Subject: [netmod] Fwd: Feedback for Access-list YANG draft

From: Akash Jale <[email-masked]>
Date: Fri, 18 Dec 2015 18:02:45 +0530

Hi Work Group,

   Based on the study of documentation of ACL feature usage with different
Vendors, it appears that the current draft doesn’t cover below
configuration options for matching:

·  *Hostname in FQDN format*

·  *Matching IPs based on wildcard masks*

We propose to add these elements into the draft to accommodate more usecase
scenarios/requirements and to be adaptable by different vendors.

*HOSTNAME Usecase:*

In deployments host generally have dynamic addresses within a Domain and
referred using the Hostnames (which is resolved into IP address using DNS).
So having Hostname/FQDN option should be present to handle scenarios for
creating hostname based ACLs.

*WILDCARD Usecase:*

Currently in the draft the Source and Destination node are IP-Prefix type.
Which is laying constraint in configuring traffic flow match criteria using
wildcards.

Using IP-Prefix, you can match packets of the subnet based on the CIDR
notation and it could support only limited wildcard mask cases.

*Examples of supported wildcard masks with CIDR notation : *

·         Prefix:/24, Mask: 255.255.255.0,  Wildcard Mask: 0.0.0.255

·         Prefix:/27 Mask:255.255.255.224, Wildcard Mask:0.0.0.31

·         Prefix:/31 Mask:255.255.255.254, Wildcard Mask:0.0.0.1

There are few usecase scenarios of wildcard masks that we have come across
cannot be covered with /<prefix> notation usage.

*Examples of Not-Supported wildcard cases:*

*      255.0.255.0 – matching a particular network arrangement*

*      255.255.255.254 – matching odd host addresses*

*Referred Link :
https://datatracker.ietf.org/doc/draft-ietf-netmod-acl-model/?include_text=1
<https://datatracker.ietf.org/doc/draft-ietf-netmod-acl-model/?include_text=1>*

*Thank you.*

-- 
Best Regards,

Akash Jale.