Subject: Re: [Netconf] Updating NETCONF over TLS document (RFC5539)

From: Alan Luchuk <[email-masked]>
Date: Wed, 28 Sep 2011 15:38:25 -0400 (EDT)

Hello,

>On Wed, Sep 28, 2011 at 06:59:24AM -0700, Kent Watsen wrote:
>> 
>> > Sounds like that might be a generic YANG module then, no?
>> 
>> Correct, if we go the route of the device needing to be configured
>> to know how to extract a NetConf username from a client certificate,
>> then a YANG module would be good.  But I still wonder how many are
>> using TLS/SOAP/BEEP and the need to keep these RFCs standard?

SNMP Research has implemented NETCONF over TLS.  Until a standard 
mechanism exists for mapping certificates to NETCONF usernames, SNMP 
Research will implement a proprietary solution.

>I think there is a case for TLS on low-end devices that do not happen
>to have SSH and where adding SSH would be expensive. Will NETCONF (or
>NETCONF light) get traction on such devices, I do not know.

I strongly agree there may be platforms on which TLS is readily avail-
able, but, for various reasons, SSH is not easily, readily, or freely 
available.  I think the number of machines deployed of this type (think
small embedded or desktop machines) is surprisingly large.  On these 
platforms, there may never be a compliant NETCONF implementation of 
RFC 4741/6241, simply because of the single sentence in sections 2.4 
(RFC 4741) or 2.3 (RFC 6241) that requires SSH.

Regards,
--Alan

 ------------------------------------------------------------------------------
 Alan Luchuk               SNMP Research, Inc.          Voice:  +1 865 573 1434
 Senior Software Engineer  3001 Kimberlin Heights Road  FAX:    +1 865 573 9197
 [email-masked]           Knoxville, TN  37920-9716    http://www.snmp.com/
 ------------------------------------------------------------------------------

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Thu, 29 Sep 2011 09:50:18 +0200

> Research will implement a proprietary solution.

As WG chair, I would much more appreciate it if SNMP Research
helps us define/document a potential solution that we can try
to get consensus on and then standardize it.

Certainly if you are doing a commercial implementation and so
probably have customers who deploy it, such experience would
be very helpful to try and work on a standardized solution.

Bert