Subject: [Isms] RE: ISMS charter

From: "David B Harrington" <[email-masked]>
Date: Sun, 21 Aug 2005 16:57:44 -0400

Hi,

The main problem we are faced with in determining whether "call-home"
is in or out of scope is understanding the use cases for "call-home"
functionality.

1) If the purpose is to work around NATs and firewalls, then I
consider this out of scope because it adds a feature not currently
found in SNMP, and not directly related to security model
functionality.

2) If the purpose is to permit agents to select the managers they want
to be managed by, I consider this out of scope because there is no
such feature in SNMP, and this is not directly related to security
model functionality.

3) If the purpose is to permit trap-directed polling, then I would
observe that trap-directed polling is not a function of the security
model, but a use case of the application subsystem. 

If ISMS provides a call-home functionality, then it will need to
provide a mechanism to configure where home is, and what security
parameters are required. This is information contained in RFC3413, the
"SNMP Applications" document. It is not within our scope to define new
applications or new approaches to RFC3413 functionality. Any proposed
approach should use the RFC3413 MIB modules for configuration (at
least until a new WG addresses leveraging existing standards to
supplement/replace RFC3413 functionality).

In my opinion, the discussion of trap-directed-polling is in scope
only to the degree that the security subsystem must not PREVENT the
use of trap-directed polling. I am not aware that an SSH security
model prevents the use of trap-directed polling. 

David Harrington
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms