Subject: RE: [Isms] Rough Consensus Declaration: ISMS Architecture is EK - Larger messages and flow control

From: Donati Andrew-MGIA0477 <[email-masked]>
Date: Sat, 7 May 2005 12:36:01 -0400

All,

I follow this message board, but normally do not participate.  I apologize if this in not the proper way to respond to the list or if this may be considered a bit off topic, but David and Keith brought up an excellent point that should be emphasized IMHO:   

>SNMP has also changed in terms of its use cases. MIB modules originally provided limited amounts of information.
>But now tables have grown in size, and MIB modules provide more information than earlier MIB modules. Much more
>management/monitoring is done for well-functioning networks. I think the advantages of larger messages
>and flow control are warranted for this type of management.

Having worked with SNMP for nearly 11 years a have to agree strongly about these points. More recently, network management has extended it reach from managing devices such as network routers, and switches at businesses to managing devices at residential areas (cable modems, FTTH PONs) that not only include data, but voice, and video as well.  Also, the voice, video, and data contain detailed information such as usage statistics that are used for reports and billing.
As a result, there is a need to update the SNMP protocol to handle more information. 

IMHO, a future security infrastructure should also be able to work with a future SNMP mechanism that can handle more information than it currently does.  

Thanks,

Andy
[email-masked]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David B Harrington
Sent: Saturday, May 07, 2005 12:28 AM
To: 'Keith McCloghrie'; [email-masked]
Subject: RE: [Isms] Rough Consensus Declaration: ISMS Architecture is EK

Hi Keith,

I am well aware of the  UDP vs TCP debate, and understand your concerns.

Personally, I think a UDP transport is, and has always been, important for troubleshooting broken networks. However, network robustness has changed dramatically since the late 80s.

SNMP has also changed in terms of its use cases. MIB modules originally provided limited amounts of information. But now tables have grown in size, and MIB modules provide more information than earlier MIB modules. Much more management/monitoring is done for well-functioning networks. I think the advantages of larger messages and flow control are warranted for this type of management.

I still believe a UDP transport will be important for troubleshooting. This could be provided by also having USM (with maybe a single root user), but supporting a DTLS transport to supplement a TLS transport would seem to make more sense, if TLS and DTLS can share a security infrastructure.

David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Keith McCloghrie
> Sent: Friday, May 06, 2005 8:57 PM
> To: [email-masked]
> Subject: Re: [Isms] Rough Consensus Declaration: ISMS 
> Architecture is EK
> 
> Apparently, the people who voted for (including the maybe's and the
> not-against's) EK, believe that they voted not only for
encapsulating
> the keying but also for encapsulating SNMP messages.  Assuming this
is
> true, then it seems to me that if one is forced to pay the
> price of TLS
> in order to have secure SNMP, then I no longer see any benefit in
> running SNMP over UDP.  There are both advantages and disadvantages
of
> running SNMP over TCP; the advantages include larger messages and
flow
> control.  For the disadvantages, all but one of them are inherent in 
> encapsulating SNMP messages in TLS; the remaining one is the minor 
> issue that both SNMP and TCP have reliability mechanisms, i.e., SNMP
engines
> should avoid having SNMP's retransmission timers fire before TCP's 
> retransmission timers (see page 2 of RFC 3430).  That one remaining 
> disadvantage is negligible compared to larger messages and 
> flow-control. Therefore, to define SNMP-over-DTLS-over-UDP is silly; 
> the only sensible way of using TLS is to define 
> SNMP-over-TLS-over-TCP.
> 
> So, I believe the WG's choice of EK discards the perceived wisdom
> of the last 15+ years that UDP was the preferred transport mapping.
> Nevertheless, given that the WG has decided to do this, I think it
> should be made explicit by:
> 
>   - putting RFC 3430 on the standards track,
>   - starting an update to remove the word "preferred" from RFC 3417,
>   - not wasting any time on defining a SNMP-over-DTLS-over-UDP,
> 
> Keith.
> 
> PS. As a further observation, I will note that this has occurred in
a
> Security Area Working Group.  How sad this all is.
> 
> _______________________________________________
> Isms mailing list
> [email-masked] https://www1.ietf.org/mailman/listinfo/isms
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms