Subject: [Isms] review of draft-nelson-radius-management-authorization-04

From: "David Harrington" <[email-masked]>
Date: Sat, 17 Mar 2007 16:54:13 -0400

Hi,

I support this proposal. I think it would benefit from an introduction
that discusses "named policy" access controls before the discussion of
the RADIUS attributes to support "named policies".

Abstract
s/Aauthentication/Authentication/

1.
The document uses terminology from RFC2865 ..." Identify the titles of
these RFCs.

3.
It is unclear to me why the management-policy-id is for framed
management only. Why not also for non-framed protocols?

4.
s/is by means outside/is outside/
then add a sentence pointing out examples of policy-specification
mechanisms that could be applied, including MIBs, PIBs, XML
configuration model, local configuration files, etc.

5.
This section seems incomplete.
s/this attributes/this attribute/

"one new attribute" - but doesn't section introduce a second new
attribute?

6.1
"left to right" would this be network-order?
"one new value" aren't there two?

7.1
s/SNMP v3/SNMPv3/
Can this be used to specify snmpv1 and snmpv2c? We are not
recommendign their use, only acknowledgeing their presence in real
networks, and discussing how to apply policies to them.

9.
proxy needs to be identified as RADIUS and/or Diameter proxy to
distinguish it from SNMP proxy.

Note that the SNMP proxy-forwarder application never opens the PDU and
does not apply any access control based on the PDU contents.

11.
I find the combination of "framed management protocol" and
"non-framed-management-security" a bit odd.

David Harrington
[email-masked] 
[email-masked]
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms