Re: [Netconf] Reminder: WG Last Call for draft-ietf-netconf-access-control-04.txt

[Kent Watsen <[e-mail]>]

> Pls review BEFORE or BY August 1 if you have not already done so.
> A "I read it and see no issues or have no concerns" is also very welcome!


I continue to struggle with why this is an important problem to solve (see http://www.ietf.org/mail-archive/web/netconf/current/msg06962.html).

First off, from an implementation perspective, I feel that this I-D would only be implemented for green-field developments.  Having a common access-model for those systems would be nice indeed, but I don't imagine any existing Juniper or similar gear ever supporting it.  This means it has little impact for a multi-vendor NMS, which is my focus.  Keep in mind that this data-model is different than others that we might talk about in that it's not just an abstraction, it goes to the core of how the device works.  Presumably this I-D only impacts the NetConf interface, but vendors will likely not see it that way after needing to pass a Common Criteria certification.

Next I question the utility of the I-D.  IMO, the purpose for common data-models is so an off-box tool (NMS) can interoperate with many devices.  As I wrote before (see above link), this typically results in the NMS logging into *all* the devices with root-like permissions and then itself presenting its own RBAC model to its users.  With this in mind, it seems that this I-D only impacts tools that talk to one device at a time, such that when it is interacting with the device, it can use the device-provided NACM model to restrict access to stuff in its UI.  This use-case is weak as it seems customers would more likely use a device's native management interfaces (Web, CLI, etc.)

I understand that this I-D is chartered work and my comments aren't very helpful towards reaching that goal, but I can't support this I-D in its current form either knowing that it won't be picked up by Juniper.

Thanks,
Kent