# A Secure Link-Layer Connectivity Platform for Multi-Site NFV Services
## 5 Conclusions  
In this paper, we have presented L5, a platform to support secure link-layer connectivity for virtual functions in multi-site NFV ecosystems. The platform can be deployed and managed as any other virtual service running on the NFV environment, leveraging pre-created virtual links to support the multi-site communications of other NFV services. From a conceptual perspective, L5 provides the abstraction of a layer-2 switch, presenting a set of access ports at every NFV site. These access ports can flexibly be assigned to different VLANs, and be used to provision link-layer connectivity to VNFs running at different sites. L5 uses protected IP tunnels to deliver each VLAN traffic among NFV sites. This way, the platform leverages the scalability and resilience properties of a layer-3 communication model, while preserves the isolated operation of multi-site NFV services using different VLANs.  
In addition, we have developed a functional prototype of the platform using _Open vSwitch_, Linux VXLAN interfaces, and the _strongSwan_ IPsec solution. The throughput measurements obtained with this prototype benefit from the allocation of multiple CPUs to L5 platform components. This is particularly noticeable when the MTU value of the L5 VLANs is chosen in such a way that fragmentation and reassembly procedures are avoided at the L5 platform. We have validated the functional behavior of L5 on a multi-site NFV ecosystem that is available at the 5 TONIC laboratory. To this purpose, we have deployed an IPTV service on three independent sites of the 5 TONIC NFV ecosystem (one of these sites has been made available at an external location, using the 5 TONIC VPN service). In our validation scenario, the L5 platform supported the appropriate operation of the IPTV service, enabling the multicast-based distribution of video content among the three NFV sites.  
Our future work will focus on the automation aspects of the L5 platform, to dynamically accommodate the communication requirements of NFV infrastructure providers, and to consider the current ETSI NFV work on PaaS (Platform as a Service) models for L5 management and orchestration. In particular, we consider the development of day-2 configuration mechanisms for the L5 VNFs. These mechanisms will be integrated into the management and orchestration procedures of a multi-site NFV ecosystem, enabling the creation of L5 VLANs as they are required, to support the multi-site data communications of new NFV services.  
Conceptualization, I.V. and D.L.; methodology, I.V., F.V. and J.R.; software, I.V. and B.N.; validation, I.V. and B.N.; formal analysis, I.V. and F.V.; investigation, I.V., B.N., D.L., J.R., F.V. and A.A.; resources, D.L., A.A., F.V.; data curation, I.V., B.N. and F.V.; writing--original draft preparation, I.V., J.R., D.L. and B.N.; writing--review and editing, I.V., F.V., D.L., J.R., B.N. and A.A.; visualization, I.V., B.N. and F.V.; supervision, I.V. and D.L.; project administration, D.L., F.V. and A.A.; funding acquisition, D.L., F.V. and A.A. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This article has partially been supported by the European H2020 FISHY Project (grant agreement 952644), and the TRUE5G project funded by the Spanish National Research Agency (PID2019-108713 RB-C52/AEI/10.13039/501100011033).  
**Conflicts of Interest:** The authors declare no conflict of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results.