Subject: ANNOUNCEMENT: WG last call on draft-ietf-snmpconf-bcp-06.txt

From: David Partain <[email-masked]>
Date: Thu, 06 Sep 2001 17:17:35 +0200

Greetings all,

We've now all seen this:

> A New Internet-Draft is available from the on-line
> Internet-Drafts directories.  This draft is a work item of the
> Configuration Management with SNMP Working Group of the IETF.
>
>   Title       : Configuring Networks and Devices with SNMP
>   Author(s)   : M. MacFaden, J. Saperia, W. Tackabury
>   Filename    : draft-ietf-snmpconf-bcp-06.txt
>   Pages       : 66
>   Date        : 05-Sep-01
>
> This document is for a variety of readers interested in the Internet
> Standard Management Framework, the Simple Network Management Protocol
> (SNMP).
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-snmpconf-bcp-06.txt

This mail is to announce the beginning of the Working Group
Last Call period on this document. The WG Last Call period
will last until October 6, 2001.

The WG members are strongly urged to review this document as
soon as possible, and express any concerns, or identify any
errors, in e-mail sent to the SNMPCONF WG mailing list.

Unless there are strong objections, published on the SNMPCONF
WG mailing list by October 6, 2001, this document will be
forwarded to the OPS Area Directors for consideration by the
IESG as a Best Current Practices document.

Please send all comments to the WG mailing list at
[email-masked].

With kind regards,

--
David Partain                  [email-masked]
Ericsson Radio Systems AB      Tel:    +46 13 28 41 44
Research and Innovation        Fax:    +46 13 28 75 67
P.O. Box 1248
SE-581 12  Linköping, Sweden

---

From: John Schnizlein <[email-masked]>
Date: Thu, 06 Sep 2001 17:47:01 -0400

At 11:17 AM 9/6/2001, David Partain wrote:
>...

One of the early promises in WG discussion was identification of
how production networks that actually use SNMP for configuration.
To support the (implied) claim that this is common in section 6,
at least some such networks should be identified. Did I just miss
this on the mailing list? Or when was it posted?

>> 6.  DEPLOYMENT AND SECURITY ISSUES
>>
>> Network devices are configured using many mechanisms, however two 
>> methods remain the most common: SNMP and Command Line Interface (CLI).

An issue which was framed more crisply in the Policy Framework WG, but
still applies here because policy configuration is advocated, is the need
to control which persons can modify (possibly even read) which 
configuration items. It is well known that different persons or teams
are responsible for different configuration parameters on production
networks. It is not clear from the relevant section how different user's
access is controlled to different items. For example, where is the
control information stored?

>> 6.4.  Sensitive Information Handling
>>
>> Some MIB modules contain objects that may contain data for keys, 
>> passwords and other such sensitive information and hence must be 
>> protected from unauthorized access.

How can the "new SNMPCONF technology" be the subject of "best practice"
without distorting the very idea that technology has been already found
effective in practice?

>> 7.  POLICY BASED MANAGEMENT
>>
>> A common practice used to move large amounts of data that some vendors
>> employ involves using SNMP as a control channel in combination with
>> other protocols defined for transporting bulk data. This approach is
>> sub-optimal since it raises a number of security and other concerns.
>> Transferring large amounts of configuration data via SNMP can be 
>> efficiently performed with several of the techniques described earlier 
>> in this document. This policy section shows how even greater efficiency 
>> can be achieved using the new SNMPCONF technology. 

Please do not simply repeat the refrain that these fundamental problems
have been addressed already, or that they are (surprisingly) appearing
only at the last-call stage of discussion. It appears they have not yet
been actually resolved.

John

---

From: "Wayne F. Tackabury" <[email-masked]>
Date: Mon, 10 Sep 2001 15:52:05 -0400

Hi John:

>without distorting the very idea that technology has been already found

In principle, I agree with you.  This document should stand alone of the 
other snmpconf work.  As you note elswhere in your posting, the doesn't 
mean that policy-based configuration overall is inappropriate to discuss.

So let's see, there are three references to snmpconf in the document.

One is in sec. 3.3.5, and as I look at it now, does look a bit out of place 
here.  The idea is that clever deployment of certain systems employing 
policy-based abstractions have a definite upside of reducing data transfer 
overhead, where the abstraction processing can be done on the agent.  But, 
this isn't just pertinent to SNMPCONF pm (of which this is true), but any 
policy agent or mlm inbound along the management path of concern.

I'd definitely be game for changing this section to reflect this more 
generic sense, and remove any direct reference to snmpconf here.

Another mention is at the beginning of section 7.  That's really mostly an 
oversight given how this section was reformatted.  I'm very game for 
shooting that penultimate sentence of section 7.

Last is the final sentence of section 7.1.  It clearly defines snmpconf as 
a latest-example of a system supporting policy abstraction directly using 
SNMP, and the bibliographic reference is to a work-in-progress.  I'd vote 
that this isn't dictating anything or outlining a highly current practice, 
but merely being illustrative as to new developments in the practice, and 
hence, is appropriately framed for your concerns.

Let me know if with these mods, the essence of your concern is 
addressed.  You had two other significant concerns, which I think Jon 
addressed (feel free to repost if you have concerns that what he pointed 
out needs amplification).  Thanks for your time and attention in looking at 
the document.

Regards,
Wayne

---

From: John Schnizlein <[email-masked]>
Date: Mon, 10 Sep 2001 16:57:17 -0400

Wayne,

Yes, fixing 3.3.5 and the beginning of 7., 
but leaving the example in 7.1 would work.

I have not seen Jon's response to the other concerns. 
Would you please forward that message?

John

At 03:52 PM 9/10/2001, Wayne F. Tackabury wrote:

>In principle, I agree with you...
>
>One is in sec. 3.3.5, and as I look at it now, does look a bit out of place here.  ...
>
>I'd definitely be game for changing this section to reflect this more generic sense, and remove any direct reference to snmpconf here.
>
>Another mention is at the beginning of section 7.  That's really mostly an oversight given how this section was reformatted.  I'm very game for shooting that penultimate sentence of section 7.
>
>Last is the final sentence of section 7.1.  It clearly defines snmpconf as a latest-example of a system supporting policy abstraction directly using SNMP, and the bibliographic reference is to a work-in-progress.  I'd vote that this isn't dictating anything or outlining a highly current practice, but merely being illustrative as to new developments in the practice, and hence, is appropriately framed for your concerns.
>
>Let me know if with these mods, the essence of your concern is addressed.  You had two other significant concerns, which I think Jon addressed (feel free to repost if you have concerns that what he pointed out needs amplification).  Thanks for your time and attention in looking at the document.