Subject: IPSec Policy Model

From: "Casey Carr" <[email-masked]>
Date: Wed, 9 May 2001 17:49:01 -0400

Looking for a pointer to the correct paragraph in the correct document for
the following:

I have been unable to locate the definition for the use of FilterInCondition
and ConditionInRule.  I believe that the original
draft-ietf-ipsp-config-policy-model-00.txt (I no longer have a copy)
described exactly how the filters were suppose to be used and how the
conditions were supposed to be used.  The FilterList definition in the
draft-ietf-ipsp-config-policy-model-01.txt document defines "FilterList
aggregates an ANDed set of filters" but I could not find a statement like
this in the 02 draft.  Presumably because the FilterList object was removed.

How are multiple conditions supposed to be evaluated so that a single
true/false results when a SARule has multiple conditions and each condition
has multiple filters?  I believe the original 00 draft covered this but I am
unable to find this in the new draft or any of the DMTF documents.

My assumption is that all filters are ANDed together (of course taking into
account the "negated" attribute).  If all filters evaluate to true then the
condition is true. If this is the case, then "EntrySequence" attribute of
the aggregation is meaningless.  This same process would then be repeated
for each condition in the rule and the results of each condition are ANDed
together.

Would someone please point me to the correct document to validate/correct my
assumption?

Casey