Subject: Re: PQIM draft issues

From: Mahadevan Iyer <[email-masked]>
Date: Thu, 2 Nov 2000 20:39:18 -0800 (PST)

> As one of the co-authers of one of the MPLS drafts,
> I can tell you that
> MPLS VPNs are very hot also form a policy-based
> management point of
> view. However, I have not really understand, what
> your model tries to
> do. Nor what the new actions, conditions are, you
> want to introduce,
> which are not available in QPIM, MLPS, etc.
> 

These are two good questions and I hope what follows
answers the questions

"What does your model try to do ?"

The model tries to integrate the configuration of IP
service functions such as firewall, NAT, bandwdith
management, VPN(security + connectivity). We are
increasingly seeing all these functions being handled
simultaenously in a single box. 
As a vendor selling this kind of a multi function box,
we see the service providers benefitting from a common
policy information model which support all these
functions in a single containment tree.
The current trend seems to be to define one model for
QoS, another for IPSEC, a third one for MPLS and so
on. The fact that they derive from [PCIM] is good but
not good enough.
The model tries to combine the common aspects(in the
policy condition clause) and allow the definition of
an extensible set of actions whether it be QoS or
IPSEC or MPLS or other IP actions. 

"What the new actions, conditions are, you want to
introduce, which are not available in QPIM, MLPS,
etc."

I would rather let the WG responsible for the action
such as the IPSEC WG (for IPSEC), RAP/DiffServ WG (for
QoS), MPLS WG(MPLS) define the actions. I have spelt
out my rationale for this in my earlier mail. I am
sure you would appreciate the MPLS WG commenting on
the actions that you propose rather than being shunted
to the policy framework group where your MPLS action
model has had little or no discussion on the mailing
list.

To answer you question in light of my previous comment
I don't want us to be defining the actions, but would
want to continue to augment the conditions to support
the existing and new actions and provide place holders
for the actions to be added in future. Once again I
would like to see the other WG drive the actions. They
are defining these actions in their MIBs and PIBs and
need to define them in the policy information model as
well. 

Gratuitous comment ...

I was present for the policy sessions in the MPLS
group at Pittsburgh and I can see that as long as we
don't come out with a clear statement on exactly where
we add value to MPLS, they will continue to push this
work out of their WG. We need to clearly articulate
the value of policy based configuration as opposed to
MIB based configuration and explain how they fit in.
This needs to be tied in to deployment advantages that
vendors/service providers/operators can relate to.

I would like to discuss this some more, but will wait
to see if people share this point of view.

Thanks

__________________________________________________
Do You Yahoo!?
From homework help to love advice, Yahoo! Experts has your answer.
http://experts.yahoo.com/

---

From: Marcus Brunner <[email-masked]>
Date: Fri, 03 Nov 2000 12:27:58 +0100

Sorry for the last mail, pressed the wrong key.

> simultaenously in a single box.

With single box you refer to a router or a policy server?

> functions in a single containment tree.

Sure, you want to have the policy information model as a single
framework to be used for each of the single functions.

> on. The fact that they derive from [PCIM] is good but

You mean the shortcommings of PCIM or what?

> IPSEC or MPLS or other IP actions.

I think the QoS authors already pointed out, that different classes,
they need to specify, could be used in various application of the PCIM.

> model has had little or no discussion on the mailing

The only thing the MPLS group is interrested is if our model complies
with the MIB specifications they have.
 
> need to define them in the policy information model as

Some comments on the VPN draft:

Why do you specify so many Lists? IPVPNPolicyDomain,
IPVPNAdminstrationPolicyList...
A policy group can have a name and it is easy to group rules for
different areas in different groups. They don't even have new
properties. I am against the inflation of classes.

I do not understand the concept of tags. What are they used for? Is this
something like an inderection intrduced? Why do you need so many?

Marcus
-- 

Dr. Marcus Brunner
C&C Research Laboratories
NEC Europe Ltd.

E-Mail: [email-masked]
WWW:    http://www.ccrle.nec.de/
personal home page: http://www.tik.ee.ethz.ch/~brunner

Adenauerplatz 6
D-69115 Heidelberg
Germany

Phone: +49 (0)6221/ 9051129
Fax:   +49 (0)6221/ 9051155