[midcom] Re: AD evaluation comments on draft-ietf-midcom-mib-07

[Juergen Quittek <[e-mail]>]

Hi Magnus and Suresh,

--On 27.07.2006 11:23 Uhr -0700 Pyda Srisuresh wrote:

> Magnus,
>
> Please see my comments below inline.
>
> regards,
> suresh
>
> --- Magnus Westerlund <[e-mail]> wrote:
>
>> Hi,
>>
>> Thanks for the quick reply. I do have some follow up below. When these
>> have been resolved please submit a new document. Then I should be able
>> to put it on IETF last call so it will be ready to go to IESG when I am
>> back from my vacation.

 [...]

>> >> 7. midcomConfigFirewallGroupId: I don't understand what scope and
>> >> effect this object has. It is not clear if it can be used to
>> >> reassign rules or if only rules created after the value takes effect.
>> >> In fact I have some problem seeing what it is used for
>> >> at all with the definition it has.
>> >
>> > The midcomConfigFirewallGroupId defines to which firewall rule group
>> > the MIDCOM rules are added. Some firewalls support grouping of rules
>> > into sets/groups. This allows easier reading of rule sets. See, for
>> > instance, groups o sets in ipf or IPFW on FreeBSD.
>> >
>>
>> Okay, however is really the "all" part of the below description correct
>> then?

The text is not really precise here. As Suresh explains below, all
firewall rules for a particular interface are assigned to the same
firewall group.  However, for different interfaces the groups may
be different.

>> "The firewall rule group to which all firewall
>>             rules of the MIDCOM server are assigned."
>>
> [suresh] The firewall table is per-port specific. So, the "all" would be right
> when the FirewallIndex is 0. Would the following rewording work for you.
>
>     The firewall rule group to which all firewall rules for the
>     specified interface of the MIDCOM server are assigned. When
>     midcomConfigFirewallIndex is set to 0, all firewall rules
>     of the MIDCOM server are assigned the same firewall rule group.

This text is better, but still not fully correct.
Even if there is an entry with index 0, then there still may
be entries for other interfaces as indicted in the DESCRIPTION clause
of midcomConfigFirewallTable:

%        The table is indexed by the object midcomConfigFirewallIndex.
%        For indexing a single interface, this object contains the
%        value of the ifIndex object that is associated with the
%        interface.  If an entry with midcomIfIndex = 0 occurs, then
%        bits set in objects of this entry apply to all interfaces
%        for which there is no entry in this table for the
%        interface's index."

Consequently, we should state:

NEW

    The firewall rule group to which all firewall rules are assigned
    that the MIDCOM server creates for the interface indicated by
    object midcomConfigFirewallIndex. If the value of object
    midcomConfigFirewallIndex is 0, then all firewall rules of the
    MIDCOM server that are created for interfaces with no specific
    entry in the midcomConfigFirewallTable are assigned to the
    firewall rule group indicated by the value of this object.

Not forgetting to fix the mistake in the DESCRIPTION clause of the
midcomConfigFirewallTable:

OLD:
        interface.  If an entry with midcomIfIndex = 0 occurs, then
NEW:
        interface.  If an entry with midcomConfigFirewallIndex = 0 occurs, then

> Similarly, the description for midcomConfigFirewallPriority can be changed as
> follows.
>
> OLD:
>       "The priority assigned to all firewall rules
>            of the MIDCOM server."
> NEW:
>
>       "The priority assigned to all firewall rules for the specified
>        interface of the MIDCOM server. When midcomConfigFirewallIndex
>        is set to 0, all firewall rules of the MIDCOM server are assigned
>        the same priority."

Similarly, this text should be something like

NEW

    The priority assigned to all firewall rules that the MIDCOM
    server creates for the interface indicated by object
    midcomConfigFirewallIndex. If the value of object
    midcomConfigFirewallIndex is 0, then this priority is assigned
    to all firewall rules of the MIDCOM server that are created for
    interfaces for which there is no specific entry in the
    midcomConfigFirewallTable.



Finally, I fixed another small mistake to be fixed in the DESCRIPTION
clause of object midcomConfigIfTable:

OLD:
         The table is indexed by the object midcomIfIndex.
NEW:
         The table is indexed by the object midcomConfigIfIndex.

OLD:
         midcomIfIndex = 0 occurs, then bits set in objects
NEW:
         midcomConfigIfIndex = 0 occurs, then bits set in objects


Thanks,

    Juergen

_______________________________________________
midcom mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/midcom