Subject: Re: FW: TDomain in IPSEC-POLICY-MIB

From: Wes Hardaker <[email-masked]>
Date: 31 May 2001 12:39:02 -0700

Since no one responded to my queries about the following, I'll
probably pick #2 (shortly, as I'll be working on the MIB this week and
next) unless someone argues otherwise.

>>>>> On 25 Apr 2001 15:40:08 -0700, Wes Hardaker <[email-masked]> said:

Wes> 1) use current existing TDomain style definitions, which (as pointed
Wes> out) don't really fit our needs.

Wes> 2) Use the above IpsecDoiIdentType definition, and then define how the
Wes> value half of that is specified, um, somewhere?  Should we then
Wes> make a IpsecDoiIdentValue TC that has an extremely long description
Wes> clause spelling out the value formating of the OCTETSTRING that its
Wes> made of?

Wes> 3) Define our own set of 11 or so TDomains to match the above and
Wes> continue to use TAddress as the value specifier.

Wes> There are also issues revolving around how they should be used.  In
Wes> the case of specifying an endpoint that is supposed to be singular
Wes> (open a connection to "here"), should the description clause of every
Wes> object dictate which is legal for that column and which isn't?  Or
Wes> should that definition be defined in the TC (I'd vote for the TC, but
Wes> common MIB practice is to cut-n-paste it everywhere to make sure its
Wes> visible and not missed because they didn't follow the TC reference).

Wes> I've started converting the other pieces of the MIB to use the other
Wes> TCs defined in the previously mentioned draft, but this is the case
Wes> that truly needs more thoughts.

Wes> Opinions?  I'm leaning towards #2 above I guess.

Wes> -- 
Wes> Wes Hardaker
Wes> NAI Labs
Wes> Network Associates

-- 
Wes Hardaker
NAI Labs
Network Associates