Subject: RE: [IPFIX] Should the IPFIX MIB be writeable?

From: "Zseby, Tanja" <[email-masked]>
Date: Thu, 19 Oct 2006 11:46:19 +0200

Hi Thomas,

in my opinion it would be extremely useful to have a writeable MIB that
would allow exporter configuration by SNMP.

Kind regards,
Tanja 

> -----Original Message-----
> From: Thomas Dietz [mailto:[email-masked]] 
> Sent: Thursday, October 19, 2006 4:19 AM
> To: [email-masked]
> Subject: [IPFIX] Should the IPFIX MIB be writeable?
> 
> Dear Benoit, Kobayashi and others,
> 
> I want to summarize 2 points that arose in the current 
> discussion of the IPFIX MIB and poll the list for comments 
> how we should proceed with it.
> 
> It is a fundamental decision if we should allow the IPFIX 
> devices to be configured via SNMP. For the collector there is 
> not much to configure but for the exporter there are many 
> things that could be set-up, changed and deleted.
> 
> Making the MIB writeable would have the consequence that we 
> need to carefully review the status for each variable and 
> table. We must define the row status and how it must be set 
> and what each setting means. Furthermore we need to carefully 
> elaborate the conformance section and need to discuss every 
> writeable object in the security considerations. So it is a 
> really big effort to make the MIB writeable so that it is 
> secure to use it.
> 
> Nevertheless, if the majority on the list has the opinion 
> that it is really useful to have the MIB (especially the 
> EXPORTER MIB) writeable than we would take that effort.
> 
> Please keep in mind that the decision we take here would also 
> affect the PSAMP MIB accordingly.
> 
> Awaiting your comments,
> 
> Thomas
> 
> -- 
> Thomas Dietz                       E-mail: [email-masked]
> Network Laboratories               Phone:  +49 6221 4342-128
> NEC Europe Ltd.                    Fax:    +49 6221 4342-155
> Kurfuersten-Anlage 36
> 69115 Heidelberg, Germany          http://www.netlab.nec.de
> 

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix

---

From: "Thomas Dietz" <[email-masked]>
Date: Thu, 19 Oct 2006 12:22:16 +0200

Dear Tanja,

It may be usefull, but I am not sure if it will be used by many people. It
is a complex task, you cannot do it easily by hand and to write a management
program (element manager or what soever) which does it for you is also a
rather tidious and complex work. In most cases the setup by a command line
interface is much faster and less error prone than using SNMP. I am quite
sure most people who configure e.g. a cisco router do it by command line
even though they might be able to do most of the work by SNMP.

Best Regards,

Thomas

> From: Zseby, Tanja [mailto:[email-masked]] 
> Sent: Thursday, October 19, 2006 11:46 AM
> To: Thomas Dietz; [email-masked]
> Subject: RE: [IPFIX] Should the IPFIX MIB be writeable?
> 
> Hi Thomas,
> 
> > -----OriginalFrom [email-masked] Thu Oct 19 06:26:14 2006
Content-class: urn:content-classes:message
Subject: RE: [IPFIX] Should the IPFIX MIB be writeable?
Date: Thu, 19 Oct 2006 12:22:16 +0200
From: "Thomas Dietz" <[email-masked]>
To: "Zseby, Tanja" <[email-masked]>,
	<[email-masked]>
Cc: 

This is a multi-part message in MIME format.
Dear Tanja,

It may be usefull, but I am not sure if it will be used by many people. It
is a complex task, you cannot do it easily by hand and to write a management
program (element manager or what soever) which does it for you is also a
rather tidious and complex work. In most cases the setup by a command line
interface is much faster and less error prone than using SNMP. I am quite
sure most people who configure e.g. a cisco router do it by command line
even though they might be able to do most of the work by SNMP.

Best Regards,

Thomas

> From: Zseby, Tanja [mailto:[email-masked]] 
> Sent: Thursday, October 19, 2006 11:46 AM
> To: Thomas Dietz; [email-masked]
> Subject: RE: [IPFIX] Should the IPFIX MIB be writeable?
> 
> Hi Thomas,
>

---

From: "Thomas Dietz" <[email-masked]>
Date: Thu, 19 Oct 2006 12:22:16 +0200

Dear Tanja,

Best Regards,

Thomas

---

From: "Natale, Bob" <[email-masked]>
Date: Thu, 19 Oct 2006 09:24:08 -0400

Hi Thomas,

Your observations below (and in your subsequent follow-up to Dave
Harrington's post) suggest a kind of "vicious circle" thinking that
results in:

   - SNMP applications being "unuseful"
   - because SNMP MIBs are (typically) less rich in L7 aspects than
they could be
   - because SNMP applications are "not used by many people".

In reality, however, such applications are "unuseful" because they are
"unusable"; they are "unusable" because the MIBs were not designed with
L7 "usability" in mind.

The key to an SNMP application's usability, particularly at the human
operator level, is the richness of the MIB relative to the management
operations applicable to the managed entities covered by the MIB.
This, IMHO, is where SNMP has yet to reach its full potential.  In this
view, a MIB design team should include consideration of this basic
question at the outset:  "What application-level operations are
essential and what others would be helpful, from the operational
perspective?"  Delivering those operations via an SNMP MIB will often
require design of and support for "higher-order" MIB objects that
aggregate (in various ways) multiple atomic MIB objects, that
instrument "behaviors", that summarize "state", and so forth.

Two other things I would like to note from my experience (which might
not be typical, I suppose):

1. For a fair number of moderately complex real-world applications
(e.g., configuring charging policies on an IP services switch in an
early IMS-like network context) using CLI is definitely NOT "faster and
less error-prone" than using an application-level tool, regardless of
the underlying protocol used by that app (SNMP, TL-1, CORBA, WSDL/SOAP,
etc.)

2. Given a fairly "rich" MIB (per above comments) there are many good
and accessible SNMP "management consoles" that can provide a reasonable
user interface w/o writing a specialized application.  (Yes, there are
definitely exceptions -- but in practice most of those exceptions exist
because the underlying MIBs are just too primitive for efficient
app-level operations.)

[Btw, I heartily concur with Dave's recommendation that MIB "Security
Consideration" sections should not limit their guidance to SNMP
operations only.  Long overdue.]

Cheers,
BobN

-----Original Message-----
From: Thomas Dietz [mailto:[email-masked]] 
Sent: Thursday, October 19, 2006 6:22 AM
To: Zseby, Tanja; [email-masked]
Subject: RE: [IPFIX] Should the IPFIX MIB be writeable?

Dear Tanja,

It may be usefull, but I am not sure if it will be used by many people.
It
is a complex task, you cannot do it easily by hand and to write a
management
program (element manager or what soever) which does it for you is also
a
rather tidious and complex work. In most cases the setup by a command
line
interface is much faster and less error prone than using SNMP. I am
quite
sure most people who configure e.g. a cisco router do it by command
line
even though they might be able to do most of the work by SNMP.

Best Regards,

Thomas

---

From: "Natale, Bob" <[email-masked]>
Date: Thu, 19 Oct 2006 09:24:08 -0400

Hi Thomas,

Cheers,
BobN

-----Original Message-----
From: Thomas Dietz [mailto:[email-masked]] 
Sent: Thursday, October 19, 2006 6:22 AM
To: Zseby, Tanja; [email-masked]
Subject: RE: [IPFIX] Should the IPFIX MIB be writeable?

Dear Tanja,

Best Regards,

Thomas