Re: [Isms] draft-hardaker-isms-dtls-tm-05 submitted - tlstmNotifications

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Mon, 14 Sep 2009 20:29:18 +0200, Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de> said:

JS> The question is to what extend the SNMP agent is really involved in
JS> all this or whether the DTLS transport takes care of the processing
JS> itself. In the SNMP over SSH case, we did decide to stay out of things
JS> that really concern the SSH layer. It seems with TLS/DTLS, we seem to
JS> go into much more details - perhaps this is even justified. I just
JS> notice that we seem to deal with these different secure transports
JS> differently.

I'd argue that if it helps the operator it doesn't matter much.  We're
not violating layers because we want to help manage a transport just as
we're not violating layers when we send a linkUp notification (which if
you drew an architectural diagram, would be way outside the SNMPv3
blocks).

In other words, do we want managers to be able to get notifications
about failed (D)TLS connections?  If yes, then we need to define the
notifications and it's implementation specific as to how to detect the
need to send them.

-- 
Wes Hardaker
Cobham Analytic Solutions