Subject: COPS message content

From: Pradosh Kumar Mohapatra <[email-masked]>
Date: Fri, 16 Jul 1999 14:08:25 -0700

Hi,
Being new to the mailing-list, I really don't know whether there is any
information available on the message content of a COPS message sent from
PEP to PDP or PDP to PEP. I am referring to the ClientSI part of the
COPS messages. Can't there be any standard way to represent this part of
the protocol, given the fact that we have the ldap structure of policy
in place.
From whatever I have read, I came to understand that this field of the
protocol is very much specific to the discipline that it related to e.g.
qos, or security. If it is so, then after the packet reaches the PDP,
how does the PDP operate? What are the details about how it accesses the
LDAP and matches a rule? If a rule is matched, what contents does it put
in the reply message?

Regards,
Pradosh

---

From: Andrew Smith <[email-masked]>
Date: Tue, 20 Jul 1999 09:08:39 -0700

Steve,

You wrote:
> Today there are vendors who think these are three
> separate entities, others who think the Policy Server and PDP are 
> combined, and still others who think the PDP and PEP should be combined.
> In my personal opinion, the first has scaling problems with per-flow 
> requests to the PDP.  The second has scaling problems with PEP requests 
> to the Policy Server, and only the third seems uniformly scalable - 
> policies and associated rules are distributed to remote PDP/PEP entities
> from the repository.  

I think I might take issue with your statement that the combined PDP/PEP is
the most scalable solution if you are talking about using LDAP or SNMP to
distribute the rules - but it is early days now and there are not that many
implementations around yet, particularly of LDAP, on which to base opinions.
But I just wanted to point out that I think there's a lot we can do,
particularly with policy-controlled COPS/RSVP admission, in order to improve
the scalability.

I tried to present some ideas on this in ISSLL and RAP WGs at the March IETF
in Minneapolis (draft at
http://www.ietf.org/internet-drafts/draft-smith-sbm-config-00.txt and slides
at http://www.ietf.org/proceedings/99mar/slides/rap-cops-99mar/index.html)
but I don't think I got my point across very well: primarily that there are
likely to be many simple policy control decisions that can be performed
easily by a router/switch/host and do not need to be "out-sourced" and there
will be other decisions that do. i.e. a co-located PDP/PEP can handle simple
decisions but they will likely need to be split for more complex ones. You
then need some sort of "meta-rules" to decide which decisions can be local
and which not: these meta-rules were the basis for most of the draft (I took
this all out when I turned it into just an SBM MIB
draft-ietf-issll-is802-sbm-mib-00.txt). I'm just wondering how to resurrect
this for future work.

Andrew