Re: [sacm] Some comments about draft-ietf-sacm-ecp-02:

["Haynes Jr., Dan" <[e-mail]>]

Hi Jess,

Here's how I was planning to respond to Frank. Does this all seem reasonable to you as well?

Thanks,

Danny

---------------

Hi Frank,

Thanks for the feedback! Comments inline below.

From: sacm [mailto:[e-mail]] On Behalf Of Xialiang (Frank, Network Integration Technology Research Dept)
Sent: Thursday, August 23, 2018 4:03 AM
To: [e-mail]
Cc: [e-mail]
Subject: [sacm] Some comments about draft-ietf-sacm-ecp-02:

Hi authors,
I have reviewed the latest draft, and think it's useful to specify the endpoint posture collection profile with a document in sacm WG.

My personal feeling is that this draft is very comprehensive and general, but does not go into depth in terms of protocol, interface, data model...
So, it's kind of design guidance, framework overview document, aiming to helping to specify more concrete ECP protocols/models. Is my understanding right?

[Danny]: Correct. Our intent is to have this document be a best practices for how to use various data models, protocols, and interfaces for the on-going collection and assessment of endpoint information as well as the ability to expose that information to other tools.

In addition, I have some specific comments on current draft, as follow:

1.      Is it going to be a Standard Track draft? Since I see you mentioned in the abstract it mainly describes the best practices, maybe an Informational draft is more suitable?


[Danny]: I think I forgot to change that in the last draft, but, we would like to see this draft published as a BCP since it discusses the best practices for using IETF and TCG standards for endpoint assessment.



2.      What is the relation of the ECP with the SACM architecture? ECP is one component of the large SACM architecture, or is using the SACM architecture, or part of it?


[Danny]: ECP intends to provide the best practices for part of the architecture. Specifically, around the collector (Posture Collection Engine), repository (Repository), evaluator (Evaluator), and orchestrator (Orchestrator) components. With that said, there are currently no protocols or interfaces defined for the repository, evaluator, and orchestrator components. So, at the moment, ECP only provides best practices for the collection of information from the endpoint information and the communication of that information to the posture manager.


3.      In Figure 1, can the Endpoint support the pub/sub interaction with the Orchestrator?


[Danny]: I don't believe so. I think the thought was that the Endpoint would interact with the Posture Manager (i.e., just collection) and the Orchestrator would be involved on the other side of the diagram.

Jess: It looks like this was discussed further at IETF 101, but, it's not clear to me from the notes what the outcome was (https://datatracker.ietf.org/doc/minutes-101-sacm/). Do you recall what it was? I wasn't at IETF 101.



4.      I think the term NETMOD is not suitable in this document, since NETMOD (WG) is mainly about the various models definition. NETCONF is better for expressing the whole network devices management protocol.

[Danny]: Addressed.


[danny]
B.R.
Frank