Subject: [Idr] Configuration objects in BGP MIB v2: Call for consenus

From: Jeffrey Haas <[email-masked]>
Date: Sun, 6 Jul 2008 21:50:00 -0400

Working Group,

Back around 2005 I had a number of discussions with people who had
provided input for the BGP MIBv2 work.  These conversations were
specifically regarding the configuration objects in the MIB.
draft-ietf-idr-bgp4-mibv2-05 was the last version of the MIB that
contained the proposed configuration objects.

The results of those discussions were effectively that the configuration
mechanisms in that MIB were too complex and had some potential issues.
In particular:

- Modern BGP implementations tend to be more complex than the feature
  set covered by the proposed MIBs.  It was not possible to
  configure all session specific features from the MIB.  Since the base
  MIB is not intended to cover all possible current and future features
  this is problematic.
- Configuration of peering sessions are not sufficient to fully
  implement BGP in an operational network.  BGP fundamentally requires
  policy for the population of the Ribs.  Policy elements and algebra
  vary considerably among vendors.  

  Providing a general policy engine for BGP in the MIB is likely out of
  scope of this work.

Presume that the structural issues from draft-05 may be addressed.
Should they be addressable, do we wish to pursue including configuration
objects in the BGP MIB?

Given the operational impact of this issue, I would appreciate it if
this call for consensus was distributed within and without IETF.  I will
be forwarding this to NANOG as a first step.

-- Jeff
_______________________________________________
Idr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/idr

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 09 Jul 2008 10:25:35 -0400

> be forwarding this to NANOG as a first step.

Jeff,

Configuration object in the BGP MIB are useless.  It is best to remove
them.

Curtis

---

From: Simon Leinen <[email-masked]>
Date: Sat, 12 Jul 2008 20:04:07 +0200

I strongly suggest dropping the configuration objects from BGP MIB v2.
They wouldn't be used much anyway, and their presence will just slow
down progress of the important (read-only) parts of the MIB.
-- 
Simon.
_______________________________________________
Idr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/idr

---

From: Danny McPherson <[email-masked]>
Date: Mon, 14 Jul 2008 07:45:46 -0600

> down progress of the important (read-only) parts of the MIB.

I tend to agree with this as well.  I'd be surprised to find
security-minded operator that's keen on using these.

-danny

---

From: bill fumerola <[email-masked]>
Date: Mon, 14 Jul 2008 11:43:57 -0700

> down progress of the important (read-only) parts of the MIB.

i would agree, given the work going on in NETCONF. i believe anything
more complex than a one-variable change is going to become out of style
for SNMP configuration of devices that support NETCONF. BGP changes
rarely if ever would be so simple. the lack of an atomic method of change
in SNMP makes BGP configuration via SNMP risky.

also as Mr. McPherson alludes to, the security of snmp configurations
in many sites remains simple and underprotected. a NETCONF setup would
almost certainly be configured to secure the authentication and control
plane in ways that most snmp installations fail to do.

-- bill