# A Secure Link-Layer Connectivity Platform for Multi-Site NFV Services
## 1 Introduction
This is because NFV sites may be geographically distributed and interconnected through untrusted network domains owned by multiple Internet service providers that in most cases, must remain oblivious to NFV operations. Moreover, sites may belong to different stakeholders and be subject to distinct management and orchestration policies, enforced by a variety of mechanisms. For these reasons, inter-site communications in distributed NFV ecosystems have commonly relied on existing layer-3 inter-site routing mechanisms (i.e., Internet routing) and/or on the use of overlay network technologies, such as Virtual Private Networks (VPNs). We want to highlight that this approach has satisfactorily been used in different research projects funded by the European Union, with the goal of implementing distributed 5G testing facilities across Europe, fostering extensive trials and demonstration with 5G technologies that involve vertical industries and key stakeholders. In particular, the 5 GINFIRE project built an experimentation ecosystem with nine NFV testing facilities, spanning Europe and Brazil [3]. In this ecosystem, data-plane communications among VNFs deployed at different sites were supported through layer-3 routing and a VPN-based overlay network [4]. Following a similar approach, the 5G-VINNI project leverages layer-3 routing and VPN functionalities to create dedicated logical networks that enable the interconnection of VNFs running on a set of eight 5G facilities [5]. The 5G-EVE project defines a specific functional entity (the Data-Plane Network Gateway) that is deployed on each of the eight 5G facilities involved in the project [6]. These data-plane gateways provide secure data connectivity among the different sites, using IP tunnels (based on IP security, IPsec [7],or Generic Routing Encapsulation, GRE [8]) and layer-3 routing. This way, the 5G-EVE project supports layer-3 connectivity among remote VNFs. Although this approach has proven to be effective to enable secure layer-3 connectivity among distant NFV sites, we want to observe that it still presents non-negligible limitations to support data communications among VNFs deployed at those sites, considering: (a) the bounded capacity of layer-3 routing mechanisms to guarantee the isolation among multi-site NFV services; (b) the potential need for undesirable day-2 configurations for the VNFs themselves, making the multi-site nature of the NFV ecosystem not oblivious to tenants; and (c) the potential requirement to configure additional forwarding state on the underlying network infrastructures that support inter-site and inter-VNF connectivity. In this context, this paper presents the following scientific contributions:  
* It identifies and analyzes the main challenges of existing approaches to support inter-site data communications in NFV ecosystems, considering layer-3 and layer-2 models for inter-site communications. * To address these challenges, the paper presents L2S, a connectivity platform that supports secure link-layer communications for multi-site NFV services. From a conceptual perspective, L2S provides the abstraction of a VLAN-capable layer-2 switch that spans multiple NFV sites. VNFs deployed on different sites can be attached to the same VLAN of the switch and be provided with link-layer connectivity with other remote VNFs. L2S protects data communications among NFV sites using existing security solutions, e.g., IPsec. Moreover, the platform can be deployed on multiple NFV sites as a regular multi-site network service. Hence, the solution does not require the installation and management of additional network equipment at those sites. * We have developed a completely functional prototype of our solution, demonstrating its potential of innovation using standard protocols and state-of-the-art open-source technologies. * We have validated the practical feasibility of our solution at the 5G Telefonica Open Network Innovation Centre (5 TONIC) [9], using it to support a realistic multi-site IP television service.