Subject: [Netconf] Zero Touch and serial numbers

From: Joe Marcus Clarke <[email-masked]>
Date: Mon, 04 Nov 2013 15:09:20 -0500

At the WG meeting today a comment was made that we should not be 
requiring serial numbers to be used by the NMS to identify devices. 
Forgive me if I misunderstood.  It sounded like the opinion of the asker 
and the author (Kent) was that serial numbers are recommended, but would 
not be required.

Due to time, I didn't raise this in the meeting, but I want to air it. 
I feel that requiring serial numbers is a good thing as it will help the 
operator.  Think of an operator that uses multiple vendors.  They need 
to have some unique ID they can use to identify devices at the NMS (Kent 
called this making sure the NMS is aware of the devices that _should_ 
connect).  I stipulate that the serial number if the easiest thing for 
the operator to get ahead of the device ship so that they can program 
the NMS.

Additionally, if they miss the serial number ahead of device ship, 
serial numbers are printed on the chassis of devices, so a non-tech user 
could easily read that value to an operator over the phone (or send a 
picture).  If different vendors are allowed to pick other things as the 
identifier, this might cause confusion and defeat some of the 
"brain-dead-easy" goals of the draft.

I'd like to make sure that whatever if chosen that it meet the needs of 
being intuitive and obvious for non-technical people to obtain.  To me, 
this means serial number.

Joe

-- 
Joe Marcus Clarke, CCIE #5384,         |          |
SCJP, SCSA, SCNA, SCSECA, VCP        |||||      |||||
Distinguished Services Engineer ..:|||||||||::|||||||||:..
Phone: +1 (919) 392-2867         c i s c o  S y s t e m s
Email: [email-masked]

----------------------------------------------------------------------------

---

From: "Diego R. Lopez" <[email-masked]>
Date: Mon, 04 Nov 2013 22:07:29 +0000

Hi Joe,

Let me insist in that (as I stated at the mike) I find the idea of using the serial numbers extremely useful and by no means I was asking for not using them. My question was addressed in two directions: First, on the fact of including this serial number in the Common Name associated with the certificate (there can be other options that address the security considerations included in the document) Second, on just leaving the possibility of performing additional checks on the certificate.

Be goode,

On 4 Nov 2013, at 12:09 , Joe Marcus Clarke wrote:

> At the WG meeting today a comment was made that we should not be requiring serial numbers to be used by the NMS to identify devices. Forgive me if I misunderstood.  It sounded like the opinion of the asker and the author (Kent) was that serial numbers are recommended, but would not be required.
>
> Due to time, I didn't raise this in the meeting, but I want to air it. I feel that requiring serial numbers is a good thing as it will help the operator.  Think of an operator that uses multiple vendors.  They need to have some unique ID they can use to identify devices at the NMS (Kent called this making sure the NMS is aware of the devices that _should_ connect).  I stipulate that the serial number if the easiest thing for the operator to get ahead of the device ship so that they can program the NMS.
>
> Additionally, if they miss the serial number ahead of device ship, serial numbers are printed on the chassis of devices, so a non-tech user could easily read that value to an operator over the phone (or send a picture).  If different vendors are allowed to pick other things as the identifier, this might cause confusion and defeat some of the "brain-dead-easy" goals of the draft.
>
> I'd like to make sure that whatever if chosen that it meet the needs of being intuitive and obvious for non-technical people to obtain.  To me, this means serial number.
>
> Joe
>
> --
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------

________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

---

From: Joe Marcus Clarke <[email-masked]>
Date: Mon, 04 Nov 2013 20:26:14 -0500

> Let me insist in that (as I stated at the mike) I find the idea of using the serial numbers extremely useful and by no means I was asking for not using them. My question was addressed in two direct…

Thanks for clarifying, Diego.  Sorry if I misunderstood.  Using the SN 
in the common name may also be something we want to do.  The reason 
being is that I envision an end user going to a vendor portal and trying 
to find some easy way to map the device to the credentials.  SN seems 
like a reasonable thing for those end users to know about.  If something 
else is allowed to be used by a vendor, it would have to meet the same 
requirements to make this easily knowable/findable by both operators and 
those who might be less technical.

Joe