Subject: Re: AuthType in VRRP MIB

From: Brian Jewell <[email-masked]>
Date: Fri, 31 Jul 1998 12:22:47 -0700 (PDT)

Lori,

My interpretation of the 'vrrpOperAuthType' object is as follows:

- It is defined on a "per-interface basis" (VRRP RFC, page 12), and hence 
doesn't fit very well into the 'vrrpOperTable'.

- It is essentially in the 'vrrpOperTable' as it seems to be an important enough 
attribute of a virtual router, that maybe a network management application would 
want to know what it has been set to.

My knowledge of IPSEC is limited, and the VRRP RFC does not go into great detail 
about where the authentication header (if used) would be validated (in VRRP or 
elsewhere?). But again, both objects would seem to provide useful information 
about a virtual router.

Since, IPSEC is configurable from a different component than VRRP (at least on 
3Com routers), it seemed to make sense to make the object "read-only", with the 
assumption that an equivalent object would exist as a read-write object in an 
(ifIndex-based) IPSEC MIB somewhere. However, I don't know that an IPSEC MIB 
exists yet.

So, I am open to suggestions as to how to deal with 'vrrpOperAuthType' and 
'vrrpOperAuthKey' in the MIB.

As an aside, my interpretation of 'vrrpOperAuthKey' is that it would return a 
"hashed" value of the authentication key, as opposed to the actual key (for 
obvious security reasons). So at the very least, I think a more detailed 
description of this object is in order for the next MIB draft revision.

In the meantime, I'll see what other input is received from concerned parties.

Thanks.

-Brian Jewell
-3Com, Inc.
[email-masked]

Original comments follow:
> 
> 
> Since the vrrpOperAuthType and vrrpOperAuthKey objects are defined as
> read-only in the VRRP MIB, how is one supposed to set the authentication
> type and key through snmp?  Are you planning on defining another group
> in the MIB for the Authentication on a per-interface basis?  Or should
> the Access for these objects be read-write?
> 
> Thanks,
> Lori
>

---

From: Scott Barvick <[email-masked]>
Date: Fri, 31 Jul 1998 16:41:35 -0400

I forget why we are trying to make this a per-ifIndex thing.  To me it
is fine as a per-VR quantity.  If we had a convenient per-interface MIB
table, we might put it there, but because we do not, why make things
confusing by trying to explain it that way.  Each VR certainly can have
the appropriate state to keep track of the authentication key and type
and do the correct processing when an advertisement is received.

Scott

-- 
Scott Barvick
[email-masked]
(978) 952-6000 x162