Subject: draft-ietf-ipsp-config-policy-model-02: SAStaticAction

From: Michael Baer <[email-masked]>
Date: 20 Jun 2001 09:08:36 -0700

Hi,

I'm trying to map the SAStaticAction classes over to the
IPSEC-POLICY-MIB and I came across a property I don't understand the
location of.  In the class definition for SAStaticAction, it has the
property of LifetimeSeconds. I don't see much use for it though for
the sub-classes of Bypass, Discard, or Reject Actions. Shouldn't this
property be moved to the PreconfiguredSAAction class (where
LifetimeKilobytes is also located)?

Mike

-- 
Michael Baer
NAI Labs

---

From: "Lee Rafalow" <[email-masked]>
Date: Thu, 21 Jun 2001 11:05:40 -0400

I think the reason was that one might have rules that have time of day
contraints (using PolicyTimePeriodCondition) and that any SA set up during a
particular period needed to expire at some point.  For example, during
normal business hours a rule permits certain traffic to bypass but in the
evening it's blocked.  The bypass SA is established with a lifetime seconds.

---

From: Michael Baer <[email-masked]>
Date: 27 Jun 2001 17:03:35 -0700

>>>>> "Lee" == Lee Rafalow <[email-masked]> writes:

    Lee> I think the reason was that one might have rules that have
    Lee> time of day contraints (using PolicyTimePeriodCondition) and
    Lee> that any SA set up during a particular period needed to
    Lee> expire at some point.  For example, during normal business
    Lee> hours a rule permits certain traffic to bypass but in the
    Lee> evening it's blocked.  The bypass SA is established with a
    Lee> lifetime seconds.

After looking over the IPsec spec, I see where this fits (I could
already see where it could be practically useful). But for the sake of
consistency, shouldn't lifetime kilobytes then also be a property of
the SAStaticAction class (i.e. move it up from the
PreconfiguredSAAction class) so as to be available for the deny,
reject, and bypass static actions. I think that between the two,
lifetime seconds would get used more often, but it seems to me that
both lifetimeSec and lifetimeKB provide a very similar capability and
should be available at the same class level.

    >> IPSEC-POLICY-MIB and I came across a property I don't
    >> understand the location of.  In the class definition for
    >> SAStaticAction, it has the property of LifetimeSeconds. I don't
    >> see much use for it though for the sub-classes of Bypass,
    >> Discard, or Reject Actions. Shouldn't this property be moved to
    >> the PreconfiguredSAAction class (where LifetimeKilobytes is
    >> also located)?
    >>
    >> Mike
    >>
    >> -- Michael Baer NAI Labs

-- 
Michael Baer
[email-masked]
NAI Labs