Session

In this presentation we introduce Firewall and Service Tickets (FAST).

FAST is a method to allow applications to signal the network for services, like QoS, that it wants applied to packets. The method is secure, expressive, stateless, not spoofable, deployable, efficient, dynamic, requires no DPI, doesn’t disclose internals of the network, and works with any transport protocol. A core element of FAST are “tickets”. Tickets are attached to packets and describe the services and grants of admission that the application has requested from the network.

We will present the datapath protocol of FAST (being developed in IETF). Tickets are sent in IPv6 Hop-by-Hop options, and we’ll provide rationale why Hop-by-Hop options are really the best choice compared to proposed alternatives despite concerns about them being dropped in the Internet. FAST also allows for “ticket reflection” that is useful to apply requested service in the reply path of a flow, and also allows for symmetric or non-symmetric use between two endpoints of a flow..

We will discuss support for FAST in Linux. Mostly, this amounts to allowing non-privileged users to set Hop-by-Hop options (and Destination options as well). We will present the patches that enable this that still allow sufficient management controls and restrictions on what applications can send.

Finally, we’ll tie all this together with some sample applications using FAST– how the tickets are requested and provided, how they’re set and transmitted in packets, how a network node can process the FAST ticket in the packet and apply network mechanisms to satisfy the service requests.