Subject: RE: [Isms] Summary of Authorize Only issue

From: "Romascanu, Dan \(Dan\)" <[email-masked]>
Date: Thu, 27 Jul 2006 18:29:42 +0300

> -----Original Message-----
> From: Nelson, David [mailto:[email-masked]] 
> Sent: Thursday, July 27, 2006 6:15 PM
> To: [email-masked]; [email-masked]
> Subject: RE: [Isms] Summary of Authorize Only issue
> 
> Dave Harrington writes...
> 
> > I think "SNMP over SSH" would be appropriate. I do not see 
> a reason to 
> > limit it to SNMPv3.
> 
> That's fine by me, if that's the consensus.  In the past, 
> I've been encouraged to omit support for v1 and v2c in I-Ds, 
> as those versions have been deprecated.  The comment was from 
> Bert Wijnen, in relation to protocol selection attributes I'd 
> included for v1 and v2c in the NAS-Management draft.
> 

I believe that that recommendation was correct and continues to stand.
The name does not bother me too much, as SNMPv3 is the only standard
version of SNMP but defining special attributes or features for v1 and
v2c should need some strong argumentation. 

Dan

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Thu, 27 Jul 2006 12:29:03 -0400

Hi,

I did not say it should support SNMPv1 or SNMPv2.

We separated the security and transport mappings from the message
format in the RFC3411 architecture; SNMPv3 refers to a message format.
Please do not bind these concepts unnecessarily in your RADIUS
proposal.

There is growing desire to share designs across IETF NM protocols, and
I can envision an SNMPv4 message processing model that uses an XML
message encoding to improve compatibility with netconf and with data
models from other SDOs. Why should RADIUS care which message format or
which encoding is used for the on-the-wire SNMP message? Will it
impact whether SSH is told it is OK to establish the "snmp" subsystem?

I do not see a technical engineering reason to limit the RADIUS
authorization to SNMPv3 over SSH, as compared to SNMP over SSH.

Dbh

> From: Romascanu, Dan (Dan) [mailto:[email-masked]] 
> Sent: Thursday, July 27, 2006 11:30 AM
> To: Nelson, David; [email-masked]; [email-masked]

---

From: "David T. Perkins" <[email-masked]>
Date: Thu, 27 Jul 2006 10:13:04 -0700 (PDT)

HI,

It looks like David Harrington (DBH) is trying to be funny
below. 

There is one "real" issue. That is the confusion of
using 1) SSH for a VPN with port redirect with
2) SNMPv3/ISMS-SSH.
For #1 (a VPN), this is outside the scope of this
WG discussion. However, the docs need to be clear
that SNMPv3/ISMS-SSH is not #1.

> Please do not bind these concepts unnecessarily in your RADIUS
Yes, the SNMPv3 Protocol definition is a message format. SNMPv3
is also a framework that includes the SNMPv1 and SNMPv2c protocols.
Yes, this is somewhat confusing.

> models from other SDOs.
I'm assuming that DBH is trying out ideas here for an April 1 RFC.

> Why should RADIUS care which message format or
Since using RADIUS for setting up #1 is outside the scope,
I don't see why it is relevant?

---

From: "David Harrington" <[email-masked]>
Date: Thu, 27 Jul 2006 13:46:12 -0400

Hi,

I'm not sure how a SSH-VPN is configured, i.e. whether it uses a
subsystem to carry snmp.
If we changed "SNMP over SSH" to "SSH snmp subsystem", would that be
clear?
That is the service we are requesting.

dbh