Internet Draft Differentiated Services Configuration MIB June 2003 Internet Engineering Task Force H. Hazewinkel INTERNET-DRAFT Consultant Expires December 2003 D. Partain Ericsson June 2003 The Differentiated Services Configuration MIB draft-ietf-snmpconf-diffpolicy-06.txt June 2003 Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet- Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This document is a product of the IETF's Configuration Management with SNMP Working Group. Comments should be addressed to WG's mailing list at snmpconf@snmp.com. The charter for the Working Group may be found at http://www.ietf.org/html.charters/snmpconf- charter.html Distribution of this memo is unlimited. SNMPCONF WG Expires December 2003 [Page 1] Internet Draft Differentiated Services Configuration MIB June 2003 Copyright Notice Copyright (C) The Internet Society (2002). All Rights Reserved. Abstract This memo describes a MIB module that provides a conceptual layer between high-level "network-wide" policy definitions that affect configuration of the Differentiated Services (diffserv) subsystem and the instance-specific information that would include such details as the parameters for all the queues associated with each interface in a system. This essentially provides an interface for configuring differentiated services at a conceptually higher layer than that of the Differentiated Services MIB. SNMPCONF WG Expires December 2003 [Page 2] Internet Draft Differentiated Services Configuration MIB June 2003 Table of Contents 1 The Internet-Standard Management Framework ................... 4 2 Introduction ................................................. 4 3 Other Documents .............................................. 4 4 Relationship to other MIBs ................................... 5 4.1 The Policy-based Management MIB module ..................... 5 4.2 The Differentiated Services MIB module ..................... 5 5 The Differentiated Services Configuration MIB module design ........................................................... 6 6 Template cloning ............................................. 7 6.1 An Approach to Template Cloning ............................ 8 6.2 Example .................................................... 9 6.2.1 The initial situation .................................... 9 6.2.2 The configuration template ............................... 11 6.2.3 Applying the template .................................... 13 7 Managed objects definitions (MIB module) ..................... 17 8 Security Considerations ...................................... 24 9 Acknowledgements ............................................. 24 10 Editors' Addresses .......................................... 24 11 Full Copyright Statement .................................... 25 12 Informative References ...................................... 25 13 Normative References ........................................ 26 SNMPCONF WG Expires December 2003 [Page 3] Internet Draft Differentiated Services Configuration MIB June 2003 1. The Internet-Standard Management Framework For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 [RFC3410]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. 2. Introduction This memo defines a MIB module that can be used to convey management information about desired network-wide Differentiated Services based policy behavior. This module is designed to integrate with the Policy-based Management MIB module [PMMIBDR] as well as the Differentiated Services MIB module [RFC3289]. Together, these three documents represent an instance of an integrated architecture for both device-specific and network-wide policy (configuration) management which is fully integrated with the Internet Standard Management Framework. The Differentiated Services MIB module [RFC3289] operates on a device level. The MIB module in this memo, the DIFFSERV-CONFIG-MIB, creates a coherent configuration management view as an umbrella over [RFC3289]. That is, the DIFFSERV-CONFIG-MIB provides a conceptual API for configuration of Differentiated Services parameters. Since the Differentiated Services MIB module is able to maintain configuration information, the DIFFSERV-CONFIG-MIB configuration API consists only of configuration template information and the start of the so-called functional datapath. 3. Other Documents It is assumed that the reader is familiar with Differentiated Services ([RFC2474] and [RFC2475]), the Policy-based Management MIB ([PMMIBDR]) and the BCP entitled "Configuring Networks and Devices With SNMP" ([RFC3512]). These documents include all of the necessary SNMPCONF WG Expires December 2003 [Page 4] Internet Draft Differentiated Services Configuration MIB June 2003 terminology for understanding this memo. [RFC3512] also provides an example MIB module which may help in understanding the relationship between DIFFSERV-CONFIG-MIB and the Differentiated Services MIB in [RFC3289]. 4. Relationship to other MIBs In this section we describe the relationship of this MIB module to other MIB modules. The overall architecture used for policy configuration management is described in [PMMIBDR]. 4.1. The Policy-based Management MIB module [PMMIBDR] defines a MIB module that enables policy-based configuration management of infrastructure using the Internet Standard Management Framework. The document includes a table for configuring policies to be implemented, tables for storing the roles of elements on a particular device, a table for representing the capabilities of a device with respect to policy management, a table for referencing elements affected by a policy, as well as other infrastructure. See [PMMIBDR] for a full description of the policy-based configuration framework it provides. 4.2. The Differentiated Services MIB module The Differentiated Services MIB module [RFC3289] provides a common set of managed objects useful for configuring Differentiated Services parameters on a Differentiated Services capable device. This is what is referred to as instance-level configuration. It is the alteration of the instance-level information in that MIB module which may be done via the objects provided by the Differentiated Services Configuration MIB module defined in this memo. It is recognized that vendors may include additional managed objects in their devices (via vendor-specific MIB modules) for configuring Differentiated Services parameters. If a vendor chooses to use the objects defined in this memo for configuration, the vendor should provide additional managed objects in a similar approach as defined for the Differentiated Services MIB module. SNMPCONF WG Expires December 2003 [Page 5] Internet Draft Differentiated Services Configuration MIB June 2003 Since the managed objects of the Differentiated Services MIB [RFC3289] are not directly associated with an instance (interface and interface direction), the same managed objects can be used for traffic treatment configuration templates in a Differentiated Services capable device and can then be applied on multiple instances. Therefore, the tables as defined in the Differentiated Services MIB can directly be used for template configuration purposes. Those tables are: - diffServClfrTable - diffServClfrElementTable - diffServMultiFieldClfrTable - diffServMeterTable - diffServTBParamTable - diffServActionTable - diffServDscpMarkActTable - diffServCountActTable - diffServAlgDropTable - diffServRandomDropTable - diffServQTable - diffServSchedulerTable - diffServMinRateTable - diffServMaxRateTable Readers familiar with the Differentiated Services MIB will notice that these are all templates. Only the diffServDataPathTable defines a managed instance for Differentiated Services traffic treatment by its indexes of the interface and its interface direction. This also allows the tables mentioned above to be used as a configuration template without defining anything directly related to a managed instance. 5. The Differentiated Services Configuration MIB module design The Differentiated Services Configuration MIB module (in this memo) of the SNMP-based configuration management framework is positioned between the Policy-based Management MIB module and the instance- specific Differentiated Services MIB module as described above. The MIB module found in this memo is designed to maintain configuration templates for the Differentiated Services MIB [RFC3289] module. The module only has a template table that describes a Differentiated Services traffic treatment by providing the starting pointer of the functional datapath. The templates represent a SNMPCONF WG Expires December 2003 [Page 6] Internet Draft Differentiated Services Configuration MIB June 2003 specific configuration of traffic treatment in a functional datapath of a Differentiated Services capable device. To avoid duplication of managed objects, the actual templates defining the functional datapath are defined in the Differentiated Services MIB module. These are also used for the management of the instances. Therefore, the implementation of the DIFFSERV-CONFIG-MIB module uses the tables defined in the Differentiated Services MIB. As soon as a configuration is made active via the POLICY-MANAGEMENT-MIB, the configuration defined within this MIB module will be instantiated in the DIFFSERV-MIB. Note that this is a conceptual process. That is, the configuration may not actually go through an API available in the subsystem which implements the DIFFSERV-MIB module. However, configuration via the DIFFSERV-CONFIG-MIB module will alter the same instrumentation as the DIFFSERV-MIB module whether it does it via the DIFFSERV-MIB module or not. The Differentiated Services Configuration MIB module only needs to define a starting point of a traffic treatment configuration template. This table is similar to the diffServDataPathTable [RFC3289]. However, it has a semantic difference in that the diffServDataPathTable is associated with an instance (interface and interface direction), whereas the diffServConfigTable in this memo is not. Unlike most MIB modules, changes to the managed objects in this MIB module do not cause a change in the device. This MIB module is used to set up per-hop-behavior configurations. As soon as configurations are made active via the POLICY-MANAGEMENT-MIB, the configurations defined within this MIB module will be instantiated in the DIFFSERV- MIB. The only table in this MIB module is the diffServConfigTable, which provides managed objects for registering traffic treatment configurations used in differentiated services. The sole purpose of this table is to provide the starting point for a traffic treatment configuration template. The traffic treatment itself is performed by functional datapath elements [RFC3289]. 6. Template cloning The concept of the DIFFSERV-CONFIG-MIB is based on having traffic treatment configuration templates. The templates provide a set of SNMPCONF WG Expires December 2003 [Page 7] Internet Draft Differentiated Services Configuration MIB June 2003 configuration values that provide a certain behavior, such as EF traffic treatment, in the functional datapath. The template (or functional datapath) is similar to a linked list from a starting point and each (functional datapath) element is connected to the next element via a so-called the element. The moment a template is activated (instantiated) on an interface and its interface direction, the template needs to be copied/cloned, so that the template remains as a template. If the template is no longer available as a template after an instantiation, the management station has to set up a new equivalent template, and the object amplification of configuration with SNMP is gone. A literal copy/clone of the template would not be possible, since the same indexes inside the element tables cannot be re-used. The instantiation process must therefore generate a new index for each element. As a result of this, the 'NEXT' pointers also need to be updated. Otherwise, those will point to the template. 6.1. An Approach to Template Cloning What should a system containing Differentiated Services capabilities and Differentiated Services configuration capabilities do conceptually at the moment a template is activated on an interface? The following order or approach should not be considered implementation guidelines, but rather a conceptual explanation of what should be done. 1) Get the index of the template to be activated 2) Get RowPointer (current) from diffServConfigStart.index of the diffServConfigTable 3) Check if RowPointer (current) exists 4) Copy/Clone the entry pointed to by RowPointer a) Get a new index for the entry b) Configure the new entry with the values of the entry to be cloned c) Update the NEXT pointer with a new RowPointer that pointed to the previous entry that was copied part of this template 5) Store RowPointer of cloned entry as previous 6) Get the RowPointer of the next element in the template as current 7) If current RowPointer does not equal zeroDotZero go to 4 SNMPCONF WG Expires December 2003 [Page 8] Internet Draft Differentiated Services Configuration MIB June 2003 6.2. Example This section provides an example of the process described in the previous section. This example will show a Differentiated Services capable incoming (ingress) interface that only counts the traffic stream. Then, with the policy-based configuration concept as defined in this document and in [PMMIBDR], a traffic marking configuration will be applied. The example will walk the reader through all of the steps involved in this process. NOTE WELL: For brevity and clarity, the example does not always show the complete entry (row) of a table. The only objects shown are those needed for creating the row pointers to the next functional datapath element or needed to provide information about the specific parameters of the functional datapath elements. The column named 'INDEX' always defines the complete index as defined for the associated entry. In some cases this is a combined index of multiple components. Therefore, the names of the columns are omitted. 6.2.1. The initial situation The initial configuration is the existing configuration of an ingress interface. +------------------------------------------------------------+ | ingress functional datapath | | +----------+ | -->|----------->----------->| count |----------->----------->|--> | +----------+ | +------------------------------------------------------------+ This figure depicts a simple traffic treatment functional datapath for an ingress interface. The functional datapath only consists of a count action. Within the DIFFSERV-MIB this would be instantiated as follows in the appropriate tables. Note that RowPointer objects must point to the first accessible columnar object in the conceptual row. Thus, while perhaps more instructive to use the index value for the RowPointer object's value (e.g., diffServCountActId.1) in the example, it would nonetheless be incorrect, and the first accessible columnar object has been used as should be done (e.g., diffServCountActOctets.1). SNMPCONF WG Expires December 2003 [Page 9] Internet Draft Differentiated Services Configuration MIB June 2003 diffServDataPathTable +-----------------+-----------------------------+ | INDEX | diffServDataPathStart | +-----------------+-----------------------------+ | ifIndex.ingress | diffServActionNext.1 | +-----------------+-----------------------------+ SNMPCONF WG Expires December 2003 [Page 10] Internet Draft Differentiated Services Configuration MIB June 2003 diffServActionTable +-------+--------------------+-------------------------+ | INDEX | diffServActionNext |diffServActionSpecific | +-------+--------------------+-------------------------+ | 1 | 0.0 |diffServCountActOctets.1 | +-------+--------------------+-------------------------+ diffServCountActTable +-------+------------------------+ | INDEX | diffServCountActOctets | +-------+------------------------+ | 1 | | +-------+------------------------+ 6.2.2. The configuration template The following provides an example of a policy configuration in which traffic is classified by a specific IP filter. That results in two classifiers (1 for the IP filter and the match all). Both streams are then metered, marked and counted. This is an example of usage on the edge (an ingress interface) of an Differentiated Services domain that wants to have EF and AF marked traffic within the Differentiated Services domain. +------------------------------------------------------------+ | ingress functional datapath | | +------------+ +-------+ +---------+ +---------+ | | | | | | | action: | | action: | | -->|-->| classifier |-->| meter |-->| mark EF |-->| count |-->|-----> | | match | | | | | | | | | +------------+ +-------+ +---------+ +---------+ | | | \ | | | \ +---------+ | | | \ | action: | |routing | | * -->| dropper | |core | | / | | | | | / +---------+ | | V / | | +------------+ +-------+ +---------+ +---------+ | | | | | | | action: | | action: | | | | classifier |-->| meter |-->| mark AF |-->| count |-->|-----> | | match all | | | | | | | | | +------------+ +-------+ +---------+ +---------+ | +------------------------------------------------------------+ SNMPCONF WG Expires December 2003 [Page 11] Internet Draft Differentiated Services Configuration MIB June 2003 This figure depicts a policy configuration for ingress traffic treatment in a Differentiated Services capable device. The configuration is represented as follows in DIFFSERV-CONFIG-MIB module and the DIFFSERV-MIB module. NOTE: the original (existing) traffic treatment of 1) is also in the tables. diffServConfigTable (in the MIB module in this memo) +-------+------------------------+---------------------------+ | INDEX | diffServConfigStart | diffServConfigDescr | +-------+------------------------+---------------------------+ | 1 | diffServClfrStorage.1 | Example traffic treatment | +-------+------------------------+---------------------------+ diffServClfrTable +-------+---------------------+ | INDEX | diffServClfrStorage | +-------+---------------------+ | 1 | | +-------+---------------------+ diffServClfrElementTable (shares index with diffServClfrTable) +-------+---------------------------+-------------------------------+ | INDEX | diffServClfrElementNext | diffServClfrElementPrecedence | +-------+---------------------------+-------------------------------+ | 1.1 |diffServMeterSucceedNext.1 | 1 | | 1.2 |diffServMeterSucceedNext.2 | 2 | +-------+---------------------------+-------------------------------+ diffServMeterTable +-------+--------------------------+-----------------------+ | INDEX | diffServMeterSucceedNext |diffServMeterFailNext | +-------+--------------------------+-----------------------+ | 1 | diffServActionNext.2 | diffServAlgDropType.1 | | 2 | diffServActionNext.3 | diffServAlgDropType.1 | +-------+--------------------------+-----------------------+ SNMPCONF WG Expires December 2003 [Page 12] Internet Draft Differentiated Services Configuration MIB June 2003 diffServActionTable +-------+----------------------+----------------------------+ | INDEX | diffServActionNext | diffServActionSpecific | +-------+----------------------+----------------------------+ | 1 | 0.0 | diffServCountActOctets.1 | | 2 | diffServActionNext.4 | diffServDscpMarkActDscp.EF | | 3 | diffServActionNext.5 | diffServDscpMarkActDscp.AF | | 4 | 0.0 | diffServCountActOctets.2 | | 5 | 0.0 | diffServCountActOctets.3 | +-------+----------------------+----------------------------+ diffServCountActTable +-------+------------------------+ | INDEX | diffServCountActOctets | +-------+------------------------+ | 1 | | | 2 | | | 3 | | +-------+------------------------+ diffServAlgDropTable +-------+---------------------+-------------------------+ | INDEX | diffServAlgDropType | diffServAlgDropSpecific | +-------+---------------------+-------------------------+ | 1 | alwaysDrop(5) | 0.0 | +-------+---------------------+-------------------------+ diffServDscpMarkActTable +-------------------------+ | diffServDscpMarkActDscp | +-------------------------+ | DSCP(EF) | | DSCP(AF) | +-------------------------+ 6.2.3. Applying the template Now we have the original ingress interface configuration and the policy configuration we want to apply to the actual interface. The example policy must provide to all interfaces used by system administrators the required Differentiated Services traffic treatment. The traffic treatment required is described in 6.2.2 above. SNMPCONF WG Expires December 2003 [Page 13] Internet Draft Differentiated Services Configuration MIB June 2003 Therefore, we have the following example policy which is configured via the POLICY-BASED-MANAGEMENT-MIB module (see [PMMIBDR]): if return roleMatch("Administrator") then /* * The $0 gets the "element" returned from the previous * statement. the .2 at the end is the egress interface * This sets, for example, diffServDataPathStart.3.2 to be * diffServActionNext.1 if interface 3 has the role * "Administrator". */ setVar("diffServDataPathStart.$0.2", "diffServActionNext.1", Oid) For our purposes, we only apply this on the outbound (egress) direction on the interface. Note that although object descriptors are used in this PolicyScript example, the object identifiers must be used in the running script. For more information on policies and their syntax refer to [PMMIBDR]. The following tables of this section provide the cloned entries in the tables of the DIFFSERV-MIB module. NOTE: the original (existing) traffic treatment of 6.2.1 and 6.2.2 are also in the tables. diffServConfigTable +-------+-------------------------+---------------------------+ | INDEX | diffServConfigStart | diffServConfigDescr | +-------+-------------------------+---------------------------+ | "foo" | diffServClfrStorage.1 | Example traffic treatment | +-------+-------------------------+---------------------------+ diffServDataPathTable +-----------------+-----------------------------+ | INDEX | diffServDataPathStart | +-----------------+-----------------------------+ | ifIndex.ingress | diffServActionNext.2 | +-----------------+-----------------------------+ SNMPCONF WG Expires December 2003 [Page 14] Internet Draft Differentiated Services Configuration MIB June 2003 diffServClfrTable +-------+---------------------+ | INDEX | diffServClfrStorage | +-------+---------------------+ | 1 | | | 2 | | +-------+---------------------+ diffServClfrElementTable +-------+----------------------------+-------------------------------+ | INDEX | diffServClfrElementNext | diffServClfrElementPrecedence | +-------+----------------------------+-------------------------------+ | 1.1 | diffServMeterSucceedNext.1 | 1 | | 1.2 | diffServMeterSucceedNext.2 | 2 | | 2.3 | diffServMeterSucceedNext.3 | 1 | | 2.4 | diffServMeterSucceedNext.4 | 2 | +-------+----------------------------+-------------------------------+ diffServMeterTable +-------+--------------------------+-----------------------+ | INDEX | diffServMeterSucceedNext | diffServMeterFailNext | +-------+--------------------------+-----------------------+ | 1 | diffServActionNext.2 | diffServAlgDropType.1 | | 2 | diffServActionNext.3 | diffServAlgDropType.1 | | 3 | diffServActionNext.6 | diffServAlgDropType.2 | | 4 | diffServActionNext.7 | diffServAlgDropType.2 | +-------+--------------------------+-----------------------+ diffServActionTable +-------+----------------------+----------------------------+ | INDEX | diffServActionNext | diffServActionSpecific | +-------+----------------------+----------------------------+ | 1 | 0.0 | diffServCountActOctets.1 | | 2 | diffServActionNext.4 | diffServDscpMarkActDscp.EF | | 3 | diffServActionNext.5 | diffServDscpMarkActDscp.AF | | 4 | 0.0 | diffServCountActOctets.2 | | 5 | 0.0 | diffServCountActOctets.3 | | 6 | diffServActionNext.8 | diffServDscpMarkActDscp.EF | | 7 | diffServActionNext.9 | diffServDscpMarkActDscp.AF | | 8 | 0.0 | diffServCountActOctets.4 | | 9 | 0.0 | diffServCountActOctets.5 | +-------+----------------------+----------------------------+ SNMPCONF WG Expires December 2003 [Page 15] Internet Draft Differentiated Services Configuration MIB June 2003 diffServCountActTable +-------+------------------------+ | INDEX | diffServActCountOctets | +-------+------------------------+ | 1 | | | 2 | | | 3 | | | 4 | | | 5 | | +-------+------------------------+ diffServAlgDropTable +-------+---------------------+-------------------------+ | INDEX | diffServAlgDropType | diffServAlgDropSpecific | +-------+---------------------+-------------------------+ | 1 | alwaysDrop(5) | 0.0 | +-------+---------------------+-------------------------+ diffServDscpMarkActTable +-------------------------+ | diffServDscpMarkActDscp | +-------------------------+ | DSCP(EF) | | DSCP(AF) | +-------------------------+ As one can see in the example, the main elements from which a functional datapath are constructed are duplicated/copied/cloned. That process is needed in order to preserve the policy configuration for reuse at a later time. It is up to the SNMP agent to keep track of which network interfaces are under policy control and which policy rules are being used. This avoids duplication of policy enforcement. How the agent does this is an implementation issue. One can see that the old functional datapath configurations stay in the MIB module tables. It is up to the SNMP agent implementation to decide whether to delete stale entries or keep them. Garbage collection of stale entries is an implementation issue. SNMPCONF WG Expires December 2003 [Page 16] Internet Draft Differentiated Services Configuration MIB June 2003 7. Managed objects definitions (MIB module) DIFFSERV-CONFIG-MIB DEFINITIONS ::= BEGIN IMPORTS OBJECT-TYPE, MODULE-IDENTITY, zeroDotZero, mib-2 FROM SNMPv2-SMI RowStatus, StorageType, RowPointer, DateAndTime FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF SnmpAdminString FROM SNMP-FRAMEWORK-MIB InetAddress, InetAddressType FROM INET-ADDRESS-MIB; diffServConfigMib MODULE-IDENTITY LAST-UPDATED "200205060000Z" ORGANIZATION "SNMPCONF WG" CONTACT-INFO "SNMPCONF Working Group http://www.ietf.org/html.charters/snmpconf-charter.html WG mailing list: snmpconf@snmp.com Editors: Harrie Hazewinkel Internet Management Consultant E-mail: harrie@lisanza.net David Partain Ericsson AB P.O. Box 1248 SE-581 12 Linkoping Sweden E-mail: David.Partain@ericsson.com" DESCRIPTION "This MIB module contains differentiated services specific managed objects to perform higher-level configuration management. This MIB allows policies SNMPCONF WG Expires December 2003 [Page 17] Internet Draft Differentiated Services Configuration MIB June 2003 to use 'templates' to be used to instantiate Differentiated Services functional datapath configurations to be assigned (associated with an interface and direction) when a policy is activated." ::= { mib-2 xxx } -- Needs to be assigned by before publishing diffServConfigMIBObjects OBJECT IDENTIFIER ::= { diffServConfigMib 1 } diffServConfigMIBConformance OBJECT IDENTIFIER ::= { diffServConfigMib 2 } -- -- The Differentiated Services configuration objects -- diffServConfigTable OBJECT-TYPE SYNTAX SEQUENCE OF DiffServConfigEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table which defines the various per-hop-behaviors for which the system has default 'templates'." ::= { diffServConfigMIBObjects 2 } diffServConfigEntry OBJECT-TYPE SYNTAX DiffServConfigEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry defining a per-hop-behavior. Each entry in this table combines the various parameters (entries) into a specific per-hop-behavior. Entries in this table might be defined by a vendor (pre-configured) or defined by a management application." INDEX { diffServConfigId } ::= { diffServConfigTable 1 } DiffServConfigEntry ::= SEQUENCE { diffServConfigId SnmpAdminString, diffServConfigDescr SnmpAdminString, diffServConfigOwner SnmpAdminString, diffServConfigLastChange DateAndTime, diffServConfigStart RowPointer, diffServConfigStorage StorageType, diffServConfigStatus RowStatus } SNMPCONF WG Expires December 2003 [Page 18] Internet Draft Differentiated Services Configuration MIB June 2003 diffServConfigId OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..116)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "A unique id for the per-hop-behavior policy. The range of up to 116 characters is chosen to stay within the SMI limit of 128 subidentifiers in an index." ::= { diffServConfigEntry 1 } diffServConfigDescr OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-create STATUS current DESCRIPTION "A human-readable description to identify this defined per-hop-behavior. Note that this is an SnmpAdminString, which permits UTF-8 strings. An administratively assigned identifier for a template that would be unique within an adminstrative domain. It is up to the management applications to agree how these are assigned within the administrative domain. Once a description, such as 'EF' is assigned, that has a certain set of parameters that achieve 'EF' from box to box, so management application code or Script code can easily scan the table to find the proper template and then easily assign it." ::= { diffServConfigEntry 2 } diffServConfigOwner OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-create STATUS current DESCRIPTION "The owner who created this entry." ::= { diffServConfigEntry 3 } diffServConfigLastChange OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The date and time when this entry was last changed." ::= { diffServConfigEntry 4 } SNMPCONF WG Expires December 2003 [Page 19] Internet Draft Differentiated Services Configuration MIB June 2003 diffServConfigStart OBJECT-TYPE SYNTAX RowPointer MAX-ACCESS read-create STATUS current DESCRIPTION "The pointer to a functional datapath configuration template as set up in the DIFFSERV-MIB. This RowPointer should point to an instance of one of: diffServClfrEntry diffServMeterEntry diffServActionEntry diffServAlgDropEntry diffServQEntry A value of zeroDotZero in this attribute indicates no further Diffserv treatment is performed on traffic of this functional datapath. This also means that the template described by this row is not defined. If the row pointed to does not exist, the treatment is as if this attribute contains a value of zeroDotZero." REFERENCE "Differentiated Services MIB module" DEFVAL { zeroDotZero } ::= { diffServConfigEntry 5 } diffServConfigStorage OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The type of storage used for this row." ::= { diffServConfigEntry 6 } diffServConfigStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "RowStatus object used for creation and deletion of rows in this table." ::= { diffServConfigEntry 7 } -- -- MIB Compliance statements. SNMPCONF WG Expires December 2003 [Page 20] Internet Draft Differentiated Services Configuration MIB June 2003 -- diffServConfigMIBCompliances OBJECT IDENTIFIER ::= { diffServConfigMIBConformance 1 } diffServConfigMIBGroups OBJECT IDENTIFIER ::= { diffServConfigMIBConformance 2 } diffServConfigMIBFullCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The full compliance for this MIB module." MODULE -- This module MANDATORY-GROUPS { diffServConfigMIBConfigGroup } MODULE DIFFSERV-MIB -- The MODULE IF-MIB and DIFFSERV-MIB are to be -- implemented in accordance to diffServMIBFullCompliance -- as defined in the DIFFSERV-MIB. -- This is copied since SMI does not allow a -- compliance statement here. MODULE IF-MIB -- The interfaces MIB, RFC2863 MANDATORY-GROUPS { ifCounterDiscontinuityGroup } MODULE DIFFSERV-MIB -- The Differentiated Services MIB MANDATORY-GROUPS { diffServMIBDataPathGroup, diffServMIBClfrGroup, diffServMIBClfrElementGroup, diffServMIBMultiFieldClfrGroup, diffServMIBActionGroup, diffServMIBAlgDropGroup, diffServMIBQGroup, diffServMIBSchedulerGroup, diffServMIBMaxRateGroup, diffServMIBMinRateGroup, diffServMIBCounterGroup } GROUP diffServMIBMeterGroup DESCRIPTION "This group is mandatory for devices that implement metering functions." GROUP diffServMIBTBParamGroup DESCRIPTION "This group is mandatory for devices that implement token-bucket metering functions." SNMPCONF WG Expires December 2003 [Page 21] Internet Draft Differentiated Services Configuration MIB June 2003 GROUP diffServMIBDscpMarkActGroup DESCRIPTION "This group is mandatory for devices that implement DSCP-Marking functions." GROUP diffServMIBRandomDropGroup DESCRIPTION "This group is mandatory for devices that implement Random Drop functions." OBJECT diffServDataPathStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." OBJECT diffServClfrStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." OBJECT diffServClfrElementStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." OBJECT diffServMultiFieldClfrAddrType SYNTAX InetAddressType { unknown(0), ipv4(1), ipv6(2) } DESCRIPTION "An implementation is only required to support IPv4 and IPv6 addresses." OBJECT diffServMultiFieldClfrDstAddr SYNTAX InetAddress (SIZE(0|4|16)) DESCRIPTION "An implementation is only required to support IPv4 and globally unique IPv6 addresses." OBJECT diffServAlgDropStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." SNMPCONF WG Expires December 2003 [Page 22] Internet Draft Differentiated Services Configuration MIB June 2003 OBJECT diffServRandomDropStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." OBJECT diffServQStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." OBJECT diffServSchedulerStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." OBJECT diffServMinRateStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." OBJECT diffServMaxRateStatus SYNTAX RowStatus { active(1) } WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notInService is not required." ::= { diffServConfigMIBCompliances 1 } diffServConfigMIBConfigGroup OBJECT-GROUP OBJECTS { diffServConfigDescr, diffServConfigOwner, diffServConfigLastChange, diffServConfigStart, diffServConfigStorage, diffServConfigStatus } STATUS current DESCRIPTION "The per-hop-behavior Group defines the MIB Objects that describe the Config template for the per-hop-behavior." ::= { diffServConfigMIBGroups 1 } END SNMPCONF WG Expires December 2003 [Page 23] Internet Draft Differentiated Services Configuration MIB June 2003 8. Security Considerations There are a number of management objects defined in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them. 9. Acknowledgements The editors gratefully acknowledge the significant contributions to this work made by several members of both the SNMPCONF and DiffServ working groups. 10. Editors' Addresses Harrie Hazewinkel Internet Management Consultant Email: harrie@lisanza.net David Partain Ericsson AB P.O. Box 1248 SNMPCONF WG Expires December 2003 [Page 24] Internet Draft Differentiated Services Configuration MIB June 2003 SE-581 12 Linkoping Sweden EMail: David.Partain@ericsson.com 11. Full Copyright Statement Copyright (C) The Internet Society (2002). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." 12. Informative References [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction and Applicability Statements for Internet- Standard Management Framework", RFC 3410, December 2002. [RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black, "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers", RFC 2474, December 1998. SNMPCONF WG Expires December 2003 [Page 25] Internet Draft Differentiated Services Configuration MIB June 2003 [RFC2475] Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z., and W. Weiss, "An Architecture for Differentiated Services", RFC 2475, December 1998. [RFC3512] MacFaden M., Partain D., Saperia J., and W. Tackabury, "Configuring Networks and Devices with Simple Network Management Protocol (SNMP)," RFC 3512, April 2003. 13. Normative References [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [RFC3289] Baker, F., K. Chan, and A. Smith, "Management Information Base for the Differentiated Services Architecture", RFC 3289, May 2002. [PMMIBDR] Waldbusser, S., J. Saperia, and T. Hongal, "Policy-based Management MIB", draft-ietf-snmpconf-pm-13.txt, Work in Progress, March 2003. SNMPCONF WG Expires December 2003 [Page 26]