Subject: [netmod] comments Re: WG Last Call: draft-ietf-netmod-acl-model-01.txt

From: Ing-Wher Chen <[email-masked]>
Date: Tue, 17 Feb 2015 18:54:18 +0000

- How does acl-type work with ace-type?

What does it mean when an ACL has acl-type = eth-acl ,
but with a match rule that has ace-type of ace-ip?

Is the intention of the model to allow each match rule to filter
for a single layer?  If that's not the intention, then what's the
reason for an independent layer-2 filter but a consolidated layer-3
and layer-4 filter?

If the model intends to allow each match rule to filter for a single
layer, and if multiple match rules are allowed, then acl-type as
allowed by the identities defined in the model doesn't mean much.

Also, if the model intends to allow each match rule to filter for
a single layer, then why combine IP and port in acl-ip-header-fields,
rather than de-couple IP and port?  De-coupling IP and port,
and having separate IP filter and layer-4 filter, also makes sense
because not all IP protocols use ports.

- Regarding the structure and scope of the model:

What is the scope of the ACL model?  If the intention is for an ACL
to be defined as a template or profile, then where can an ACL
be applied?  Is an ACL to be applied to an interface, to a port,
or to a VRF?

As a global tree, the model doesn't allow for the use case
where a user wishes to make its ACL definitions private within
a routing-instance or a VRF
(https://svn.tools.ietf.org/html/draft-ietf-netmod-routing-cfg-16).

Also, the definition of "acl-oper-data" and "targets"
forces each ACL to keep a reference to the application where
the ACL is applied, when it arguably should be the other
way around, i.e., the application that chooses to utilize an ACL
should reference the ACL.

In terms of smaller structural details, for container "acl-oper-data",
why isn't "match-counter" a leaf-list to parallel "targets",
to track counter for each target?  A user would want to know how
many packets matched an ACL at a particular interface, port, or even VRF,
perhaps more so than the total number of packets that matched an ACL.

Thanks,
Helen