Subject: More on IPSEC-POLICY-MIB

From: "Casey Carr" <[email-masked]>
Date: Fri, 20 Apr 2001 15:12:06 -0400

Is this the correct forum for this stuff or should I be going directly to
the MIB authors?  I don't want to bore those not interested but is it
considered bad practice to do and end run around this mailing list?

 1. "pgIKEConditionListType DEFVAL( true )" should be either
"pgIKEConditionListType DEFVAL( or )" or "pgIKEConditionListType
DEFVAL( and )"
2. "ficFilterIsNegated" is defined but not include in the
"FiltersInConditionEntry"
2. The AntiReplay objects are defined inconsistently.  Should they all be
TruthValue syntax?
3. ipsecGroupId object in the IpsecActionEntry - should the syntax be
"IpsecGroupId" instead of  INTEGER?

My personal opinion is that the IpsecGroupId ::= TEXTUAL-CONVENTION would be
more appropriately named "DhGroupId".

Casey

NetZero Platinum
No Banner Ads and Unlimited Access
Sign Up Today - Only $9.95 per month!
http://www.netzero.net

---

From: Wes Hardaker <[email-masked]>
Date: 20 Apr 2001 15:04:04 -0700

>>>>> On Fri, 20 Apr 2001 15:12:06 -0400, "Casey Carr" <[email-masked]> said:

Casey> Is this the correct forum for this stuff or should I be going
Casey> directly to the MIB authors?

This is the correct forum.  We warned the WG that it may be a lot of
traffic at the last meeting and they said it actually would be a good
thing.  We'll see if they agree after the onslaught I intend to post
next week about it.

Casey> 1. "pgIKEConditionListType DEFVAL( true )" should be either
Casey> "pgIKEConditionListType DEFVAL( or )" or "pgIKEConditionListType
Casey> DEFVAL( and )"

Thanks.  Changed to "and".  (we were originally using a boolean TC
there).

Casey> 2. "ficFilterIsNegated" is defined but not include in the
Casey> "FiltersInConditionEntry"

fixed.

Casey> 2. The AntiReplay objects are defined inconsistently.  Should they all be
Casey> TruthValue syntax?

Changed them all to TruthValue.

Casey> 3. ipsecGroupId object in the IpsecActionEntry - should the syntax be
Casey> "IpsecGroupId" instead of INTEGER?

Yep.  Fixed.

Casey> My personal opinion is that the IpsecGroupId ::=
Casey> TEXTUAL-CONVENTION would be more appropriately named
Casey> "DhGroupId".

Good point. Changed to "DHGroupId".

Thanks again for the comments!

(by the way, you may wish to check out
http://www.hardakers.net/ipsec/presentation/ which is a presentation I
gave at the last meeting on the MIB if you missed it [warning: slow
ISDN link]).

-- 
Wes Hardaker
NAI Labs
Network Associates