A Policy Information Model for RFC2547-like IP VPNs

Abstract

Abstract:This article presents a Policy Infonnation Model for RFC2547-like IP VPNs. Policy Infonnation Models are the key component of Policy-based Management systems. They describe a set of service specific policy conditions andlor policy actions, used to fonnulate the policy mies to fonnalise a service.In this artic1e, the principles of Policy-based Management are reminded and the role and usage of Policy Infonnation Models is introduced. Then this artic1e provides adescription of the way an RFC2547-like IP VPN is provisioned in a network. Finally the authors propose a Policy Infonnation Model for managing RFC2547-like IP VPNs.Keywords: BGP/MPLS VPNs, Policy Infonnation Model INTRODUCTIONThis artic1e presents an IP Virtual Private Network (VPN) Policy Information Model. The targeted VPN service is based on an IP network where MPLS is used for forwarding packets over the core, and BOP is used for distributing routes over the core. Moreover, only the case of a network based (or PE-based) VPN is considered here. These kind of IP VPNs are described in RFC 2547 [1]. They will be called hereafter RFC2547-like IP VPNs. Policy information models are used in the context of Policy-based Management, which principles are defined in [2]. The IP VPN Policy Information Model presented hereafter defines a set of policy actions related to the management of RFC2547-like IP VPNs services, that will be used to implement policy rules that are the key components of Policy-based Management.

Implementing a VPN service with policy rules

“…This requires careful design of the policy information models to support service design and implementation. These models are PCIM [5], PCIMe [6], QPIM [4], and the IP VPN PIM [11].…”

“…For configuration of the edge of an MPLSlDiffServ network, the targeted PIMs are: an IPVPN PIM [11] strictly for the VPN part, QPIM [4] for the QoS part and peIM/peIMe [5][6] as background models. A description of these models and implementation is given in the next sections.…”

“…The IP VPN policy information model [11] is an Alcatel proprietary model anticipating the evolving ffiTF standard [12]. This model defines rules related to Reachability, NAT, Firewall and Encryption.…”

“…In any case, each rule is defined similarly: the condition part of this rule is a time validity period and the action part is one action, Provision VRFPolicy Action, as defined in [11]. The only property of this action is the list of SAPs (to associate with the VRF) as defined in the reachability component.…”

“…Thus, the number of required rules depends on the definition of the accessibility. Each rule illustrated below is defined similarly: the condition is the time validity period and the action is one /mplementing VPN Service with Policy Rules 6/ action, ConfigureVRFPolicyAction, as defined in [11]. This rule is to be enforced on PEs attached to source sites.…”