Minor issues:
- The document has several grammatical errors. I have fixed many of them in my
review below but surely not all. I hope that chairs/ADs could do another pass
before sending this to the RFC editor.
Nits/editorial comments:
- The document uses terms such as NSF ships/implements IKEv2. Use consistent
terminology.
- Abstract: There were too many issues with the abstract to individually point
out. Here is an edited version for you to consider:
This document describes how to provide IPsec-based flow protection (integrity
and confidentiality) by means of an Interface to Network Security Function
(I2NSF) controller. It considers two main well-known scenarios in IPsec: (i)
gateway-to-gateway and (ii) host-to-host. The service described in this
document allows the configuration and monitoring of IPsec Security Associations
(SAs) from a I2NSF Controller to one or several flow-based Network Security
Functions (NSFs) that rely on IPsec to protect data traffic.
The document focuses on the I2NSF NSF-facing interface by providing YANG data
models for configuring the IPsec databases (SPD, SAD, PAD) and IKEv2. This
allows IPsec SA establishment with minimal intervention by the network
administrator.
- The SDN controller manages and configures the distributed network resources
and provides an abstracted view of the network resources to the SDN
applications. -> Incorrect usage of "the" in several places. Consider changing
to: "SDN controllers configure and manage distributed network resources and
provide an abstracted view of the network resources to SDN applications"
- The SDN application can customize and automate the operations (including
management) of the abstracted network resources in a programmable manner via
this interface [RFC7149] [ITU-T.Y.3300] [ONF-SDN-Architecture] [ONF-OpenFlow].
-> Remove article from the beginning of the sentence "SDN applications can
customize and automate the operations (including management) of the abstracted
network resources in a programmable manner via this interface [RFC7149]
[ITU-T.Y.3300] [ONF-SDN-Architecture] [ONF-OpenFlow]."
- Several sentences are way too long. Here is an edited version of the 2nd
paragraph that you could consider: Several network scenarios now demand a
centralized way of managing different security aspects. For example,
Software-Defined WANs (SD-WANs). SD-WANs are an SDN extension providing a
software abstraction to create secure network overlays over traditional WAN and
branch networks. SD-WANs utilize IPsec [RFC4301] as an underlying security
protocol. The goal of SD-WANs is to provide flexible and automated deployment
from a centralized point to enable on-demand network security services such as
IPsec Security Association (IPsec SA) management.
Additionally, Section 4.3.3 in [RFC8192] describes another example use case for
Cloud Data Center Scenario titled "Client-Specific Security Policy in Cloud
VPNs". The use case in RFC 8192 states that "dynamic key management is critical
for securing the VPN and the distribution of policies". These VPNs can be
established using IPsec. The management of IPsec SAs in data centers using a
centralized entity is a scenario where the current specification maybe
applicable.
- This text is repeated twice: "In the IKE case, IKEv2 already provides a
mechanism to detect whether ..."
- "view is built either requesting information to the NSFs under its control,
or because these NSFs inform the I2NSF Controller." -> "view is built either by
requesting information from the NSFs under its control, or by information
pushed from the NSFs to the I2NSF Controller"
- "Combined algorithms has been removed" -> have been
- "admit the configurations of these values." -> "accept configuration of these
values"
- "Beside, IaaS services providing virtualization environments are deployments
solutions based on IPsec to provide" -> "Besides, IaaS services providing
virtualization environments are deployments that often rely on IPsec to provide"
- "Despite this procedure may increase the latency to complete the process, no
traffic is sent over the network until the IPsec SAs are completely operative."
-> "Even though this procedure may increase"
- "If some of the operations described above fails" -> "If some of the
operations described above fail"
- "In such as reactive mode, upon reception of the sadb-acquire notification,
the I2NSF Controller installs the new IPsec SAs in NSF A and B (following" -> ""
- "If this is not critic then it is an" -> this is not critical
_______________________________________________
I2nsf mailing list
I2nsf@xxxxxxxx
https://www.ietf.org/mailman/listinfo/i2nsf
