Subject: [Supa] Fwd: I-D Action: draft-halpern-supa-generic-policy-data-model-01.txt

From: Joel Halpern <[email-masked]>
Date: Fri, 15 Apr 2016 16:32:20 -0400

We have revised the data model draft to fix the extraction and YANG errors.
It has been checked with a YANG 1.1 validator, which says it works.

The must clauses on the instance-identifiers now indicate the target 
class (including subclasses) of the association.  As I noted in BA, for 
associations with properties, the two end-points both point to the 
association class, which points to both end-points.

We will be doing the YANG tree, better descriptions, and text about the 
mapping from IM to DM.

Please review either the IM or the DM (using the IM descriptions) to see 
whether this model represents what the WG wants to see.

Yours,
Joel

-------- Forwarded Message --------
Subject: I-D Action: draft-halpern-supa-generic-policy-data-model-01.txt
Date: Fri, 15 Apr 2016 13:06:32 -0700
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.

         Title           : Generic Policy Data Model for Simplified Use 
of Policy Abstractions (SUPA)
         Authors         : Joel Halpern
                           John Strassner
	Filename        : draft-halpern-supa-generic-policy-data-model-01.txt
	Pages           : 48
	Date            : 2016-04-15

Abstract:
    This document defines two YANG policy data models. The first is a
    generic policy model that is meant to be extended on an application-
    specific basis. The second is an exemplary extension of the first
    generic policy model, and defines rules as event-condition-action
    policies. Both models are independent of the level of abstraction of
    the content and meaning of a policy.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-halpern-supa-generic-policy-data-model/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-halpern-supa-generic-policy-data-model-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-halpern-supa-generic-policy-data-model-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Andy Bierman <[email-masked]>
Date: Fri, 15 Apr 2016 17:37:00 -0700

Hi,

Here is the object tree that pyang generates.
Looks fairly complex. How many of these 168 objects does one
usually need to provide for a typical policy?

It would be helpful to see examples to understand how this YANG module is
used.

I read this framework draft:
http://www.ietf.org/id/draft-liu-supa-policy-based-management-framework-00.txt

It is still difficult to understand how they relate to each other and
how a SUPA controller would provide a standards-based solution.

Andy

On Fri, Apr 15, 2016 at 1:32 PM, Joel Halpern <[email-masked]> wrote:

> The must clauses on the instance-identifiers now indicate the target class
> (including subclasses) of the association.  As I noted in BA, for
>         Title           : Generic Policy Data Model for Simplified Use of
> Policy Abstractions (SUPA)
>         Authors         : Joel Halpern
>                           John Strassner
>         Filename        :
> draft-halpern-supa-generic-policy-data-model-01.txt
>         Pages           : 48
>         Date            : 2016-04-15
>
> Abstract:
> Supa mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/supa
>

---

From: Andy Bierman <[email-masked]>
Date: Sat, 16 Apr 2016 10:56:34 -0700

Hi,

I would like to see an example of SUPA in use.
I thought Juergen has a clear maybe-not-simple use-case with SNMP:

Event: example-interface-up notification received
Task: Extract NE ID and interface ID

Condition: Determine if NE,interface is an edge interface to an untrusted
network
Task: examine topology database?  Out of scope?

Action: install an ACL on this NE, interface to deny incoming and outbound
packets on port 161, 162
Task: Determine how ACLs done on NE and send proper configuration changes

What parts will SUPA provide and how are they done?
What parts will the domain-specific models provide and how do
they integrate with this module?  What parts are left
as implementation details and out of scope for SUPA?

I am far from convinced this approach is simpler than a controller level
data model.
E.g.,  a network-wide ACL that blocks SNMP from entering or exiting the
administrative
domain can implement this policy, and all the ECA configuration and
execution details
are hidden within implementation details.

Andy

---

From: "Joel M. Halpern" <[email-masked]>
Date: Sat, 16 Apr 2016 14:35:14 -0400

Yes, that case can be represented.  No, it will not be simpler than a 
hard-coded system that places such an ACL whenever interfaces come up. 
(General tools seem to usually be more complex than specialized ones.)

Rough sketch:

Subclass of event to represent interface up, with sufficient information 
to know what interface it is.

Subclass of Condition testing whether the interface testing whether an 
interface is an edge interface (both solutions assume this is knowable, 
otherwise the problem is not solvable without human intervention.)

Subclass of action representing applying an ACL set, with the ACL 
parameters.

Then a Policy Clause that ties the three together,
and a policy statement that says to apply the clause.

This does not make use of the pwoer of policy statement or policy 
clause.  Those are to enable representation of more complex policies.

Yours,
Joel

On 4/16/16 1:56 PM, Andy Bierman wrote:
> Condition: Determine if NE,interface is an edge interface to an
> untrusted network
> On Fri, Apr 15, 2016 at 1:32 PM, Joel Halpern <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     class (including subclasses) of the association.  As I noted in BA,
>     for associations with properties, the two end-points both point to
>     the association class, which points to both end-points.
>
>     We will be doing the YANG tree, better descriptions, and text about
>     the mapping from IM to DM.
>
>     Please review either the IM or the DM (using the IM descriptions) to
>     see whether this model represents what the WG wants to see.
>
>     Yours,
>     Joel
>
>
>     From: [email-masked] <mailto:[email-masked]>
>     Reply-To: [email-masked] <mailto:[email-masked]>
>     To: [email-masked] <mailto:[email-masked]>
>
>
>              Title           : Generic Policy Data Model for Simplified
>     Use of Policy Abstractions (SUPA)
>              Authors         : Joel Halpern
>                                John Strassner
>              Filename        :
>     until the htmlized version and diff are available at tools.ietf.org
>     <http://tools.ietf.org>.
>
>     [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>