Subject: IPSP Authors' Design Meeting Minutes

From: "Jason, Jamie" <[email-masked]>
Date: Wed, 9 May 2001 11:10:58 -0700

IPSP Authors' Design Meeting
Thursday, May 3, 2001
Particpants:
  Wes Hardaker, Network Associates
  Jamie Jason, Intel
  Man Li, Nokia
  Lee Rafalow, IBM
  Eric Vyncke, Cisco
  Cliff Wang, SmartPipes

The authors of the different IPSP policy drafts (model, MIB, and PIB)
participated in a teleconference to discuss several issues that were raised
at the Minneapolis IETF.  These issues were:

- filtering on dynamic ports (for example, as are used in the context of a
protocol like H.323).  The decision was made that for the sake of
progressing the model to last call, this issue will not be addressed and the
recommendation is to use the existing filtering mechanisms.  The filtering
that would be necessary to accomplish dynamic ports in the manner brought up
in the Minneapolis WG meeting would require additional context, for example,
an application type (like H.323).
- filtering on other packet values in addition to 5-tuple (for example, ICMP
type).  The decision was made that for the sake of progressing the model to
last call, this issue will not be addressed.  However, the model is
extensible so that in the future new filter types may be added to allow this
capability.
- executing multiple actions with one rule.  The method originally proposed
on the mailing list (adding an additional attribute to the assocation
between SARule and SAAction) is deemed as sufficient.  However, the Policy
Core Information Model extensions (PCIMe) introduced the idea of a compound
action and the group took as an action item to determine if the compound
action can be used instead.  This has the added benefit that we also
partially address how the IPsec policy model will interact with the PCIMe
work.
- one of the universally hated restrictions has been removed from the IPsec
policy model.  Originally, it was stated that a policy group may only
contain rules or other groups.  That restriction has been lifted so that now
IPsec policy groups may contain both.
- an investigation is to be made into the amount of work necessary to define
a common rule structure that can be shared among all WGs (DiffServ, MPLS,
IPSP, etc.) so that mixture of different kinds of rules is easier.  A
pitfall to avoid is delaying the IPsec policy model last call an
indeterminate amount of time in order to align all of the different
factions.  Any umbrella work that would affect multiple WGs working on
policy would likely need to be done in the Policy Framework WG and it is
unlikely that they would be willing to take on new charter items given their
desire to finish up all current work in time for the London IETF in August.
- an investigation will be made into whether or not the 5-tuple and 6-tuple
filter classes defined in the QoS device-level model (QDDIM) can be used to
replace the FilterEntry class currently being used.  These filter classes
are going to be moved into PCIMe.

----------------------------------------------------------------
Jamie Jason                       email: [email-masked]
Intel Architecture Labs           phone: 503-264-9531
2111 NE 25th Avenue               fax:   503-264-9428
Hillsboro, OR 97124
                          
"To give anything less than your best is to sacrifice the gift."
 - Steve Prefontaine

All opinions expressed are:
1.  Entirely my own.
2.  Not necessarily shared by my employer.
3.  Unencumbered by the thought process.
----------------------------------------------------------------