Subject: [Supa] About generic policy mode

From: "Jun Bi" <[email-masked]>
Date: Fri, 8 May 2015 15:19:16 +0800

Hi, John,

The recent generic policy model is a very interesting work. It defines an
information model of the generic policy which provides a higher level of
abstraction of policies. 

I have some comments and questions as follows:

1. The generic policy model defines an information model which should be
"independent of data repository, data definition language, query language,
implementation language, and protocol." The system might need a data model
to deploy the policy. As mentioned in the draft, data model should be
"dependent of data repository, data definition language, query language,
implementation language, and protocol." The mapping mechanism ( protocol
independent information model to a service dependent data model) seems not
quite clear yet in the draft. The mapping procedure would be very important
for the use of information model.

2. How to aggregate several SUPABooleanClauses into SUPAEncodedClause to
define the content of a policy?

3. IMHO, the intent/Goal policy is not well defined in the current version.
Based on the diagram, intent/goal policy seems to be a peer to the ECA
policy. Is that right, or the intent/goal policy should be in a higher level
abstraction than the ECA policy.

Best Regards,
Jun

---

From: Masaki Fukushima <[email-masked]>
Date: Sat, 09 May 2015 02:48:11 +0900

Hi John and all,

I agree with Jun that this is a quite interesting work and significant 
progress towards the creation of a generic policy information model 
envisioned in the supa draft charter.

 From service provider's perspective, this kind of high-level 
abstractions are necessary to model our operational policies without 
unnecessarily depending on detailed data models.

IMHO, what is missing from the current information model is a generic 
service information model.  As we discussed in Dallas, a policy model 
always comes with a service model governed by the policy.  That is, a 
generic policy information model should come with a generic service 
information model.

Is there any WG working on such service information models?
(In my understanding, L3SM is scoped on only data models.)
If there is no such WG, supa should investigate on them.

Regards,
Masaki Fukushima

On 2015/05/08 16:19, Jun Bi wrote:
> _______________________________________________
> Supa mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/supa
>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 8 May 2015 21:42:04 +0200

Hi,

I do not really know what a generic service model is. I suggest you
write an I-D and then we can read it and understand what it is.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: John Strassner <[email-masked]>
Date: Sat, 9 May 2015 21:35:13 -0700

Hi Jun,

Thank you for your questions. Brief answers are as follows:

   1. The mapping mechanism is not yet specified. This draft (as you will
        shortly see) is getting fairly long. Mapping is an art, and is
highly
        dependent on both the source and targets of the mapping as well as
        the content being mapped. I think that this should be specified in a
        separate I-D.
   2. This is described in -01 (soon to be released) and will be expanded
       on in Section 8 (Examples) in -02 of this draft.
   3. This is described more in -01 (soon to be released) and will be
expanded
       on in Section 8 (Examples) in -02 of this draft. However, from an
       information modeling perspective, intent/goal (which is now called a
       SUPALogicStatement) is a peer of an ECA policy rule, because they
       both inherit from the same superclass (SUPAPolicyRuleAtomic) and
       are both used to express a type of policy. Don't confuse the level of
       abstraction with a position in the model hierarchy. :-)

However, this last point does bring up the notion of the Policy Continuum
that I described at the IETF92 BoF. This could be used to further
differentiate
between types of Policy Rules; I'd be interested in the feedback of you and
the group about this...

best regards,
John

-- 
regards,
John

---

From: Ying Cheng <[email-masked]>
Date: Mon, 11 May 2015 21:05:30 +0800

Hi all,

Just for your information. The updated zaalouk-draft includes the generic VPN service model. You can reach the detail via the following link.

https://www.ietf.org/internet-drafts/draft-zaalouk-supa-vpn-service-management-model-05.txt 

BR,
Ying

2015-05-11 

Ying CHENG  程莹
China Unicom Network Technology Research Institute 中国联通网络技术研究院
Tel: +86-10-68799999-7702
Mobile: +86-18601102971

发件人： Juergen Schoenwaelder 
发送时间： 2015-05-09  03:42:21 
收件人： Masaki Fukushima 
抄送： Jun Bi; 'John Strassner'; [email-masked] 
主题： Re: [Supa] About generic policy mode 
 
Hi,
.

如果您错误接收了该邮件，请通过电子邮件立即通知我们。[email-masked]，即可以退订此邮件。我们将立即将您的信息从我们的发送目录中删除。
If you have received this email in error please notify us immediately by e-mail. Please reply to [email-masked] if you want to unsubscribe from this mail. We will immediately remove your information from our sending catalogue.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 11 May 2015 15:52:12 +0200

Well, the discussion was about a generic service model which is not
the same as a generic VPN service model. I am also not sure about this:

   The abstracted L3VPN model here is a subset of the one of L3SM.

If it is a subset, why not simply use the L3SM? Or how would an
implementor decide which model of the two to implement? Can I
implement both? If so, how do configs of both interact?

/js

---

From: Benoit Claise <[email-masked]>
Date: Mon, 11 May 2015 16:08:46 +0200

Ying ,

The L3VPN service modeling work should be done in L3SM.
If some service model aspect can be made generic, fine... even if this 
is not a L3SM charter objective.
Anyway, this should be discussed on the L3SM mailing list (and let's 
avoid cross-posting).

Regards, Benoit

> Hi all,
> Just for your information. The updated zaalouk-draft includes the 
> generic VPN service model. You can reach the detail via the following 
> link.
> ------------------------------------------------------------------------
> Ying CHENG  程莹
> ------------------------------------------------------------------------
> *发件人：* Juergen Schoenwaelder
> *发送时间：* 2015-05-09  03:42:21
> *收件人：* Masaki Fukushima
> *抄送：* Jun Bi; 'John Strassner'; [email-masked]
> *主题：* Re: [Supa] About generic policy mode
> Hi,
> 如果您错误接收了该邮件，请通过电子邮件立即通知我们。请回复邮件到hqs- 
> [email-masked]，即可以退订此邮 件。我们将立即将您的信息从我们的发 
> 送目录中删除。 If you have received this email in error please notify 
> us immediately by e-mail. Please reply to [email-masked] if 
> you want to unsubscribe from this mail. We will immediately remove 
> your information from our sending catalogue.
>
>
>

---

From: Ying Cheng <[email-masked]>
Date: Thu, 14 May 2015 09:41:17 +0800

Hi all,

Many thanks for Benoit and Juergen's comments.

The reason is like what we wrote in the draft, we may use the output of L3sm in the future or any other existing models, however, there is no officially output there right now. 
The reason we designed such an abstracted l3vpn service model is for DDC service model to use, then maybe further used by SUPA policy like ECA (policy authors, correct me if I am wrong). DDC service need VPN model to finish the creation of connection, and according to use case draft, such VPN connections may need to be adjusted according to policy. For this purpose, we only write the part that DDC service model will use, instead of branches and details like the draft in L3sm. The main goal is to fulfill the DDC service model for use case in our use case draft.
Btw, as you know, l3vpn model mentioned in zaalouk-draft comes first (the first version was submitted on 2014-09-22 ).
BR,
Ying

2015-05-14 

Ying CHENG  程莹

发件人： Benoit Claise 
发送时间： 2015-05-11  22:08:57 
收件人： Ying Cheng(联通集团联通网络技术研究院); Juergen Schoenwaelder; Masaki Fukushima 
抄送： Jun Bi; 'John Strassner'; [email-masked] 
主题： Re: [Supa] About generic policy mode 
 
Ying ,

The L3VPN service modeling work should be done in L3SM.
If some service model aspect can be made generic, fine... even if this is not a L3SM charter objective.
Anyway, this should be discussed on the L3SM mailing list (and let's avoid cross-posting).

Regards, Benoit

Hi all,

BR,
Ying

2015-05-11 

Ying CHENG  程莹

如果您错误接收了该邮件，请通过电子邮件立即通知我们。[email-masked]，即可以退订此邮 件。我们将立即将您的信息从我们的发送目录中删除。 If you have received this email in error please notify us immediately by e-mail. Please reply to [email-masked] if you want to unsubscribe from this mail. We will immediately remove your information from our sending catalogue.