Subject: (ION) NHRP MIB - Summary of Changes

From: [email-masked] (Joan Cucchiara)
Date: Mon, 26 Jan 1998 17:08:00 -0500

Hi Everyone,

A new version of the NHRP MIB
based on <draft-ietf-rolc-nhrp-13.txt> 
was recently emailed to the IETF and should
be available soon.  The following summarizes
the changes to the new version of the
MIB, <draft-ietf-ion-nhrp-mib-02.txt>.

Please note, no MIB objects were added which 
would allow configuration of or access to NHRP 
security mechanisms.  However, new text was added 
to the "Security Considerations" Section (see #10 below).  

Comments are welcomed!  

      Thank you, 
         Joan ([email-masked])

SUMMARY of CHANGES
------------------

1) (editorial) overall change:
     all indices start at 1.

2) (editorial) Added "Internetwork" to 
   the name of the objects which were related to
   an Internetwork Address.  For example,
   
   nhrpNextHopDestAddr was changed to 
       nhrpNextHopDestInternetworkAddr

3) the use of PrefixLength as an index 
   has been removed and replaced by a
   generic index which is unique within
   the agent (this index will help to
   uniquely identify the row).

   Reason:  PrefixLength can change 
   between the request and the response.
   Depending  upon how row-creation is done,
   this may be a problem.

   Rather than limit how an implementor
   chooses to do Row Creation, removing
   the PrefixLength as an index seemed
   to be a better (i.e. more flexible)
   alternative.

   (NOTE:  PrefixLength still appears within
           the row, but is no longer part of
           the index clause.)

(Following are Table by Table Explanations of
changes to specific Managed Objects.)

General Objects
----------------------

4) nhrpNextHopResTable

   * removed nhrpNextHopResPrefixLength as an index
     and added a new index nhrpNextHopResIndex
  
   * changed the name of nhrpNextHopResDestAddr to
       nhrpNextHopResDestInternetworkAddr

   * Added "scsp" choice to the nhrpNextHopResEntryType.
     (this was a true/false object in the nhrpServerNextHopResTable.
      This true/false object, nhrpServerNextHopResScsp was removed.)

NHC Changes
--------------------------
5) nhrpClientTable

   * nhrpClientRequestTimeout
     was renamed:  nhrpClientInitialRequestTimeOut
     and changed semantically.

     New Description:
     "The number of seconds that the client will wait before
     timing out an NHRP initial request.  This object only has
     meaning for the initial timeout period."

     Reason:  
     In the event that an implementor 
     prefers to use an incremental backoff, the original
     description would have prevented this.  Thus, it
     was changed to only mandate the initial request
     timeout period.

   * Also, the following objects were removed/added

     nhrpClientRequestRetries was removed
        and replaced by the following 3 objects:

        nhrpClientRegistrationRequestRetries
        nhrpClientResolutionRequestRetries
        nhrpClientPurgeRequestRetries

     Reason: instead of having one Request Retries
     object referring to all three types of requests,
     Each request can now have its own retry value.

6) nhrpClientStatTable -- these changes were due to
    the changes in the NHRP Specification.

   *  nhrpClientStatRxResolveReplyNakProhibited       -- added
   *  nhrpClientStatRxResolveReplyNakInsufResources   -- added
     
   *  nhrpClientStatRxRegisterNakCantServe replaced by
         nhrpClientStatRxRegisterNakProhibited

   *  nhrpClientStatRxRegisterNakOverflow replaced by
         nhrpClientStatRxRegisterNakInsufResources

   * nhrpClientStatTxError name changed to 
        nhrpClientStatTxErrorIndication (editorial)

   * nhrpClientStatRxErrSubnetworkIDMismatch removed

NHS Changes
------------

7) nhrpServerTable

    nhrpServerSubnetworkID removed (due to change in the
       NHRP Spec.)

    nhrpServerAuthentication removed (due to changes in
      the NHRP Spec.)
  
8) nhrpServerNextHopResTable (and nhrpNextHopResTable)
   (discussed previously under the nhrpNextHopResTable)

    nhrpServerNextHopResScsp object removed and an 
      enum 'scsp' was added to nhrpNextHopResEntryType in the
      nhrpNextHopResTable.

    Reason:  This object was originally used to see
    if the cache entry was added as a result of
    using SCSP (true/false), the nhrpNextHopResEntryType
    would have shown 'other' as the choice.  It was
    just as informative, and perhaps easier to use
    nhrpNextHopResEntryType and have an scsp choice added
    to the enums.

9) nhrpServerStatTable -- these changes were due to changes
    in the NHRP Specification.

   nhrpServerStatTxResolveReplyNakProhibited -- added
   nhrpServerStatTxResolveReplyNakInsufResources -- added

   nhrpServerStatTxRegisterNakCantServer changed to
     nhrpServerStatTxRegisterNakProhibited

   nhrpServerStatTxRegisterNakOverflow changed to
     nhrpServerStatTxRegisterNakInsufResources

   nhrpServerStatTxErrSubnetworkIDMismatch -- removed

   nhrpServerStatRxErrInvalidResReplyReceived, -- added

   nhrpServerStatTxErrSubnetworkIDMismatch  --- removed

   nhrpServerStatFwError name changed to
     nhrpServerStatFwErrorIndication (editorial)

10) Security Considerations (updated as a result of the
      NHRP Specification)

Managed Objects which would configure/expose the security portion of
the NHRP protocol [1] could result in the NHRP protocol being
unsecure and vunerable.  In other words, since there is very minimal
security provided with SNMPv1, and SNMPv3 is at proposed Standard
and is not in wide-spread usage, this MIB document does not contain
objects which would jeopardize the security of NHRP. 
Having such objects configurable/visable through SNMP
would defeat the purpose of NHRP's security mechanisms.

The following items/objects may be considered when 
implementing the security aspects of NHRP.  Items denoted as (configurable)
are those which would need values.  Items denoted as (read-only) are
those which may provide relevant information or may be useful in debugging.

  1. (configurable) enable/disable security
  2. (configurable) SPI (security parameter index).  
     Depending upon the implementation, 
     there may be multiple SPIs, and these would 
     be configurable also.  For example, if the 
     implementation switched to a different SPI 
     after a given time.
  3. (configurable) algorithm.
     The HMAC-MD5-128 is the default hash algorithm.
  4. (configurable) lifetime value in seconds.
  5. (read-only) key.
  6. (read-only) list of users who have access 
     to the above information.

End of Summary.

X-Info: To unsubscribe, email [email-masked]' with
X-Info: 'unsubscribe ion' in the body of the message.