Subject: Management model for Diff-Serv

From: [email-masked]
Date: Thu, 10 Dec 1998 18:16:06 -0800

The following is being forwarded to the policy mailing list.
Message originally sent by Andrew Smith <[email-masked]>
---------------------------------------------------------------------------

Ping,

I don't agree with your distinction between using a Diff-Serv MIB for
up-front configuration using SNMP and then using "policy" at run-time. A
more useful distinction (and I do believe there is a real one) is between
(a) a high-level description of policy and the transport of a
policy-managers commands to the PDP: this is the problem that the Policy WG
is chartered to tackle, and (b) the information formats and protocol(s) for
transporting commands between PDP and PEP (the device). This is basically
the model that Ed Elleson presented earlier this week in the policy WG and
newsnmp BoF. 

The "device communication" part has 3 candidate mechanisms under discussion:
a) SNMP - SETs for config, GETs for stats: Diff-Serv MIB is a good
candidate; being produced (sort of) by the Diff-Serv WG.
b) COPS - currently mostly used for devices wanting to outsource policy
decisions to a PDP ("query" model) rather than for configuration ("push").
Protocol is designed to be fairly symetric in this respect. Would need to
define a numbering space/structure for any new Diff-Serv-related objects; no
work is currently chartered on this but lots of willing volunteers are
chomping at the bit in the RAP WG. 
c) LDAP + schema definition: there are some who believe LDAP is an
appropriate protocol in this context and that the CIM/DEN/DMTF work on
information structure is sufficient.

I do see some direct overlap between (a) and (b) here. I believe that people
are generally comfortable using SNMP for stats gathering and COPS would not
be a good tool for that. Users are less comfortable with SNMP for
configuration (unsecure SETs) and COPS is an equally good candidate there
(can just run on SSL/TLS). That does beg the question: why not run SNMP over
SSL/TLS? Does anyone actually do that? So I think the jury is out on that
one - opinions please (but don't copy all the above WG lists). 
I don't believe that (c) LDAP is a viable candidate for this part of the
picture, at least in the short to medium term. Right now I do not believe
that there is any IETF work chartered in any WG for this purpose, hence the
need for this discussion.

Apologies for all the CC: groups but this topic needs to transcend
individual WG boundaries (briefly) in order to get straightened out.

Andrew
<Disclaimer: RAP WG co-chair>

-----Original Message-----
From: Ping Pan
To: Jeremy Greene
Cc: [email-masked]; [email-masked]; [email-masked]
Sent: 12/10/98 6:26 AM
Subject: Re: Model for inclusion in the MIB
...
> Btw, regarding COPS/SNMP, I have heard the response that snmp doesn't
> do sets, either by design or actual implementation. Again, I have many
> issues with snmp, but it certainly can be used for sets. I know of at
> least one diff-edge router that does it quite well :) In fact I think
> it follows the model above.

Let me try to clarify the relationship between DIffServ MIB and DiffServ
policy. I think the ISP's may use the MIB to configure their DiffServ
enabled links. As a result, a link's bandwidth is divided into several
classes (each associate with a rate, a queue, and a bunch of dropping
preference). As user packets come in, it's up to the router's policy
entity to pipe traffic into the proper class for transmission. The
policy entity can be in the form of client-server, and is responsible
for admission control and accounting. In short, the MIB is meant to
pre-configuration, while the policy provides run-time support.

> And what do people think SNMPv3 is for?
>

Sure. But let's implement something for real first, get some operational
experience, and move on. If SNMPv3 is what ISP's want, go for it!

- Ping Pan

---

From: [email-masked]
Date: Sun, 13 Dec 1998 22:40:45 -0500

The following is being forwarded to the policy mailing list.
Message originally sent by [email-masked] (Jeremy Greene)
---------------------------------------------------------------------------

Ping,

> Andrew Smith wrote:
> > up-front configuration using SNMP and then using "policy" at
> > run-time.
> 
> Andrew,
> 
> You do have a point that SNMP SET is probably not the best tool out
> there to config DiffServ parameters for routers.

Why? (Btw, I don't think Andrew meant this). 

I agree with what I think Andrew was trying to say: don't distinguish
between 'up-front config' and run-time config. If you can fully
configure all aspects of diff-serv using snmp, then why not use it for
configuration resulting from policy actions (translated by the pdp).

Certainly the goal I will push hard for is the ability to completely
monitor and configure a diff-serv node using snmp.

I've always been referring *only* to the PDP and PEP communication, not
between the policy server and PDP.

And snmpv3 does address security issues (which are just as important,
if not more so) during 'up-front' configuration.

Jeremy

---

From: [email-masked]
Date: Mon, 14 Dec 1998 12:00:48 -0800

Ping,

> From: Ping Pan [mailto:[email-masked]]
> Sent: Friday, December 11, 1998 5:43 AM
> To: Andrew Smith
> Cc: [email-masked] '; [email-masked]';
> [email-masked]'
> Subject: Re: Management model for Diff-Serv
> 
...
> a) The description of policy is private to each ISP, we, IETF, should
> simply focus on how to deliver policy data reliably and timely to the
> destination. So I have trouble with the objective of the Policy WG.
> After all, who are we to tell ISP's how to define their services? :-)

I wonder what the Policy WG thinks of this? I had thought it was an agreed
goal of the WG to tackle this problem and one Diff-Serv WG co-chair is
telling us to wait for its outcome before defining low-level MIBs and
configuration for Diff-Serv devices.

> b) PEP-PDP communication for *all* applications still needs further
> investigation. At this point, we need to have a mechanism to allow some
> policy servers (Bandwidth Brokers???) to run resource management,
> accounting and admission control at the edge of the DiffServ network.
> Please also take a look at AAA BOF's charter. 

Can you point me to any standards'-track documents that are within any WG
scope that define the "bandwidth broker" concept/protocol/functionality? I
think it is a little premature to talk about configuration mechanisms for
BBs. A better example might be accounting/authentication mechanisms for RASs
which the AAA BoF has discussed at length  - but AAA is not even a working
group at present so don't hold your breath.

> Now, can we move into each individual WG mailing list for further
> discussion? Thanks!

Sorry, but no - the whole point of my message was that this is a
cross-WG/BoF issue.

> Regards,
> - Ping 

Andrew

****************************************************************
Andrew Smith                              tel: +1 (408) 863-2821
Extreme Networks                          fax: +1 (408) 342-0990
10460 Bandley Drive               http://www.extremenetworks.com
Cupertino CA 95014               em:  [email-masked]
****************************************************************