Re: [netmod] WG Last Call: draft-ietf-netmod-acl-model-14

[Eliot Lear <[e-mail]>]

I like this because ACLs will be used in many different ways, and
expecting that a single model be augmented for each attachment seems a
bit unrealistic.

Eliot

On 12/13/17 3:57 PM, Einar Nilsen-Nygaard (einarnn) wrote:
> Perhaps like this, as an augmentation to the interface:
>
>       augment /if:interfaces/if:interface:
>         +--rw ingress-acls
>         |  +--rw acl-sets
>         |     +--rw acl-set* [name]
>         |        +--rw name              -> /access-lists/acl/name
>         |        +--rw type?             -> /access-lists/acl/type
>         |        +--ro ace-statistics* [name] {interface-stats}?
>         |           +--ro name               ->
>     /access-lists/acl/aces/ace/name
>         |           +--ro matched-packets?   yang:counter64
>         |           +--ro matched-octets?    yang:counter64
>         +--rw egress-acls
>            +--rw acl-sets
>               +--rw acl-set* [name]
>                  +--rw name              -> /access-lists/acl/name
>                  +--rw type?             -> /access-lists/acl/type
>                  +--ro ace-statistics* [name] {interface-stats}?
>                     +--ro name               ->
>     /access-lists/acl/aces/ace/name
>                     +--ro matched-packets?   yang:counter64
>                     +--ro matched-octets?    yang:counter64
>
>
> Could also put an “aces” container above both these & rename
> “ingress-acls" to “ingress”, etc. to give a single root for the
> augmentation if preferred.
>
> Cheers,
>
> Einar
>
>
>> On 6 Dec 2017, at 19:43, Eliot Lear <[e-mail]
>> <mailto:[e-mail]>> wrote:
>>
>>
>>
>> On 12/6/17 7:23 PM, Mahesh Jethanandani wrote:
>>> How does one move the interface attachment point, currently an
>>> 'interface-ref', to an augmentation of the if:interfaces/interface,
>>> inside of the ‘acl’  container? Down the line we might need to have an
>>> container for "attachment points" to accommodate the possibility of
>>> attaching an ACL either to an interface or “globally”.
>>>
>>
>> Keeping in mind that one use is that an ACL doesn't attach to an
>> interface at all.
>>
>> _______________________________________________
>> netmod mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/netmod
>