Re: [Anima-signaling] GRASP issue 49: More text about inter-domain GRASP

[Toerless Eckert <[e-mail]>]

Its really hard to define requirements when you don't know what the
communication should ultimately do.

So, for example:

In our Cisco implementation, we allow services to run on systems that
do not have ACP - just because its evolving work to get the ACP onto
such systems. Eg: TFTP servers, Radius Servers - or the like. SO there's
a leg of the ACP that's unencrypted. And the deployment requirement is
to physcially protect this segment - aka: router with ACP co-located with
those servers n a secure NOC room. And we use mDNS there.

The same setup would make sense to me to accelerate deployment also of
course with GRAP - instead of mDNS.

So, this is an example of expanding the secured insance of GRASP across
a segment thats not cryptographically (IPsec) but physically protected.

Now i could easily imagine that the next step would be to have multiple
disjoined autonomic networks, but a shared NOC. In that case, the
reason that we don't use encryption is not only "server systems suck, have no ACP",
but also: If a server should provide objectives (services) to multiple
autonomic networks, then we would need to solve how it could be cryptographically
part of multiple ACPs. Thats even more work.

If i take your text and would want to build a solution around it, then
i could think of some gateway-device thats part of two ACPs, and
has an ASA participating in each ACPs GRASP instance and is filtering/forwarding
objectives that should be allowed to be used across ACPs. Makes sense too...

Cheers
    Toerless

On Tue, Aug 02, 2016 at 01:39:35PM +1200, Brian E Carpenter wrote:
> Hi,
> 
> I came up with an idea of how to tackle this: state that any such inter-domain
> operation MUST be a separate (D)TLS-based instance of GRASP that does not
> share common data structures with the normal (ACP-based) instance.
> 
>     Brian
> On 01/08/2016 09:11, Brian E Carpenter wrote:
> > Hi,
> > 
> > Here's another issue for design team comments.
> > 
> >    o  49.  Section 3.3.1 should say more about signaling between two
> >       autonomic networks/domains.
> > 
> > I need ideas about what to say.
> > 
> > Regards
> >    Brian
> > 
> 
> _______________________________________________
> Anima-signaling mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/anima-signaling

-- 
---
Toerless Eckert, [e-mail]