Subject: [netconf] ietf-netconf-server and ietf-netconf-client keepalives

From: Michal Vaško <[email-masked]>
Date: Mon, 04 May 2020 18:26:12 +0200

Hi,
in the current YANG modules in the drafts, there are 3 types of keepalives defined for both a server and a client. They are SSH, TLS, and TCP keepalives and can be configured separately for each connection (endpoint).

While I understand what TCP keepalive is as it is a feature with exact definition, I am not that positive for SSH nor TLS. I can only assume the keepalive mechanisms from a Call Home [1] server are used. I would appreciate if the modules define the specifics of all these keepalives because otherwise interoperability cannot be guaranteed. Also, the relation to the Call Home RFC itself should probably be mentioned somewhere. Meaning the answers to questions such as whether SHOULD each RESTCONF/NETCONF server use SSH/TLS keepalive even when a TCP keepalive is enabled. I am also not sure about the need for all 3 types of keepalives, needing to specify them for each connection , or allowing to support 2 kinds simultaneously, but that is just my opinion.

Thanks for any feedback. It is also possible I may have missed something/am wrong and I am sorry in that case.

Regards,
Michal

[1] https://tools.ietf.org/html/rfc8071#page-8

---

From: Kent Watsen <[email-masked]>
Date: Tue, 5 May 2020 23:22:07 +0000

Hi Michal,

> On May 4, 2020, at 12:26 PM, Michal Vaško <[email-masked]> wrote:
> 
> Hi,
> While I understand what TCP keepalive is as it is a feature with exact definition, I am not that positive for SSH nor TLS. I can only assume the keepalive mechanisms from a Call Home [1] server are used. I would appreciate if the modules define the specifics of all these keepalives because otherwise interoperability cannot be guaranteed.

Good suggestion.  Indeed, they would be the same as in RFC 8071

> Also, the relation to the Call Home RFC itself should probably be mentioned somewhere.

draft-ietf-netconf-netconf-client-server currently has 11 references to RFC 8071...not enough, or do you mean that the keepalive description should say something like "consistent with RFC 8071, ..."? 

> Meaning the answers to questions such as whether SHOULD each RESTCONF/NETCONF server use SSH/TLS keepalive even when a TCP keepalive is enabled. I am also not sure about the need for all 3 types of keepalives, needing to specify them for each connection , or allowing to support 2 kinds simultaneously, but that is just my opinion.

Keepalives were heavily discussed with the TSV Area a couple years ago.  The general takeaway was that keepalives SHOULD be defined for every protocol, and that applications SHOULD use as many as makes sense, as each tests a different thing and with varying levels of security.

> [1] https://tools.ietf.org/html/rfc8071#page-8

Kent // contributor

---

From: Michal Vaško <[email-masked]>
Date: Wed, 06 May 2020 08:33:55 +0200

Hi Kent,
thanks for the response and as long as you add the definition of SSH/TLS keepalive I will have no more comments, as it seems the rest was discussed and intentionally specified the way it is.

Regards,
Michal