# A Secure Link-Layer Connectivity Platform for Multi-Site NFV Services
## 3 Description of the L2S Platform
### Layer-2 Connectivity for Multi-Site Network Services  
Once a functional instantiation of the L2S platform is available on a set of NFVIs, it can be used to support data communications among VNFs deployed on them. In our example of Figure 2, \(\text{NS}_{2}\) requires layer-2 connectivity between \(\text{VNF}_{2\text{b}}\), \(\text{VNF}_{2\text{c}}\), and \(\text{VNF}_{2\text{d}}\), being these VNFs deployed at different sites. To realize this connectivity and preserve the VNF forwarding graph, \(\text{NS}_{2}\) is assigned a VLAN from the L2S platform (VLAN 102 in our example). This VLAN must be selected in advance by the infrastructure providers involved in the deployment, considering the set of available VLANs that they share for their inter-site communications. Upon the deployment of \(\text{NS}_{2}\), \(\text{VNF}_{2\text{b}}\) is attached to the pre-created virtual link that provides connectivity to access port 2 of the L2S platform. This virtual link should be indicated to the MANO platform of site \(A\), as a deployment parameter for \(\text{VNF}_{2\text{b}}\). Analogously, \(\text{VNF}_{2\text{c}}\) and \(\text{VNF}_{2\text{d}}\) are connected to ports 4 and 5 of the layer-2 switch, through the respective virtual links at sites \(B\) and \(C\). At this point, \(\text{VNF}_{2\text{b}}\), \(\text{VNF}_{2\text{c}}\), and \(\text{VNF}_{2\text{d}}\) will be interconnected at layer-2 by the L2S platform. A similar procedure would be followed to deploy \(\text{NS}_{1}\), with VLAN 101 allocated by the layer-2 switch.  
The L2S platform guarantees a strict isolation among multi-site network services. In our example, \(\text{VNF}_{1\text{b}}\) is not reachable by \(\text{VNF}_{2\text{b}}\), \(\text{VNF}_{2\text{c}}\), or \(\text{VNF}_{2\text{d}}\). This is because the latter are connected to VLAN 102 of the layer-2 switch, and traffic entering an access port of VLAN 102 can only be addressed towards other access ports on the same VLAN. On the other hand, VNFs of the same network service can be interconnected at the link-layer, independently of the site where they are actually deployed. This way, our solution preserves the VNF forwarding graph in multi-site network services, which avoids additional day-2 configurations on the VNFs by end users, e.g., to use specific edge routers as next hops in their routing tables. Last but not least, the deployment of functional multi-site network services does not require per-service forwarding state at the intermediate routers that interconnect NFV sites. Inter-site traffic is always transmitted within IP tunnels that are established among L2S VNFs. Hence, the IP addresses that VNFs use for data communications (even IP multicast and anycast addresses) are not visible to intermediate network routers, which only observe IP data packets originated and terminated at L2S VNFs (i.e., the IP tunnel endpoints). Consequently, to realize inter-site communications, intermediate routers only need forwarding state to reach the L2S VNFs, and not the VNFs of the multi-site network services that are to be deployed.  
Therefore, the L2S platform enables layer-2 communications among the VNFs of a multi-site network service. Still, inter-site data communications take place at layer-3, using IP tunnels that terminate at L2S VNFs. This way, our solution provides the scalability and resilience of a layer-3 inter-site communication approach, while addressing its limitations.