Subject: how scalable is the policy framework?

From: "Vladimir Sukonnik" <[email-masked]>
Date: Wed, 7 Jul 1999 16:56:26 -0400

Hello,

I've read the policy framework and COPS internet drafts and have a basic
question. I hope you can help me to clear up
my confusion. I don't see how this framework would scale for thousands for
PEPs. According to these documents certain events
trigger PEPs into calling up PDPs for "the final policy decision". Wouldn't
this make the PDP a potential bottleneck and
slow PEPs down to a crawl while they wait for that decision to come down?
What am I missing?

Thank you,
Vladimir.

---

From: Shai Herzog <[email-masked]>
Date: Wed, 07 Jul 1999 18:20:27 -0400

Vladimir,

You are probably correct in your assumption that a single PDP wouldn't
be able to scale to thousands of ACTIVE PEPs. Fortunately, it has been
shown that policy enforcement is really a distributed process.

On one extreme, one PDP controls an entire huge network. On the other
extreme, each device/client fends for itself and makes its own policy
decisions. In the latter case, local decisions are at risk of being
uncoordinated with the rest of the network.

The framework allows a flexible adoption of those two extremes as
well as the continuum in between. It allows some devices to have both
PDP and PEP internally (to be free of management by any external PDP).
It also allows multiple PDPs to reside in the same domain, where each
PDP is responsible for a distinct set of devices.

So, I believe the framework doesn't restrict scalability. In fact,
the distributed solution has very good scaling properties and can scale
to virtually any size network.

Shai

P.S., As an example you can look at our OPS system, which employs
a fully distributed architecture with multiple PDPs, all
coordinated under the same management infrastructure.

>slow PEPs down to a crawl while they wait for that decision to come down?

__________________________________________________________
Shai Herzog                  Founder & CTO, IPHighway Inc.
Cell: (408) 390-3045       http://www.iphighway.com/herzog
Tel : (201) 585-0800                  Fax : (212) 656-1006