

Interface to Network Security Function (I2NSF) is a Working Group (WG) of IETF, which is the primary mechanism for development of specifications and guidelines, many of which are intended to be standards or recommendations~\cite{I2NSF-03}. 
The purpose of I2NSF is to implement a framework and a set of interfaces for the interaction with Network Security Functions (NSFs).
The I2NSF framework allows heterogeneous NSFs developed by different security solution vendors to be used in the Network Functions Virtualization (NFV) environment by exploiting the capabilities of such NSFs through I2NSF interfaces such as Customer-Facing Interface and NSF-Facing Interface~\cite{I2NSF-01}.

Without standard interfaces to monitor and control the behaviour of NSFs, it has become really impossible for providers, who offers security services, to automate their infrastructure using different NSF implementation from multiple vendors~\cite{I2NSF-02}.
I2NSF defines two different functional levels of interfaces, both for configure and control NSFs.

\begin{itemize}
	\item
	The I2NSF Capability Layer: it handles all the control and monitoring operations at a functional implementation level. This means that all NSF controllers must implement a set of standard interfaces by which it can operate, invoke and monitor NSFs.
	\item 
	The I2NSF Service Layer: it provides the definition of how clients security policies may be expressed to a security control~\cite{I2NSF-01} at high level. Then the NSF controller puts into effect its policies using the available capabilities provided by the I2NSF Capability Layer, which makes it to contact one or more NSFs instances through it self.
\end{itemize}

The customer can use both the former, in which he may leverage the controller, or the latter, in which the client interacts directly with one ore more NSFs to express its security policies.
