Subject: [sacm] Comments on Network Interface

From: Henk Birkholz <[email-masked]>
Date: Tue, 4 Nov 2014 17:38:48 +0100

Hi all,

the new draft (draft-ietf-sacm-information-model-00) now includes a 
combined section for "Network Session" and "Network Interface" (4.10.).

My recommendation is to divide the elements Network Session, Network 
Interface and potentially (Network) Address into separate sections of 
the same level (4.x).

While both terms are related, of course, there are several (more or less 
important) reasons for this:
A session typically involves multiple participants (e.g. endpoints, or - 
broken down - eventually addresses or interfaces) and typically has a 
limited life-time. An interface, in contrast, is a singular entity that 
can exist over the complete life-cycle of an endpoint (virtual 
interfaces can have a foreseeable limited life-time). As Ira pointed 
out, an interface typically provides connectivity to a network on layer 
two to three, while a network session is typically associated with 
layers above those.

Although closely related, they are quite different, semantically, and 
may even need separate representations in the SACM IM.

My proposal for a separate "Network Interface" section:

---snip---
Network Interface

An endpoint is connected to a network via one or more interfaces. 
Interfaces can be physical or virtual. Interfaces of an endpoint can 
operate on different layers, most prominently what is now commonly 
called layer 2 and 3. Within a layer, interfaces can be nested.
On layer 2, a root interface is typically associated with a physical 
interface port and nested interfaces are virtual interfaces. In the case 
of a virtual endpoint, a root interface can be a virtual interface. 
Virtual layer 2 interfaces of one or more endpoints can also
constitute an aggregated group of links that act as one.
On layer 3, nested interfaces typically constitute virtual tunnels or 
networks.
Examples include: physical Ethernet port, layer 2 VLAN interface, a 
MC-LAG setup, layer 3 Point-to-Point tunnel ingress or egress.
---snap---

A small addition to the "Address" section, analogously:

---snip---
Network Address

Network addresses are layer specific and follow layer specific address 
schemes. Each interface of a specific layer can be associated with one 
or more addresses appropriate for that layer.
There is no guarantee that an address is globally unique. In general, 
there is a scope to an address in which it is intended to be unique.
Examples include: physical Ethernet port with a MAC address, layer 2 
VLAN interface with a MAC address, layer 3 interface with multiple IPv6 
addresses, layer 3 tunnel ingress or egress with an IPv4 address.
---snap---

Sometimes, the complexity a setup of interfaces can incorporate is a 
little bit underestimated, IMHO. The proposed text above only includes 
the most common cases and does not touch emerging practices, such as 
physical interface modules that provide a set of single physical 
interfaces, which are associated with multiple distinguishable endpoints 
at the same time.

In order to address network centric security/monitoring processes, 
effectively, the SACM IM should be able to handle the complexity of 
applied common practice in its definition of "Network Interface", I think.

Best,

Henk