Re: [Anima-signaling] GRASP issue 49: More text about inter-domain GRASP

On Tue, Aug 02, 2016 at 11:56:02AM -0400, Michael Richardson wrote:
> 
> Toerless Eckert <eckert@cisco.com> wrote:
>     > In our Cisco implementation, we allow services to run on systems that
>     > do not have ACP - just because its evolving work to get the ACP onto
>     > such systems. Eg: TFTP servers, Radius Servers - or the like. SO there's
>     > a leg of the ACP that's unencrypted. And the deployment requirement is
>     > to physcially protect this segment - aka: router with ACP co-located with
>     > those servers n a secure NOC room. And we use mDNS there.
> 
> I was under the impression that we'd make this secure either by physical
> means (as you write), or by putting those services in containers or VMs, and
> connect them to devices/routers that would have ACP on them.

Right. Those are the easily managed approaches.

>     > Now i could easily imagine that the next step would be to have multiple
>     > disjoined autonomic networks, but a shared NOC. In that case, the
>     > reason that we don't use encryption is not only "server systems suck, have no ACP",
>     > but also: If a server should provide objectives (services) to multiple
>     > autonomic networks, then we would need to solve how it could be cryptographically
>     > part of multiple ACPs. Thats even more work.
> 
> I'm not sure it's that big a deal to be part of multiple ACPs.
> Depends a lot upon the details of the service.
> 
> For some services build upon a multi-tier architecture (anything RESTful,
> such as NETCONF...) then putting a front-end server into two ACPs while
> connecting to middle-ware on a common back-end network would be trivial.
> 
> Ditto: Radius things, you can always add a layer of radius proxy.
> TFTP servers... not a huge deal, just NFS mount /tftpboot across a backend
> LAN from the real machine and have multiple TFTP servers in multiple ACPs.

Yes, there are a lot of different ways to do this, but i think they
all involve some additional SW design, which may be trivial, but needs to
be implemented, and i am not sure we have a sufficient strong use-case for
any specific optoin to mandate or even suggest any such extension right now -
as opposed to any other option.

Cheers
    Toerless

>     > If i take your text and would want to build a solution around it, then
>     > i could think of some gateway-device thats part of two ACPs, and
>     > has an ASA participating in each ACPs GRASP instance and is filtering/forwarding
>     > objectives that should be allowed to be used across ACPs. Makes sense too...
> 
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
> 

> _______________________________________________
> Anima-signaling mailing list
> Anima-signaling@ietf.org
> https://www.ietf.org/mailman/listinfo/anima-signaling

-- 
---
Toerless Eckert, eckert@cisco.com