Subject: RE: 1:1 relationship of PConsumer to PTarget

From: "Ken Roberts" <[email-masked]>
Date: Fri, 29 Oct 1999 12:32:23 -0400

Folks,
A one to one relationship is limiting, it is unreasonable to state that a
single policy constrains a single "target". The difficulty in relaxing the
1:1 relationship comes from not formalizing the "administrative aspects" of
policy. Conflicts stem from both the operational and administrative sides of
policy and violation detection is charged with ensuring the administrative
potential conflicts are managed. 
Real life suggests that multiple policies will constrain a single entity and
rationalization between the multiple policies, both administratively and
operationally, had better be part of a generic framework.

--------------------------------------------------------------------------
Regards,
Ken Roberts
INM Product Architecture
Nortel Networks
?ESN   :        655-7844			?Direct  : 408-565-7844
?  Fax    :        408-565-8226
? email :      [email-masked]
 
This message may contain information proprietary to Nortel Networks
Corporation so any
unauthorised disclosure, copying or distribution of its contents is strictly
prohibited.

 -----Original Message-----
From: 	Hugh Mahon [mailto:[email-masked]] 
Sent:	Friday, October 29, 1999 8:51 AM
To:	[email-masked]
Cc:	[email-masked]; [email-masked]
Subject:	Re: 1:1 relationship of PConsumer to PTarget

Hi Jon and Avri,

> It seems to me that one Policy Target should be associated with one
LOGICAL
> Policy Consumer.  Then it can be explained that a logical PC is one or
more
> PC's that appear consitent between each other.

I like this answer.  Having the Policy Consumer implemented in a 
distributed manner makes sense if that is what is necessary, and it is 
the Policy Consumer design that handles coordination between PC pieces 
to ensure consistent behavior and interactions with the Policy 
Target(s).  In this way the Policy Management Application (PMA) has a 
single interface to the logical PC.  

The concern I was trying to address in the document was one of 
allowing management of the target, while minimizing administration of 
components as much as possible.  If the PMA must coordinate between 
multiple PCs working with the same target it could get messy on the 
PMA.  A distributed PC addresses your (Avri's) concerns yet allows a 
relatively simple mapping between a Policy Target and (logical) PC. 

Thanks,

Hugh

> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]]On Behalf Of [email-masked]
> > Sent: Thursday, October 28, 1999 5:26 PM
> > To: [email-masked]
> > Subject: 1:1 relationship of PConsumer to PTarget
> >
> >
> > Hi,
> >
> > I have a question about the following limitation:
> >
> >       Each  Policy  Target has one Policy Consumer.  To have more
> >       than one Policy Consumer responsible  for  configuring  the
> >       Policy  Target  would  invite contention between the Policy
> >       Consumers.  There may be one or more  Policy  Consumers  to
> >       enable  continued operation in a failure mode, but only one |
> >       at a time is to be the 'active' Policy Consumer.  A  Policy |
> >       Consumer,  though, can work with multiple Policy Targets at |
> >       the same time.
> >       	draft-ietf-policy-req-01-diffs.txt; p10
> >
> > The reason I ask is that on occasion the processing involved in
> > being a Policy Consumer may be such that load sharing would be
> > desired.  This could be the case when a Policy Target would have a great
> > number of capabilities for which it is requesting a PC act
> > as a outsourcing PDP.
> > If this limitation remains then we could end up with a single
> > system having a number of PTs in order to handle a large number of
> > capabilities. This too could become cumbersome.
> >
> > Or can a requirement be imposed on PCs such that they are required to
> > coordinate between themselves and the PT(s)?
> >
> > a.
> > -----------------------------------
> > avri doria
> > +1 617 678 9402
> >
> >
> 
>

---

From: Francis Reichmeyer -NJ <[email-masked]>
Date: Fri, 29 Oct 1999 11:32:12 -0400

> From: John Schnizlein [mailto:[email-masked]]
> Sent: Friday, October 29, 1999 11:08 AM
> To: Francis Reichmeyer -NJ; 'Jon Sjoberg'; [email-masked];
> [email-masked]
> Subject: RE: 1:1 relationship of PConsumer to PTarget
> 
> 
> The point is that there must be only one authoritative source for
> any policy, otherwise an uncontrolled opportunity for conflict exists.
> If security policy and QoS policy imply different interface/device
> configuration, how would this be detected, resolved and/or prevented?

One way is by configuration at the device. The device is configured to
connect to different PDPs to receive different policies and advertises
the appropriate policies it expects from the PDPs. Then each PDP is
the authoritative source for those policies.

Personally, I prefer an implemintation with a single PDP managing all
policy for a device. I was just mentioning a way that multiple PDPs
*could* manage different policies on a device.

> 
> A related question regards the implication of a "role" at at device
> if different policy sources have different views of it. Recall that
> "roles" are independently configured on device interfaces by the
> configuration management system; we have no mechanism specified for
> coordinating the interpretation of a "role" (combination) either
> between the configuration management and policy management systems,
> much less between multiple policy sources.

Sounds like the concept of "roles" needs more work, then :^) Of course,
if we can't coordinate roles between config management and a single
PDP, then multiple PDPs are going to be that much harder to implement.

-Fran

> 
> - John
> 
> At 09:55 AM 10/29/1999 -0400, Francis Reichmeyer -NJ wrote:
> >My understanding is that a Target/PEP can be associated with
> >more than one Consumer/PDP but multiple Comsumers/PDPs cannot
> >configure the same policy information on the Target/PEP.
> >The example that used to get thrown around is one where there
> >are separate Consumers/PDPs for QoS policy, Security policy, etc.
> >As long as two Consumers/PDPs don't try to set or change the same
> >piece of policy data on the device, the model works.
> >
> >-Fran
>

---

From: [email-masked]
Date: Fri, 29 Oct 1999 19:08:21 +0300

Hi,

I like the idea as well.  However, if a PT/PMA is going to avoid being 
at the mercy of possibly unruly logical PC entities, it should have 
some way of registering the identities of the participating PC 
entities and should have a set of rules for the association(s).

regards,
a.

> 
> > It seems to me that one Policy Target should be associated 
> with one LOGICAL
> > Policy Consumer.  Then it can be explained that a logical 
> PC is one or more