Subject: [I2nsf] questions & comments to draft-jeong-i2nsf-consumer-facing-interface-dm-03

From: Linda Dunbar <[email-masked]>
Date: Tue, 15 Aug 2017 23:03:14 +0000

Paul, Eunsoo, Tae-Jin, Rakesh, and Sue,

Thank you very much for the updated i2nsf-consumer-facing-interface-dm03, which matches much better with the i2nsf-consumer-facing-im draft.

Just a few questions.

I noticed that you don't list individual value for the rules. For example, "primary-action" list the "permit", "deny", "rate limit", etc in the description:

             leaf primary-action {

               type string;

               description

                 "This field identifies the action when a rule

                 is matched by NSF. The action could be one of

                 'PERMIT', 'DENY', 'RATE-LIMIT', 'TRAFFIC-CLASS',

                 'AUTHENTICATE-SESSION', 'IPS, 'APP-FIREWALL', etc.";

             }

In  draft-ietf-netmod-acl-model-11, the actions are listed as explicit value.

Similar paten goes with the definition of "Source" and "destination". You have:

             leaf source {

               type string;

               description

                 "This field identifies the source of

                 the traffic. This could be reference to

                 either 'Policy Endpoint Group' or

                 'Threat-Feed' or 'Custom-List' if Security

                 Admin wants to specify the source; otherwise,

                 the default is to match all traffic.";

             }

Not an expert in the data model, I am wondering if you need to explicitly list the 'Policy Endpoint Group', 'Custom-List', etc

Thank you very much,

Linda

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Wed, 16 Aug 2017 21:40:51 +0900

Hi Linda,
You are right.
In the revision, we authors will revise the Consumer-Facing Interface data
model
such that it lists individual values for rules.
Also, we will explicitly list the 'Policy Endpoint Group' and 'Custom-List'.

Thanks for your good points.

Best Regards,
Paul

On Wed, Aug 16, 2017 at 8:03 AM, Linda Dunbar <[email-masked]>
wrote:

> Thank you very much for the updated i2nsf-consumer-facing-interface-dm03,
> which matches much better with the i2nsf-consumer-facing-im draft.
>
>
>
> Just a few questions.
>
>
>
> I noticed that you don’t list individual value for the rules. For example,
> “primary-action” list the “permit”, “deny”, “rate limit”, etc in the
> description:
>
>
>
>              leaf primary-action {
>
>                type string;
>
>                description
>
> Similar paten goes with the definition of “Source” and “destination”. You
> have:
>
>
>
>              leaf source {
>
>                type string;
>
>                description
>
> Not an expert in the data model, I am wondering if you need to explicitly
> list the 'Policy Endpoint Group', 'Custom-List', etc
>
>
>
>
>
> Thank you very much,
>
>
>
> Linda
>
>
>
> _______________________________________________
> I2nsf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i2nsf
>
>

-- 
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software
Sungkyunkwan University
Office: +82-31-299-4957
Email: [email-masked], [email-masked]
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php
<http://cpslab.skku.edu/people-jaehoon-jeong.php>

---

From: Linda Dunbar <[email-masked]>
Date: Thu, 17 Aug 2017 21:37:59 +0000

Paul,
Thanks.

Also the “source” and “destination” of the “policy-rule*” in the general data model (page 7) shouldn’t be “string”, should it refer to the policy-endpoint-groups specified on Page 5 instead?

           +--rw policy-rule* [policy-rule-id]
            |  +--rw policy-rule-id                   string
            |  +--rw name?                            string
            |  +--rw date?                            yang:date-and-time
            |  +--rw source?                          policy-endpoint-groups
            |  +--rw destination?                     policy-endpoint-groups
            |  +--rw exception?                       string
            |  +--rw action?                          string
            |  +--rw precedence?                      uint8

On page 7, your “policy-instance” has both “policy-rule*” and “policy-instance*” listed under. Is it intended? Or typeo?

Thanks, Linda

From: Mr. Jaehoon Paul Jeong [mailto:[email-masked]]
Sent: Wednesday, August 16, 2017 7:41 AM
To: Linda Dunbar <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [I2nsf] questions & comments to draft-jeong-i2nsf-consumer-facing-interface-dm-03

Hi Linda,
You are right.
In the revision, we authors will revise the Consumer-Facing Interface data model
such that it lists individual values for rules.
Also, we will explicitly list the 'Policy Endpoint Group' and 'Custom-List'.

Best Regards,
Paul

On Wed, Aug 16, 2017 at 8:03 AM, Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:
Paul, Eunsoo, Tae-Jin, Rakesh, and Sue,

Just a few questions.

I noticed that you don’t list individual value for the rules. For example, “primary-action” list the “permit”, “deny”, “rate limit”, etc in the description:

             leaf primary-action {

               type string;

               description

             }

Similar paten goes with the definition of “Source” and “destination”. You have:

             leaf source {

               type string;

               description

             }

Thank you very much,

Linda

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf

--
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software
Sungkyunkwan University
Office: +82-31-299-4957
Email: [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php<http://cpslab.skku.edu/people-jaehoon-jeong.php>

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Thu, 24 Aug 2017 10:11:43 +0900

Hi Linda,
My group checked your questions below and prepared answers as follows.

On Fri, Aug 18, 2017 at 6:37 AM, Linda Dunbar <[email-masked]>
wrote:

> Paul,
>
> Thanks.
>
>
>
> Also the “source” and “destination” of the “policy-rule*” in the general
> data model (page 7) shouldn’t be “string”, should it refer to the
> policy-endpoint-groups specified on Page 5 instead?
>
>
>
>
>

 => Yes, you are right. The source and destination fields have the type of
policy-endpoint-groups according to
      the information model of Consumer-Facing Interface:
      https://tools.ietf.org/html/draft-kumar-i2nsf-client-
facing-interface-im-03#page-14

      More actually, we need to use a reference (called leafref) to the
policy-endpoint-groups's variable as follows:

     +-rw security-policy-instance
       +-rw policy-rule* [policy-rule-id]
       |  +-rw policy-rule-id        uint16
       |  +-rw name?                 string
       |  +-rw date?                   yang:date-and-time
       |  +-rw source?               -> /ietf-i2nsf-consumer-facing-
interface/threat-prevention/threat-feed/threat-feed-id
       |  +-rw destination?        -> /ietf-i2nsf-consumer-facing-
interface/policy-endpoint-groups/user-group/user-group-id
       |  +-rw exception?            boolean
       |  +-rw exception-detail?     string
       +-rw action* [action-id]
       .
       .
       .
       +-rw policy-instance* [policy-instance-id]
          +-rw policy-instance-id     string
          +-rw name?                  string
          +-rw date?                    yang:date-and-time
          +-rw rules?                    -> /ietf-i2nsf-consumer-facing-
interface/security-policy-instance/policy-rule/policy-rule-id
          +-rw scheduling?          -> /ietf-i2nsf-consumer-facing-
interface/security-policy-instance/policy-calendar/policy-calendar-id
          +-rw owner?                 string

       In the above partial data tree, source refers to threat-feed-id as
an attack source and destination refers to
       user-group-id as a protected destination.
       In the same way, we let the fields of rules and scheduling have the
type of leafref as a reference.

> On page 7, your “policy-instance” has both “policy-rule*” and
> “policy-instance*” listed under. Is it intended? Or typeo?
>

  => The current information model uses these duplicate name of
policy-instance to represent a security policy instance.
       So we rename the first policy-instance as security-policy-instance
above:

      I attach the data tree and yang code for the security-policy-instance
for your reference.

      Thanks.

      Best Regards,
      Paul

>
>
> Thanks, Linda
>
>
>
>
>
> *From:* Mr. Jaehoon Paul Jeong [mailto:[email-masked]]
> *Sent:* Wednesday, August 16, 2017 7:41 AM
> *To:* Linda Dunbar <[email-masked]>
> *Cc:* [email-masked]; draft-jeong-i2nsf-consumer-fac
> [email-masked]; [email-masked];
> [email-masked]
> *Subject:* Re: [I2nsf] questions & comments to
> draft-jeong-i2nsf-consumer-facing-interface-dm-03
>
>
>
> Hi Linda,
>
> You are right.
>