Subject: Re: PQIM draft issues

From: Mahadevan Iyer <[email-masked]>
Date: Sun, 5 Nov 2000 21:53:06 -0800 (PST)

--- Marcus Brunner <[email-masked]> wrote:
> > The model tries to integrate the configuration of
> IP
> > service functions such as firewall, NAT, bandwdith
> > management, VPN(security + connectivity). We are
> > increasingly seeing all these functions being
> handled
> > simultaenously in a single box.
> 
> With single box you refer to a router or a policy
> server?

Single box = multi function router

> > on. The fact that they derive from [PCIM] is good
> but
> > not good enough.
> 
> You mean the shortcommings of PCIM or what?

I mean that the PCIM does what it is supposed to do
and
does it well i.e. provide the basic platform to define
policies

Policy applications related to IP services could use
a common information model (built on this platform)
which integrates the common aspects of IP functions.

> 
> > The model tries to combine the common aspects(in
> the
> > policy condition clause) and allow the definition
> of
> > an extensible set of actions whether it be QoS or
> > IPSEC or MPLS or other IP actions.
> 
> I think the QoS authors already pointed out, that
> different classes,
> they need to specify, could be used in various
> application of the PCIM.

This was mentioned in a previous mail and my reply
remains the same.
It is laudable that the QoS authors mention this, but
clearly the main purpose of the draft is to define the
QoS specific conditions and actions.

Discussing the pros and cons of these classes w.r.t.
to the IPVPN information model is a follow up
discussion. I am not sure we are there yet. It is
important to remember here that as per the last
communication I have received the IPVPN draft is not
considered to be in line with the WG charter. 

I would be glad to discuss this off line with you, but
at the momemt I do not want to get distracted from the
main point I am trying to make i.e. "Lets create the
common policy information model(integrating the policy
conditions across IP functions, single containment
tree etc) and leave the action definitions to the WGs"

> 
> The only thing the MPLS group is interrested is if
> our model complies
> with the MIB specifications they have.

So once the MIB is in place, what additional value
does the MPLS policy information model provide ? 

> Some comments on the VPN draft:
> 
> Why do you specify so many Lists? IPVPNPolicyDomain,
> IPVPNAdminstrationPolicyList...
> A policy group can have a name and it is easy to
> group rules for
> different areas in different groups. They don't even
> have new
> properties. I am against the inflation of classes.

Inflation is bad, but each of the lists has a purpose.
If you can suggest a means to collapse the lists and
differentiate between the different purposes I would
be glad to discuss it. Once again going back to my
previous comment on the focus of this thread I would
like to get the main question answered before we get
into the merits of portions of the draft.

> 
> I do not understand the concept of tags. What are
> they used for? Is this
> something like an inderection intrduced? Why do you
> need so many?

A tag, is a label assigned to a resource such
as(network, users, policy enforcers, application
filters) so that they can be referenced in a policy
condition. A network tag could be statically
associated with a resource using an IP address or
dynamically associated when the network is plugged
into a switch port and authenticates itself.

It would be useful to hear from vendors such as
Orchestream if they are tapped into this mailing list.
I assume they have a lot of experience in this area
and can shed some light on whether this (objective of
the IPVPN draft) goes beyond "sure it would be nice"
to "yes this is key".

__________________________________________________
Do You Yahoo!?
Thousands of Stores.  Millions of Products.  All in one Place.
http://shopping.yahoo.com/

---

From: "Andrea Westerinen" <[email-masked]>
Date: Sun, 12 Nov 2000 20:36:29 -0800

Just a quick comment - Policy is but one part of an information model.  You
need the concept of Policy PLUS the rest of the model.  Policy acts on the
nouns, using the verbs, of the rest of the information model.

My recommendation would be to start with the nouns and verbs, decide what
you want to model and affect - and then start on the Policy
(condition/action pairs).  Policy is about automated operation and automated
management.  You need to have a model that supports operation and
management, before you can automate it.

Andrea

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Mahadevan Iyer
Sent: Sunday, November 05, 2000 9:53 PM
To: [email-masked]
Cc: Policy Mailing List
Subject: Re: PQIM draft issues

---

From: Marcus Brunner <[email-masked]>
Date: Mon, 13 Nov 2000 11:51:06 +0100

Andrea, 

I totally agree on that. The problem lies in what "nouns and verbs" are
per-defined (in the drafts). IMO, there should be a set of
area-independent classes to operate on specific models.

Marcus

-- 

Dr. Marcus Brunner
C&C Research Laboratories
NEC Europe Ltd.

E-Mail: [email-masked]
WWW:    http://www.ccrle.nec.de/
personal home page: http://www.tik.ee.ethz.ch/~brunner

Adenauerplatz 6
D-69115 Heidelberg
Germany

Phone: +49 (0)6221/ 9051129
Fax:   +49 (0)6221/ 9051155

---

From: Marcus Brunner <[email-masked]>
Date: Mon, 13 Nov 2000 11:51:06 +0100

Andrea, 

Marcus

-- 

Dr. Marcus Brunner

Adenauerplatz 6
D-69115 Heidelberg
Germany

---

From: "Andrea Westerinen" <[email-masked]>
Date: Mon, 13 Nov 2000 08:50:28 -0800

YES!
Andrea

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Marcus Brunner
Sent: Monday, November 13, 2000 2:51 AM
To: Andrea Westerinen
Cc: Mahadevan Iyer; Policy Mailing List
Subject: Re: PQIM draft issues

Andrea,

Marcus

--

Dr. Marcus Brunner

Adenauerplatz 6
D-69115 Heidelberg
Germany