Subject: [Netconf] call home

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 3 Oct 2013 09:15:05 +0200 (CEST)

Hello.

We have a use case where we want end systems and routers to be configured 
via Netconf/YANG and some of these might not be connectable from the 
Internet directly. The Reverse-SSH and rfc5539bis documents seem very 
relevant to implementation of this use case.

I am currently in process of trying to document/develop architecture 
document for everything from bootstrap (key/certificate/other information 
distribution for a factory defaulted system) up until the device is fully 
provisioned and delivering services. There are quite a lot of question 
marks and gaps that need to be filled, where the ability to have the 
provision system being able to provision services, for instance via 
call-home is one part.

There seems to have been very little progress on the reverse-SSH and TLS 
drafts in the past months? What's the current thinking on these? According 
to the time schedule in the charter the WGLC proposed time is long over.

Is there anything I can do to help things along? I have read 
draft-ietf-netconf-reverse-ssh-01 and it seems perfectly viable for our 
deployment case as it is.

Current thinking is to exchange cryptographic (and other) information via 
DHCPv6 to bootstrap ability for the netconf client and server to 
authenticate each other, and use public keys/host keys for login. I read 
some concerns that would interesting to hear more about.

I will be attending IETF88 in Vancouver, but I would be a lot happier if 
the call home part at least had passed WGLC by then :)

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Kent Watsen <[email-masked]>
Date: Thu, 3 Oct 2013 16:04:21 +0000

Hi Mikael,

I'm currently working on a Reverse SSH reference implementation, which I
hope to have completed in a few days.  I then need to get it blessed by
Juniper's Open Source Software committee before I can post it - hopefully
that won't take too long.

I also plan to update draft-ietf-netconf-reverse-ssh - really just need to
clarify a few points and add an Applicability Statement that declares it
only suitable for Network Management.

Regarding how device discovery and secure key distribution can be
implemented is outside the scope of the Reverse SSH draft, but it is
exactly what the "ZeroConf" draft will address.  ZeroConf was discussed
during the Reverse SSH presentation in Berlin. Stephen Hanna and I took an
action item to submit a draft for it.  We went ahead and met with Russ
Mundy and Wes Hardaker and sketched out a solution, which I hope to write
a draft for shortly, but can't promise it'll make the Vancouver cut-off
date.

PS: I also plan to be in Vancouver and look forward to seeing you there.

Thanks,
Kent

On 10/3/13 3:15 AM, "Mikael Abrahamsson" <[email-masked]> wrote:

>_______________________________________________
>Netconf mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/netconf
>
>

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Fri, 04 Oct 2013 13:16:05 +0200

Rmember that revision -00 drafts cutoff for Vancouver is

2013-10-07 (Monday): Working Group Chair approval for initial document (Version -00) submissions appreciated by UTC 24:00.
2013-10-11 (Friday): Final agenda to be published.
2013-10-21 (Monday): Internet Draft submission cut-off (for all drafts, including -00) by UTC 24:00, upload using IETF ID Submission 
Tool.

SO if you plan to submit a revision-00 draft for the zero-conf, maybe we should
prep-approve. However, that would mean that we see it s a WG draft right away.
Maybe better as an individual draft first.

Bert

---

From: Kent Watsen <[email-masked]>
Date: Tue, 8 Oct 2013 16:38:48 +0000

Just a quick update, the ZeroConf draft is written but is now going
through an internal review.  Since yesterday was the cutoff for WG -00
drafts, I'll submit this as an I-D and we can discuss in Vancouver if the
WG is interested in chartering it...

Thanks,
Kent

On 10/4/13 7:16 AM, "Bert Wijnen (IETF)" <[email-masked]> wrote:

>2013-10-07 (Monday): Working Group Chair approval for initial document
>(Version -00) submissions appreciated by UTC 24:00.
>2013-10-21 (Monday): Internet Draft submission cut-off (for all drafts,
>including -00) by UTC 24:00, upload using IETF ID Submission
>Tool.
>

---

From: "ietfdbh" <[email-masked]>
Date: Tue, 8 Oct 2013 17:29:18 -0400

Hi Kent,

According to http://www.ietf.org/meeting/cutoff-dates-2013.html#IETF88
The deadline is the same for -00- and -0x- drafts.
2013-10-21 (Monday): Internet Draft submission cut-off (for all drafts,
including -00) by UTC 24:00, upload using IETF ID Submission Tool.

2013-10-07 (Monday): Working Group Chair approval for initial document
(Version -00) submissions appreciated by UTC 24:00.
Is only a request that WG Chairs approve early, to make the system work
smoother.

David Harrington
[email-masked]
+1-603-828-1401

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Kent Watsen
> Sent: Tuesday, October 08, 2013 12:39 PM
> To: Bert Wijnen (IETF)
> Cc: [email-masked]
> Subject: Re: [Netconf] call home
> 
>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 15 Oct 2013 08:33:51 +0200

On Thu, Oct 03, 2013 at 09:15:05AM +0200, Mikael Abrahamsson wrote:
> 
> There seems to have been very little progress on the reverse-SSH and
> TLS drafts in the past months? What's the current thinking on these?
> According to the time schedule in the charter the WGLC proposed time
> is long over.
> 

The TLS draft needs an update to reflect the changes discussed in
Berlin (namely doing the role swap before TLS starts). I hope to get
this done by the I-D deadline.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>