site or among pods within the site, cooling failures, insufficient backup power, cyber threat attacks, too many changes outside of the maintenance window, etc. / New text/ Site failures can include (but are not limited to) a site capacity degradation or entire site going down. The reasons for these capacity degradations or failures can include: a) fiber cuts for links connecting to the site or among pods within the site, b) cooling failures, c) insufficient backup power, d) cyber threat attacks, e) too many changes outside of the maintenance window, or other errors. / [Linda] changed. - Section 3.4: [rtg-dir] * It would be nice to add a reference to 5G, specially when mentions the 5G core functions [Linda] Add the reference to 3GPP TS 23.548 (5G System Enhancements for Edge Computing) [rtg-dir] * Does the mentioned problems and mitigations applies for 5G Standalone and Non-Standalone deployments options? [Linda] The 3GPP's Edge Computing is for 5G only. [hares]old text/The 5G Core functions include Radio Control Functions, Session Management Functions (SMF), Access Mobility Functions (AMF), User Plane Functions (UPF), etc./ New text/The 5G Core functions include Radio Control Functions, Session Management Functions (SMF), Access Mobility Functions (AMF), User Plane Functions (UPF), and others./ [Linda] changed. - Section 3.5: [hares] Old text/ cloud edge resources. [tab]To mitigate such security risk, it is necessary for the ports facing the internet to enable Anti-DDos features. / New text/ cloud edge resources. To mitigate such security risk, it is necessary for the ports facing the internet to enable Anti-DDos features. / [Linda] changed. [rtg-dir][hares] Old text/More diligent security procedures need to be considered to mitigate all those security issues/ New text/Additional Internet security procedures need to be designed that are able to to mitigate all these issues./ [Linda] changed. - Section 3.7: [rtg-dir][hares] suggestion to add the URL as a reference rather than a inline comment: (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.aws.amazon.com%2FAmazonVPC%2Flatest%2FUserGuide%2Fvpc-&data=05%7C01%7Clinda.dunbar%40futurewei.com%7C8cb15a8129cc4ab15b6808db3a094c12%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C638167583844802823%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=0kI3G%2BvqIzXPvFI4E2J06Sx7kJh6eW3MXC559jv%2FJBw%3D&reserved=0 nat-gateway.html#nat-gateway-other-services) [Linda] Changed. [hares] It might also be good to provide references to Google's Cloud NAT, Goggle /cold virtual machine (VM), and Google Kubernetes Engine (GKE). [Linda] Added. Also added Azure NAT reference. - Section 4.1 [hares] it might be useful to provide references to the services referenced for Amazon, Microsoft, and Google. [Linda] Added AWS, Azure, and Google's Cloud access references Positive: The diagram helps this text. section 4.2 page 13, please check the spacing after a), b), and c). It appears in my printout that there are extra spaces. section 4.3 [hares] in this text, the last phrase is confusing: text/ As MPLS VPNs provide more secure and higher quality services, it is desirable to locate the PEs with the least cost (including routing distance and capacity cost) for the dynamic IPsec tunnels to the Cloud DC GW./ Do you mean that these dynamic IPsec tunnels should be on the Cloud DC GW? [Linda] The intension is to say: When the MPLS VPN network can't reach the desired Cloud DCs, IPsec tunnels can be used to dynamically connect the MPLS PEs with the desired Cloud DCs GWs. As MPLS VPNs provide more secure and higher quality services, choosing a PE closest to the Cloud GW for the IPsec tunnel is desirable to minimize the IPsec tunnel distance over the public Internet. Is the text more clear? Section 5.1 [hares] old text/ To scale the IPsec key management, a solution like group encryption where a single IPsec SA is necessary at the GW can be considered. But the drawback is key distribution and maintenance of a key server, etc./ New text/ To scale the IPsec key management, a solution like group encryption where a single IPsec SA is necessary at the GW can be considered. The drawback of group encryption solutions is the key distribution for group encryption which requires protocols and a maintenance of a key server. Other mechanisms, might be operationally better this situation/ [Linda] changed. Section 5.2 Old Text/ When large number of IPSec encap & decap are needed, the performance is degraded. / New text/ When large numbers of IPSec encapsulation and decapsulation sequences are needed, the performance is degraded./ [Linda] Changed to the following: IPSec encap & decap are very processing intensive, which can degrade router performance. NAT also adds to the performance burden. Thank you very much for all those wonderful and insightful comments. Linda
_______________________________________________ rtgwg mailing list [email protected] https://www.ietf.org/mailman/listinfo/rtgwg
