Subject: [Isis-wg] Another question wrt to the isisSysTable

From: Hans De Vleeschouwer A0 VR233 58223 <[email-masked]>
Date: Mon, 10 Jan 2000 12:02:44 +0100

hi,

I have followed the discussion related to the isisSysTable field
isisSysMaxAreaAddresses with great interest.

For now, I think I will stick to the solution where:
1. the value can range between 1 and 3
2. the default value = 3

This will imply that a request to change the field isisSysOperState to
'on'  will be rejected if no entry exists in the isisManAddrTable for
this system instance.

Now I have a different question related to the field
isisSysAuthAreaType.
I already understand from Jeff Parker that this field will be extended
to allow also MD5 as authentication method.

However, I still have the following questions:
1. The description talks about 'protecting L1 LSPs' . However, If I look
at the RFC1195, it seems that authentication can apply to all types of
messages, not only to LSP PDU. e.g. authentication can be applied to L1
Hello PDUs.

Is there any reason to authenticate only the LSP PDU?

2. The value of the field is set to read-write.  Would it make sense to
state that this object follows the 'replaceOnlyWhileDisabled behavior' ?

Kind regards,
  Hans De Vleeschouwer (alcatel Belgium).

_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Jeff Parker <[email-masked]>
Date: Mon, 10 Jan 2000 09:49:55 -0500

> messages, not only to LSP PDU. e.g. authentication can be 
> applied to L1 Hello PDUs.

There are four Authentication types: 
 isisSysAuthAreaType   - level 1 pkts
 isisSysAuthDomainType - level 2 pkts
 isisCircL1PasswordType- level 1 hellos
 isisCircL2PasswordType- level 2 hellos

> Is there any reason to authenticate only the LSP PDU?

The dominant implementation only protects the LSPs
with the Area and Dommain values.  

> state that this object follows the 'replaceOnlyWhileDisabled 

I need to review this with my SNMP gurus - 
I don't want to allow these to be set via SNMP
for obvious security reasons.