Re: [Isms] comments on draft-nelson-isms-extended-vacm-00

["Dave Nelson" <d.b.nelson at comcast.net>]

Juergen Schoenwaelder writes ... [
 
> But isn't the RADIUS aware transport doing the manipulation of the
> VACM table?

Channeling Dave Harrington:  No, that would be a violation of RFC3411
modularity.  :-)

> Perhaps this is one thing to clarify further - which
> component is actually manipulating the VACM table.

The transport populates tmStateReference.  It's up to the extended VACM code
to do something with that information, i.e., populate MIB tables.

My concern is related to attempting to use extended VACM, and thus the
tmStateRefrence, in the absence of a RADIUS-aware secure transport.  The
only input to the VACM's ASI that would indicate whether there is or is not
a RADIUS-aware transport at work would be the Security Model selector.  Do
you see another way to accomplish this?