Subject: Re: [I2nsf] WGLC for draft-ietf-i2nsf-problem-and-use-cases-06

From: "Susan Hares" <[email-masked]>
Date: Sat, 28 Jan 2017 19:32:30 -0500

Adrian: 

Version 7 combines edits from you, Paul Jeong, and Dave Qi.   Exceptions to
your edits are indicated below.  The resolutions to your comments are below.

This version does not have is: 
1)  Cyber Threat Alliance (CA, http://cyberthreatalliance.org/)   Do you
want the Cyber Threat alliance as a [CTA] reference?  I can provide the web
link, but do you want a document or a web site? 

2) URLS in references  - I need to find out how to put URLs into XML
references.  If you have reference to a tutorial on how to do this, please
send it to me.  

Most of Paul's comments went exactly as he requested.  I've attached pdf
file for Paul's resolutions.  

Since all of these were public comments on editorial, I put these in.  If
co-authors or other WG members wish any additional changes, please specify
them against version -07. 

Thank you, 

Sue 

-----Original Message-----
From: I2nsf [mailto:[email-masked]] On Behalf Of Adrian Farrel
Sent: Monday, December 19, 2016 9:09 AM
To: [email-masked]
Subject: Re: [I2nsf] WGLC for draft-ietf-i2nsf-problem-and-use-cases-06

Hi,

This review should count as WG chair review and also getting ahead on the
document shepherd review.

All of my comments are pretty minor.

Thanks for the work,
Adrian

---

idnits shows up some issues with references. At first glance, these all seem
to be real problems. Note that the reference cited in Section 10 is not
picked up by idnits, but still needs to be sorted out.

https://www.ietf.org/tools/idnits?url=https://www.ietf.org/archive/id/draft-
ietf
-i2nsf-problem-and-use-cases-06.txt

---

"DC" is used in the Introduction without expansion.
OTOH, once explained in section 2, it is not used again.

*** Sue done 

---

Section 2
I2NSF s/interface/Interface/

*** Done 
---

Section 2.
I think your definition is semantically equivalent to what we have in our
charter, but I would feel more comfortable if you matched the wording. Is
that OK?
  A Network Security Function (NSF) is a function used to ensure
  integrity, confidentiality, or availability of network communications,
  to detect unwanted network activity, or to block or at least mitigate
  the effects of unwanted activity.

*** done 
---

Section 2 includes "VNFPool" but the term (and the concept) is not used in
the rest of the document.

** deleted 
---

Section 3

You have...
   There is currently no standard mechanism to capture
   those requirements.
This could be enhanced by saying whether it is the objective of the I2NSF
work to address this absence.

(similar in 3.1.6, 3.2.3, and 3.5)
** done - please verify the solution is what you wish 

By the way do you mean "address these requirements", or perhaps "express
those requirements for communication between the customer and provider"?

** done -- not sure where the last request comes from 
---

3.1
You have used a number of terms without expansion.
DMZ
AAA

Done - Although AAA is an IETF approved abbreviation. 
---

3.1.1
OLD
   What is needed is a standardized interface to control and monitor the
   rule sets that NSFs use to treat packets traversing through.
NEW
   What is needed is a standardized interface to control and monitor the
   rule sets that NSFs use to treat packets that traverse them.  [these
NSFs] 

Done - with exception of old/them/  new/these NSFs/ 
---

3.1.2
   Since no widely accepted industry standard security interface exists
   today, management of NSFs (device and policy provisioning,
   monitoring, etc.) tends to be bespoke security management offered by
   product vendors.

The term "security interface" hasn't been introduced, and I think you mean
"interface to security NSFs".

Done 

---

3.1.3

   The European Telecommunications Standards Institute (ETSI) Network
   Function Virtualization (NFV) initiative

Do you have a reference for that?

Sue: Added reference 

---

3.1.3

OLD
   security policies to be enforced by distributed,
   virtual, and network security functions (vNSF).
NEW
   security policies to be enforced by distributed,
   virtual network security functions (vNSF).

Changed NEW to: 
   security policies to be enforced by distributed
   virtual network security functions (vNSF).

Please confirm this works for you. 

---

3.1.3

   A vNSF has higher risk of failure, migrating, and state changes as
   their hosting VMs are being created, moved, or decommissioned.

I understand "migration" but I think it is a synonym for "moved"
"State change" seems to possibly be an effect of migration.
"Higher risk of failure" doesn't follow unless you are saying that a VM
infrastructure is fundamentally less stable than dedicated hardware.

In fact, I don't think I can get on board with this statement at all.

BTW, you need to expand "VM".
------------

Sue: changed to: 
A vNSF has higher risk of changes to the state of network connection,
interfaces, 
 or traffic as their hosting Virtual Machines (VMs) are being created,
moved, or decommissioned
 ---

3.1.7 has "DOTS" without explanation or expansion

Now spelled out (Paul  you) 
---

3.1.7 s/envelop/envelope/

Done 
---

3.1.9
s/uites/suites/

Sue: fixed 
---

3.1.9 para 1 has an additional close parentheses

Sue: Fixed 

---

3.2

Might be nice to indicate that DOTS, MILE, and SACM are working groups
responsible for documenting the guidelines you list.

---

3.2.2

   Customers may consume NSFs by multiple service providers.

"hosted by"? "provided by"?

Sue: Customers may utilize NSFs provided by multiple service providers. 
-

3.2.2 Figure 1

It's not clear what "Picture:" means in the figure.

You should add an explicit reference to the figure from the text.

Sue:  old/Picture/New:/video/  reference added. 

---

3.5

I think DDoS is not a security function. Maybe "DDoS mitigation"?

Sue: Good catch. 

---

3.5

   Cyper Threat Alliance (CA, http://cyberthreatalliance.org/)

s/Cyper/Cyber/
Can you turn the URL into a reference?

[Will do once I find out more information. 

---

3.6

s/events somethings happen/events sometimes happen/

replaced with: 
New/ However, unexpected events may happen causing the NSF to exhaust those
negotiated resources./ 

---

4.1 introduces some unexplained abbreviations

NSP
BSS
OSS
Sue: Done 

---

4.1 Figure 2
Need one more "-" in the Interface 1 arrow.

Sue: Done 
---

4.1 Page 15 para 1
line 1 s/client/clients/
s/control/controller/

Sue: done 
---

4.1

s/consolidate them,/consolidate it,/

Done 

---

4.1 says...

   In order to achieve this, the security controller may collect
   security measurements and share them with an independent and trusted
   third party (via interface 1) in order to allow for attestation of
   NSF functions using the third party added information.

Does this mean that there is  need for an additional standard interface
between the client and this third party?

Added: 

This implies that there may be the following two types of clients using
interface 1:  the end-user and and the trusted independent third party.  
The I2NSF work may determine that interface 1 creates two sub-interfaces
to support these two types of clients.
		
---

4.2 uses some terms without expansion:

CPE
vCPE
vPE
vEPC (although maybe this is a typo?)

Sue: [not a typo, all detailed in figure 2] 

---

4.2 Figure 3

You need to make an explicit reference to the figure from the text.

I think the figure is trying to show a domain of influence for the
Management System. This component is not described in the text, and the
curvy line on the figure is also not describe.

Maybe this could be tidied up as...

            Customer   |    Access     |   PoP/Datacenter
                       |               | 
                       |               |      +--------+
                       |    ..................|Network |
                       |   :           |      |Operator|
       +-------------+ |   :   +----+  |      |Mgmt Sys|
       | Residential |-+---:---+vCPE+-----+   +--------+
       +-------------+ |   :   +----+  |   \     |   : 
                       |   :           |    \    |   :
        +----------+   |   :   +----+  |     +----+  :
        |Enterprise|---+---:---+ vPE+--+-----+ NSF|  :
        +----------+   |   :   +----+  |     +----+  :
                       |   :           |    /        :
            +--------+ |   :   +----+  |   /         :
            | Mobile |-+---:---+vEPC+-----+          :
            +--------+ |   :   +----+  |      Mgmt   :
                       |   :           |      Domain :
                       |   :.........................:
                       |               |       
                       |               | 

However, your text describes four "different access clients" including
Residential, Enterprise, Mobile, and Service Provider, while the figure only
shows three of these.

Sue : Fixed 
---

4.2 under "Mobile:"

  removing malicious programs such as Botnet, DDoS, and Malware.

Is DDoS a program?

   Threat management for infrastructure includes detecting and removing 
			malicious programs such as botnet, malware, and
other programs that create
			distributed DoS attacks).  
---

4.3

You need to reference Figure 4 from the text.
[Sue] Done; 
---

4.3.3

s/need not only to secure/not only need to secure/

Done. 

---

4.4 uses "VoLTE" without expansion.
Defined 

---

4.4

s/this kind of attacks/these kinds of attack/

---

4.5

Please capitalise the section header.

Done 

---

4.5

You should expand PCI-DSS and HIPPA. You should also probably include
references.

Done 
_______________________________________________
I2nsf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i2nsf