Subject: Re: [ipfix] Some ideas on IPFIX-architecture

From: Juergen Quittek <[email-masked]>
Date: Wed, 12 Dec 2001 23:02:28 +0100

JC,

--On 12 December 2001 12:56 -0800 Jc Martin <[email-masked]> wrote:

> Michael
>
>> On Wed, Dec 12, 2001 at 08:54:09AM -0500, Gopal Ram (NRC/Boston) wrote:
>> > (2) We should keep in mind that IPFIX is not going existing on its own
>> > its has relations with Diameter,
>> > Intrusion Detection subsystem
>>
>> I do not see any required relation to Diameter as of today
>> other than at some point in the possible future that the
>> protocol is best fitted for the IPFIX requirements.
>
> Well, there should be a relation, maybe not with Diameter, but at
> least with AAA. The name space and attributes should/must be identical.

Do you see one or even several requirement for IPFIX
concerning compliance with AAA?

If yes, then I suggest you phrase it in a little bit
more elaborated paragraph, that we can discuss here
and that can be inserted into the requirements draft.
Particularly, it woulde be interesting why you think
the name spaces must/should/may be identical. Also
the phrase "maybe not with Diameter" is not really
clear to me.

    Juergen
-- 
Juergen Quittek     [email-masked]     Tel: +49 6221 90511-15
NEC Europe Ltd.,    Network Laboratories     Fax: +49 6221 90511-55
Adenauerplatz 6, 69115 Heidelberg, Germany   http://www.ccrle.nec.de

>
>>
>> IPFIX work is standardizing *existing practice*
>> that has been deployed for years.
>
> Then why a requirement document ? Why not just a description of
> the current practice ?
>
> JC.
>
> --
> Help        mailto:[email-masked] and say "help" in message body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/
>

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Jc Martin <[email-masked]>
Date: Wed, 12 Dec 2001 15:50:30 -0800

Juergen,

See my response inline.

> concerning compliance with AAA?

If you look at the rfc3127, you can see that the evaluation
of the AAA protocols for accounting had the following criteria :
-Real Time Accounting
-Mandatory Compact Encoding
-Accounting Record Extensibility
-Batch Accounting
-Guaranteed Delivery
-Accounting Timestamps
-Dynamic Accounting
which is overlapping with the requirements of IPFIX. While the scope of
the accounting is different (network access vs. network traffic), the
low level requirements seem identical. I'm not suggesting that IPFIX use
diameter, far from that. I think that each protocol has some specific requirements
that justify the divergence. 
While the protocol can be different, the transport requirements are identical,
and the data model can be common, and since the server receiving AAA accounting
will likely receive also IPFIX data, it would be wise to have some commonalties.

> the phrase "maybe not with Diameter" is not really

My comment about "maybe not Diameter" means that I don't
see the specific relation with Diameter as the issue, but more
the relation between AAA and IPFIX. Ultimately, the accounting
data from AAA will be consolidated with IPFIX data by the
mediation device. It's natural to hope that similar concepts will
be expressed identically.

One possible approach would be to reuse the sections described in
4.3, 4.4 and 4.5 in draft-ietf-aaa-diameter-08.txt, 
if the information in that draft is still valid for the AAA protocol
( I did not follow the latest developments in AAA).

Hope this makes sense.

JC.

---

From: Jc Martin <[email-masked]>
Date: Wed, 12 Dec 2001 15:52:09 -0800

Juergen,

See my response inline.

Hope this makes sense.

JC.