Re: [Supa] Fwd: I-D Action: draft-halpern-supa-generic-policy-data-model-01.txt

["Joel M. Halpern" <[e-mail]>]

Yes, that case can be represented.  No, it will not be simpler than a 
hard-coded system that places such an ACL whenever interfaces come up. 
(General tools seem to usually be more complex than specialized ones.)

Rough sketch:

Subclass of event to represent interface up, with sufficient information 
to know what interface it is.

Subclass of Condition testing whether the interface testing whether an 
interface is an edge interface (both solutions assume this is knowable, 
otherwise the problem is not solvable without human intervention.)

Subclass of action representing applying an ACL set, with the ACL 
parameters.

Then a Policy Clause that ties the three together,
and a policy statement that says to apply the clause.

This does not make use of the pwoer of policy statement or policy 
clause.  Those are to enable representation of more complex policies.

Yours,
Joel

On 4/16/16 1:56 PM, Andy Bierman wrote:
> Hi,
>
> I would like to see an example of SUPA in use.
> I thought Juergen has a clear maybe-not-simple use-case with SNMP:
>
>
> Event: example-interface-up notification received
> Task: Extract NE ID and interface ID
>
> Condition: Determine if NE,interface is an edge interface to an
> untrusted network
> Task: examine topology database?  Out of scope?
>
> Action: install an ACL on this NE, interface to deny incoming and outbound
> packets on port 161, 162
> Task: Determine how ACLs done on NE and send proper configuration changes
>
> What parts will SUPA provide and how are they done?
> What parts will the domain-specific models provide and how do
> they integrate with this module?  What parts are left
> as implementation details and out of scope for SUPA?
>
> I am far from convinced this approach is simpler than a controller level
> data model.
> E.g.,  a network-wide ACL that blocks SNMP from entering or exiting the
> administrative
> domain can implement this policy, and all the ECA configuration and
> execution details
> are hidden within implementation details.
>
>
>
> Andy
>
>
>
> On Fri, Apr 15, 2016 at 1:32 PM, Joel Halpern <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     We have revised the data model draft to fix the extraction and YANG
>     errors.
>     It has been checked with a YANG 1.1 validator, which says it works.
>
>     The must clauses on the instance-identifiers now indicate the target
>     class (including subclasses) of the association.  As I noted in BA,
>     for associations with properties, the two end-points both point to
>     the association class, which points to both end-points.
>
>     We will be doing the YANG tree, better descriptions, and text about
>     the mapping from IM to DM.
>
>     Please review either the IM or the DM (using the IM descriptions) to
>     see whether this model represents what the WG wants to see.
>
>     Yours,
>     Joel
>
>
>     -------- Forwarded Message --------
>     Subject: I-D Action: draft-halpern-supa-generic-policy-data-model-01.txt
>     Date: Fri, 15 Apr 2016 13:06:32 -0700
>     From: [e-mail] <mailto:[e-mail]>
>     Reply-To: [e-mail] <mailto:[e-mail]>
>     To: [e-mail] <mailto:[e-mail]>
>
>
>     A New Internet-Draft is available from the on-line Internet-Drafts
>     directories.
>
>
>              Title           : Generic Policy Data Model for Simplified
>     Use of Policy Abstractions (SUPA)
>              Authors         : Joel Halpern
>                                John Strassner
>              Filename        :
>     draft-halpern-supa-generic-policy-data-model-01.txt
>              Pages           : 48
>              Date            : 2016-04-15
>
>     Abstract:
>         This document defines two YANG policy data models. The first is a
>         generic policy model that is meant to be extended on an application-
>         specific basis. The second is an exemplary extension of the first
>         generic policy model, and defines rules as event-condition-action
>         policies. Both models are independent of the level of abstraction of
>         the content and meaning of a policy.
>
>
>
>     The IETF datatracker status page for this draft is:
>     https://datatracker.ietf.org/doc/draft-halpern-supa-generic-policy-data-model/
>
>     There's also a htmlized version available at:
>     https://tools.ietf.org/html/draft-halpern-supa-generic-policy-data-model-01
>
>     A diff from the previous version is available at:
>     https://www.ietf.org/rfcdiff?url2=draft-halpern-supa-generic-policy-data-model-01
>
>
>     Please note that it may take a couple of minutes from the time of
>     submission
>     until the htmlized version and diff are available at tools.ietf.org
>     <http://tools.ietf.org>.
>
>     Internet-Drafts are also available by anonymous FTP at:
>     ftp://ftp.ietf.org/internet-drafts/
>
>     _______________________________________________
>     I-D-Announce mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/i-d-announce
>     Internet-Draft directories: http://www.ietf.org/shadow.html
>     or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
>
>     _______________________________________________
>     Supa mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/supa
>
>