A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN)

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 90
Abstract: This document describes how to provide IPsec-based flow protection (integrity and confidentiality) by means of an Interface to Network Security Function (I2NSF) Controller. It considers two main well-known scenarios in IPsec: gateway-to-gateway and host-to-host. The service described in this document allows the configuration and monitoring of IPsec Security Associations (IPsec SAs) from an I2NSF Controller to one or several flow-based Network Security Functions (NSFs) that rely on IPsec to protect data traffic. This document focuses on the I2NSF NSF-Facing Interface by providing YANG data models for configuring the IPsec databases, namely Security Policy Database (SPD), Security Association Database (SAD), Peer Authorization Database (PAD), and Internet Key Exchange Version 2 (IKEv2). This allows IPsec SA establishment with minimal intervention by the network administrator. This document defines three YANG modules, but it does not define any new protocol.
Publication Date: 2021-07-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9061
Link: https://doi.org/10.17487/RFC9061
Author(s): Rafael Marin-Lopez
Gabriel Lopez
Fernando Pereniguez-Garcia
Keyword(s): NSF, SDN, IPSEC

Latest version of IETF RFC 9061

Document Versions — IETF RFC 9061

▶ IETF RFC 9061 (2021-07-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IANA, "Protocol Numbers", <https://www.iana.org/assignments/protocol-numbers/>. EXTERNAL
IANA, "Transform Type 1 - Encryption Algorithm Transform IDs", <https://www.iana.org/assignments/ikev2-parameters/>. EXTERNAL
IANA, "Method Type", <https://www.iana.org/assignments/eap-numbers/>. EXTERNAL
IANA, "Internet Key Exchange Version 2 (IKEv2) Parameters", <https://www.iana.org/assignments/ikev2-parameters/>. EXTERNAL
IANA, "Transform Type 4 - Diffie-Hellman Group Transform IDs", <https://www.iana.org/assignments/ikev2-parameters/>. EXTERNAL
IANA, "IKEv2 Authentication Method", <https://www.iana.org/assignments/ikev2-parameters/>. EXTERNAL
IANA, "Transform Type 3 - Integrity Algorithm Transform IDs", <https://www.iana.org/assignments/ikev2-parameters/>. EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 3947 [Active*]
IETF RFC 3948 [Active*]
IETF RFC 4301 [Active, Amended*]
IETF RFC 4303 [Active*]
IETF RFC 5280 [Active, Amended*]
IETF RFC 5322 [Active, Amended*]
IETF RFC 5915 [Active*]
IETF RFC 6020 [Active*]
IETF RFC 6241 [Active*]
IETF RFC 6242 [Active*]
IETF RFC 6960 [Active*]
IETF RFC 6991 [Superseded*]
IETF RFC 7296 [Active*]
IETF RFC 7383 [Active*]
IETF RFC 7427 [Active*]
IETF RFC 7619 [Active*]
IETF RFC 7950 [Active, Amended*]
IETF RFC 8017 [Active*]
IETF RFC 8040 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 8221 [Active*]
IETF RFC 8229 [Superseded*]
IETF RFC 8247 [Active*]
IETF RFC 8340 [Active*]
IETF RFC 8341 [Active*]
IETF RFC 8342 [Active*]
IETF RFC 8446 [Superseded*]
T-REC-X.690.2021 — X690 EXTERNAL

Bibliographic Reference(s)

10.1109-SDN4FNS.2013.6702553 — SDNSecServ EXTERNAL
10.1145-2491185.2491199 — SDNSecurity EXTERNAL
IETF.draft-carrel-ipsecme-controller-ike-01 — I-D.carrel-ipsecme-controller-ike EXTERNAL
IETF.draft-tran-ipsecme-yang-01 — I-D.tran-ipsecme-yang EXTERNAL
Open Networking Foundation, "SDN architecture", Issue 1, June 2014, <https://www.opennetworking.org/wp-content/uploads/2013/02/TR_SDN_ARCH_1.0_06062014.pdf>. EXTERNAL
Stefan Wallin, "Tutorial: NETCONF and YANG", January 2014, <https://ripe68.ripe.net/presentations/181-NETCONF-YANG-tutorial-43.pdf>. EXTERNAL
Open Networking Foundation, "OpenFlow Switch Specification", Version 1.4.0 (Wire Protocol 0x05), October 2013, <https://www.opennetworking.org/wp-content/uploads/2014/10/openflow-spec-v1.4.0.pdf>. EXTERNAL
CESNET, "strongSwan: the OpenSource IPsec-based VPN Solution", <https://www.strongswan.org/>. EXTERNAL
The Libreswan Project, "Libreswan VPN software", <https://libreswan.org/>. EXTERNAL
IETF RFC 2367 [Active*]
IETF RFC 3688 [Active*]
IETF RFC 6040 [Active*]
IETF RFC 6071 [Active*]
IETF RFC 6437 [Active*]
IETF RFC 7149 [Active*]
IETF RFC 7426 [Active*]
IETF RFC 8192 [Active*]
IETF RFC 8329 [Active*]
T-REC-Y.3300.2014 — ITUY3300 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9061.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9061, A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN). Available at https://doi.org/10.17487/RFC9061

Snippet:

IETF RFC 9061, A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN). Available at https://doi.org/10.17487/RFC9061

HTML (ISO 690 compliant)

Preview:

IETF RFC 9061, A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN). Available at https://doi.org/10.17487/RFC9061

Snippet:

<span class="citation"><cite>IETF RFC 9061</cite>, A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN). Available at <a href="https://doi.org/10.17487/RFC9061" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9061</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9061, A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN)
doi: 10.17487/RFC9061
url: https://doi.org/10.17487/RFC9061

Snippet:

<li>
<cite id="bib-rfc9061">IETF RFC 9061</cite>, A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN)
<span class="doi">10.17487/RFC9061</span>
</li>

Referenced By

IETF RFC 9348 [Active*]