An Approach to Expose 'Device Models'-as-'Network Models'

Internet-Draft	DMaNM	July 2024
Dios, et al.	Expires 6 January 2025	[Page]

Abstract

This document describes an approach for exposing Device Models as Network Models (DMaNM). In particular, this document provides guidance for structuring a data model to facilitate the reuse of device models within the customer-facing interface of Software-Defined Networking (SDN) controllers. The objective of this approach is to enhance the reusability of device models in various network scenarios and ease the mapping between network/service models with device models and ensure lossless mapping between the various layers.¶

1. Introduction

Network operators need to efficiently manage network elements (including, embedded service functions) throughout their infrastructure. By implementing network-wide management and configuration practices, operators can achieve centralized control and better visibility over their network elements. Doing so enables them to streamline operations, monitor performance, and promptly respond to network events. Moreover, network-wide management facilitates the enforcement of standardized policies and configurations, thus, ensuring consistent behavior and minimizing the risk of errors or misconfigurations that may result in service disruptions. Additionally, that approach enables operators to implement proactive actions such as performance optimization, efficient load balancing, and security policies across the entire network, fostering a more secure and efficient infrastructure.¶

The ability to reuse device models may play a crucial role in network management. Multiple teams within an organization, such as network engineering, operations, and planning, can benefit from leveraging and using these device models. These models may serve as a common "language" for understanding and managing network services and elements, ensuring consistency and interoperability across different teams and systems. The utilization of models from various teams is a key requirement for network operators.¶

The IETF has made remarkable progress in defining device models to manage network element capabilities. These device models, often represented using YANG data modeling language [RFC7950], provide a structured, standardized approach to manage various network devices and their features. By leveraging YANG models, network operators can effectively manage the network element functionalities. These models not only streamline network management but also promote interoperability between different vendors and platforms, fostering a more efficient and robust networking ecosystem.¶

Some examples device models which can be to manage specific network functions are listed below:¶

"ietf-routing-policy" [RFC8349]: This YANG model defines a generic data model for managing routing policies that can be applied to various routing protocols. The model provides a framework for creating, modifying, and applying routing policies, which allows defining how routes are selected, filtered, and modified. The "ietf-routing-policy" model covers features like policy definition, policy attachment, route filters, and route actions.¶
"ietf-bgp-policy" [I-D.ietf-idr-bgp-model]: This YANG model defines a data model for the Border Gateway Protocol (BGP). The "ietf-bgp-policy" model is designed to configure and manage BGP routers and sessions, as well as provide a representation of BGP operational state data. The model covers BGP-specific features such as peer configuration, address families, route filters, and route actions. The model is intended to work alongside the "ietf-routing-policy" model to manage BGP routing policies.¶
"ietf-access-list" [RFC8519]: This YANG model provides a data model for configuring and managing network access control lists (ACLs). This model provides a generic structure for representing ACLs, along with the ability to define rules for permitting, denying, or assigning a specific action to matching packets.¶
"ietf-nat" [RFC8512] defines a YANG module for the Network Address Translation (NAT) function. Various translation flavors are covered: Network Address Translation from IPv4 to IPv4 (NAT44), Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (NAT64), customer-side translator (CLAT), Stateless IP/ICMP Translation (SIIT), Explicit Address Mappings (EAM) for SIIT, IPv6-to-IPv6 Network Prefix Translation (NPTv6), and Destination NAT.¶

Software-Defined Networking (SDN) [RFC7149][RFC7426] controllers facilitate seamless communication and coordination between high-level management systems and the underlying network infrastructure. This arrangement enables efficient translation of network-wide policies and objectives, defined by the Operations Support Systems (OSS), into granular, device-specific configurations and commands for the network elements. A similar concept applies for orchestration scenarios like in Network Slicing [RFC9543]. SDN controllers are typically placed as intermediate entities between the OSS and the network elements. Figure 1 represents such scenario, where an SDN controller exposes its customer-facing interface to the OSS or orchestration layer.¶

        +-----+  +------+
        | OSS |  | Orch |
        +-----+  +------+
           ^        ^
           |        | Customer-Facing
           v        v    Interface
     +-------------------+
     | SDN Controller(s) |
     +-------------------+
      ^      ^       ^
      |      |       | Network-Facing
      v      v       v    Interface
  +-----+ +-----+ +-----+
  | NE1 | | NE2 | | NE3 |
  +-----+ +-----+ +-----+

Figure 1: An Example of SDN Scenario

Figure 1 illustrates the hierarchical relationship between the OSS, SDN controllers, and the network elements. In this example, the OSS acts as the central management system responsible for overseeing the entire network. An orchestrator acts with a similar role in scenarios like Network Slicing. An SDN controller, positioned in the middle, acts as an intermediary, facilitating communication, and coordination between the OSS and the network elements. At the bottom, the network elements are directly controlled and configured by an SDN controller. This architecture enables efficient translation of high-level network policies into device-specific configurations, ultimately streamlining network management and decoupling the systems from the network evolution.¶

Device models were defined to be applicable in the network-facing interface of an SDN controller. As a result, these models do not inherently expose/capture the necessary network concepts to make them directly applicable in the customer-facing interface of the SDN controller.¶

Within the scope of the IETF, efforts can be focused on two approaches when it comes to creating network models for device models. The first approach involves creating network models specific to each device model, while the second approach entails developing a generic and reusable structure for all models. This document puts forth a proposal for a reusable structure, aligning with the latter approach.¶

The YANG data model defined in this document conforms to the Network Management Datastore Architecture (NMDA) defined in [RFC8342].¶

2. Terminology

2.1. Terminology and Notations

The meanings of the symbols in the YANG tree diagrams are defined in [RFC8340].¶

The document uses the following terms from [RFC8309] and [RFC8969]:¶

Service Model:: Describes a service and the parameters of the service in a portable way that can be used uniformly and independent of the equipment and operating environment.¶
: Examples of service models are the L3VPN Service Model (L3SM) [RFC8299] and the L2VPN Service Model (L2SM) [RFC8466].¶
Network Model:: Describes a network-level abstraction (or a subset of aspects of a network infrastructure), including devices and their subsystems, and relevant protocols operating at the link and network layers across multiple devices. This model corresponds to the network configuration model discussed in [RFC8309]. : It can be used by a network operator to allocate resources (e.g., tunnel resource, topology resource) for the service or schedule resources to meet the service requirements defined in a service model.¶
: Examples of network models are the L3VPN Network Model (L3NM) [RFC9182] or the L2VPN Network Model (L2NM) [RFC9291].¶
Device Model:: Refers to the Network Element YANG data model described in [RFC8199] or the device configuration model discussed in [RFC8309].¶
: Device models are also used to refer to model a function embedded in a device (e.g., Access Control Lists (ACLs) [RFC8519]).¶

2.2. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

2.3. Prefix in Data Node Names

Names of data nodes and other data model objects are prefixed using the standard prefix associated with the corresponding YANG imported modules, as shown in Table 1.¶

Table 1: Prefixes and corresponding YANG modules
Prefix	Yang Module	Reference
grp	ietf-grp-ntw-elements	RFCXXX

RFC Editor Note:

Please replace XXXX with the RFC number assigned to this document. Please remove this note in that case.¶

3. Sample Use Cases

3.1. "Device Config"-as-a-Service

"Device Config"-as-a-Service involves the use of device models by an OSS to configure network elements through the SDN controller. In this scenario, the SDN controller acts as an intermediary between the OSS and the network elements, providing a configuration service for each network element.¶

By leveraging device models, the OSS gains a common representation of the network elements' capabilities and configuration parameters. These device models define the desired configuration for specific functions, such as ACLs or routing policies. The OSS utilizes these device models to define the desired configuration for each network element.¶

Through an SDN controller, the OSS can send the configuration instructions based on the device models to the respective network elements. The SDN controller translates and applies the configuration, ensuring consistency and correctness across the network. Moreover, the mediation of an SDN controller facilitates the access to the network elements from several users, applications or OSS minimizing the impact on the device.¶

3.2. Profiles

By leveraging device models, network operators can design profile that represent configurations for specific network functionalities, protocols, or services. These templates serve as reusable building blocks, encapsulating best practices, and ensuring consistency in network configuration and management. Once a profile is created, it can be applied to one or multiple network elements, either individually or in groups, depending on the specific network requirements.¶

This approach not only simplifies the configuration process but also reduces the likelihood of errors and misconfigurations, ultimately improving network stability and performance. Moreover, this process facilitates the lifecycle of the configurations enabling updating the profiles and, later, the network elements in a consistent manner across multiple network elements as a network-wide operation.¶

4. Guidelines to Use Device Models in the Customer-facing Interface of SDN Controllers

This section outlines two key concepts for the guidelines on utilizing device models in the Customer-facing Interface of SDN controllers: (1) groups of network elements and (2) a YANG structure for extending device models to enable network-wide utilization.¶

4.1. Groups of Network Elements

The management of groups of network elements is a requirement to cover the previous use cases. It is intended to have a YANG model to tag a group of network elements under the same identifier, so the operator can apply a given configuration to a set of devices. This document defines a module called "ietf-grp-ntw-elements", which provides a structured approach to represent and manage groups of network elements, enabling efficient network management.¶

The "ietf-grp-ntw-elements" module defines a YANG model for representing a group of network elements. Within the module, there is a list called "grp-ntw-element" that includes the groups of network elements. Each group is uniquely identified by the "grp-ne-id" leaf, which has a string data type and represents the group's identifier. The "grp-ntw-element" list has a nested list called "ntw-elements" to specify the individual network elements within each group. The "ntw-element" list has a key of "ne-id" to uniquely identify each network element. The "ne-id" leaf represents the identifier of each network element and has a string data type.¶

Figure 2 represents the tree of the proposed YANG model.¶

module: ietf-grp-ntw-elements
  +--rw grp-ntw-elements* [grp-ne-id]
     +--rw grp-ne-id       string
     +--rw ntw-element* [ne-id]
        +--rw ne-id    string

Figure 2: Group of Network Elements

4.2. YANG Structure for Extending the Models

The document proposes a structure to enable the reutilization of the device models in network scenarios. The objective is to create a YANG model with the device model and providing a nested structure to store deployment information for network elements associated with each instance in the list. The guideline is to follow the next structure:¶

An import of the device model.¶
A container named deployment that includes:¶
A list called "ntw-element" with the following elements:¶
A leaf named "ne-id" of type string that serves as the network element identifier (which is the key).¶
A leaf named "devmod-alias" of type string that serves as the device module alias for the deployment.¶
A list called "grp-ntw-elements" with the following elements:¶
- A leaf named "grp-ne-id" of type string that serves as the network element identifier (which is the key).¶
- A leaf named "devmod-alias" of type string that serves as the device module alias for the deployment.¶

Let us assume that there is a device model called "foo.yang". The tree of the "foo.yang" model is shown in Figure 3.¶

module: foo
  +--rw foo?   empty

Figure 3: Foo Tree Structure

This document proposes the creation of a module that consists of a list of instances from the "foo.yang" model. To iterate through the list, a key named "devmod-name" must be defined, which will be a string. Additionally, the new model will import "foo.yang". Lastly, a container called "deployment" will encompass a list of network elements, with each element identified by the "ne-id" and having a "devmod-alias" as an alias for the "devmod-name" configuration in the network element.¶

An example of the proposed structure is shown in Figure 4.¶

module: foo-ntwdev
  +--rw devmod-list* [devmod-name]
     +--rw devmod-name    string
     +--rw foo?           -> /foo:foo
     +--rw deployment
        +--rw ntw-elements* [ne-id]
        |  +--rw ne-id           string
        |  +--rw devmod-alias?   string
        +--rw grp-ntw-elements* [grp-ne-id]
           +--rw grp-ne-id       string
           +--rw devmod-alias?   string

Figure 4: Usage Example for 'foo' Module

5. DMaNM YANG Model

5.1. Groups of Network Elements

<CODE BEGINS> file "[email protected]"

module ietf-grp-ntw-elements {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-grp-ntw-elements";
  prefix "grp";

  organization
    "IETF NETMOD Working Group";
  contact
    "WG Web:  <https://datatracker.ietf.org/wg/netmod/>
    WG List:  <mailto:[email protected]>

    Editor:   Oscar Gonzalez de Dios
              <mailto:[email protected]>
    Editor:   Victor Lopez
              <mailto:[email protected]>
    Editor:   Mohamed Boucadair
              <mailto:[email protected]>
    Editor:   Daniele Ceccarelli
              <mailto:[email protected]>";

  description
    "YANG model for group of network elements.";

  revision "2024-07-05" {
    description "Initial version.";
    reference
      "RFC XXXX: An Approach to Expose 'Device Models'
      -as-'Network Models'";
  }

  list grp-ntw-elements {
    key "grp-ne-id";
    description
      "List of groups of network elements.";

    leaf grp-ne-id {
      type string;
      description
        "Group of network element identifier.";
    }

    list ntw-element {
      key "ne-id";
      description
        "List of network elements.";

      leaf ne-id {
        type string;
        description
          "Network element identifier.";
      }
    }
  }
}

<CODE ENDS>

5.2. Usage Example: Applying the Guidelines to The 'foo' Module"

<CODE BEGINS> file "[email protected]"

module foo-ntwdev {
  namespace "urn:example:foo-ntwdev";
  prefix "netdevfoo";

  import foo {
    prefix "foo";
  }

  organization "Example Organization";
  contact "[email protected]";
  description "YANG model for foo-dev.";

  revision "2024-07-05" {
    description
      "Initial version.";
    reference
      "RFC XXXX: YANG Model for foo-dev";
  }

  leaf foo {
    type leafref {
      path "/foo:foo";
    }
    description
      "Reference to foo leaf from foo.yang";
  }

  container deployment {
    description
      "Deployment container.";

    list ntw-element {
      key "ne-id";
      description
        "List of network elements.";

      leaf ne-id {
        type string;
        description
          "Network element identifier.";
      }
      leaf devmod-alias {
        type string;
        description
          "Device module alias for the deployment.";
      }
    }

    list grp-ntw-elements {
      key "grp-ne-id";
      description
        "List of group of network elements.";

      leaf grp-ne-id {
        type string;
        description
          "Group of network element identifier.";
      }
      leaf devmod-alias {
        type string;
        description
          "Device module alias for the deployment.";
      }
    }
  }
}

<CODE ENDS>

6. Security Considerations

The YANG module specified in this document defines schema for data that is designed to be accessed via network management protocols such as NETCONF [RFC6241] or RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure transport is TLS [RFC8446].¶

The Network Configuration Access Control Model (NACM) [RFC8341] provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content.¶

There are a number of data nodes defined in this YANG module that are writable/creatable/deletable (i.e., config true, which is the default). These data nodes may be considered sensitive or vulnerable in some network environments. Write operations (e.g., edit-config) and delete operations to these data nodes without proper protection or authentication can have a negative effect on network operations. These are the subtrees and data nodes and their sensitivity/ vulnerability in the "xxx" module:¶

TBC¶
TBC¶

Some of the readable data nodes in this YANG module may be considered sensitive or vulnerable in some network environments. It is thus important to control read access (e.g., via get, get-config, or notification) to these data nodes. These are the subtrees and data nodes and their sensitivity/vulnerability in the "ixxx" module:¶

TBC¶
TBC¶

9. References

9.1. Normative References

[RFC2119]: Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/rfc/rfc2119>.
[RFC3688]: Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004, <https://www.rfc-editor.org/rfc/rfc3688>.
[RFC6020]: Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI 10.17487/RFC6020, October 2010, <https://www.rfc-editor.org/rfc/rfc6020>.
[RFC6241]: Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, <https://www.rfc-editor.org/rfc/rfc6241>.
[RFC6242]: Wasserman, M., "Using the NETCONF Protocol over Secure Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011, <https://www.rfc-editor.org/rfc/rfc6242>.
[RFC7149]: Boucadair, M. and C. Jacquenet, "Software-Defined Networking: A Perspective from within a Service Provider Environment", RFC 7149, DOI 10.17487/RFC7149, March 2014, <https://www.rfc-editor.org/rfc/rfc7149>.
[RFC7426]: Haleplidis, E., Ed., Pentikousis, K., Ed., Denazis, S., Hadi Salim, J., Meyer, D., and O. Koufopavlou, "Software-Defined Networking (SDN): Layers and Architecture Terminology", RFC 7426, DOI 10.17487/RFC7426, January 2015, <https://www.rfc-editor.org/rfc/rfc7426>.
[RFC7950]: Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016, <https://www.rfc-editor.org/rfc/rfc7950>.
[RFC8040]: Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017, <https://www.rfc-editor.org/rfc/rfc8040>.
[RFC8174]: Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.
[RFC8199]: Bogdanovic, D., Claise, B., and C. Moberg, "YANG Module Classification", RFC 8199, DOI 10.17487/RFC8199, July 2017, <https://www.rfc-editor.org/rfc/rfc8199>.
[RFC8299]: Wu, Q., Ed., Litkowski, S., Tomotaki, L., and K. Ogaki, "YANG Data Model for L3VPN Service Delivery", RFC 8299, DOI 10.17487/RFC8299, January 2018, <https://www.rfc-editor.org/rfc/rfc8299>.
[RFC8309]: Wu, Q., Liu, W., and A. Farrel, "Service Models Explained", RFC 8309, DOI 10.17487/RFC8309, January 2018, <https://www.rfc-editor.org/rfc/rfc8309>.
[RFC8340]: Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, <https://www.rfc-editor.org/rfc/rfc8340>.
[RFC8341]: Bierman, A. and M. Bjorklund, "Network Configuration Access Control Model", STD 91, RFC 8341, DOI 10.17487/RFC8341, March 2018, <https://www.rfc-editor.org/rfc/rfc8341>.
[RFC8342]: Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K., and R. Wilton, "Network Management Datastore Architecture (NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018, <https://www.rfc-editor.org/rfc/rfc8342>.
[RFC8446]: Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, <https://www.rfc-editor.org/rfc/rfc8446>.
[RFC8466]: Wen, B., Fioccola, G., Ed., Xie, C., and L. Jalil, "A YANG Data Model for Layer 2 Virtual Private Network (L2VPN) Service Delivery", RFC 8466, DOI 10.17487/RFC8466, October 2018, <https://www.rfc-editor.org/rfc/rfc8466>.
[RFC8519]: Jethanandani, M., Agarwal, S., Huang, L., and D. Blair, "YANG Data Model for Network Access Control Lists (ACLs)", RFC 8519, DOI 10.17487/RFC8519, March 2019, <https://www.rfc-editor.org/rfc/rfc8519>.
[RFC8969]: Wu, Q., Ed., Boucadair, M., Ed., Lopez, D., Xie, C., and L. Geng, "A Framework for Automating Service and Network Management with YANG", RFC 8969, DOI 10.17487/RFC8969, January 2021, <https://www.rfc-editor.org/rfc/rfc8969>.
[RFC9182]: Barguil, S., Gonzalez de Dios, O., Ed., Boucadair, M., Ed., Munoz, L., and A. Aguado, "A YANG Network Data Model for Layer 3 VPNs", RFC 9182, DOI 10.17487/RFC9182, February 2022, <https://www.rfc-editor.org/rfc/rfc9182>.
[RFC9291]: Boucadair, M., Ed., Gonzalez de Dios, O., Ed., Barguil, S., and L. Munoz, "A YANG Network Data Model for Layer 2 VPNs", RFC 9291, DOI 10.17487/RFC9291, September 2022, <https://www.rfc-editor.org/rfc/rfc9291>.
[RFC9543]: Farrel, A., Ed., Drake, J., Ed., Rokui, R., Homma, S., Makhijani, K., Contreras, L., and J. Tantsura, "A Framework for Network Slices in Networks Built from IETF Technologies", RFC 9543, DOI 10.17487/RFC9543, March 2024, <https://www.rfc-editor.org/rfc/rfc9543>.

9.2. Informative References

[I-D.ietf-idr-bgp-model]: Jethanandani, M., Patel, K., Hares, S., and J. Haas, "YANG Model for Border Gateway Protocol (BGP-4)", Work in Progress, Internet-Draft, draft-ietf-idr-bgp-model-17, 5 July 2023, <https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-model-17>.
[RFC8349]: Lhotka, L., Lindem, A., and Y. Qu, "A YANG Data Model for Routing Management (NMDA Version)", RFC 8349, DOI 10.17487/RFC8349, March 2018, <https://www.rfc-editor.org/rfc/rfc8349>.
[RFC8512]: Boucadair, M., Ed., Sivakumar, S., Jacquenet, C., Vinapamula, S., and Q. Wu, "A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)", RFC 8512, DOI 10.17487/RFC8512, January 2019, <https://www.rfc-editor.org/rfc/rfc8512>.