Subject: semantics of Priority of PolicyRule

From: "Mircea Pana" <[email-masked]>
Date: Fri, 26 Jan 2001 17:51:22 -0500

Is PCIM intentionally ambiguous w.r.t. the usage of the Priority property of
the PolicyRule class? In situations where multiple PolicyRules are
applicable which one of the following scenarios does PCIM recommended one:

1. For each applicable(*) PolicyRule, in descending order of Priorities, the
conditions are evaluated and, only for the first one that evaluates true,
the actions are executed.

2. For each applicable(*) PolicyRule, in descending order of Priorities, the
conditions are evaluated and, for all those that evaluate true, the actions
are executed.

(*) a PolicyRule is applicable if its PolicyRole matches the functional,
admin etc. role of the PEP.

Thanks,
Mircea Pana

---

From: "Robert Moore" <[email-masked]>
Date: Mon, 29 Jan 2001 09:39:32 -0500

Mircea,

How about "unintentionally ambiguous"?  What we were
*trying* to say in PCIM is neither of your alternatives.
The additional, ill-defined concept of conflicting policy
rules also figures into the algorithm.  The basic idea is
that in the absence of conflicts, actions for all of the
rules whose conditions evaluate to true are performed.
When there are conflicts, however, the actions for the
higher-priority conflicting rule are performed, and those
for any lower-priority conflicting rules are not.

You should be aware, though, that in the PCIM Extensions
work currently going on, we're looking to clarify/modify
these semantics.  Based on some existing work in QPIM,
we're thinking about eliminating policy conflicts from
the algorithm altogether, and introducing a new property
at the PolicyGroup level, to let the policy administrator
specify which of your two ways of doing it he/she wants:
perform the actions for the first matching PolicyRule, or
perform them for all matching PolicyRules.

For this and several other PCIM changes, stay tuned for a
first PCIM Extensions I-D, which will be available by
the -00 draft cutoff date of February 23.

Regards,
Bob

Bob Moore
IBM Networking Software
+1-919-254-4436
[email-masked]

"Mircea Pana" <[email-masked]>@raleigh.ibm.com on 01/26/2001
05:51:22 PM

Please respond to "Mircea Pana" <[email-masked]>

Sent by:  [email-masked]

To:   "[email-masked]'" <[email-masked]>
cc:
Subject:  semantics of Priority of PolicyRule

Is PCIM intentionally ambiguous w.r.t. the usage of the Priority property
of the PolicyRule class? In situations where multiple PolicyRules are
applicable which one of the following scenarios does PCIM recommended one:

1. For each applicable(*) PolicyRule, in descending order of Priorities,
the conditions are evaluated and, only for the first one that evaluates
true, the actions are executed.

2. For each applicable(*) PolicyRule, in descending order of Priorities,
the conditions are evaluated and, for all those that evaluate true, the
actions are executed.

Thanks,
Mircea Pana