Subject: Re: [IPFIX] New version of IPFIX configuration draft

From: Gerhard Muenz <[email-masked]>
Date: Wed, 15 Oct 2008 16:54:04 +0200

Hi Kobayashi,

A late reply to your proposal to add ACL configuration into IPFIX
configuration.

We (the authors of the draft) think that ACL configuration is out of
scope of IPFIX. The reason is that ACLs in routers are not restricted to
packet filtering for IPFIX/Netflow. They affect other router functions
as well. Therefore, an ACL should not be regarded as a PSAMP Selection
Process.

You are right that today's router allow configuring IPFIX/Netflow
functions for a given ACL. From the IPFIX point of view, the output of
the ACL should then be regarded as the Observation Point, e.g.:

linecard => ACL => OP => ...
                |
                |--> from here, we are in the scope of IPFIX

You are also right that ACL configuration would be a nice feature.
However, we think that this is not part of IPFIX standardization.

Regards,
Gerhard

Kobayashi Atsushi wrote:
> Hi Gerhard, Benoit and all,
> 
> This draft is almost complete and great work.
> I think that such XML configuration enhances efficiency of the use of
> flexibility of IPFIX.
> 
> IMHO, I am afraid that the filtering method is different than current ACL
> implemented in several routers. Therefore, the IPFIX XML cfg might not
> be implemented, because of the gap between current ACL filter and IPFIX
> XML cfg, even if psamp mention "AND" operation only.  
> 
> I propose the following XML schema added the ACL elements to -03 draft.
> I am not familiar with YANG yet, sorry.
> 
> http://www3.plala.or.jp/akoba/ipfix-cfg-acl.txt
> http://www3.plala.or.jp/akoba/ipfix-cfg-acl.html
> 
> The following Complex/Simple type elements are added.
> - Complex Type: accessListMatch_type
> - Complex Type: sequenceList_type
> - Simple Type: action_type 
> 
> In addition, it allows "selectionProcess_type" to include
> "AccessListMatch" element. 
> 
> What do you think about that? I think that it enhances flexibility as
> optional. 
> 
> Regards,
> Atsushi KOBAYASHI
> 
> On Mon, 25 Feb 2008 17:50:21 +0100
> Gerhard Muenz <[email-masked]> wrote:
> 
>> Dear all,
>>
>> A new revision of the IPFIX/PSAMP configuration data model has been
>> published:
>> http://www.ietf.org/internet-drafts/draft-muenz-ipfix-configuration-04.txt
>>
>> Apart from smaller changes in the model itself, the big change compared
>> to the previous version concerns the specification language: instead of
>> XML Schema, we now use YANG, a new language for modelling Netconf data
>> models. As a consequence, conformance to Netconf can be guaranteed.
>>
>> We received a lot of valuable feedback and support from Martin Bjorklund
>> who is a Netconf expert and author of the YANG draft. We will try to get
>> some additional feedback from other Netconf experts as well.
>>
>> Regards,
>> Gerhard
>>
>> -- 
>> Dipl.-Ing. Gerhard Münz
>> Computer Networks and Internet
>> Wilhelm Schickard Institute for Computer Science
>> University of Tuebingen
>> Sand 13 (Room B309), D-72076 Tuebingen, Germany
>> Phone:  +49 7071 29-70534       Fax: +49 7071 29-5220
>> E-mail: [email-masked]
>> WWW:    http://net.informatik.uni-tuebingen.de/~muenz
>>
> 
> --- 
> Atsushi KOBAYASHI  <[email-masked]>
> NTT Information Sharing Platform Lab.
> tel:+81-(0)422-59-3978 fax:+81-(0)422-59-5637
> 

-- 
Dipl.-Ing. Gerhard Münz
Chair for Network Architectures and Services (I8)
Department of Informatics
Technische Universität München
Boltzmannstr. 3, 85748 Garching bei München, Germany
Phone:  +49 89 289-18008       Fax: +49 89 289-18033
E-mail: [email-masked]    WWW: http://www.net.in.tum.de/~muenz

_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix

---

From: Gerhard Muenz <[email-masked]>
Date: Wed, 15 Oct 2008 16:54:04 +0200

Hi Kobayashi,

Regards,
Gerhard

---

From: Atsushi Kobayashi <[email-masked]>
Date: Fri, 17 Oct 2008 10:13:25 +0900

Hi Gerhard,

>                 |--> from here, we are in the scope of IPFIX

Yes. Actually, Cisco NetFlow input filter and Foundry ACL based sFlow
use the given ACL feature. I think that the given ACL feature will be
used, even if they become IPFIX/PSAMP. But, the given ACL features are
different style among the several vendors. So, it might be hard to
standardize them.

>From view point of IPFIX configuration, I hope that it would allow some
vendor to add on ACL feature as enterprise option. Is it possible?

Regards,
Atsushi Kobayashi

On Wed, 15 Oct 2008 16:54:04 +0200
Gerhard Muenz <[email-masked]> wrote:

> >> Dipl.-Ing. Gerhard M〓z
> Dipl.-Ing. Gerhard M〓z
> Technische Universit舩 M〓chen
> Boltzmannstr. 3, 85748 Garching bei M〓chen, Germany

---

---

From: Atsushi Kobayashi <[email-masked]>
Date: Fri, 17 Oct 2008 10:13:25 +0900

Hi Gerhard,

Regards,
Atsushi Kobayashi

---

---

From: Gerhard Muenz <[email-masked]>
Date: Fri, 17 Oct 2008 12:16:17 +0200

Hi Kobayashi,

> vendor to add on ACL feature as enterprise option. Is it possible?

Yes, vendors can augment the data model with vendor-specific parameters.
Yet, I cannot answer if and how they will do this in the case of ACLs.

Regards,
Gerhard

---

From: Gerhard Muenz <[email-masked]>
Date: Fri, 17 Oct 2008 12:16:17 +0200

Hi Kobayashi,

Regards,
Gerhard

---

From: Atsushi Kobayashi <[email-masked]>
Date: Mon, 27 Oct 2008 01:46:31 +0900

Hi Gerhard,

> >>                 |--> from here, we are in the scope of IPFIX

On second thought, I would not like to limit the scope of IPFIX.
It is better that observation point indicates the physical entity e.g.
line card, even if ACL applied.

Above figure seems more complicated for vendors and operators.

> Yet, I cannot answer if and how they will do this in the case of ACLs.

I prefer that your configuration scheme can include entry point which
indicates vendor specific configuration, just like
ipfixSelectorFunctions in IPFIX-MIB.

Does your configuration allow them?

Thanks,
Atsushi

---

---

From: Atsushi Kobayashi <[email-masked]>
Date: Mon, 27 Oct 2008 01:46:31 +0900

Hi Gerhard,

Thanks,
Atsushi

---

---

From: Gerhard Muenz <[email-masked]>
Date: Mon, 27 Oct 2008 12:33:03 +0100

Hi Atsushi,

> Does your configuration allow them?

How to extend a standard configuration module with vendor-specific
parameters depends on the "world" in which the module is defined.
Therefore, we should follow the rules of the world in which we define
the configuration model.

In the SNMP/MIB world, it is necessary to provide such explicit entry
points in the standard MIB modules to enable a linkage to the
vendor-specific parameters.

In the Netconf/XML world, this is not necessary and not common practice.
The NETMOD WG is currently discussing how vendor-specific extensions of
and deviations from standard XML modules are realized in the best way
using YANG. Regardless of how the solution will finally look like, it
very probably will not require any explicit entry points in the standard
XML modules.

So, I propose to wait for the results of the NETMOD WG regarding this
issue. I assume that we finally do not have to modify the IPFIX module
because the treatment of vendor-specific changes is solved by the NETMOD WG.

Regards,
Gerhard

---

From: Gerhard Muenz <[email-masked]>
Date: Mon, 27 Oct 2008 12:33:03 +0100

Hi Atsushi,

Regards,
Gerhard

---

From: Atsushi Kobayashi <[email-masked]>
Date: Mon, 27 Oct 2008 21:43:03 +0900

Hi Gerhard,

Thank you for reply.

I understood what you want to say.
It will take long term to find some solution, as you mentioned.

I regret that we must wait them, although some commercial products will
release the acl based flow product more and more.
Because your configuration scheme can be utilized in the Flow world
immediately. 

Regards,
Atsushi

On Mon, 27 Oct 2008 12:33:03 +0100
Gerhard Muenz <[email-masked]> wrote:

> >> Yet, I cannot answer if and how tFrom [email-masked]  Mon Oct 27 05:49:23 2008
Date: Mon, 27 Oct 2008 21:43:03 +0900
From: Atsushi Kobayashi <[email-masked]>
To: Gerhard Muenz <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [IPFIX] New version of IPFIX configuration draft
Sender: [email-masked]

Hi Gerhard,

Thank you for reply.

I understood what you want to say.
It will take long term to find some solution, as you mentioned.

I regret that we must wait them, although some commercial products will
release the acl based flow product more and more.
Because your configuration scheme can be utilized in the Flow world
immediately. 

Regards,
Atsushi

On Mon, 27 Oct 2008 12:33:03 +0100
Gerhard Muenz <[email-masked]> wrote:

> >> Yet, I cannot answer if and howhey will do this in the case of ACLs.
> > 

--- 

 they will do this in the case of ACLs.

---

---

From: Andy Bierman <[email-masked]>
Date: Mon, 27 Oct 2008 08:31:08 -0700

Gerhard Muenz wrote:
>> Does your configuratioFrom [email-masked]  Mon Oct 27 08:31:37 2008
Date: Mon, 27 Oct 2008 08:31:08 -0700
From: Andy Bierman <[email-masked]>
To: Gerhard Muenz <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [IPFIX] New version of IPFIX configuration draft
Sender: [email-masked]

Gerhard Muenz wrote:
>> Does your configuratn allow them?
> 

This is not correct.
If the standard MIB module has a 'fooEntry',
then any vendor module can AUGMENT fooEntry.
There are no changes to the original module
needed at all for this to work.

The same will be true for YANG.

> because the treatment of vendor-specific changes is solved by the NETMOD WG.

Andy

ion allow them?
> vendor-specific parameters.

This is not correct.
If the standard MIB module has a 'fooEntry',
then any vendor module can AUGMENT fooEntry.
There are no changes to the original module
needed at all for this to work.

The same will be true for YANG.

> because the treatment of vendor-specific changes is solved by the NETMOD WG.

Andy