Subject: PolicyTimePeriodCondition from PCIM in the data model

From: Wes Hardaker <[email-masked]>
Date: Sun, 17 Mar 2002 17:37:24 -0800

RFC3060 says this about the PolicyTimePeriodCondition:

   In some cases a PDP may need to perform certain setup / cleanup
   actions when a policy rule becomes active / inactive.  For example,
   sessions that were established while a policy rule was active might
   need to be taken down when the rule becomes inactive.  In other
   cases, however, such sessions might be left up:  in this case, the
   effect of deactivating the policy rule would just be to prevent the
   establishment of new sessions.  Setup / cleanup behaviors on validity
   period transitions are not currently addressed by the PCIM, and must
   be specified in 'guideline' documents, or via subclasses of
   PolicyRule, PolicyTimePeriodCondition or other concrete subclasses of
   Policy.  If such behaviors need to be under the control of the policy
   administrator, then a mechanism to allow this control must also be
   specified in the subclass.

Specifically, it might be a good thing to explicitly define in the
data model what happens to IPsec SAs when a policy ends due to time
constraints.  Right now that behavior seems to be undefined, according
to the above since the IPSP derived data model itself doesn't specify
what to do?

-- 
Wes Hardaker
NAI Labs
Network Associates