IETF Logo Mail Archive

Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-14.txt

<mohamed.boucadair@orange.com> Wed, 24 January 2018 12:36 UTC

Return-Path: <mohamed.boucadair@orange.com>
X-Original-To: opsawg@ietfa.amsl.com
Delivered-To: opsawg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D88F1241FC for <opsawg@ietfa.amsl.com>; Wed, 24 Jan 2018 04:36:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.619
X-Spam-Level:
X-Spam-Status: No, score=-2.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_RP_MATCHES_RCVD=-0.01, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x00VpH8zqQlw for <opsawg@ietfa.amsl.com>; Wed, 24 Jan 2018 04:36:05 -0800 (PST)
Received: from orange.com (mta134.mail.business.static.orange.com [80.12.70.34]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 802D7120726 for <opsawg@ietf.org>; Wed, 24 Jan 2018 04:36:04 -0800 (PST)
Received: from opfednr07.francetelecom.fr (unknown [xx.xx.xx.71]) by opfednr20.francetelecom.fr (ESMTP service) with ESMTP id 2478840BFC; Wed, 24 Jan 2018 13:36:03 +0100 (CET)
Received: from Exchangemail-eme2.itn.ftgroup (unknown [xx.xx.31.34]) by opfednr07.francetelecom.fr (ESMTP service) with ESMTP id 021591C007E; Wed, 24 Jan 2018 13:36:03 +0100 (CET)
Received: from OPEXCLILMA3.corporate.adroot.infra.ftgroup ([fe80::60a9:abc3:86e6:2541]) by OPEXCLILM6F.corporate.adroot.infra.ftgroup ([fe80::bd00:88f8:8552:3349%17]) with mapi id 14.03.0382.000; Wed, 24 Jan 2018 13:36:02 +0100
From: mohamed.boucadair@orange.com
To: Eliot Lear <lear@cisco.com>
CC: Mahesh Jethanandani <mjethanandani@gmail.com>, "opsawg@ietf.org" <opsawg@ietf.org>, Mark Nottingham <mnot@mnot.net>, "Saswat Praharaj (saspraha)" <saspraha@cisco.com>
Thread-Topic: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-14.txt
Thread-Index: AQHTlO4ijwfw7fdn00+sxY/M7KbCAqOCvqXQ///8YYCAABDhAIAAE6cAgAAV2dA=
Date: Wed, 24 Jan 2018 12:36:02 +0000
Message-ID: <787AE7BB302AE849A7480A190F8B93300A0C61BF@OPEXCLILMA3.corporate.adroot.infra.ftgroup>
References: <151678258073.24096.1546664821566754428@ietfa.amsl.com> <74177d27-9a95-c791-db77-be5bafee957d@cisco.com> <787AE7BB302AE849A7480A190F8B93300A0C5FDD@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <f3706db8-1dcf-1efa-5f4b-746166ae97e4@cisco.com> <787AE7BB302AE849A7480A190F8B93300A0C612A@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <df784995-a522-46da-28e0-d92f1fd75b98@cisco.com>
In-Reply-To: <df784995-a522-46da-28e0-d92f1fd75b98@cisco.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.168.234.4]
Content-Type: multipart/alternative; boundary="_000_787AE7BB302AE849A7480A190F8B93300A0C61BFOPEXCLILMA3corp_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsawg/SZKl_it0Ut7QhMxiQzjwk7reHqs>
Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-14.txt
X-BeenThere: opsawg@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OPSA Working Group Mail List <opsawg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsawg>, <mailto:opsawg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsawg/>
List-Post: <mailto:opsawg@ietf.org>
List-Help: <mailto:opsawg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsawg>, <mailto:opsawg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Jan 2018 12:36:08 -0000

Fair enough. Thank you.

Cheers,
Med

De : Eliot Lear [mailto:lear@cisco.com]
Envoyé : mercredi 24 janvier 2018 13:16
À : BOUCADAIR Mohamed IMT/OLN
Cc : Mahesh Jethanandani; opsawg@ietf.org; Mark Nottingham; Saswat Praharaj (saspraha)
Objet : Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-14.txt


Hi Med,

Please see below:

On 24.01.18 12:54, mohamed.boucadair@orange.com<mailto:mohamed.boucadair@orange.com> wrote:



My understanding from draft-ietf-netmod-acl-model-14 is that acl-type remains acl-type.  acl-name became name.  But you're right- rule-name became name as well.  I will adjust the text accordingly.
[Med] I guess you meant -15. I confirm that acl-type is to be changed too. Below an excerpt of the acl tree structure:

     +--rw access-lists
        +--rw acl* [name]
        |  +--rw name    string
        |  +--rw type?   acl-type


* This sentence should be carefully updated as well: “With the exceptions of "name", "acl-type", "rule-name", and TCP and”.

* I guess the examples should be checked to align with the new ACL structure. For example,

 - “ipv6-acl” entries should be updated to “ipv6”.

You're right.  I stand corrected.  And I spotted the error in the example.  Will correct.


Which is the text I adjusted ;-)
[Med] Yes. I was referring to the examples.



 - add “l3” entry before “ipv4” and “ipv6”.

I think this is done in the normative text but you're right- it needs to be corrected in the examples.




* It would useful to add a justification why it is not recommended to support 'reject' action.

Ok, I'll add some text.


[Med] Thank you. BTW, wouldn’t you need a rate-limit action to “protect” against exhausting Thing resources?

I don't think that's appropriate at this point.  For one thing, it goes well beyond what many implementations can actually do.  For another, it may be asking a bit much of the manufacturers to predict this sort of behavior, and it will be easy to get wrong.  I would suggest this be handled later as we get some additional operational experience.

Eliot

v2.23.0 | Report a Bug | By Email