[dhcwg] proposal for new global options

[Kent Watsen <[e-mail]>]

[first timer on this list]

The NETCONF WG has recently chartered a draft for ZeroTouch.   I'm
currently working on draft-ietf-netconf-zerotouch-00, which hasn't been
posted yet, but the previous I-D is here:
http://datatracker.ietf.org/doc/draft-kwatsen-netconf-zerotouch/.

This draft regards devices bootstrapping their management connection to a
network management system (NMS).   The draft currently states that devices
MAY upgrade their software and/or download initial configuration first,
but that how to do so is unspecified.  The expectation was that DHCPv4
options 60/61/43 or DHCPv6 options 1/16/17 could be used.   There was
discussion during the presentation in London regarding a desire to have an
IETF-defined solution that wasn't vendor-specific, which is what this
email regards.

The ZeroTouch solution assumes that the devices have an IEEE 802.1AR
(Secure Device Identity), essentially an X.509 certificate that uniquely
identifies it.   Assuming devices from different vendors have said
certificates, we can construct a vendor-independent solution as follows:

    - have DHCP server send in its OFFER message one option encoding two
      sets of URIs
         - one for downloading software image
         - one for downloading configuration file
     - specify that when device accesses any URI, it first postpends the
       fingerprint of its IEEE 802.1AR certificate, for instance:
         - http://example.com/zerotouch/image?device=<fingerprint>
         - http://example.com/zerotouch/config?device=<fingerprint>


Thus a vendor-neutral solution.


Questions:

1) Is there merit to this approach?  - any concerns?
2) Should a separate draft be submitted to DHCWG, or can I put the IANA
requests into the NETCONF WG draft?
3) Is it necessary to define options for both IPv4 and IPv6?


Thanks,
Kent