Re: [Isms] comments on draft-nelson-isms-extended-vacm-00

["David Harrington" <ietfdbh at comcast.net>]

Hi,

 

There would be no RADIUS attributes available if the transport model doesn't support RADIUS.

Of course, that works on incoming traffic.

 

For notifications access control is done before authentication in SNMP, so there would be no RADIUS attributes available (at least for the first time).

I assume notifications might use pre-configured access controls.

 

dbh

---

From: d.b.nelson at comcast.net [mailto:d.b.nelson at comcast.net]
Sent: Monday, July 27, 2009 4:30 PM
To: David Harrington
Cc: isms at ietf.org; Juergen Schoenwaelder
Subject: Re: [Isms] comments on draft-nelson-isms-extended-vacm-00

David Harrington writes...

> The RADIUS management attributes are principal-specific.
> The principal-specific attributes can be found using
> securitymodel/securityname/securitylevel.
> isAccessAllowed already supports these fields.

Yes.

I think another way to frame Juergen's original comment is why the (augmented) VACM tables should useTSM in the securityModel field.

My answer was that it need not be restricted to TSM, but it would need to be restricted to some security model that was "dependent" on a RADIUS-aware transport model.  Today, that means TSM.