Re: [dhcwg] proposal for new global options

["Bernie Volz (volz)" <[e-mail]>]

Here's my personal answer (DHC WG co-chair hat off):

1) Is there merit to this approach?  - any concerns?

I will punt on this one for now.

2) Should a separate draft be submitted to DHCWG, or can I put the IANA
requests into the NETCONF WG draft?

As these are just 'data options' (not protocol options), you can do this in the NETCONF WG draft. Please look at RFC 7227, Guidelines for Creating New DHCPv6 Options. These guidelines also generally apply to DHCPv4.

3) Is it necessary to define options for both IPv4 and IPv6?

Yes. If you want to support both DHCPv4 and DHCPv6, you would have to define separate DHCPv4 and DHCPv6 options.

Note that for downloading images, DHCPv4 and DHCPv6 already have options to support this. For example, the DHCPv6 document is RFC 5970. (The DHCPv4 is covered in RFC 2132 and isn't a URI.)


-          Bernie

From: dhcwg [mailto:[e-mail]] On Behalf Of Kent Watsen
Sent: Monday, June 23, 2014 8:58 PM
To: [e-mail]
Subject: [dhcwg] proposal for new global options

[first timer on this list]

The NETCONF WG has recently chartered a draft for ZeroTouch.   I'm
currently working on draft-ietf-netconf-zerotouch-00, which hasn't been
posted yet, but the previous I-D is here:
http://datatracker.ietf.org/doc/draft-kwatsen-netconf-zerotouch/.

This draft regards devices bootstrapping their management connection to a
network management system (NMS).   The draft currently states that devices
MAY upgrade their software and/or download initial configuration first,
but that how to do so is unspecified.  The expectation was that DHCPv4
options 60/61/43 or DHCPv6 options 1/16/17 could be used.   There was
discussion during the presentation in London regarding a desire to have an
IETF-defined solution that wasn't vendor-specific, which is what this
email regards.

The ZeroTouch solution assumes that the devices have an IEEE 802.1AR
(Secure Device Identity), essentially an X.509 certificate that uniquely
identifies it.   Assuming devices from different vendors have said
certificates, we can construct a vendor-independent solution as follows:

    - have DHCP server send in its OFFER message one option encoding two
      sets of URIs
         - one for downloading software image
         - one for downloading configuration file
     - specify that when device accesses any URI, it first postpends the
       fingerprint of its IEEE 802.1AR certificate, for instance:
         - http://example.com/zerotouch/image?device=<fingerprint<http://example.com/zerotouch/image?device=%3cfingerprint>>
         - http://example.com/zerotouch/config?device=<fingerprint<http://example.com/zerotouch/config?device=%3cfingerprint>>


Thus a vendor-neutral solution.


Questions:

1) Is there merit to this approach?  - any concerns?
2) Should a separate draft be submitted to DHCWG, or can I put the IANA
requests into the NETCONF WG draft?
3) Is it necessary to define options for both IPv4 and IPv6?


Thanks,
Kent