RE: [Isms] Re: modularity

["David B Harrington" <ietfdbh at comcast.net>]

Hi Eric,

> Reading the various postings, it seems to me that the WG still
doesn't
> have a common model in mind for these fundamental -- and core 
> -- design
> issues. I am particularly alarmed that some still want to make
minimal
> changes to SNMPv3 USM and VACM and others want to make major
> replacements to USM and VACM. Can we please reach consensus on that
> fundamental point

The SNMPv3 WG did have consensus on a common model, and documented
that consensus. To be consistent with the RFC3411 architecture, both
USM and VACM should remain unchanged, and be able to coexist with
supplementary security and access control models, such as those that
outsource the security to other elements. The MIB module for USM
should be used only by USM, and the MIB module for VACM should be used
only by VACM, and any new secuirty model or new AC model should define
its own MIB module, and only it should access that model-specific MIB
module.

Regarding scalability, the SNMPv3 WG reached consensus on the
following design decision:
"      - Controlled Complexity
         It is recognized that producers of simple managed devices
want
         to keep the resources used by SNMP to a minimum.  At the same
         time, there is a need for more complex configurations which
can
         spend more resources for SNMP and thus provide more
         functionality.  The design tries to keep the competing
         requirements of these two environments in balance and allows
         the more complex environments to logically extend the simple
         environment."

USM's local accounts represents the simple model, which is suitable
for simple environments; interfacing to external security
infrastructure for scalability is a requirement of a more complex
environment, and can be achieved by designing a separate,
supplementary security model, and a separate supplementary access
control model.

David Harrington
dbharrington at comcast.net
co-chair IETF SNMPv3 WG, concluded



_______________________________________________
Isms mailing list
Isms at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms