Subject: RE: how scalable is the policy framework?

From: "Durham, David" <[email-masked]>
Date: Wed, 7 Jul 1999 14:22:26 -0700

From the perspective of the RAP WG, COPS can be used so 
a PEP can outsource its questions to a PDP when it does
not know better. This mechanism is useful for coarse granularity
events, such as the arrival of an RSVP reservation or 
authentication request. Likewise, the PDP can use COPS to 
dynamically and continuously configure simple access control 
lists on its PEPs such that the PEPs can make simple policy 
decisions locally (based on 5-tuple filters and device specific
actions). The latter is ongoing work related to COPS-PR and the 
definition of the PIB (Policy Information Base).

Thus, COPS achieves a balance between scalability and flexibility
all within a notification-based architecture that alleviates the 
need for continuos polling. You may also note that there will 
likely be several PDPs within a domain containing thousands of 
PEPs, each responsible for only a subset of the PEPs.

-Dave

> -----Original Message-----
> From:	Vladimir Sukonnik [SMTP:[email-masked]]
> Sent:	Wednesday, July 07, 1999 1:56 PM
> To:	[email-masked]
> Subject:	how scalable is the policy framework?
> 
> Hello,
> 
> I've read the policy framework and COPS internet drafts and have a basic
> question. I hope you can help me to clear up
> my confusion. I don't see how this framework would scale for thousands for
> PEPs. According to these documents certain events
> trigger PEPs into calling up PDPs for "the final policy decision".
> Wouldn't
> this make the PDP a potential bottleneck and
> slow PEPs down to a crawl while they wait for that decision to come down?
> What am I missing?
> 
> Thank you,
> Vladimir.

---

From: "Raju Rajan" <[email-masked]>
Date: Wed, 7 Jul 1999 18:28:21 -0400

Vladimir,

Scalability in just the size of the network is a partial view; one must
consider other factors including:
1) What is the operational environment? Eg. LANs, ISP backbone, cable modem
banks, phone modems, wireless, etc
2) What are the services you are trying to provide? VPNs, pay-per-view,
content filtering, remote access, privacy, etc.
3) What is the "fragmentation" of your policy base? i.e., How many users,
devices, accounts, application categories, administrative domains, etc.
4) What is the dynamism of the environment? ie., how many flows, what is the
rate of rule change, binding services turnover (think DHCP, for eg.) etc.

In other words, even LDAP alone (with replication) can scale to 1000s of
devices if you have relatively static, simple and stateless rules. A
reasonable solution like COPS+LDAP+SNMP+Radius/Diameter (deployed in
different parts of your network) can cover much more ground. The answer to
scalability can only be given when you pose the question more precisely.
(Anyway, I suspect it will be "not right now!" :)

IMHO, the real problem is not the number of devices; at least 90% of the
1000s of PEPs you're talking about will be policy unaware for the next 4-5
years. The question is what are you going to do about them?

raju rajan

----- Original Message -----
From: Durham, David <[email-masked]>
To: 'Vladimir Sukonnik' <[email-masked]>;
<[email-masked]>
Sent: Wednesday, July 07, 1999 5:22 PM
Subject: RE: how scalable is the policy framework?

-Dave