Re: [Isms] draft-hardaker-isms-dtls-tm-05 submitted - tlstmNotifications

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Mon, 14 Sep 2009 12:40:38 -0400, "Donati Andrew-MGIA0477" <adonati at motorola.com> said:

DA> Will it be feasible to define optional notifications for each the 
DA> events defined by the counters below ?

DA> tlstmSessionInvalidClientCertificates
DA> tlstmSessionInvalidServerCertificates 

I think it's a good idea to have notifications defined for those two
cases.  The likely triggering points would be:

1) tlstmSessionInvalidClientCertificates

   - command responder, notification responder or proxy application
     receives a client cert it can't cope with.

2) tlstmSessionInvalidServerCertificates

   - a command generator in a remote device (e.g., disman-event mib type
     functionality or ...) or proxy application receives a server cert
     it can't cope with.

   - in theory a local manager could trigger this condition too, but it
     doesn't make as much sense.  There is no reason to say they can't
     send it though.


The interesting question is that for #1, we actually already have such a
notification in a more generic form:  the authenticationFailure
notification from the SNMPv2-MIB.  The questions in my mind are:

A) should we include a more specific one for DTLS
B) should we specify in the documentation other likely (recommend)
   DTLS specific variables to add to the generic authenticationFailure
   notification when being sent?

-- 
Wes Hardaker
Cobham Analytic Solutions