Re: [Supa] We need some good examples of what SUPA can do !

Thanks Benoit.  I do not think that (block vs send syslog) is the hard 
part of the case.

I think we can address the proposed case.  In discussing it with John, 
we found that there were actually two different use cases in there.  We 
are putting together enough explanation to send to the WG on the 
approach we think works, building on the SUPA model, to address these 
cases.  We will an email out soon.

Yours,
Joel

On 12/16/16 10:18 AM, Benoit Claise wrote:
> On 11/23/2016 3:33 PM, Joel M. Halpern wrote:
>> To some degree Bert, you are demonstrating the limitations of the
>> directive from the AD that SUPA is to use only ECA policies, not
>> declarative.  Modeling the policy goal would be much easier.
> Ok.
>
> OLD:
>      ensures that SNMP is blocked on ports at the edge
>      of the administrative domain to prevent SNMP going
>      out or coming in from outside the enterprise.
>
> NEW:
>     send a (syslog/whatever) message if SNMP traffic is going out or
> coming in from outside the enterprise
>
> Let's walk before we run.
>
> Regards, B.
>>
>> I do believe that with a few extra definitions, we can create a set of
>> meaningful events to trigger.  Mostly the insertion of ports at the
>> edge of the domain.  And then the actions will be to create the filter
>> rules to block SNMP in both directions.
>>
>> I will be working with John to work out the exact modeling.
>>
>> Yours,
>> Joel
>>
>> On 11/23/16 5:54 AM, Bert Wijnen (IETF) wrote:
>>> On 23/11/2016 10:56, Georgios Karagiannis wrote:
>>>> Hi Bert,
>>>>
>>>> Thanks for your input.
>>>> Please note that I agree with Joel that the input is useful.
>>>> Can you please provide more details on what will be the Event
>>>> Condition Action?
>>> well, is that not my exact question?
>>>
>>> I am asking what ECA policies need to be setup/defined in order to
>>> achieve/effectuate a policy that
>>>
>>>      ensures that SNMP is blocked on ports at the edge
>>>      of the administrative domain to prevent SNMP going
>>>      out or coming in from outside the enterprise.
>>>
>>> Bert
>>>> Best regards,
>>>> Georgios
>>>>
>>>>
>>>> -----Original Message-----
>>>> From: Supa [mailto:supa-bounces@ietf.org] On Behalf Of Joel M. Halpern
>>>> Sent: Friday, November 18, 2016 2:45 AM
>>>> To: Bert Wijnen (IETF); Nevil Brownlee;
>>>> draft-cheng-supa-applicability@ietf.org
>>>> Cc: SUPA list
>>>> Subject: Re: [Supa] We need some good examples of what SUPA can do !
>>>>
>>>> Thank you Bert.  That is exactly the kind of request I am looking for.
>>>>
>>>> No, I do not think it will be simple to answer your question. But I
>>>> do think that showing how to do so will show both what we have and
>>>> what more we need.
>>>>
>>>> Yours,
>>>> Joel
>>>>
>>>> On 11/17/16 8:28 PM, Bert Wijnen (IETF) wrote:
>>>>> Could the proponets of the current (in my view still complex) IM and
>>>>> DM work out how one would define/configure/populate the policies for:
>>>>>
>>>>>       ensure that SNMP is blocked on ports at the edge
>>>>>       of the administrative domain to prevent SNMP going
>>>>>       out or coming in from outside the enterprise.
>>>>>
>>>>> This should be simple, no?
>>>>>
>>>>> Thanks, Bert
>>>>>
>>>>> On 17/11/2016 18:31, Nevil Brownlee wrote:
>>>>>> Hi all:
>>>>>>
>>>>>> Your SUPA chairs met this morning with some of the SUPA I-D authors
>>>>>> to consider "how can we get people working on some simple examples to
>>>>>> demonstrate how SUPA could be used."
>>>>>>
>>>>>> One idea we considered was "we need a few good example uses, with
>>>>>> clear specs written for each - we could start with the examples in
>>>>>> our (draft) Applicability Statement.  That considers five examples -
>>>>>>
>>>>>>    4.1.  Use Case 1: Switched Ethernet services (SES)
>>>>>>    4.2.  Use Case 2: Virtualized Private Clouds (VPC)
>>>>>>    4.3.  Use Case 3: Traffic Manipulation cross DCs
>>>>>>    4.4.  Use Case 4: Virtual SP
>>>>>>    4.5.  Use Case 5: Instant VPN
>>>>>>    4.6.  Use Case 6: traffic optimization and Qos assurance on ISP DC
>>>>>>
>>>>>> It would help SUPA a lot to have input, especially from network
>>>>>> operators, telling us "what do you actually want (SUPA to) do?"
>>>>>>
>>>>>> Do please give this some thought, and send your 'wishes' text to the
>>>>>> SUPA list!
>>>>>>
>>>>>> Cheers, Nevil
>>>>>>
>>>>> _______________________________________________
>>>>> Supa mailing list
>>>>> Supa@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/supa
>>>>>
>>>> _______________________________________________
>>>> Supa mailing list
>>>> Supa@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/supa
>>>>
>>>
>>
>> _______________________________________________
>> Supa mailing list
>> Supa@ietf.org
>> https://www.ietf.org/mailman/listinfo/supa
>> .
>>
>