Re: [Call-home] draft now posted; BoF?

On Mon, Sep 26, 2005 at 03:46:29PM +0200, Eliot Lear wrote:

> A draft is now posted - draft-lear-callhome-description-00.txt.  It
> doesn't yet have much in the way of SNMP specifics but I am working on
> that now.

I am not sure what the scope of your efforts here are. Do you limit
this in scope to the management domain (which is somewhat implied by
talking about managers and agents) or do you want to address the more
general question of how to reverse connection establishment from the
inside to the outside. In any case, I would like to discuss this issue
not only in the context of SNMP, but at least also consider netconf,
where the required to implement transport mapping also does not
provide call home at the moment.

Personally, I am concerned about the security considerations. I would
very much prefer a solution where the authenticated identities and the
way they are authenticated remain the same, regardless whether I am
using call-home or not. Now, it may turn out that this is not feasible
to achieve. If that is the case, these findings need to be documented
somewhere.

> Did I miss architectural issues in the draft?

I only had a very quick read. For me, the really interesting issue is
to figure out how much security protocols like SSH or TLS actually
reply on the connection initiation procedure or whether the
client/server roles can be "turned" before the security protocols do
their work. In other words, I would like to know whether some
extensions to say SSH can solve most of the issues with call home
support in ISMS and NETCONF.

To answer this question, one might have to dive into the details of
the security mechanisms in order to figure out whether there is an
architectural reasons why this can or cannot work.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

_______________________________________________
Call-home mailing list
Call-home@ietf.org
https://www1.ietf.org/mailman/listinfo/call-home