Subject: Re: IPSEC-POLICY-MIB - Negotiation actions

From: Wes Hardaker <[email-masked]>
Date: Wed, 18 Jul 2001 14:46:07 -0700

>>>>> On Wed, 9 May 2001 11:05:53 -0400, "Casey Carr" <[email-masked]> said:

Casey> I'm concerned about the apparent deviation from the IPSec
Casey> Policy model that the IPSEC-POLICY-MIB has taken with regards
Casey> to SANegotiatedActions.

Casey> The NegotiationAction table contains the sanIKEActionName and
Casey> sanIPsecActionName.

Casey,

I've fixed in the copy of the MIB that will be published by Friday's
ID deadline.  The saNegotiationAction table no longer exists and the
ikeActionTable and ipsecActionTable should be pointed to directly be
the action related row pointers.  I have, however, kept the lifetime
parameters separate for the time being in a replacement of the
saNegotationAction table which has been renamed to
"saNegotationParametersTable" and the pointer columns removed (and
pointer columns were added to the ikeActionTable and
ipsecActionTable).

My view on this is that the reuse in this case is probably warranted
as it's likely that administrators would want to globally define
lifetime parameters that they feel are acceptable and that they'll
likely not only want to have both the ike and ipsec related actions be
able to reuse those same definitions, but multiple independent actions
of the same time (eg, ike and ike) will likely want to use the same
values as well.  This provides for easy changing of the lifetime
parameters at a more global location.

However, if the WG disagrees with me on this I'd be happy to duplicate
the columns in the other two action tables and move on.  Let me
know...

Here's the new table breakdown of the 3 tables discussed:

+--saNegotiationParametersTable(11)
   |
   +--saNegotiationParametersEntry(1)
      |  Index: sanActionParametersName
      |
      +-- CR-- String    sanActionParametersName(1)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- CR-- String    sanActionDescription(2)
      |        Size: 0..255
      +-- CR-- Integer32 sanMinimumLifetimeSeconds(3)
      +-- CR-- Integer32 sanMinimumLifetimeKB(4)
      +-- CR-- Integer32 sanRefreshThresholdSeconds(5)
      +-- CR-- Integer32 sanRefreshThresholdKB(6)
      +-- CR-- Integer32 sanIdleDurrationSeconds(7)
      +-- -R-- TimeTicks sanLastChanged(8)
      |        Textual Convention: TimeStamp
      +-- CR-- EnumVal   sanStorageType(9)
      |        Textual Convention: StorageType
      |        Values: other(1), volatile(2), nonVolatile(3), permanent(4), readOnly(5)
      +-- CR-- EnumVal   sanRowStatus(10)
               Textual Convention: RowStatus
               Values: active(1), notInService(2), notReady(3),
               createAndGo(4), createAndWait(5), destroy(6)

+--ikeActionTable(12)
   |
   +--ikeActionEntry(1)
      |  Index: ikeActionName
      |
      +-- ---- String    ikeActionName(1)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- ---- String    ikeActionParametersName(2)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- CR-- Integer32 ikeThresholdDerivedKeys(3)
      |        Range: 0..100
      +-- CR-- EnumVal   ikeExchangeMode(4)
      |        Values: main(1), agressive(2)
      +-- CR-- EnumVal   ikeAgressiveModeGroupId(5)
      |        Textual Convention: IkeGroupDescription
      |        Values: reserved(0), modp768(1), modp1024(2), ec2nGF155(3), ec2nGF185(4), ec2nGF163Random(6), ec2nGF163Koblitz(7), ec2nGF283Random(8), ec2nGF283Koblitz(9), ec2nGF409Random(10),
ec2nGF409Koblitz(11), ec2nGF571Random(12), ec2nGF571Koblitz(13)
      +-- CR-- String    ikeProposalName(6)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- CR-- String    ikeIdentityName(7)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- -R-- TimeTicks ikeActionLastChange(8)
      |        Textual Convention: TimeStamp
      +-- CR-- EnumVal   ikeActionStorageType(9)
      |        Textual Convention: StorageType
      |        Values: other(1), volatile(2), nonVolatile(3), permanent(4), readOnly(5)
      +-- CR-- EnumVal   ikeActionRowStatus(10)
               Textual Convention: RowStatus
               Values: active(1), notInService(2), notReady(3),
               createAndGo(4), createAndWait(5), destroy(6)

+--ipsecActionTable(14)
   |
   +--ipsecActionEntry(1)
      |  Index: ipsecActionName
      |
      +-- ---- String    ipsecActionName(1)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- ---- String    ipsecActionParametersName(2)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- CR-- String    ipsecProposalName(3)
      |        Textual Convention: SnmpAdminString
      |        Size: 1..32
      +-- CR-- EnumVal   ipsecUsePfs(4)
      |        Textual Convention: TruthValue
      |        Values: true(1), false(2)
      +-- CR-- String    ipsecVendorId(5)
      |        Size: 0..255
      +-- CR-- EnumVal   ipsecGroupId(6)
      |        Textual Convention: IkeGroupDescription
      |        Values: reserved(0), modp768(1), modp1024(2), ec2nGF155(3), ec2nGF185(4), ec2nGF163Random(6), ec2nGF163Koblitz(7), ec2nGF283Random(8), ec2nGF283Koblitz(9), ec2nGF409Random(10),
ec2nGF409Koblitz(11), ec2nGF571Random(12), ec2nGF571Koblitz(13)
      +-- CR-- EnumVal   ipsecUseIkeGroup(7)
      |        Textual Convention: TruthValue
      |        Values: true(1), false(2)
      +-- CR-- EnumVal   ipsecGranularity(8)
      |        Values: wideSelector(1), narrowSelector(2)
      +-- CR-- EnumVal   ipsecMode(9)
      |        Values: tunnel(1), transport(2)
      +-- CR-- EnumVal   ipsecDFHandling(10)
      |        Values: copy(1), set(2), clear(3)
      +-- -R-- TimeTicks ipsecActionLastChange(11)
      |        Textual Convention: TimeStamp
      +-- CR-- EnumVal   ipsecActionStorageType(12)
      |        Textual Convention: StorageType
      |        Values: other(1), volatile(2), nonVolatile(3), permanent(4), readOnly(5)
      +-- CR-- EnumVal   ipsecActionRowStatus(13)
               Textual Convention: RowStatus
               Values: active(1), notInService(2), notReady(3), createAndGo(4), createAndWait(5), destroy(6)

-- 
Wes Hardaker
NAI Labs
Network Associates