[Isms] review of draft-nelson-radius-management-authorization-04

Hi,

I support this proposal. I think it would benefit from an introduction
that discusses "named policy" access controls before the discussion of
the RADIUS attributes to support "named policies".

Abstract
s/Aauthentication/Authentication/

1.
The document uses terminology from RFC2865 ..." Identify the titles of
these RFCs.

3.
It is unclear to me why the management-policy-id is for framed
management only. Why not also for non-framed protocols?

4.
s/is by means outside/is outside/
then add a sentence pointing out examples of policy-specification
mechanisms that could be applied, including MIBs, PIBs, XML
configuration model, local configuration files, etc.

5.
This section seems incomplete.
s/this attributes/this attribute/

"one new attribute" - but doesn't section introduce a second new
attribute?

6.1
"left to right" would this be network-order?
"one new value" aren't there two?

7.1
s/SNMP v3/SNMPv3/
Can this be used to specify snmpv1 and snmpv2c? We are not
recommendign their use, only acknowledgeing their presence in real
networks, and discussing how to apply policies to them.

9.
proxy needs to be identified as RADIUS and/or Diameter proxy to
distinguish it from SNMP proxy.

Note that the SNMP proxy-forwarder application never opens the PDU and
does not apply any access control based on the PDU contents.

11.
I find the combination of "framed management protocol" and
"non-framed-management-security" a bit odd.

David Harrington
dharrington@huawei.com 
dbharrington@comcast.net
ietfdbh@comcast.net

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms