Anapaya appliance configuration (scion only)

scion object

The SCION section contains the configuration of the SCION protocol and AS. It consists of a list of SCION AS configurations. An Anapaya appliance can have configurations for multiple SCION ASes, however, in most cases there will only be a single SCION AS configured. Additionally, the path and beacon synchronization between multiple appliances can be configured in this section.

ases object[]

List of SCION ASes that this device is part of identified by their ISD-AS identifier.

Array [

ca_service object

SCION CPPKI (Control Plane Public Key Infrastructure) CA service configuration data. This section defines how the anapaya-scion interacts with the SCION CPPKI CA service backend. It is only required for SCION ASes that act as a CA in their respective ISD.

anapaya_vault object

The configuration data of the Anapaya SCION CPPKI CA service. This section must be provided when the CA service type is ANAPAYA_VAULT.

addressesstring[]

The list of addresses where the Anapaya Vault backend can be reached. This list must be non-empty.

credentials object

The necessary credentials to be logged into the Anapaya Vault backend.

role_idstring

The role ID used to authenticate with the Vault backend via the AppRole Authentication Method. See https://www.vaultproject.io/docs/auth/approle for more details.

secret_id_refstring<secret-ref>

Reference to the secret ID used to authenticate with the Vault backend via the AppRole Authentication Method. See https://www.vaultproject.io/docs/auth/approle for more details.

validation object

The validation option configures how the Anapaya Vault backend validate CSRs.

subjectstring

The subject option configures how the Anapaya Vault backend validates the subject of the CSRs.

Enum Value	Description
EXACT_MATCH	The Anapaya Vault backend validates that the complete CSR subject is exactly the same as in the certificate that was used to sign the request.
MATCHING_ISD_AS	The Anapaya Vault backend validates that the ISD-AS field of the CSR subject is the same as in the certificate that was used to sign the request.

Possible values: [MATCHING_ISD_AS, EXACT_MATCH]

external object

The configuration data for the External SCION CPPKI CA service. This section must be provided when the CA service is of type EXTERNAL.

addressstring

The address where the external SCION CPPKI CA service can be reached.

Example: 192.0.2.3:5000

client_idstring

The client ID that is used to authenticate with the CA service. The client ID is set in the 'sub' and 'iss' claim of the generated JWT. If unset, a generic client ID based on the ISD-AS is used.

shared_secret_refstring<secret-ref>

Reference to the shared secret used between the appliance and the CA service (used to generate JWTs for authentication).

service_typestring

The type of CA service that is used by the appliance.

EXTERNAL is a generic CA backend not implemented by Anapaya. Note that the external CA backend must implement the SCION CA API to be compatible with the Anapaya appliance. If this service type is used, the external section must be configured.

ANAPAYA_VAULT is the SCION CA backend provided by Anapaya. It is based on Hashicorp Vault with a suitable frontend. If this service type is used, the anapaya_vault section must be configured.

IN_PROCESS is a CA service that is implemented in the Anapaya appliance. It should only be used for testing purposes and is not suitable for productive use. If this service type is used, no other section needs to be configured.

Enum Value	Description
ANAPAYA_VAULT	ANAPAYA_VAULT is the SCION CA backend provided by Anapaya. It is based on Hashicorp Vault with a suitable frontend. If this service type is used, the 'anapaya_vault' section must be configured.
EXTERNAL	EXTERNAL is a generic CA backend not implemented by Anapaya. Note that the external CA backend must implement the SCION CA API to be compatible with the Anapaya appliance. If this service type is used, the 'external' section must be configured.
IN_PROCESS	IN_PROCESS is a CA service that is implemented in the Anapaya appliance. It should only be used for testing purposes and is not suitable for productive use. If this service type is used, no other section needs to be configured.

Possible values: [EXTERNAL, ANAPAYA_VAULT, IN_PROCESS]

control object

The configuration for the SCION control service.

addressstring

The address of the control service. Clients connect to this address to request control plane data, e.g., SCION path segments. The address needs to be specified as a string in the format :. If the port is set to 0 it will be automatically assigned.

Example: 192.168.1.1:30100

enabledbooleanrequired

Whether the service is enabled.

coreboolean

Indicate whether the AS is core in its ISD. The core flag must only be set if the AS is a core AS in its ISD (as indicated in the TRC of the ISD). A core AS provides connectivity to other SCION ISDs and operates the main path directories within its ISD. It also regularly initiates path construction beacons that create path segments to other SCION ASes in the same ISD or to other core ASes in different ISDs. For most of the ASes this is not the case and the flag must be set to false or not specified (defaults to false)

Default value: false

cppki object

SCION CPPKI configuration for the SCION AS.

disable_auto_renewalboolean

Whether automatic renewal of AS certificates should be disabled. Usually, this value should not be set. By disabling certificate renewal, the appliance is set into a manual mode where new AS certificates must be provisioned manually and periodically.

disable_issuer_fallbackboolean

Whether fallback to the certificate authorities listed in the latest TRC should be disabled. By disabling this feature, the appliance will only use the issuers explicitly set in the configuration. If not disabled, the certificate authorities in the latest TRC are tried in the order that their certificate appears in the TRC.

issuers object[]

The SCION CPPKI Issuers that issue certificates for the local SCION AS. The list of issuers is tried in order of their priority. If no issuers are set explicitly, the renewal process will use the issuer of the newest existing SCION CPPKI AS Certificate.

Array [

isd_asstring<isd-as>required

The ISD-AS identifier of the issuing AS.

Example: 1-ff00:0:120

priorityinteger<int32>required

The priority of the issuing AS. The appliance attempts to get certificates issued from the AS with the highest priority. The value 0 indicates the highest priority, higher numbers are lower priority.

]

defaultboolean

Default indicates whether the respective SCION AS should be used by default as the source AS by SCION applications, e.g., scion ping or scion showpaths. The configurations with more than one default ASes will be rejected because there can only be one default AS. If there is only a single AS configured, it will be the default. Therefore, this setting is only necessary if multiple ASes are configured on the appliance.

Default value: false

details object

User-defined details about the SCION AS for informational purpose.

descriptionstring

User-defined description, or comment, that describes this SCION AS.

namestring

SCION AS name for informational purpose.

forwarding_key_refstring<secret-ref>

Reference to the forwarding key of this AS. The forwarding key secret is used to authenticate the hop field of the SCION path which corresponds to this AS. It is a local secret that only needs to be known to the AS. The forwarding key MUST be identical across all appliances in an AS. The referenced secret must be a base64-encoded string.

isd_asstring<isd-as>required

The ISD-AS identifier is the tuple that uniquely identifies the AS within a SCION isolation domain (ISD). This number is usually assigned by a numbering authority.

Example: 1-ff00:0:110

neighbors object[]

List of neighbor SCION ASes that this device is connected to via one or multiple SCION interfaces. Each entry is identified by the remote ISD-AS.

Array [

descriptionstring

Description, or comment, for the neighbor AS.

interfaces object[]

The local SCION interfaces in the current AS that link to the neighbor AS. The local end of the link is an external SCION interface.

Array [

addressstring

UDP/IP underlay endpoint of the SCION Interface. The data plane traffic is received on this address. The address must be specified as host:port. Both host and port must be specified.

Example: 169.254.0.1:30100

administrative_statestring

The administrative state of the interface with one of the following values:

• UP The interface is up and ready to send/receive SCION packets as well as being advertised during beaconing.
• DATAPLANE_ONLY The interface is up and ready to send/receive SCION packets, but is not advertised during beaconing.
• ADMIN_DOWN The interface is down and neither sends/receives SCION packets nor is it advertised during beaconing.

Experimental: Currently only UP is supported.

Enum Value	Description
ADMIN_DOWN
DATAPLANE_ONLY
UP

Possible values: [UP, ADMIN_DOWN, DATAPLANE_ONLY]

bfd object

Bidrirectional Forwarding Detection (BFD) configuration for the SCION interface. BFD is used to track the healthiness of a SCION link.

desired_minimum_tx_intervalinteger<uint32>

The minimum interval between transmission of BFD control packets that the operator desires. This value is advertised to the peer, however the actual interval used is specified by taking the maximum of desired-minimum-tx-interval and the value of the remote required-minimum-receive interval value. This value is specified as an integer number of microseconds.

Default value: 200000

detection_multiplierinteger<uint8>

The number of packets that must be missed to declare this session as down. The detection interval for the BFD session is calculated by multiplying the value of the negotiated transmission interval by this value.

Possible values: >= 1 and <= 255

Default value: 3

enabledboolean

If set to true, then the BFD session is enabled on the SCION interface - if it is set to false, BFD is disabled on that SCION interface. When disabled, the health of the interface is not tracked and it is assumed to be healthy. Note that the remote side of this SCION interface should have the same setting for enabled.

Default value: true

required_minimum_receiveinteger<uint32>

The minimum interval between received BFD control packets that this system should support. This value is advertised to the remote peer to indicate the maximum frequency (i.e., minimum inter-packet interval) between BFD control packets that is acceptable to the local system.

Default value: 200000

descriptionstring

Description, or comment, for the SCION interface.

enable_scion_rssboolean

Flag to activate SCION RSS for this link. If activated, the router utilizes UDP source port entropy on the underlay such that the remote router can leverage RSS for SCION traffic. This can greatly improve throughput performance. For low throughput SCION links (up to 1 Gbps), enabling SCION RSS is not necessary. Before enabling this feature, please ensure that the remote router supports SCION RSS.

Default value: false

interface_idinteger<uint16>required

SCION interface identifier. It must be unique in the SCION AS.

Possible values: >= 1 and <= 65535

remote object

Remote SCION interface endpoint of the link.

addressstring

UDP/IP underlay endpoint of the remote SCION Interface. The address must be specified as host:port. This information is provided by the neighbor AS.

Example: 169.254.0.2:30200

interface_idinteger<uint16>required

The SCION interface identifier of the remote end of the link. This information is provided by the neighbor AS.

Possible values: >= 1 and <= 65535

scion_mtuinteger<uint16>

The maximum transmission unit in bytes for SCION packets on the external interface. This represents the protocol data unit (PDU) of the SCION layer on this interface and is usually calculated as maximum Ethernet payload - IP Header - UDP Header. Note that the SCION MTU can differ between the various links and also from SCION MTU supported in the internal network of the local AS.

Default value: 1472

Example: 1472

]

neighbor_isd_asstring<isd-as>required

ISD-AS number of the neighbor AS.

Example: 2-ff00:0:210

relationshipstringrequired

The relationship to the neighbor AS. If the local AS is core, this value must either be CORE or CHILD. If the local AS is non-core, this value must either be PARENT, CHILD or PEER.

Enum Value	Description
CHILD
CORE
PARENT
PEER

Possible values: [CORE, CHILD, PARENT, PEER]

]

router object

The configuration for the SCION router service. The address configures where the router is exposed. AS internal hosts send SCION data plane traffic to this address for forwarding over the local SCION interfaces.

enabledbooleanrequired

Whether the service is enabled.

internal_interfacestring

The internal SCION interface is where the appliance receives SCION packets from AS internal hosts/applications for forwarding. It is defined as a UDP/IP network endpoint on which the SCION packets are received from the internal network. The endpoint must be specified as a string in the format :. If the port is set to 0 it will be automatically assigned.

Example: 192.168.1.1:30100

scion_mtuinteger<uint16>

The maximum transmission unit in bytes for SCION packets. This represents the protocol data unit (PDU) of the SCION layer on this interface and is usually calculated as maximum Ethernet payload - IP Header - UDP Header. If the Ethernet MTU is 1500, the SCION MTU is 1472 for an IPv4 underlay network and 1452 for an IPv6 underlay network.

Default value: 1472

Example: 1472

shard_idinteger<uint32>

The control and the data plane of a SCION AS is split into multiple shards. Each shard is responsible for processing and disseminating path information only for a subset of links. Shards are units that operate and fail independently from other shards. Usually, each appliance operates as a separate shard to increase the resiliency of the network. This field is the ID of the shard to which the control service and the router on this appliance belong.

]

synchronization object

The synchronization configuration contains the configuration for SCION path and beacon synchronization.

beacon_synchronization_intervalstring<duration-string>

The interval between two consecutive beacon synchronizations attempts to the cluster peers. It requires a unit suffix out of ['d', 'h', 'm', 's']. The encoding consists of a decimal number concatenated with a suffix; for example, '5s', '10m', '12h', and '1d'.

Default value: 4s

path_segment_synchronization_intervalstring<duration-string>

The interval between two consecutive path segment synchronizations attempts to cluster peers. It requires a unit suffix out of ['d', 'h', 'm', 's']. The encoding consists of a decimal number concatenated with a suffix; for example, '5s', '10m', '12h', and '1d'.

Default value: 4s

Config_SCION_Wrapped

{
  "scion": {
    "ases": [
      {
        "ca_service": {
          "anapaya_vault": {
            "addresses": [
              "string"
            ],
            "credentials": {
              "role_id": "string",
              "secret_id_ref": "string"
            },
            "validation": {
              "subject": "MATCHING_ISD_AS"
            }
          },
          "external": {
            "address": "192.0.2.3:5000",
            "client_id": "string",
            "shared_secret_ref": "string"
          },
          "service_type": "EXTERNAL"
        },
        "control": {
          "address": "192.168.1.1:30100",
          "enabled": true
        },
        "core": false,
        "cppki": {
          "disable_auto_renewal": true,
          "disable_issuer_fallback": true,
          "issuers": [
            {
              "isd_as": "1-ff00:0:120",
              "priority": 0
            }
          ]
        },
        "default": false,
        "details": {
          "description": "string",
          "name": "string"
        },
        "forwarding_key_ref": "string",
        "isd_as": "1-ff00:0:110",
        "neighbors": [
          {
            "description": "string",
            "interfaces": [
              {
                "address": "169.254.0.1:30100",
                "administrative_state": "UP",
                "bfd": {
                  "desired_minimum_tx_interval": 200000,
                  "detection_multiplier": 3,
                  "enabled": true,
                  "required_minimum_receive": 200000
                },
                "description": "string",
                "enable_scion_rss": false,
                "interface_id": 0,
                "remote": {
                  "address": "169.254.0.2:30200",
                  "interface_id": 0
                },
                "scion_mtu": 1472
              }
            ],
            "neighbor_isd_as": "2-ff00:0:210",
            "relationship": "CORE"
          }
        ],
        "router": {
          "enabled": true,
          "internal_interface": "192.168.1.1:30100"
        },
        "scion_mtu": 1472,
        "shard_id": 0
      }
    ],
    "synchronization": {
      "beacon_synchronization_interval": "4s",
      "path_segment_synchronization_interval": "4s"
    }
  }
}