Network Working Group M. Boucadair
Internet-Draft C. Jacquenet
Intended status: Standards Track Orange
Expires: July 14, 2018 S. Sivakumar
Cisco Systems
January 10, 2018

A YANG Data Module for Dual-Stack Lite (DS-Lite)
draft-ietf-softwire-dslite-yang-14

Abstract

This document defines a YANG module for the DS-Lite Address Family Transition Router (AFTR) and Basic Bridging BroadBand (B4) elements.

Editorial Note (To be removed by RFC Editor)

Please update these statements with the RFC number to be assigned to this document:

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on July 14, 2018.

Copyright Notice

Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.


Table of Contents

1. Introduction

This document defines a data model for DS-Lite [RFC6333], using the YANG data modeling language [RFC7950]. Both the Address Family Transition Router (AFTR) and Basic Bridging BroadBand (B4) elements are covered by this specification.

As a reminder, Figure 1 illustrates an overview of the DS-Lite architecture that involves AFTR and B4 elements.

                   +-----------+
                   |    Host   |
                   +-----+-----+
                         |192.0.2.1
                         |
                         |
                         |192.0.2.2
               +---------|---------+
               |         |         |
               |    Home router    |
               |+--------+--------+|
               ||       B4        ||
               |+--------+--------+|
               +--------|||--------+
                        |||2001:db8:0:1::1
                        |||
                        |||<-IPv4-in-IPv6 softwire
                        |||
                 -------|||-------
               /        |||        \
              |   ISP core network  |
               \        |||        /
                 -------|||-------
                        |||
                        |||2001:db8:0:2::1
               +--------|||--------+
               |        AFTR       |
               |+--------+--------+|
               ||   Concentrator  ||
               |+--------+--------+|
               |       |NAT|       |
               |       +-+-+       |
               +---------|---------+
                         |198.51.100.1
                         |
                 --------|--------
               /         |         \
              |       Internet      |
               \         |         /
                 --------|--------
                         |
                         |203.0.113.1
                   +-----+-----+
                   | IPv4 Host |
                   +-----------+

Figure 1: DS-Lite Base Architecture

[RFC6908].

This document follows the guidelines of [RFC6087], uses the common YANG types defined in [RFC6991], and adopts the Network Management Datastore Architecture (NMDA).

1.1. Terminology

This document makes use of the terms defined in Section 3 of [RFC6333].

The terminology for describing YANG data modules is defined in [RFC7950].

The meaning of the symbols in tree diagrams is defined in [I-D.ietf-netmod-yang-tree-diagrams].

2. DS-Lite YANG Module: An Overview

As shown in Figure 1:

Therefore, the DS-Lite YANG module is designed to augment both the Interfaces YANG module [RFC7223] and the NAT YANG module [I-D.ietf-opsawg-nat-yang] with DS-Lite specific features.

The YANG "feature" statement is used to distinguish which of the DS-Lite elements ('aftr' or 'b4') is relevant for a specific data node.

Concretely, the DS-Lite YANG module (Figure 2) augments the Interfaces YANG module with the following:

In addition, the DS-Lite YANG module augments the NAT YANG module (policy, in particular) with the following:

Given that the NAPT table of the AFTR element is extended to include the source IPv6 address of incoming packets, the DS-Lite YANG module augments the NAPT44 mapping-entry with the following:

Access Control List (ACL) and Quality of Service (QoS) policies discussed in Section 2.5 of [RFC6908] are out of scope. A YANG module for ACLs is documented in [I-D.ietf-netmod-acl-model].

Likewise, PCP-related considerations discussed in Section 8.5 of [RFC6333] are out of scope. A YANG module for PCP is documented in [I-D.boucadair-pcp-yang].

module: ietf-dslite
  augment /if:interfaces/if:interface:
    +--rw ipv6-address?              inet:ipv6-address
    +--rw ipv4-address?              inet:ipv4-address
    +--rw aftr-ipv6-addr?            inet:ipv6-address {b4}?
    +--rw tunnel-mtu?                uint16
    +--rw v6-v4-dscp-preservation?   boolean
  augment /nat:nat/nat:instances/nat:instance/nat:policy:
    +--rw max-softwires-per-subscriber?   uint8 {aftr}?
    +--rw state-migrate?                  boolean {aftr}?
    +--rw b4-address-change-limit?        uint32 {aftr}?
    +--rw mss-clamping {aftr}?
       +--rw enable?      boolean
       +--rw mss-value?   uint16
  augment /nat:nat/nat:instances/nat:instance
          /nat:mapping-table/nat:mapping-entry:
    +--rw b4-ipv6-address {aftr}?
    |  +--rw address?               inet:ipv6-address
    |  +--rw last-address-change?   yang:date-and-time
    +--rw v6-dscp?            uint8 {aftr}?
    +--rw internal-v4-dscp?   uint8 {aftr}?
    +--rw external-v4-dscp?   uint8 {aftr}?
  augment /nat:nat/nat:instances/nat:instance
          /nat:statistics/nat:mappings-statistics:
    +--ro active-softwires?   yang:gauge32 {aftr}?

  notifications:
    +---n b4-address-change-limit-policy-violation {aftr}?
       +--ro id           -> /nat:nat/instances/instance/id
       +--ro policy-id    -> /nat:nat/instances/instance/policy/id
       +--ro address      inet:ipv6-address

Figure 2: YANG Module for DS-Lite

Examples to illustrate the use of this module are provided in Appendix A and Appendix B.

3. DS-Lite YANG Module

<CODE BEGINS> file "ietf-dslite@2018-01-10.yang"

module ietf-dslite {
  yang-version 1.1;

  namespace "urn:ietf:params:xml:ns:yang:ietf-dslite";
  prefix dslite;
    
  import ietf-inet-types { prefix inet; }
  import ietf-interfaces { prefix if; }
  import iana-if-type { prefix ianaift; }
  import ietf-nat {prefix nat;}
  import ietf-yang-types { prefix yang; }
    
  organization "IETF Softwire Working Group";

  contact

    "WG Web:   <https://datatracker.ietf.org/wg/softwire/>
     WG List:  <mailto:softwires@ietf.org>

     Editor:  Mohamed Boucadair 
              <mailto:mohamed.boucadair@orange.com>
   
     Editor:  Christian Jacquenet 
              <mailto:christian.jacquenet@orange.com>

     Editor:  Senthil Sivakumar 
              <mailto:ssenthil@cisco.com>";
     
   description
      "This module is a YANG module for DS-Lite AFTR and B4 
      implementations.

      Copyright (c) 2017 IETF Trust and the persons identified as
      authors of the code.  All rights reserved.

      Redistribution and use in source and binary forms, with or
      without modification, is permitted pursuant to, and subject
      to the license terms contained in, the Simplified BSD License
      set forth in Section 4.c of the IETF Trust's Legal Provisions
      Relating to IETF Documents
      (http://trustee.ietf.org/license-info).

      This version of this YANG module is part of RFC XXXX; see
      the RFC itself for full legal notices.";

  revision 2018-01-10 {
    description
      "Initial revision.";
    reference
      "RFC XXXX: A YANG Data Module for Dual-Stack Lite (DS-Lite)";
  }

 /*
  * Features
  */

  feature b4 {
    description
      "The B4 element is a function implemented on a dual-stack-capable
       node, either a directly connected device or a CPE, that creates 
       a tunnel to an AFTR.";
    reference
      "Section 5 of RFC 6333."; 
  }

  feature aftr {
    description
      "An AFTR element is the combination of an IPv4-in-IPv6 tunnel 
       endpoint and an IPv4-IPv4 NAT implemented on the same node.";
    reference
      "Section 6 of RFC 6333."; 
  }

 /*
  * Augments
  */

  augment "/if:interfaces/if:interface" {
    when 'derived-from(if:type, "ianaift:tunnel")'; 
    description 
      "Augments Interface module with DS-Lite parameters.

       IANA interface types are maintained at this registry:
       https://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib.
         
       tunnel (131),       -- Encapsulation interface"; 
        
    leaf ipv6-address {
      type inet:ipv6-address;
      description 
        "IPv6 address of the local DS-Lite endpoint (AFTR or B4).";
      reference
        "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                   IPv4 Exhaustion"; 
    }
    
    leaf ipv4-address {
      type inet:ipv4-address;
      description 
        "IPv4 address of the local DS-Lite AFTR or B4.

         192.0.0.1 is reserved for the AFTR element, while 
         192.0.0.0/29 is reserved for the B4 element.

         This address can be used to report ICMP problems and will
         appear in traceroute outputs.";
      reference
        "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                   IPv4 Exhaustion";  
    }

    leaf aftr-ipv6-addr {
      if-feature b4;
      type inet:ipv6-address;
      description
        "Indicates the AFTR's IPv6 address to be used by a B4 element.";
      reference
        "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                   IPv4 Exhaustion";  
    }
   
    leaf tunnel-mtu {
      type uint16;
      description 
        "Configures a tunnel MTU.

         [RFC6908] specifies that since fragmentation and reassembly
         is not optimal, the operator should do everything possible
         to eliminate the need for it.  If the operator uses simple 
         IPv4-in-IPv6 softwire, it is recommended that the MTU size 
         of the IPv6 network between the B4 and the AFTR accounts for
         the additional overhead (40 bytes)."; 
      reference
        "RFC 6908: Deployment Considerations for Dual-Stack Lite"; 
    }          
   
    leaf v6-v4-dscp-preservation {
      type boolean;
      description 
        "Copies the DSCP value from the IPv6 header and vice versa.

         According to Section 2.10 of [RFC6908], operators should 
         use this model by provisioning the network such that the 
         AFTR/B4 copies the DSCP value in the IPv4 header to 
         the Traffic Class field in the IPv6 header, after the 
         encapsulation for the downstream traffic.";
      reference
        "Section 2.10 of RFC 6908."; 
    }
  }

  augment "/nat:nat/nat:instances/nat:instance/nat:policy" {
    when "derived-from-or-self(/nat:nat/nat:instances/nat:instance/" + 
         "nat:type, 'nat:napt44')" + 
         " and /nat:nat/nat:instances/nat:instance/" + 
         "nat:per-interface-binding='dslite'";
    if-feature aftr;
    description 
      "Augments the NAPT44 module with AFTR parameters.";        

    leaf max-softwires-per-subscriber {
      type uint8;
      default 1;
      description 
        "Configures the maximum softwires per subscriber feature.

         A subscriber is uniquely identified by means 
         of a subscriber mask (subscriber-mask-v6).

         This policy aims to prevent a misbehaving subscriber from 
         mounting several DS-Lite softwires that would consume 
         additional AFTR resources (e.g., get more external ports 
         if the quota were enforced on a per-softwire basis,
         consume extra processing due to a large number of active 
         softwires).";

      reference
        "Section 4 of RFC 7785."; 
    }
  
    leaf state-migrate {
      type boolean;
      default true;
      description 
        "State migration is enabled by default.

         In the event a new IPv6 address is assigned to the B4 element,
         the AFTR should migrate existing state to be bound to the new
         IPv6 address.  This operation ensures that traffic destined to
         the previous B4's IPv6 address will be redirected to the newer
         B4's IPv6 address.  The destination IPv6 address for tunneling
         return traffic from the AFTR should be the last seen as the 
         B4's IPv6 source address from the user device (e.g., CPE).

         The AFTR uses the subscriber-mask-v6 to determine whether two
         IPv6 addresses belong to the same CPE (e.g., if the
         subscriber-mask-v6 is set to 56, the AFTR concludes that
         2001:db8:100:100::1 and 2001:db8:100:100::2 belong to the same
         CPE assigned with 2001:db8:100:100::/56).";

      reference
        "RFC 7785: Recommendations for Prefix Binding in the Context
                   of Softwire Dual-Stack Lite"; 
    }

    leaf b4-address-change-limit {
      type uint32;
      units "seconds";
      default '1800';
      description
        "Minimum number of seconds between successive B4's IPv6 address
         change from the same prefix.

         Changing the source B4's IPv6 address may be used as an attack
         vector.  Packets with a new B4's IPv6 address from the same 
         prefix should be rate-limited.

         It is recommended to set this rate limit to 30 minutes; other
         values can be set on a per-deployment basis.";

      reference
        "RFC 7785: Recommendations for Prefix Binding in the Context
                   of Softwire Dual-Stack Lite"; 
    }      
   
    container mss-clamping {
      description 
        "MSS rewriting configuration to avoid IPv6 fragmentation.";

      leaf enable {
        type boolean;
        description 
          "Enable/disable MSS rewriting feature.";
      }
    
      leaf mss-value {
        type uint16;
        units "octets";
        description 
          "Sets the MSS value to be used for MSS rewriting.";
      }
    }
  }

  augment "/nat:nat/nat:instances/nat:instance/"+
          "nat:mapping-table/nat:mapping-entry" {
    when "derived-from-or-self(/nat:nat/nat:instances/nat:instance/" + 
         "nat:type, 'nat:napt44')" + 
         " and /nat:nat/nat:instances/nat:instance/" + 
         "nat:per-interface-binding='dslite'";
    if-feature aftr;
    description
      "Augments the NAPT44 mapping table with DS-Lite specifics."; 

    container b4-ipv6-address {
      description 
        "Records the IPv6 address used by a B4 element and the last 
         time that address changed.";

      leaf address {
        type inet:ipv6-address;
        description 
          "Corresponds to the IPv6 address used by a B4 element.";
        reference
          "RFC 6333: Dual-Stack Lite Broadband Deployments Following
                     IPv4 Exhaustion"; 
      } 
  
      leaf last-address-change {
        type yang:date-and-time;      
        description 
          "Records the last time when the address changed.";
      }
    }

    leaf v6-dscp {
      when "/if:interfaces/if:interface/" + 
           "dslite:v6-v4-dscp-preservation='true'";
      type uint8;
      description 
        "DSCP value used at the softwire level (i.e., IPv6 header)."; 
    }

    leaf internal-v4-dscp {
      when "/if:interfaces/if:interface/" + 
           "dslite:v6-v4-dscp-preservation='true'";
      type uint8;
      description 
        "DSCP value of the encapsulated IPv4 packet."; 
    }

    leaf external-v4-dscp {
      when "/if:interfaces/if:interface/" + 
           "dslite:v6-v4-dscp-preservation='true'";
      type uint8;
      description 
        "DSCP value of the translated IPv4 packet as marked by
         the AFTR."; 
    }
  }

  augment "/nat:nat/nat:instances/nat:instance/nat:statistics/" +
          "nat:mappings-statistics" {
    if-feature aftr;
    description 
      "Indicates the number of active softwires.";

    leaf active-softwires{
      type yang:gauge32;
      description
        "The number of currently active softwires on the AFTR
         instance.";
    }
  }

 /*
  * Notifications
  */

  notification b4-address-change-limit-policy-violation {
    if-feature aftr;
    description
      "Generates notifications when a B4 unsuccessfully attempts 
       to change IPv6 address in a time shorter than the value of
       b4-address-change-limit. 

       Notifications are rate-limited (notify-interval).";

    leaf id {    
      type leafref {
        path "/nat:nat/nat:instances/nat:instance/nat:id";
      }
      mandatory true; 
      description
        "NAT instance identifier.";
    }

    leaf policy-id {    
      type leafref {
        path "/nat:nat/nat:instances/nat:instance/nat:policy/nat:id";
      }
      mandatory true; 
      description
        "Policy Identifier.";
    }

    leaf address {
      type inet:ipv6-address;
      mandatory true;
      description
        "B4's IPv6 address.";
    }
  }
}
<CODE ENDS>

4. Security Considerations

The YANG module defined in this document is designed to be accessed via network management protocols such as NETCONF [RFC6241] or RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure transport is TLS [RFC5246].

The NETCONF access control model [RFC6536] provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content.

All data nodes defined in the YANG module which can be created, modified and deleted (i.e., config true, which is the default) are considered sensitive. Write operations (e.g., edit-config) applied to these data nodes without proper protection can negatively affect network operations. An attacker who is able to access to the B4/AFTR can undertake various attacks, such as:

Additional security considerations are discussed in [I-D.ietf-opsawg-nat-yang].

Security considerations related to DS-Lite are discussed in [RFC6333].

5. IANA Considerations

         URI: urn:ietf:params:xml:ns:yang:ietf-dslite
         Registrant Contact: The IESG.
         XML: N/A; the requested URI is an XML namespace.
         name: ietf-dslite
         namespace: urn:ietf:params:xml:ns:yang:ietf-dslite
         prefix: dslite
         reference: RFC XXXX

This document requests IANA to register the following URI in the "IETF XML Registry" [RFC3688]: [RFC7950].

6. Acknowledgements

Thanks to Qin Wu, Benoit Claise, and Andy Bierman who helped for identifying compiling errors. Mahesh Jethanandani provided an early yangdoctors review; many thanks to him.

Many thanks to Ian Farrer for the review and comments.

7. References

7.1. Normative references

[I-D.ietf-opsawg-nat-yang] Boucadair, M., Sivakumar, S., Jacquenet, C., Vinapamula, S. and Q. Wu, "A YANG Data Model for Network Address Translation (NAT) and Network Prefix Translation (NPT)", Internet-Draft draft-ietf-opsawg-nat-yang-09, November 2017.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/RFC5246, August 2008.
[RFC6241] Enns, R., Bjorklund, M., Schoenwaelder, J. and A. Bierman, "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011.
[RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011.
[RFC6333] Durand, A., Droms, R., Woodyatt, J. and Y. Lee, "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion", RFC 6333, DOI 10.17487/RFC6333, August 2011.
[RFC6536] Bierman, A. and M. Bjorklund, "Network Configuration Protocol (NETCONF) Access Control Model", RFC 6536, DOI 10.17487/RFC6536, March 2012.
[RFC6991] Schoenwaelder, J., "Common YANG Data Types", RFC 6991, DOI 10.17487/RFC6991, July 2013.
[RFC7223] Bjorklund, M., "A YANG Data Model for Interface Management", RFC 7223, DOI 10.17487/RFC7223, May 2014.
[RFC7950] Bjorklund, M., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016.
[RFC8040] Bierman, A., Bjorklund, M. and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017.

7.2. Informative references

[I-D.boucadair-pcp-yang] Boucadair, M., Jacquenet, C., Sivakumar, S. and S. Vinapamula, "YANG Modules for the Port Control Protocol (PCP)", Internet-Draft draft-boucadair-pcp-yang-05, October 2017.
[I-D.ietf-netmod-acl-model] Jethanandani, M., Huang, L., Agarwal, S. and D. Blair, "Network Access Control List (ACL) YANG Data Model", Internet-Draft draft-ietf-netmod-acl-model-14, October 2017.
[I-D.ietf-netmod-yang-tree-diagrams] Bjorklund, M. and L. Berger, "YANG Tree Diagrams", Internet-Draft draft-ietf-netmod-yang-tree-diagrams-04, December 2017.
[RFC3022] Srisuresh, P. and K. Egevang, "Traditional IP Network Address Translator (Traditional NAT)", RFC 3022, DOI 10.17487/RFC3022, January 2001.
[RFC6087] Bierman, A., "Guidelines for Authors and Reviewers of YANG Data Model Documents", RFC 6087, DOI 10.17487/RFC6087, January 2011.
[RFC6908] Lee, Y., Maglione, R., Williams, C., Jacquenet, C. and M. Boucadair, "Deployment Considerations for Dual-Stack Lite", RFC 6908, DOI 10.17487/RFC6908, March 2013.
[RFC7785] Vinapamula, S. and M. Boucadair, "Recommendations for Prefix Binding in the Context of Softwire Dual-Stack Lite", RFC 7785, DOI 10.17487/RFC7785, February 2016.

Appendix A. B4 Example

The following example shows a B4 element (2001:db8:0:1::1) that is configured with an AFTR element (2001:db8:0:2::1). The B4 element is also instructed to preserve the DSCP marking.

<interfaces>
  <interface>
    <name>myB4</name>
    <type>ianaift:tunnel</type>
    <enabled>true</enabled>
    <dslite:ipv6-address>
      2001:db8:0:1::1
    </dslite:ipv6-address>
    <dslite:aftr-ipv6-addr>
      2001:db8:0:2::1
    </dslite:aftr-ipv6-addr>
    <dslite:v6-v4-dscp-preservation>
      true
    </dslite:v6-v4-dscp-preservation>
  </interface>
</interfaces>

Appendix B. AFTR Examples

The following example shows an AFTR that is reachable at 2001:db8:0:2::1. Also, this XML snippet indicates that the AFTR is provided with an IPv4 address (192.0.0.1) to be used for troubleshooting purposes such as reporting problems to B4s.

Note that a subscriber is identified by a subscriber mask ([RFC7785]) that can be configured by means of [I-D.ietf-opsawg-nat-yang].

<interfaces>
  <interface>
    <name>myAFTR</name>
    <type>ianaift:tunnel</type>
    <enabled>true</enabled>
    <dslite:ipv6-address>2001:db8:0:2::1</dslite:ipv6-address>
    <dslite:ipv4-address>192.0.0.1</dslite:ipv4-address>
  </interface>
</interfaces>

The following shows an XML excerpt depicting a dynamic UDP mapping entry maintained by a DS-Lite AFTR for a packet received from the B4 element introduced in Appendix A. Concretely, this UDP packet received with a source IPv6 address (2001:db8:0:1::1), a source IPv4 address (192.0.2.1), and source port number (1568) is translated into a UDP packet having a source IPv4 address (198.51.100.1) and source port number (15000). The remaining lifetime of this mapping is 300 seconds.

<mapping-entry>
  <index>15</index>
  <type>
    dynamic-explicit
  </type>
  <transport-protocol>
    17
  </transport-protocol>
  <dslite:b4-ipv6-address>
    <dslite:address>
      2001:db8:0:1::1
    </dslite:address>
  </dslite:b4-ipv6-address>
  <internal-src-address>
    192.0.2.1
  </internal-src-address>
  <internal-src-port>
    <start-port-number>
      1568
    </start-port-number>
  </internal-src-port>
  <external-src-address>
    198.51.100.1
  </external-src-address>
  <external-src-port>
    <start-port-number>
      15000
    </start-port-number>
  </external-src-port>
  <lifetime>
    300
  </lifetime>
</mapping-entry>

Authors' Addresses

Mohamed Boucadair Orange Rennes, 35000 France EMail: mohamed.boucadair@orange.com
Christian Jacquenet Orange Rennes, 35000 France EMail: christian.jacquenet@orange.com
Senthil Sivakumar Cisco Systems 7100-8 Kit Creek Road Research Triangle Park, North Carolina 27709 USA Phone: +1 919 392 5158 EMail: ssenthil@cisco.com