# A Secure Link-Layer Connectivity Platform for Multi-Site NFV Services
## 2 Background on Multi-Site VNF Communications
### Layer-3 Inter-Site Communications  
A first approach to support data communications among the VNFs of the same network service located at different sites is to rely on layer-3 routing functionalities [4; 5; 6]. Following this approach, inter-site VNF communications would be realized based on information located at the IP header of each packet and the routing decisions taken by the network routers that interconnect the sites where VNFs are deployed. A reference scenario for layer-3 inter-site communications is shown at the bottom part of Figure 1.  
Figure 1: Reference Scenario for Inter-Site Communications. In a layer-3 communications approach, a VNF whose communication peer is located at a remote site (for instance, VNF1b in Figure 1) is generally provided with network-layer connectivity towards an edge router, which in turn offers layer-3 access towards other edge routers across, or on top of, other networks (e.g., the Internet). This network-layer connectivity can be realized in different ways. As an example, a site administrator may configure a set of VLANs on its local network infrastructure to interconnect the NFVI with the edge router. The administrator can then use the VIM to pre-create virtual links on the NFVI, supporting the attachment of VNFs to those VLANs. With this configuration, a VNF requiring network connectivity with a remote VNF is simply allocated to a VLAN, being attached upon instantiation to the virtual link on the NFVI that offers access to that VLAN. This way, the VNF and the edge router are effectively connected on the same VLAN, and the latter can act as the next IP hop of the VNF towards external networks. Traffic originated at this VNF can then be delivered to the edge router over the VLAN, and then routed towards the remote site, for example, through a chain of network routers, maybe even owned by different Internet service providers, or via transport services emulating a L3 environment, such as an MPLS-based layer-3 VPN. At the remote site, its edge router shares a VLAN with the destination VNF (or, alternatively, with a VNF that serves as the next hop towards the destination VNF). When the edge router receives the data traffic, it can route it towards its final destination. In the reverse direction, traffic is delivered following an analogous approach. This inter-site communication model is completely functional, taking advantage of the scalability and resiliency properties inherent to IP routing on the site-to-site network paths. Still, our experience suggests that a layer-3 approach presents some limitations with regards to NFV multi-site connectivity that are described next:  
**(1) There is no strict isolation among multi-site network services**. As a matter of fact, we can observe in the picture that VNF1b and VNF2b, which belong to different network services, are both connected to edge router \(A\). This inevitably means that both VNFs are automatically interconnected at layer-3 and could potentially reach each other, raising security concerns. One alternative to address this issue is to use Virtual Routing and Forwarding (VRF) instances at edge routers. VRF technology enables the coexistence and use of multiple routing tables on a network router. However, their use creates a new challenge related to the automated deployment and configuration of these instances in multi-site environments, making their use in our NFV reference scenario impractical in large-scale multi-service production environments. Another direct method to address this limitation could be to define specific filtering rules at the edge router, to prevent cross data traffic among different virtual links of the NFVI (and, consequently, among different network services deployed at the site). Although this approach can help in providing a certain degree of confinement among network services at a single site, it may be impractical to isolate inter-site data traffic.