A YANG Data Model for Augmenting VPN Service and Network Models with Attachment Circuits
Extracted elements (23)
The AC Glue module was designed as a separate augmentation module rather than modifying the LxSM/LxNM directly, enabling operators to separate AC provisioning from VPN service provisioning. A single AC may be reused across multiple connectivity services (L2VPN, L3VPN, Network Slice), so centralizing AC management via ACaaS avoids redundant information across service models.
The 'ietf-ac-glue' module includes provisions to reference ACs both within and outside a VPN network access entry. This accommodates deployment contexts where an AC reference may be created before or after a VPN instance is created, allowing flexible ordering of provisioning steps.
A 'site-network-access' in RFC 8299 (L3SM) maps to an AC with both Layer 2 and Layer 3 properties per RFC 9834; a 'site-network-access' in RFC 8466 (L2SM) maps to an AC with Layer 2 properties. Similarly, 'vpn-network-access' defined in RFC 9182 and RFC 9291 maps to an AC per RFC 9834 or RFC 9835.
The 'ietf-ac-glue' module augments four existing VPN modules: L2SM (RFC 8466), L3SM (RFC 8299), L2NM (RFC 9291), and L3NM (RFC 9182). It imports both 'ietf-ac-svc' (RFC 9834) for service-layer AC references and 'ietf-ac-ntw' (RFC 9835) for network-layer AC references.
This approach is consistent with the design in the YANG Network Slice Service draft (YANG-NSS) where 'ac-svc-ref' is used to indicate AC service names. When both 'ac-svc-ref' and attributes of 'attachment-circuits' are defined, the 'ac-svc-ref' takes precedence.
NETCONF and RESTCONF protocols accessing the 'ietf-ac-glue' module have to use a secure transport layer (e.g., SSH, TLS, QUIC) and have to use mutual authentication.
The YANG data model in this document conforms to the Network Management Datastore Architecture (NMDA) defined in RFC 8342.
When an AC is referenced within a specific network access, that AC information takes precedence over any overlapping information also enclosed for that network access. The ACaaS information overrides locally specified attributes for site-network-access entries.
The 'ac-glue' feature is defined to indicate that a VPN implementation supports binding a specific VPN network access or site access to an AC. Augmentations that glue a single network access entry to an AC are guarded by 'if-feature ac-glue'.
The 'ac-ntw-ref' structure within L2NM and L3NM augmentations carries three leafrefs: 'ac-ref' (key, mandatory), 'node-ref' (optional node identifier), and 'network-ref' pointing to '/nw:networks/network/network-id'. This allows correlation of a VPN network access with a specific AC in a specific network.
The 'ac-svc-ntw-ref' grouping defines both a leaf-list 'ac-svc-ref' and a list 'ac-ntw-ref' (keyed by 'ac-ref') to carry multiple service and network AC references. Used to augment the node-level 'vpn-network-accesses' container in both L2NM and L3NM.
The 'ac-svc-ref' grouping defines a leaf-list 'ac-svc-ref' of type 'ac-svc:attachment-circuit-reference', enabling a single site to reference multiple service ACs. Used to augment the site-level 'site-network-accesses' container in both L2SM and L3SM.
The L2NM augmentation at the vpn-network-accesses level (within a vpn-node) adds both 'ac-svc-ref' leaf-list and 'ac-ntw-ref' list (keyed by ac-ref), providing combined service and network AC references for Layer 2 VPN nodes.
The L2SM augmentation at the site-network-accesses level adds a leaf-list 'ac-svc-ref' to bind a site to multiple Layer 2 ACs created using ACaaS. The per-access augmentation (if-feature ac-glue) adds a single 'ac-svc-ref' leaf to bind one site-network-access to one Layer 2 AC.
The L3NM augmentation at the vpn-network-accesses level (within a vpn-node) adds both 'ac-svc-ref' leaf-list and 'ac-ntw-ref' list (keyed by ac-ref), providing combined service and network AC references for Layer 3 VPN nodes.
The L3SM augmentation at the site-network-accesses level adds a leaf-list 'ac-svc-ref' to bind a site to multiple Layer 2/3 ACs created using ACaaS. The per-access augmentation (if-feature ac-glue) adds a single 'ac-svc-ref' leaf to bind one site-network-access to one Layer 2/3 AC.
The 'single-ac-svc-ntw-ref' grouping contains both a single 'ac-svc-ref' leaf (service layer reference) and an 'ac-ntw-ref' container (network layer reference using 'ac-ntw:attachment-circuit-reference'). Used for individual VPN network access entries in the L2NM and L3NM.
The 'single-ac-svc-ref' grouping defines a single 'ac-svc-ref' leaf of type 'ac-svc:attachment-circuit-reference', providing a reference to a specific AC provisioned via the ACaaS module. Used to bind an individual site-network-access or vpn-network-access to one service AC.
IANA registered the URI 'urn:ietf:params:xml:ns:yang:ietf-ac-glue' in the 'ns' subregistry of the IETF XML Registry (RFC 3688), with the IESG as registrant contact.
IANA registered the YANG module 'ietf-ac-glue' in the 'YANG Module Names' registry within the 'YANG Parameters' registry group, with namespace 'urn:ietf:params:xml:ns:yang:ietf-ac-glue', prefix 'ac-glue', and reference RFC 9836. Maintained by IANA: No.
An attacker with write access to 'ac-svc-ref' or 'ac-ntw-ref' can delete or modify ACs bound to a running VPN service, causing service malfunction and SLA violations including complete traffic interruption for a client. Such activity can be detected by monitoring and tracking network configuration changes.
Read access to 'ac-svc-ref' may be used to track the set of VPN instances in which a given customer is involved, creating a privacy-relevant information exposure. 'ac-ntw-ref', unlike 'ac-svc-ref', is unique within the scope of a node and may multiplex many peer CEs.
The Network Configuration Access Control Model (NACM, RFC 8341) provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of available protocol operations and content, and should be used to protect writable AC reference data nodes.