Search RFCs

RFC Editor

File formats:

Also available:XML file for editing

 

Status:

PROPOSED STANDARD

Authors:

R. Marin-Lopez
G. Lopez-Millan
F. Pereniguez-Garcia

Stream:

IETF

Source:

i2nsf (sec)

Cite this RFC:TXT  | XML  |  BibTeX

DOI:  https://doi.org/10.17487/RFC9061

Discuss this RFC: Send questions or comments to the mailing listi2nsf@ietf.org

Other actions:Submit Errata  | Find IPR Disclosures from the IETF  | View History of RFC 9061

Abstract

This document describes how to provide IPsec-based flow protection(integrity and confidentiality) by means of an Interface to NetworkSecurity Function (I2NSF) Controller. It considers two mainwell-known scenarios in IPsec: gateway-to-gateway and host-to-host.The service described in this document allows the configuration andmonitoring of IPsec Security Associations (IPsec SAs) from an I2NSFController to one or several flow-based Network Security Functions(NSFs) that rely on IPsec to protect data traffic.

This document focuses on the I2NSF NSF-Facing Interface by providingYANG data models for configuring the IPsec databases, namely SecurityPolicy Database (SPD), Security Association Database (SAD), PeerAuthorization Database (PAD), and Internet Key Exchange Version 2(IKEv2). This allows IPsec SA establishment with minimal interventionby the network administrator. This document defines three YANGmodules, but it does not define any new protocol.

For the definition ofStatus,seeRFC 2026.

For the definition ofStream, seeRFC 8729.