Re: Last Call: <draft-ietf-ipfix-mib-variable-export-09.txt> (Exporting MIB Variables using the IPFIX Protocol) to Proposed Standard

Randy Presuhn <randy_presuhn@mindspring.com> Mon, 28 September 2015 18:45 UTC

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=mindspring.com; b=awTdQnWydHW+4jeomX2b2wcCFo5M81rv0O9TpIq9BKbkUG3dfEtvYc029Nrb+78g; h=Message-ID:Date:From:Reply-To:To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP;
Message-ID: <14635125.1443465917433.JavaMail.root@elwamui-milano.atl.sa.earthlink.net>
Date: Mon, 28 Sep 2015 11:45:17 -0700
From: Randy Presuhn <randy_presuhn@mindspring.com>
To: ietf@ietf.org
Subject: Re: Last Call: <draft-ietf-ipfix-mib-variable-export-09.txt> (Exporting MIB Variables using the IPFIX Protocol) to Proposed Standard
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/ietf/00kTHwfJLwYbLy7v9W0YtPJaKlQ>
Precedence: list
Reply-To: Randy Presuhn <randy_presuhn@mindspring.com>

Hi -

>From: The IESG <iesg-secretary@ietf.org>
>Sent: Sep 28, 2015 10:11 AM
>To: IETF-Announce <ietf-announce@ietf.org>
>Subject: Last Call: <draft-ietf-ipfix-mib-variable-export-09.txt> (Exporting MIB Variables using the IPFIX Protocol) to Proposed Standard
...

I think the Security Considerations section needs to be a bit more explicit.
For example, it states:

| However if the exporter is a client of an SNMP engine on the same
|   device it MUST abide by existing SNMP security rules.

A few questions come to mind:

  - just exactly what is meant by "client of an SNMP engine"?

  - in deciding whether a bit of information may be exported to
    a particular entity, how does the IPFIX implementation decide
    what VACM user name would correspond to that entity, in order
    to abide by SNMP security rules?

  - if the VACM configuration specifies that a given piece of information
    is to be communicated only by secure means (e.g. auth/priv using
    a particular algorithm) how does the IPFIX implementation honor
    that commitment in forwarding the information without subverting
    the keystore?

  - in granting IPFIX access to the information, should VACM be using
    the read view or the notify view?

Randy

Re: Last Call: <draft-ietf-ipfix-mib-variable-exp… Randy Presuhn