Subject: RE: network controls are necessary

From: "Tony Li" <[email-masked]>
Date: Fri, 6 Dec 2002 18:39:36 -0800

Tony,

|   > In fact, in my humble experience, it is normally the case 
|   > that they are mortal enemies, competing for budget.
|   
|   This does not mean it is our responsibility to foster the petty
|   bickering. The goal appears to be to pick sides, with heavy
|   representation from those who are most closely related to 
|   the network
|   side. I am not advocating that the hosts do it all, in fact I don't
|   think either side can go it alone, much as they would often 
|   like to. 

I agree that it's not our place to foster bickering.  But we should also
be cognizant of it when we think about how sites are administered.  We
cannot dictate that it be fixed.

I'm somewhat offended that you would accuse us of being partisan.  This
is an architectural discussion about the right engineering compromises
to help grow the Internet.  I'm fully cognizant of what a host administrator
has to do.  I was a Unix and VMS sysadmin for USC from 1983-2000.  We
supported over 2000 workstations and 30,000 user accounts.  Simplifying
host management was a requirement then and still.

I have nothing to gain by having control in the SBR.  I no longer work 
at Cisco, so I have no interest in placing more responsibility and 
complexity into the CPE gear.  I'm just trying to design a clean architecture
that scales.  That's what we should all be striving for.

|   Our job is to define a mechanism that allows a disparate range of
|   policies to be implemented without serious detriment to the routing
|   system. Locking down so that the routing system is in 
|   complete control
|   makes defining a technology simpler, but that doesn't mean 
|   the result
|   will actually address the policy requirements. Dismissing a set of
|   policies is a fine thing to do when building a network, but not when
|   defining the standard technology that those individual networks will
|   use. 

Our first job is to define an architecture, not a mechanism.  That
architecture will be able to support some policies, not all.  We need to
understand the bounds of the policies that can be supported by a
particular architecture and to choose the architecture which 
balances policy against complexity and our other design goals.
Supporting all possible policies is not an architectural trait that
is supported with either host or SBR policies.  The amount of possibly
relevant information that either of them will have is far too limited
in any rational design to begin to implement all policies.

So we have to choose.

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Mon, 9 Dec 2002 10:00:57 -0800

Tony Li wrote:
> ....
> I'm somewhat offended that you would accuse us of being 
> partisan.  

I was not trying to acuse or label anyone. My point was that we all are
bringing viewpoints based on past expierence, and they can cause
particular approaches to be declaired 'too complex' without serious
study. 

> This

Simplifying does not always mean moving the function into the network.
In fact that approach may make the host job more complex, because the
network has limited knowledge. 

> that scales.  That's what we should all be striving for.

I agree, and was not trying to acuse anyone of focusing on financial
gain. I do think we need more voices involved from host & network
administrators of end sites that are currently multi-homed. The real
trick is finding the people from that set who are willing to put time
into the IETF, and who have some understanding of the range of options
they will have with IPv6. If everyone approaches this from the
standpoint of 'this is how it is done in IPv4', we may be unnecessarily
limiting our options.

> architecture will be able to support some policies, not all.  

I agree we can't arbitrarily support all policies, but we appear to be
writing off a significant number of them because the mechanisms that
would allow them to fit into the target architecture are too complex. 

> We need to

Yes we have to choose. My concern is that the vocal participants are not
providing a balanced perspective on the cost / benefit tradeoffs. Again,
this is not to fault anyone, just raise awareness that we need more
participation from multi-homed host administrators.

Tony

---

From: "Craig A. Huegen" <[email-masked]>
Date: Mon, 9 Dec 2002 16:02:58 -0600 (Central Standard Time)

> network has limited knowledge.

As long as you are considering how to take a network of 100,000 hosts in a
distribution of 65% OS-A, 25% OS-B, 5% OS-C, and 5% OS-Other (comprised of
about 35 different other OS's), push this policy to them within a day or
so, and ensure that the policy will behave the same way across the 39
OS's, then I've got no problem with a fully-distributed host-based
selection mechanism.

The alternative, of course, is for the administrator to make perhaps a
couple of policy changes in a central policy database that are then
automatically utilized by those 100,000 hosts.

Either way you want to approach it, it _will_ require standards, and
better standards than the leftmost longest-bit-match that the address
selection draft provides.  Whether there be a finite set of policy
capabilities a host MUST have, or whether there is a standard protocol
that allows extensibility of the policy engine (a la DNS-like operation),
we have to come up with it.

(PS - No, those aren't real numbers of operating system distribution at
any particular entity that still exists.  It is, however, a representative
distribution of a technology-oriented R&D operation that has no particular
ties to anyone I'm currently affiliated with.  I'm sure that some other
larger organizations have a more standardized environment, and I'm sure
some universities have a significantly more complex environment.)

> into the IETF, and who have some understanding of the range of options

The trick is finding those exact people who have the capability to give
their time.  I'm so busy that I can maybe get to the discussions here once
every two weeks if I'm lucky.

> participation from multi-homed host administrators.

Network administrators generally have a good view of host administration
already, at least enough to know what manpower it would take to
communicate changes, modify standard images, offer alternatives for the
non-conformists, make the change, and support the change.  We all make
design decisions to change various aspects of our networks and we must
know what impact that causes to the host administrators, whether it can be
scripted or not, and the end result effort.  I agree we need more of these
people.

/cah

---
Craig A. Huegen, Chief Network Architect      C i s c o  S y s t e m s
IT Transport, Network Technology & Design           ||        ||
Cisco Systems, Inc., 400 East Tasman Drive          ||        ||
San Jose, CA  95134, (408) 526-8104                ||||      ||||
email: [email-masked]       CCIE #2100      ..:||||||:..:||||||:..