Re: [Netconf] draft-ietf-netconf-monitoring-09 last call comments from js

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Tue, Nov 03, 2009 at 03:32:58PM +0100, Phil Shafer wrote:
> Juergen Schoenwaelder writes:
> >Tell me how this works (AVPs are the things RADIUS sends around in the
> >payload) - or better tell me not, since this would impact ISMS badly.
> 
> Look for "JUNOS Configuration" in:
> 
> http://www.cymru.com/gillsr/documents/junos-radius-authentication.htm

That seems to be a Juniper specific thing and given my experience with
IETF Radius folks, they might or might not agree this is good usage of
Radius. RFC 5607 seems the closest in the IETF world as it provides a
Management-Policy-Id - this Management-Policy-Id might be used for
access control decisions. But it is not changing the user identity.
Anyway, this gets us deeply into terminology issues and implementation
details - we will have to go there if we do access control work. Lets
not do it now.

> >You won't expect TCP objects to document how TCP works, right. The
> >same logic applies to RFC 3412 and all the other SNMP RFCs.
> 
> No, but I would expect the tcp.yang to fully describe how the tcp
> objects work, not just that this leaf has a range of such and the
> leaf is a boolean.  Given that we can say:
> 
>     description "
> 
> Lots of very detailed text.
> More detailed text.
> 
> ";
> 
> and:
> 
> /*
> 
> Some detailed text that needn't be in the description statement.
> 
> */
> 
> And given the number of mib implementors that seem to not read the
> rfc, just the mib, I'd vote to have all real text live within the
> yang module.

We both agree on the principle - I just disagree with your citation of
RFC 3412 in an attempt to prove me wrong that the SMIv2 practice has
been for a long time to have MIB modules self-contained.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>