From nobody Tue Apr 2 20:06:52 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F95212044F; Tue, 2 Apr 2019 20:06:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pXacmwLA8zax; Tue, 2 Apr 2019 20:06:46 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E161B1200A3; Tue, 2 Apr 2019 20:06:46 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 7A603B82421; Tue, 2 Apr 2019 20:06:32 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, opsawg@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20190403030632.7A603B82421@rfc-editor.org> Date: Tue, 2 Apr 2019 20:06:32 -0700 (PDT) Archived-At: Subject: [OPSAWG] =?utf-8?q?RFC_8549_on_Export_of_BGP_Community_Informati?= =?utf-8?q?on_in_IP_Flow_Information_Export_=28IPFIX=29?= X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 03:06:50 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8549 Title: Export of BGP Community Information in IP Flow Information Export (IPFIX) Author: Z. Li, R. Gu, J. Dong Status: Standards Track Stream: IETF Date: April 2019 Mailbox: li_zhenqiang@hotmail.com, gurong_cmcc@outlook.com, jie.dong@huawei.com Pages: 18 Characters: 43692 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsawg-ipfix-bgp-community-12.txt URL: https://www.rfc-editor.org/info/rfc8549 DOI: 10.17487/RFC8549 By introducing new Information Elements (IEs), this document extends the existing BGP-related IEs to enable IP Flow Information Export (IPFIX) to export BGP community information, including the BGP Standard Communities defined in RFC 1997, BGP Extended Communities defined in RFC 4360, and BGP Large Communities defined in RFC 8092. According to the network operator's BGP community planning, network traffic information can then be accumulated and analyzed at the BGP community granularity, which represents the traffic of different kinds of customers, services, or geographical regions. Network traffic information at the BGP community granularity is useful for network traffic analysis and engineering. This document is a product of the Operations and Management Area Working Group Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Mon Apr 8 07:31:19 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E65F120041 for ; Mon, 8 Apr 2019 07:31:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 68S_iBM5Wj8u for ; Mon, 8 Apr 2019 07:31:16 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7309B120026 for ; Mon, 8 Apr 2019 07:31:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3767; q=dns/txt; s=iport; t=1554733876; x=1555943476; h=to:from:subject:message-id:date:mime-version: content-transfer-encoding; bh=B4443jWV9QhN2+s6nV/Rt9TBR795Y1/mX4Q2XSjzAvc=; b=WZ1o5Er0DJF4sJm/hdpFug7lu57CTOALvfLiw4d3XhcMZuRgPxiRnOSf 2GEvW5fe40dc6sbRuJgEhF0/fzUxEJ4ot9tWOkCr9zd1UG1wlUqDLbwx7 djpBkbPR1akvejYMKGeANEO1r0ZTipXjw3FVC0MzvfaeqUnmFzLnnNDGV s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AKCQA1Wqtc/5FdJa1lHAEBAQQBAQc?= =?us-ascii?q?EAQGBZYFnKmgDTjKENZM7gWiaZhCKUyI4EgEBAwEBCQECAQJtHQuFdA8BOkE?= =?us-ascii?q?CJgJfDQgBAYJTSwGBdZ9AjniBL4okgQsli0cXgUA/gTgMgl+IDIJXA4sOmng?= =?us-ascii?q?JggWKHIdcBhqLWIkEihGBQpQmgWYhgVZNIxWDKJBnIwORHQEB?= X-IronPort-AV: E=Sophos;i="5.60,325,1549929600"; d="scan'208";a="459577599" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 08 Apr 2019 14:31:14 +0000 Received: from [192.168.10.113] (rtp-jclarke-nitro5.cisco.com [10.118.87.86]) by rcdn-core-9.cisco.com (8.15.2/8.15.2) with ESMTP id x38EVD4c019936 for ; Mon, 8 Apr 2019 14:31:14 GMT To: "opsawg@ietf.org" From: Joe Clarke Openpgp: preference=signencrypt Autocrypt: addr=jclarke@cisco.com; prefer-encrypt=mutual; keydata= mQINBFx0f7kBEACpXvK/9vZPCzcdpjMCFxTYDJSbYGPBj4jAct6j26evawhP4nQFuk8a/N0T u/l5KhN8nj0F+4wYLBBm/Vq6OYnXcuu/Qnaa5SeN6A8xp0KGFvY81x2BzPMqoM1XLnBAgcHU BlO+OikGlQSouJYagtw1qhlJpmtjwdcJ91Sun5N0SLd8iJVTU2ndCBdlj4PFuDBae9urft7D lkL3sDeAimsnPp8SJF8L2wdMWBXuht666lla+xYzwQ76+ibEmH+zr9Xy3JWySCcS75pbIikj eV/LF/YdyVPr6YGPXawO+srQGiiaqAcUY4oeWYEuFZuG0zGiCDNl106Sc4GVPOTOragqFMZv 1DoFvdaHvmBz3dbKQJ7L+W/paaBxk9F7uu73g9pPWgdio/Bh63iDlEfOm360qIQI3cbisSPF yR9RLnQTUWsy3aolG3NmxSJ+YPDwunNS9soPvPwZixbL6XUy05sUyu6d4lFKMtfo135VJ8N0 SgxNlBn/MZwFsuj66nLq015rz+bud5kz1EIK428q9+Kn4t92uq61oa/9un42qm9Xp/mm4j0J LUdNXXp987F1lZdZltcqkoYlY66OWmUr+YcVB+JAGPCA+C0T7CDjXgxkeyA3/9y7/jtVEDSx UWzCzLhzU/78QqC3NtMyUVRG7feRF0NWRzcc+d4ZEsojicmdEwARAQABtCtKb2UgQ2xhcmtl IChqY2xhcmtlKSAoKSA8amNsYXJrZUBjaXNjby5jb20+iQJOBBMBCAA4FiEE40r9XruLwkD8 nwY9s2u9ges9Y6oFAlx0f7kCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQs2u9ges9 Y6oT1Q//Vjy5ZVYA2Hy6eDz0jrmdkwQZklLU/MXvRgI8WWj6wGs2JKugdKSkkfwvDbD7Rg7b nqkMaZDcLK5eh/492CcwXwvcJKo/9bH1gUPYcDbu5INahiEagkgOS9GOjuHQs4cVr1JNiExf UZ/UcF0R+agP9jfqlJ7eiUN74w1cddZUfhfM0U0cLJ5TJtTjqnqsOCefNiWBLdSn+9RX8c6y cW77N4TVO6Vtv03SvLs5KniLmb6r7qwg6gkU2Vw6TDCk9UdJWSsKHEiOBmq1aGGmZHfBq9iZ GxwCaEqUBdN438JYN8RJMB2qv7EzTsv+KVz2E96jUBzeWdTFqu2xPikg4mwwUmJ1SAqc6AGI JZ8ICNr50xONoPpfdR+1QQzImnua8TuV28pracEDKex8r/ieDZQh8UyVM3mdGL7RSVa4/+EO iKCVmFfHLdnbuwhJLUhsHOlfeYSmRzmHUwS9K1sERMPUJCImMJUOAynQEoeTuLc6dDWq0oTP 6kJ3my7eMcg5MsFsGob8qtUDujiGof7LKZYHOqwYjCzrK4s4vwyX1Yh228sLRiEuNbCpvlD1 U/iKBv/VL5FMbI1kd0FPXvY+ygW+aobZYUOYXOvvdTeq9phCL2aHa5hHG7QNhSF6NsCuZhg6 mnOFOdAF7imXVmLa6cYEYqV17SGgceDKotNea2AxL965Ag0EXHR/uQEQAOIdXbR7GqhQdITX a+tCgi9r8p0o5e2Q2Rq22YIMR6FiyeWFTO2RQpW2NZW4yDfpGZnvBdFTWB62MWxu5Z7FwA09 ZON0l7c4IK7TFJ7Vx9azx1Ebx7r1p5hcARSmvU4CmlJZGPR0m9b+p9rPx27B5vCIWITQbWB/ PPgbksEdxXYYHCVJCWHk6LxL5iZJFVjoQGvHX/3PtzxByHtnVWQ937PZRCHaSAgERr6qVNWd XaO9ZlHm8l2yqMxKk+LUxOtj0FYY/vVdVwFFaGGkhXzhr4f6FJ7+j6Q+aOBbCvO2z/xfw/mh Tlg8W3cQYFwQcaW//FzdTprIRD8AiBRuEH5daLHZAhqj1M1srMv1SRyE7wu/e233ngUZ7UbZ J52bE2RsmA4sUVQVPB57/mn1U9xXW1pyus0n45sQi0GRsFl8fHujeQeAVPWIZl9AL8FiNlLZ +VDvMV0V24vChwRo7OVgohJNkc9NkIb7zYsv8Hqo2OinXWmQmMsluQzU9nSkGdC2eSgOPzVF fzY1KEcifF5O7A5PH2DPNsC1hPer+4vVZbMEQwW5mBIl04IvuCA3S3j+Vvfj3yyPuhf5ExjM 0YtaP5x0S4pqXVKNhzrHX/YtV13c3BP6Zx56MW2t5KnmV0MF97h2vejh/DHPSymz5blUv2Mr 0kknFYhJ+tp/rqP7B8+HABEBAAGJAjYEGAEIACAWIQTjSv1eu4vCQPyfBj2za72B6z1jqgUC XHR/uQIbDAAKCRCza72B6z1jqpFIEACKHqK4wdmimwJU+uq3HJcDBP12vnISDxkrcq19xWCv 01EWp1DR4izRLJXFIke7jlGk1GWfHKkjpUmkXOdujxYZvrVUXD9BwnNDWfDlZaPgpQNoMIlH Pcnq+MovlsuHiLnA29RRxUfRRn49fnpB4MQhB9tzsHGcghApFxB0h/CLs8ZWLTP6EDyDSNem ynEeJ8YjsbyBDqmAHs/+PS14FS7R6jHW8XNonzu5qKVvwkfA5EAI17CLJWTLkFwa3y7vOL6v x6qsoGNPvN4kolAGhz8cm2zqyZ/ts3paYnjZnBWnziYATv3hZzijcLKlLKBJaP7dUlkdNePN yzLkeN+oCVcz1DTGBhfIzlp+Dk3ySFoV2bYyEqiFmttpaDcBbPoB1LKvVZE/C1/f0Z9Tc0Fi VYQ2R60npDISUCanFF0JsN14PGoJdaV90Ouitr8GBzUJpKXFYi93L4M8gHCnSGWmjqAFGNj9 374pUwI8wbBAK5GI1hmjQZLA1UFM/SJ9J86gBzPUPNFR1xTSU+GTEufGHtcQ7wL42X+xz/lv 2pzhluScPl2WWXnwMSiE1a8AaVIhJvsrHuBxNH2l0RHuknWvJOjKtn6wdvPnEURJMH5dQ0jl QFqXPmJVYpL5AvqTYKXtS0Jy1z9oQN6ZUngZoaIYLDogKSQ9DOYd8WvdmOE24auWtA== Organization: Cisco Message-ID: Date: Mon, 8 Apr 2019 10:31:13 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Outbound-SMTP-Client: 10.118.87.86, rtp-jclarke-nitro5.cisco.com X-Outbound-Node: rcdn-core-9.cisco.com Archived-At: Subject: [OPSAWG] Review of draft-song-opsawg-ntf-03 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Apr 2019 14:31:18 -0000 As I promised at the mic at 104, I have a more comprehensive review of this draft. I'll tackle this section-by-section. These are a combination of nits and more substantive comments. === In the abstract, you have a sentence: Network telemetry promises better flexibility, scalability, accuracy, coverage, and performance... This left me wondering, "than what?" That is, I think you’re trying to say that with respect to traditional poll-based network monitoring, telemetry provides these advantages. If you're going to say something is better, it would help to compare that to something else in order to provide better clarity. === Section 1: s/ideal mean/ideal means/ s/telemetry remain/telemetry remains/ === Section 2: The first sentence of your motivation bothers me. I don’t buy it. Yes, some are using machine learning to pull insights out of “big data,” but the way this reads, AI is commonplace in networking. I would say this is still very much in niche areas and research. One key issue with the vast amounts of data that some networks produce is sorting through it to find useful information. Large operators may have the means to do ML, but others struggle to make sense of this data. You use the term "intent-driven autonomous network." I asked around with some operators and other vendors, and this is 100% buzz word. People either don't know what it means or define it using even more buzzwords. I know each vendor has their own meaning for this, but these terms on not widely known. Your document aims to clarify taxonomy. I would clarify this buzzy phrase. In your third paragraph, you say, "the system bottleneck is shifting from data consumption to data supply." I disagree. Telemetry is furthering the data consumption problem. More data doesn't mean more insight. More data means more headache. In addition to getting more data more easily, we _must_ have a way to translate that data into useful, actionable information. This goes to Benoit's talk on telemetry on Thursday at 104. How do we up-level the value of telemetry? === Section 2.1: s/An intents/An intent/ === Section 2.2: The sentence "These convention techniques are not sufficient to support the above use cases for the following reasons:" doesn't make sense. There are some grammatical issues here. Consider rephrasing. Maybe, "These conventional techniques". === Section 2.3: You define IDN as Intent-Driven Network, but I would again say you need to define this in its entirety so the reader is clear. You do define, "an intent" but IDN/IBN is more comprehensive than that. === Section 4.1: s/avaiable/available/ You define different types of telemetry data as "Simple Data" and then "Custom Data". Might I suggest you rename Custom Data to Complex Data as "complex" tends to typically refer to some level of multiple combination or aggregation. === Section 4.2: Can you talk more about what you mean by social data and why environmental is defined to be external? I can have on-board sensors that relay internal environmental data. Why is external data not offered over HTTP? I imagine "social" would be HTTP, but without more definition, I'm not sure. === Section 4.4: Why isn't gRPC listed in the Simple Data query? Under Custom Data Query, there is a “YANG FSM” draft as an individual draft in netmod, but it’s not clear what the future is. There seems to be a general thought that event-driven YANG is useful, but if that will be an FSM per se is yet to be seen. What is PBT? I didn't see it in glossary. === That's it for now. I think this will give you a lot to chew on. Joe From nobody Mon Apr 8 10:23:24 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3178B1200EF for ; Mon, 8 Apr 2019 10:23:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SLuAx7Wdrwkd for ; Mon, 8 Apr 2019 10:23:19 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 860EC120059 for ; Mon, 8 Apr 2019 10:23:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1939; q=dns/txt; s=iport; t=1554744199; x=1555953799; h=to:from:subject:message-id:date:mime-version: content-transfer-encoding; bh=GwyFU5chFid/IzaqwA99I1PitmeQJjvB6SQixI0wUuM=; b=lfms1CFBErubXRq5uOuh1o6EDE8wvqXecVZx+P2/QS+cex3iKPptiTw0 6OihOU4LBARRFrEyt71NvMCFM6iquYQMkK1DZK94tswlYwvkIBB+b5wEo vgVKpO3SURzGP//SoHs8trxO+BU3GVoVWXqTPAc0uRpaGRSgqHofSne3o o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AGCQD6gatc/4UNJK1lHAEBAQQBAQc?= =?us-ascii?q?EAQGBZYIRa04yhDWTPIFommYQilMiOBIBAQMBAQkBAgECbR0LhXQPAXsCJgJ?= =?us-ascii?q?fDQgBAYMegXafNo54gS+KJoELJYtHF4FAP4E4DIJfgVWGN4JXA4o5UoFZmSI?= =?us-ascii?q?JggWReAYaggWJUyaIXotTlCaBZiGBVk0jFYMoghUXjjsjA5EdAQE?= X-IronPort-AV: E=Sophos;i="5.60,326,1549929600"; d="scan'208";a="534148017" Received: from alln-core-11.cisco.com ([173.36.13.133]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 08 Apr 2019 17:23:18 +0000 Received: from [192.168.10.113] (rtp-jclarke-nitro5.cisco.com [10.118.87.86]) by alln-core-11.cisco.com (8.15.2/8.15.2) with ESMTP id x38HNHOj009303 for ; Mon, 8 Apr 2019 17:23:18 GMT To: "opsawg@ietf.org" From: Joe Clarke Openpgp: preference=signencrypt Autocrypt: addr=jclarke@cisco.com; prefer-encrypt=mutual; keydata= mQINBFx0f7kBEACpXvK/9vZPCzcdpjMCFxTYDJSbYGPBj4jAct6j26evawhP4nQFuk8a/N0T u/l5KhN8nj0F+4wYLBBm/Vq6OYnXcuu/Qnaa5SeN6A8xp0KGFvY81x2BzPMqoM1XLnBAgcHU BlO+OikGlQSouJYagtw1qhlJpmtjwdcJ91Sun5N0SLd8iJVTU2ndCBdlj4PFuDBae9urft7D lkL3sDeAimsnPp8SJF8L2wdMWBXuht666lla+xYzwQ76+ibEmH+zr9Xy3JWySCcS75pbIikj eV/LF/YdyVPr6YGPXawO+srQGiiaqAcUY4oeWYEuFZuG0zGiCDNl106Sc4GVPOTOragqFMZv 1DoFvdaHvmBz3dbKQJ7L+W/paaBxk9F7uu73g9pPWgdio/Bh63iDlEfOm360qIQI3cbisSPF yR9RLnQTUWsy3aolG3NmxSJ+YPDwunNS9soPvPwZixbL6XUy05sUyu6d4lFKMtfo135VJ8N0 SgxNlBn/MZwFsuj66nLq015rz+bud5kz1EIK428q9+Kn4t92uq61oa/9un42qm9Xp/mm4j0J LUdNXXp987F1lZdZltcqkoYlY66OWmUr+YcVB+JAGPCA+C0T7CDjXgxkeyA3/9y7/jtVEDSx UWzCzLhzU/78QqC3NtMyUVRG7feRF0NWRzcc+d4ZEsojicmdEwARAQABtCtKb2UgQ2xhcmtl IChqY2xhcmtlKSAoKSA8amNsYXJrZUBjaXNjby5jb20+iQJOBBMBCAA4FiEE40r9XruLwkD8 nwY9s2u9ges9Y6oFAlx0f7kCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQs2u9ges9 Y6oT1Q//Vjy5ZVYA2Hy6eDz0jrmdkwQZklLU/MXvRgI8WWj6wGs2JKugdKSkkfwvDbD7Rg7b nqkMaZDcLK5eh/492CcwXwvcJKo/9bH1gUPYcDbu5INahiEagkgOS9GOjuHQs4cVr1JNiExf UZ/UcF0R+agP9jfqlJ7eiUN74w1cddZUfhfM0U0cLJ5TJtTjqnqsOCefNiWBLdSn+9RX8c6y cW77N4TVO6Vtv03SvLs5KniLmb6r7qwg6gkU2Vw6TDCk9UdJWSsKHEiOBmq1aGGmZHfBq9iZ GxwCaEqUBdN438JYN8RJMB2qv7EzTsv+KVz2E96jUBzeWdTFqu2xPikg4mwwUmJ1SAqc6AGI JZ8ICNr50xONoPpfdR+1QQzImnua8TuV28pracEDKex8r/ieDZQh8UyVM3mdGL7RSVa4/+EO iKCVmFfHLdnbuwhJLUhsHOlfeYSmRzmHUwS9K1sERMPUJCImMJUOAynQEoeTuLc6dDWq0oTP 6kJ3my7eMcg5MsFsGob8qtUDujiGof7LKZYHOqwYjCzrK4s4vwyX1Yh228sLRiEuNbCpvlD1 U/iKBv/VL5FMbI1kd0FPXvY+ygW+aobZYUOYXOvvdTeq9phCL2aHa5hHG7QNhSF6NsCuZhg6 mnOFOdAF7imXVmLa6cYEYqV17SGgceDKotNea2AxL965Ag0EXHR/uQEQAOIdXbR7GqhQdITX a+tCgi9r8p0o5e2Q2Rq22YIMR6FiyeWFTO2RQpW2NZW4yDfpGZnvBdFTWB62MWxu5Z7FwA09 ZON0l7c4IK7TFJ7Vx9azx1Ebx7r1p5hcARSmvU4CmlJZGPR0m9b+p9rPx27B5vCIWITQbWB/ PPgbksEdxXYYHCVJCWHk6LxL5iZJFVjoQGvHX/3PtzxByHtnVWQ937PZRCHaSAgERr6qVNWd XaO9ZlHm8l2yqMxKk+LUxOtj0FYY/vVdVwFFaGGkhXzhr4f6FJ7+j6Q+aOBbCvO2z/xfw/mh Tlg8W3cQYFwQcaW//FzdTprIRD8AiBRuEH5daLHZAhqj1M1srMv1SRyE7wu/e233ngUZ7UbZ J52bE2RsmA4sUVQVPB57/mn1U9xXW1pyus0n45sQi0GRsFl8fHujeQeAVPWIZl9AL8FiNlLZ +VDvMV0V24vChwRo7OVgohJNkc9NkIb7zYsv8Hqo2OinXWmQmMsluQzU9nSkGdC2eSgOPzVF fzY1KEcifF5O7A5PH2DPNsC1hPer+4vVZbMEQwW5mBIl04IvuCA3S3j+Vvfj3yyPuhf5ExjM 0YtaP5x0S4pqXVKNhzrHX/YtV13c3BP6Zx56MW2t5KnmV0MF97h2vejh/DHPSymz5blUv2Mr 0kknFYhJ+tp/rqP7B8+HABEBAAGJAjYEGAEIACAWIQTjSv1eu4vCQPyfBj2za72B6z1jqgUC XHR/uQIbDAAKCRCza72B6z1jqpFIEACKHqK4wdmimwJU+uq3HJcDBP12vnISDxkrcq19xWCv 01EWp1DR4izRLJXFIke7jlGk1GWfHKkjpUmkXOdujxYZvrVUXD9BwnNDWfDlZaPgpQNoMIlH Pcnq+MovlsuHiLnA29RRxUfRRn49fnpB4MQhB9tzsHGcghApFxB0h/CLs8ZWLTP6EDyDSNem ynEeJ8YjsbyBDqmAHs/+PS14FS7R6jHW8XNonzu5qKVvwkfA5EAI17CLJWTLkFwa3y7vOL6v x6qsoGNPvN4kolAGhz8cm2zqyZ/ts3paYnjZnBWnziYATv3hZzijcLKlLKBJaP7dUlkdNePN yzLkeN+oCVcz1DTGBhfIzlp+Dk3ySFoV2bYyEqiFmttpaDcBbPoB1LKvVZE/C1/f0Z9Tc0Fi VYQ2R60npDISUCanFF0JsN14PGoJdaV90Ouitr8GBzUJpKXFYi93L4M8gHCnSGWmjqAFGNj9 374pUwI8wbBAK5GI1hmjQZLA1UFM/SJ9J86gBzPUPNFR1xTSU+GTEufGHtcQ7wL42X+xz/lv 2pzhluScPl2WWXnwMSiE1a8AaVIhJvsrHuBxNH2l0RHuknWvJOjKtn6wdvPnEURJMH5dQ0jl QFqXPmJVYpL5AvqTYKXtS0Jy1z9oQN6ZUngZoaIYLDogKSQ9DOYd8WvdmOE24auWtA== Organization: Cisco Message-ID: Date: Mon, 8 Apr 2019 13:23:16 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Outbound-SMTP-Client: 10.118.87.86, rtp-jclarke-nitro5.cisco.com X-Outbound-Node: alln-core-11.cisco.com Archived-At: Subject: [OPSAWG] Review of draft-wu-model-driven-management-virtualization-03 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Apr 2019 17:23:22 -0000 As promised at the mic during opsawg at 104, here is a more detailed review of this draft. Overall, I found it a bit difficult to read. It could stand from an editorial pass to clarify grammar and sentence structure. This document wants to say a lot, and it would benefit from more clarity to convey its points. As to the destiny of this document, I'm a bit unclear. It does a lot to spell out some of the existing YANG modules developed within the IETF and how they might fit together; but that number will definitely change over time. If the intent is, like with the YANG Catalog documents, to continually evolve this as a set of guidelines, that may make sense. I'm also reminded of Benoit's presentation on telemetry on Thursday during 104 where he called for a combination of tools, the models themselves, and the collaboration with other SDOs. This document really needs that cross-SDO element as not everything can be solved with the IETF. Said another way, even if operators were clamoring for vendors to implement IETF modules, do the modules they need exist today? Are they fully ratified? We would love operators to push IETF modules more, but I'm not convinced they will if they don't see the value or functionality in them. This document could help illustrate that (if it continues to evolve to subsume other use cases), but I would love to understand the _gaps_ from operators, and then where other SDOs may help. On a more tactical level, you mention YANG Catalog in Section 2.4. YANG Catalog doesn’t manage modules per se. It manages the metadata around modules. It helps different types of users find the modules they need, understand where modules are supported, and view module characteristics such as lifecycle, structure, changes, etc. You describe some of those elements below, but I want to avoid the concept the YC.o “manages” the modules themselves. Joe From nobody Mon Apr 8 12:26:36 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18E71120422 for ; Mon, 8 Apr 2019 12:26:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z2m9sq0xnlJr for ; Mon, 8 Apr 2019 12:26:25 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DAC5120436 for ; Mon, 8 Apr 2019 12:26:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1638; q=dns/txt; s=iport; t=1554751583; x=1555961183; h=to:from:subject:message-id:date:mime-version: content-transfer-encoding; bh=IM3+d9683f5kRw2TLqE6LeF0iTYoWiOfN/SEVWyLfs0=; b=cUNImy4ohjtgcCWJ/8M5EIcikySxwve+Xkzz7//7pDtqRVYhvi5rFX15 ILsuUo9YhW8ugkw3Hl4ZH3WnTMCNHMS/taDiFserMStXDLQzZlYeTkQ1U wIPbezldFtWqAdJJX5q93l3cu2omTI5dosZKXu+rGhyqTeIMHZGlIMTvy 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B0AgCZn6tc/4gNJK1lHAEBAQQBAQc?= =?us-ascii?q?EAQGBVAQBAQsBghBrTjKENZM8nE4QilMiNwYNAQEDAQEJAQIBAm0dC4V0DwF?= =?us-ascii?q?7AiYCXw0IAQGDHoF2nz2OeIEviiqBCyUBi0YXgUA/gTiCa4RsgyCCVwOmBgm?= =?us-ascii?q?CBZF4BhqLWIkEi1OUJoFlIoFWTSMVO4JtkGcjA5EdAQE?= X-IronPort-AV: E=Sophos;i="5.60,326,1549929600"; d="scan'208";a="545269093" Received: from alln-core-3.cisco.com ([173.36.13.136]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 08 Apr 2019 19:26:22 +0000 Received: from [192.168.10.113] (rtp-jclarke-nitro5.cisco.com [10.118.87.86]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTP id x38JQKqT026796 for ; Mon, 8 Apr 2019 19:26:21 GMT To: "opsawg@ietf.org" From: Joe Clarke Openpgp: preference=signencrypt Autocrypt: addr=jclarke@cisco.com; prefer-encrypt=mutual; keydata= mQINBFx0f7kBEACpXvK/9vZPCzcdpjMCFxTYDJSbYGPBj4jAct6j26evawhP4nQFuk8a/N0T u/l5KhN8nj0F+4wYLBBm/Vq6OYnXcuu/Qnaa5SeN6A8xp0KGFvY81x2BzPMqoM1XLnBAgcHU BlO+OikGlQSouJYagtw1qhlJpmtjwdcJ91Sun5N0SLd8iJVTU2ndCBdlj4PFuDBae9urft7D lkL3sDeAimsnPp8SJF8L2wdMWBXuht666lla+xYzwQ76+ibEmH+zr9Xy3JWySCcS75pbIikj eV/LF/YdyVPr6YGPXawO+srQGiiaqAcUY4oeWYEuFZuG0zGiCDNl106Sc4GVPOTOragqFMZv 1DoFvdaHvmBz3dbKQJ7L+W/paaBxk9F7uu73g9pPWgdio/Bh63iDlEfOm360qIQI3cbisSPF yR9RLnQTUWsy3aolG3NmxSJ+YPDwunNS9soPvPwZixbL6XUy05sUyu6d4lFKMtfo135VJ8N0 SgxNlBn/MZwFsuj66nLq015rz+bud5kz1EIK428q9+Kn4t92uq61oa/9un42qm9Xp/mm4j0J LUdNXXp987F1lZdZltcqkoYlY66OWmUr+YcVB+JAGPCA+C0T7CDjXgxkeyA3/9y7/jtVEDSx UWzCzLhzU/78QqC3NtMyUVRG7feRF0NWRzcc+d4ZEsojicmdEwARAQABtCtKb2UgQ2xhcmtl IChqY2xhcmtlKSAoKSA8amNsYXJrZUBjaXNjby5jb20+iQJOBBMBCAA4FiEE40r9XruLwkD8 nwY9s2u9ges9Y6oFAlx0f7kCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQs2u9ges9 Y6oT1Q//Vjy5ZVYA2Hy6eDz0jrmdkwQZklLU/MXvRgI8WWj6wGs2JKugdKSkkfwvDbD7Rg7b nqkMaZDcLK5eh/492CcwXwvcJKo/9bH1gUPYcDbu5INahiEagkgOS9GOjuHQs4cVr1JNiExf UZ/UcF0R+agP9jfqlJ7eiUN74w1cddZUfhfM0U0cLJ5TJtTjqnqsOCefNiWBLdSn+9RX8c6y cW77N4TVO6Vtv03SvLs5KniLmb6r7qwg6gkU2Vw6TDCk9UdJWSsKHEiOBmq1aGGmZHfBq9iZ GxwCaEqUBdN438JYN8RJMB2qv7EzTsv+KVz2E96jUBzeWdTFqu2xPikg4mwwUmJ1SAqc6AGI JZ8ICNr50xONoPpfdR+1QQzImnua8TuV28pracEDKex8r/ieDZQh8UyVM3mdGL7RSVa4/+EO iKCVmFfHLdnbuwhJLUhsHOlfeYSmRzmHUwS9K1sERMPUJCImMJUOAynQEoeTuLc6dDWq0oTP 6kJ3my7eMcg5MsFsGob8qtUDujiGof7LKZYHOqwYjCzrK4s4vwyX1Yh228sLRiEuNbCpvlD1 U/iKBv/VL5FMbI1kd0FPXvY+ygW+aobZYUOYXOvvdTeq9phCL2aHa5hHG7QNhSF6NsCuZhg6 mnOFOdAF7imXVmLa6cYEYqV17SGgceDKotNea2AxL965Ag0EXHR/uQEQAOIdXbR7GqhQdITX a+tCgi9r8p0o5e2Q2Rq22YIMR6FiyeWFTO2RQpW2NZW4yDfpGZnvBdFTWB62MWxu5Z7FwA09 ZON0l7c4IK7TFJ7Vx9azx1Ebx7r1p5hcARSmvU4CmlJZGPR0m9b+p9rPx27B5vCIWITQbWB/ PPgbksEdxXYYHCVJCWHk6LxL5iZJFVjoQGvHX/3PtzxByHtnVWQ937PZRCHaSAgERr6qVNWd XaO9ZlHm8l2yqMxKk+LUxOtj0FYY/vVdVwFFaGGkhXzhr4f6FJ7+j6Q+aOBbCvO2z/xfw/mh Tlg8W3cQYFwQcaW//FzdTprIRD8AiBRuEH5daLHZAhqj1M1srMv1SRyE7wu/e233ngUZ7UbZ J52bE2RsmA4sUVQVPB57/mn1U9xXW1pyus0n45sQi0GRsFl8fHujeQeAVPWIZl9AL8FiNlLZ +VDvMV0V24vChwRo7OVgohJNkc9NkIb7zYsv8Hqo2OinXWmQmMsluQzU9nSkGdC2eSgOPzVF fzY1KEcifF5O7A5PH2DPNsC1hPer+4vVZbMEQwW5mBIl04IvuCA3S3j+Vvfj3yyPuhf5ExjM 0YtaP5x0S4pqXVKNhzrHX/YtV13c3BP6Zx56MW2t5KnmV0MF97h2vejh/DHPSymz5blUv2Mr 0kknFYhJ+tp/rqP7B8+HABEBAAGJAjYEGAEIACAWIQTjSv1eu4vCQPyfBj2za72B6z1jqgUC XHR/uQIbDAAKCRCza72B6z1jqpFIEACKHqK4wdmimwJU+uq3HJcDBP12vnISDxkrcq19xWCv 01EWp1DR4izRLJXFIke7jlGk1GWfHKkjpUmkXOdujxYZvrVUXD9BwnNDWfDlZaPgpQNoMIlH Pcnq+MovlsuHiLnA29RRxUfRRn49fnpB4MQhB9tzsHGcghApFxB0h/CLs8ZWLTP6EDyDSNem ynEeJ8YjsbyBDqmAHs/+PS14FS7R6jHW8XNonzu5qKVvwkfA5EAI17CLJWTLkFwa3y7vOL6v x6qsoGNPvN4kolAGhz8cm2zqyZ/ts3paYnjZnBWnziYATv3hZzijcLKlLKBJaP7dUlkdNePN yzLkeN+oCVcz1DTGBhfIzlp+Dk3ySFoV2bYyEqiFmttpaDcBbPoB1LKvVZE/C1/f0Z9Tc0Fi VYQ2R60npDISUCanFF0JsN14PGoJdaV90Ouitr8GBzUJpKXFYi93L4M8gHCnSGWmjqAFGNj9 374pUwI8wbBAK5GI1hmjQZLA1UFM/SJ9J86gBzPUPNFR1xTSU+GTEufGHtcQ7wL42X+xz/lv 2pzhluScPl2WWXnwMSiE1a8AaVIhJvsrHuBxNH2l0RHuknWvJOjKtn6wdvPnEURJMH5dQ0jl QFqXPmJVYpL5AvqTYKXtS0Jy1z9oQN6ZUngZoaIYLDogKSQ9DOYd8WvdmOE24auWtA== Organization: Cisco Message-ID: <9513957f-9dc1-ddca-bdd4-27ad075b9997@cisco.com> Date: Mon, 8 Apr 2019 15:26:20 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Outbound-SMTP-Client: 10.118.87.86, rtp-jclarke-nitro5.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: [OPSAWG] Review of draft-zheng-opsawg-tacacs-yang-01 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Apr 2019 19:26:27 -0000 As promised at the mic during opsawg at IETF 104, here is my more detailed review of this draft. As I stated during the meeting, I think the AAA module should be taken out of this document. I believe Alan has commented the same. A AAA module may be required, but I don't want to muddle the TACACS+ work with that. Plus, I'm not convinced opsawg would be the correct place for a more general AAA module. Secondly, I like the fact that you're extending the ietf-system module in a manner similar to RADIUS. I think that this work fits nicely there for device admin. I would remove the AAA moniker from the module for now. Leave it as ietf-tacacs-plus. I recall seeing a comment on-list that any reference to "tacacs" must be "tacacs+" or "tacacs_plus" or similar. TACACS without the plus is a very different beast. Let's not confuse what we're trying to do here. Maybe I'm being overly pedantic here, but why is "options" separated from other rw objects by the statistics branch? I would think you'd want to group the rw objects together. The word "accounting" is misspelled throughout this document. In general, I would run a spell checker over it. After listening to Heather at the keynote, we should do our best to help out RFC Editor, even early on in the document lifecycle. What is the intent of network-instance? Is this like specifying a VRF on which to reach the T+ server? The description was not very clear. You have a source IP option, but I know some vendors also implement a source-interface. I think it would be useful to have that as well (maybe a choice there). Joe From nobody Tue Apr 9 01:28:26 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10B52120116 for ; Tue, 9 Apr 2019 01:28:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UXSwfrvB5px8 for ; Tue, 9 Apr 2019 01:28:21 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA4281200D8 for ; Tue, 9 Apr 2019 01:28:21 -0700 (PDT) Received: from lhreml702-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id CE258AB0C7B52B6B1282 for ; Tue, 9 Apr 2019 09:28:19 +0100 (IST) Received: from lhreml708-chm.china.huawei.com (10.201.108.57) by lhreml702-cah.china.huawei.com (10.201.108.43) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 9 Apr 2019 09:28:19 +0100 Received: from lhreml708-chm.china.huawei.com (10.201.108.57) by lhreml708-chm.china.huawei.com (10.201.108.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 9 Apr 2019 09:28:19 +0100 Received: from DGGEMI401-HUB.china.huawei.com (10.3.17.134) by lhreml708-chm.china.huawei.com (10.201.108.57) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256) id 15.1.1713.5 via Frontend Transport; Tue, 9 Apr 2019 09:28:18 +0100 Received: from DGGEMI526-MBX.china.huawei.com ([169.254.8.204]) by dggemi401-hub.china.huawei.com ([10.3.17.134]) with mapi id 14.03.0415.000; Tue, 9 Apr 2019 16:28:15 +0800 From: "Wubo (lana)" To: Joe Clarke , "opsawg@ietf.org" Thread-Topic: [OPSAWG] Review of draft-zheng-opsawg-tacacs-yang-01 Thread-Index: AdTugc7EL8UqRARgRU+9EAWScX5sbQ== Date: Tue, 9 Apr 2019 08:28:15 +0000 Message-ID: <520ECC8D9CA1724BA1CE492DF898F6A34923F4@DGGEMI526-MBX.china.huawei.com> Accept-Language: en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.134.189.23] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [OPSAWG] Review of draft-zheng-opsawg-tacacs-yang-01 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Apr 2019 08:28:24 -0000 SGkgSm9lLA0KDQpNYW55IHRoYW5rcyBmb3IgeW91ciB2YWx1YWJsZSBjb21tZW50cyBhbmQgc3Vn Z2VzdGlvbnMuDQpQbGVhc2Ugc2VlIG15IGluLWxpbmUgcmVwbHkgYmVsb3cuDQoNClRoYW5rcywN CkJvDQoNCi0tLS0t08q8/tStvP4tLS0tLQ0Kt6K8/sjLOiBPUFNBV0cgW21haWx0bzpvcHNhd2ct Ym91bmNlc0BpZXRmLm9yZ10gtPqx7SBKb2UgQ2xhcmtlDQq3osvNyrG85DogMjAxOcTqNNTCOcjV IDM6MjYNCsrVvP7Iyzogb3BzYXdnQGlldGYub3JnDQrW98ziOiBbT1BTQVdHXSBSZXZpZXcgb2Yg ZHJhZnQtemhlbmctb3BzYXdnLXRhY2Fjcy15YW5nLTAxDQoNCkFzIHByb21pc2VkIGF0IHRoZSBt aWMgZHVyaW5nIG9wc2F3ZyBhdCBJRVRGIDEwNCwgaGVyZSBpcyBteSBtb3JlIGRldGFpbGVkIHJl dmlldyBvZiB0aGlzIGRyYWZ0Lg0KDQpBcyBJIHN0YXRlZCBkdXJpbmcgdGhlIG1lZXRpbmcsIEkg dGhpbmsgdGhlIEFBQSBtb2R1bGUgc2hvdWxkIGJlIHRha2VuIG91dCBvZiB0aGlzIGRvY3VtZW50 LiAgSSBiZWxpZXZlIEFsYW4gaGFzIGNvbW1lbnRlZCB0aGUgc2FtZS4gIEEgQUFBIG1vZHVsZSBt YXkgYmUgcmVxdWlyZWQsIGJ1dCBJIGRvbid0IHdhbnQgdG8gbXVkZGxlIHRoZSBUQUNBQ1MrIHdv cmsgd2l0aCB0aGF0LiAgUGx1cywgSSdtIG5vdCBjb252aW5jZWQgb3BzYXdnIHdvdWxkIGJlIHRo ZSBjb3JyZWN0IHBsYWNlIGZvciBhIG1vcmUgZ2VuZXJhbCBBQUEgbW9kdWxlLg0KW0JvXSBUaGFu a3MsIHdlIHdpbGwgdGFrZSBvdXQgdGhlIEFBQSBtb2R1bGUgYW5kIGZvY3VzIHRoZSBkcmFmdCBv biBUQUNBQ1MrIFlBTkcgbW9kZWwuDQoNClNlY29uZGx5LCBJIGxpa2UgdGhlIGZhY3QgdGhhdCB5 b3UncmUgZXh0ZW5kaW5nIHRoZSBpZXRmLXN5c3RlbSBtb2R1bGUgaW4gYSBtYW5uZXIgc2ltaWxh ciB0byBSQURJVVMuICBJIHRoaW5rIHRoYXQgdGhpcyB3b3JrIGZpdHMgbmljZWx5IHRoZXJlIGZv ciBkZXZpY2UgYWRtaW4uICBJIHdvdWxkIHJlbW92ZSB0aGUgQUFBIG1vbmlrZXIgZnJvbSB0aGUg bW9kdWxlIGZvciBub3cuICBMZWF2ZSBpdCBhcyBpZXRmLXRhY2Fjcy1wbHVzLg0KDQpJIHJlY2Fs bCBzZWVpbmcgYSBjb21tZW50IG9uLWxpc3QgdGhhdCBhbnkgcmVmZXJlbmNlIHRvICJ0YWNhY3Mi IG11c3QgYmUgInRhY2FjcysiIG9yICJ0YWNhY3NfcGx1cyIgb3Igc2ltaWxhci4gIFRBQ0FDUyB3 aXRob3V0IHRoZSBwbHVzIGlzIGEgdmVyeSBkaWZmZXJlbnQgYmVhc3QuICBMZXQncyBub3QgY29u ZnVzZSB3aGF0IHdlJ3JlIHRyeWluZyB0byBkbyBoZXJlLg0KW0JvXSBUaGFuayB5b3UgZm9yIHRo ZSBzdWdnZXN0aW9uLCB0aGUgbW9kdWxlIG5hbWUgd2lsbCBiZSBjaGFuZ2VkIHRvIGlldGYtdGFj YWNzLXBsdXMgdG8gYXZvaWQgbWlzdW5kZXJzdGFuZGluZyBhcyB0aGUgbmV0d29yayBhY2Nlc3Mg QUFBIG9yIFRBQ0FDUy4NCg0KTWF5YmUgSSdtIGJlaW5nIG92ZXJseSBwZWRhbnRpYyBoZXJlLCBi dXQgd2h5IGlzICJvcHRpb25zIiBzZXBhcmF0ZWQgZnJvbSBvdGhlciBydyBvYmplY3RzIGJ5IHRo ZSBzdGF0aXN0aWNzIGJyYW5jaD8gIEkgd291bGQgdGhpbmsgeW91J2Qgd2FudCB0byBncm91cCB0 aGUgcncgb2JqZWN0cyB0b2dldGhlci4NCltCb10gQWdyZWUsIHRoZSAib3B0aW9ucyIgY29udGFp bmVyIHdpbGwgYmUgbW92ZWQgdG8gdGhlIGZyb250IG9mIHRoZSB0YWNhY3MtcGx1cyBjb250YWlu ZXIgdG8gbWFrZSB0aGUgY29uZmlndXJhdGlvbiBwYXJhbWV0ZXJzIHRvZ2V0aGVyLg0KDQpUaGUg d29yZCAiYWNjb3VudGluZyIgaXMgbWlzc3BlbGxlZCB0aHJvdWdob3V0IHRoaXMgZG9jdW1lbnQu ICBJbiBnZW5lcmFsLCBJIHdvdWxkIHJ1biBhIHNwZWxsIGNoZWNrZXIgb3ZlciBpdC4gIEFmdGVy IGxpc3RlbmluZyB0byBIZWF0aGVyIGF0IHRoZSBrZXlub3RlLCB3ZSBzaG91bGQgZG8gb3VyIGJl c3QgdG8gaGVscCBvdXQgUkZDIEVkaXRvciwgZXZlbiBlYXJseSBvbiBpbiB0aGUgZG9jdW1lbnQg bGlmZWN5Y2xlLg0KW0JvXSBTdXJlLCBzcGVsbCBjaGVja2luZyB3aWxsIGJlIGRvbmUgYW5kIGNv cnJlY3RlZC4NCg0KV2hhdCBpcyB0aGUgaW50ZW50IG9mIG5ldHdvcmstaW5zdGFuY2U/ICBJcyB0 aGlzIGxpa2Ugc3BlY2lmeWluZyBhIFZSRiBvbiB3aGljaCB0byByZWFjaCB0aGUgVCsgc2VydmVy PyAgVGhlIGRlc2NyaXB0aW9uIHdhcyBub3QgdmVyeSBjbGVhci4NCltCb10gWWVzLCB0aGlzIGlz IHRoZSBpbnRlbnRpb24uIE1vcmUgdGV4dCB3aWxsIGJlIGFkZGVkLg0KDQpZb3UgaGF2ZSBhIHNv dXJjZSBJUCBvcHRpb24sIGJ1dCBJIGtub3cgc29tZSB2ZW5kb3JzIGFsc28gaW1wbGVtZW50IGEg c291cmNlLWludGVyZmFjZS4gIEkgdGhpbmsgaXQgd291bGQgYmUgdXNlZnVsIHRvIGhhdmUgdGhh dCBhcyB3ZWxsIChtYXliZSBhIGNob2ljZSB0aGVyZSkuDQpbQm9dIE9rLCB3ZSBjYW4gY2hhbmdl ICJzb3VyY2UtaXAiIHRvIGEgY2hvaWNlIHN0YXRlbWVudCB0byBhY2NvbW1vZGF0ZSBib3RoIGlt cGxlbWVudGF0aW9uIG9wdGlvbnMuIFRoYW5rcy4NCg0KSm9lDQoNCg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCk9QU0FXRyBtYWlsaW5nIGxpc3QNCk9Q U0FXR0BpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9vcHNh d2cNCg== From nobody Tue Apr 9 06:27:22 2019 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 548801202E8; Tue, 9 Apr 2019 06:27:14 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.95.0 Auto-Submitted: auto-generated Precedence: bulk Sender: CC: ibagdona@gmail.com, draft-ietf-opsawg-tacacs@ietf.org, jclarke@cisco.com, opsawg-chairs@ietf.org, Joe Clarke , opsawg@ietf.org Content-Transfer-Encoding: 7bit Reply-To: ietf@ietf.org Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Message-ID: <155481643427.7004.8619808358425389592.idtracker@ietfa.amsl.com> Date: Tue, 09 Apr 2019 06:27:14 -0700 Archived-At: Subject: [OPSAWG] Last Call: (The TACACS+ Protocol) to Informational RFC X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Apr 2019 13:27:15 -0000 The IESG has received a request from the Operations and Management Area Working Group WG (opsawg) to consider the following document: - 'The TACACS+ Protocol' as Informational RFC The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2019-04-23. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract TACACS+ provides Device Administration for routers, network access servers and other networked computing devices via one or more centralized servers. This document describes the protocol that is used by TACACS+. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-opsawg-tacacs/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-opsawg-tacacs/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Tue Apr 9 09:09:49 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 442AE120144 for ; Tue, 9 Apr 2019 09:09:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RFOUzGr0du3z for ; Tue, 9 Apr 2019 09:09:44 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA9191200EB for ; Tue, 9 Apr 2019 09:09:44 -0700 (PDT) Received: from lhreml702-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 9B8BBE13B312FA3A9E46 for ; Tue, 9 Apr 2019 17:09:42 +0100 (IST) Received: from SJCEML701-CHM.china.huawei.com (10.208.112.40) by lhreml702-cah.china.huawei.com (10.201.108.43) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 9 Apr 2019 17:09:42 +0100 Received: from SJCEML521-MBS.china.huawei.com ([169.254.2.52]) by SJCEML701-CHM.china.huawei.com ([169.254.3.61]) with mapi id 14.03.0439.000; Tue, 9 Apr 2019 09:09:35 -0700 From: Haoyu song To: Joe Clarke , "opsawg@ietf.org" Thread-Topic: [OPSAWG] Review of draft-song-opsawg-ntf-03 Thread-Index: AQHU7hgGqHGbb5saEkunx/Ok2oZqjqY0AKsg Date: Tue, 9 Apr 2019 16:09:34 +0000 Message-ID: <78A2745BE9B57D4F9D27F86655EB87F9376961CF@sjceml521-mbs.china.huawei.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.200.66.200] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [OPSAWG] Review of draft-song-opsawg-ntf-03 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Apr 2019 16:09:47 -0000 SGkgSm9lLA0KDQpUaGFuayB5b3UgdmVyeSBtdWNoIGZvciB0aGUgcmV2aWV3ISBJJ2xsIHVwZGF0 ZSB0aGUgZHJhZnQgYWNjb3JkaW5nIHRvIHlvdXIgY29tbWVudHMuDQoNCkJlc3QgcmVnYXJkcywN Ckhhb3l1DQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBPUFNBV0cgW21haWx0 bzpvcHNhd2ctYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEpvZSBDbGFya2UNClNlbnQ6 IE1vbmRheSwgQXByaWwgMDgsIDIwMTkgNzozMSBBTQ0KVG86IG9wc2F3Z0BpZXRmLm9yZw0KU3Vi amVjdDogW09QU0FXR10gUmV2aWV3IG9mIGRyYWZ0LXNvbmctb3BzYXdnLW50Zi0wMw0KDQpBcyBJ IHByb21pc2VkIGF0IHRoZSBtaWMgYXQgMTA0LCBJIGhhdmUgYSBtb3JlIGNvbXByZWhlbnNpdmUg cmV2aWV3IG9mIHRoaXMgZHJhZnQuDQoNCkknbGwgdGFja2xlIHRoaXMgc2VjdGlvbi1ieS1zZWN0 aW9uLiAgVGhlc2UgYXJlIGEgY29tYmluYXRpb24gb2Ygbml0cyBhbmQgbW9yZSBzdWJzdGFudGl2 ZSBjb21tZW50cy4NCg0KPT09DQoNCkluIHRoZSBhYnN0cmFjdCwgeW91IGhhdmUgYSBzZW50ZW5j ZToNCg0KTmV0d29yayB0ZWxlbWV0cnkgcHJvbWlzZXMgYmV0dGVyIGZsZXhpYmlsaXR5LCBzY2Fs YWJpbGl0eSwgYWNjdXJhY3ksIGNvdmVyYWdlLCBhbmQgcGVyZm9ybWFuY2UuLi4NCg0KVGhpcyBs ZWZ0IG1lIHdvbmRlcmluZywgInRoYW4gd2hhdD8iICBUaGF0IGlzLCBJIHRoaW5rIHlvdeKAmXJl IHRyeWluZyB0byBzYXkgdGhhdCB3aXRoIHJlc3BlY3QgdG8gdHJhZGl0aW9uYWwgcG9sbC1iYXNl ZCBuZXR3b3JrIG1vbml0b3JpbmcsIHRlbGVtZXRyeSBwcm92aWRlcyB0aGVzZSBhZHZhbnRhZ2Vz LiAgSWYgeW91J3JlIGdvaW5nIHRvIHNheSBzb21ldGhpbmcgaXMgYmV0dGVyLCBpdCB3b3VsZCBo ZWxwIHRvIGNvbXBhcmUgdGhhdCB0byBzb21ldGhpbmcgZWxzZSBpbiBvcmRlciB0byBwcm92aWRl IGJldHRlciBjbGFyaXR5Lg0KDQo9PT0NCg0KU2VjdGlvbiAxOg0KDQpzL2lkZWFsIG1lYW4vaWRl YWwgbWVhbnMvDQoNCnMvdGVsZW1ldHJ5IHJlbWFpbi90ZWxlbWV0cnkgcmVtYWlucy8NCg0KPT09 DQoNClNlY3Rpb24gMjoNCg0KVGhlIGZpcnN0IHNlbnRlbmNlIG9mIHlvdXIgbW90aXZhdGlvbiBi b3RoZXJzIG1lLiAgSSBkb27igJl0IGJ1eSBpdC4gIFllcywgc29tZSBhcmUgdXNpbmcgbWFjaGlu ZSBsZWFybmluZyB0byBwdWxsIGluc2lnaHRzIG91dCBvZiDigJxiaWcgZGF0YSzigJ0gYnV0IHRo ZSB3YXkgdGhpcyByZWFkcywgQUkgaXMgY29tbW9ucGxhY2UgaW4gbmV0d29ya2luZy4gIEkgd291 bGQgc2F5IHRoaXMgaXMgc3RpbGwgdmVyeSBtdWNoIGluIG5pY2hlIGFyZWFzIGFuZCByZXNlYXJj aC4gIE9uZSBrZXkgaXNzdWUgd2l0aCB0aGUgdmFzdCBhbW91bnRzIG9mIGRhdGEgdGhhdCBzb21l IG5ldHdvcmtzIHByb2R1Y2UgaXMgc29ydGluZyB0aHJvdWdoIGl0IHRvIGZpbmQgdXNlZnVsIGlu Zm9ybWF0aW9uLiAgTGFyZ2Ugb3BlcmF0b3JzIG1heSBoYXZlIHRoZSBtZWFucyB0byBkbyBNTCwg YnV0IG90aGVycyBzdHJ1Z2dsZSB0byBtYWtlIHNlbnNlIG9mIHRoaXMgZGF0YS4NCg0KWW91IHVz ZSB0aGUgdGVybSAiaW50ZW50LWRyaXZlbiBhdXRvbm9tb3VzIG5ldHdvcmsuIiAgSSBhc2tlZCBh cm91bmQgd2l0aCBzb21lIG9wZXJhdG9ycyBhbmQgb3RoZXIgdmVuZG9ycywgYW5kIHRoaXMgaXMg MTAwJSBidXp6IHdvcmQuDQpQZW9wbGUgZWl0aGVyIGRvbid0IGtub3cgd2hhdCBpdCBtZWFucyBv ciBkZWZpbmUgaXQgdXNpbmcgZXZlbiBtb3JlIGJ1enp3b3Jkcy4gIEkga25vdyBlYWNoIHZlbmRv ciBoYXMgdGhlaXIgb3duIG1lYW5pbmcgZm9yIHRoaXMsIGJ1dCB0aGVzZSB0ZXJtcyBvbiBub3Qg d2lkZWx5IGtub3duLiAgWW91ciBkb2N1bWVudCBhaW1zIHRvIGNsYXJpZnkgdGF4b25vbXkuICBJ IHdvdWxkIGNsYXJpZnkgdGhpcyBidXp6eSBwaHJhc2UuDQoNCkluIHlvdXIgdGhpcmQgcGFyYWdy YXBoLCB5b3Ugc2F5LCAidGhlIHN5c3RlbSBib3R0bGVuZWNrIGlzIHNoaWZ0aW5nIGZyb20gZGF0 YSBjb25zdW1wdGlvbiB0byBkYXRhIHN1cHBseS4iICBJIGRpc2FncmVlLiAgVGVsZW1ldHJ5IGlz IGZ1cnRoZXJpbmcgdGhlIGRhdGEgY29uc3VtcHRpb24gcHJvYmxlbS4gIE1vcmUgZGF0YSBkb2Vz bid0IG1lYW4gbW9yZSBpbnNpZ2h0LiAgTW9yZSBkYXRhIG1lYW5zIG1vcmUgaGVhZGFjaGUuICBJ biBhZGRpdGlvbiB0byBnZXR0aW5nIG1vcmUgZGF0YSBtb3JlIGVhc2lseSwgd2UgX211c3RfIGhh dmUgYSB3YXkgdG8gdHJhbnNsYXRlIHRoYXQgZGF0YSBpbnRvIHVzZWZ1bCwgYWN0aW9uYWJsZSBp bmZvcm1hdGlvbi4gIFRoaXMgZ29lcyB0byBCZW5vaXQncyB0YWxrIG9uIHRlbGVtZXRyeSBvbiBU aHVyc2RheSBhdCAxMDQuICBIb3cgZG8gd2UgdXAtbGV2ZWwgdGhlIHZhbHVlIG9mIHRlbGVtZXRy eT8NCg0KPT09DQoNClNlY3Rpb24gMi4xOg0KDQpzL0FuIGludGVudHMvQW4gaW50ZW50Lw0KDQo9 PT0NCg0KU2VjdGlvbiAyLjI6DQoNClRoZSBzZW50ZW5jZSAiVGhlc2UgY29udmVudGlvbiB0ZWNo bmlxdWVzIGFyZSBub3Qgc3VmZmljaWVudCB0byBzdXBwb3J0IHRoZSBhYm92ZSB1c2UgY2FzZXMg Zm9yIHRoZSBmb2xsb3dpbmcgcmVhc29uczoiIGRvZXNuJ3QgbWFrZSBzZW5zZS4NClRoZXJlIGFy ZSBzb21lIGdyYW1tYXRpY2FsIGlzc3VlcyBoZXJlLiAgQ29uc2lkZXIgcmVwaHJhc2luZy4gIE1h eWJlLCAiVGhlc2UgY29udmVudGlvbmFsIHRlY2huaXF1ZXMiLg0KDQo9PT0NCg0KU2VjdGlvbiAy LjM6DQoNCllvdSBkZWZpbmUgSUROIGFzIEludGVudC1Ecml2ZW4gTmV0d29yaywgYnV0IEkgd291 bGQgYWdhaW4gc2F5IHlvdSBuZWVkIHRvIGRlZmluZSB0aGlzIGluIGl0cyBlbnRpcmV0eSBzbyB0 aGUgcmVhZGVyIGlzIGNsZWFyLiAgWW91IGRvIGRlZmluZSwgImFuIGludGVudCIgYnV0IElETi9J Qk4gaXMgbW9yZSBjb21wcmVoZW5zaXZlIHRoYW4gdGhhdC4NCg0KPT09DQoNClNlY3Rpb24gNC4x Og0KDQpzL2F2YWlhYmxlL2F2YWlsYWJsZS8NCg0KWW91IGRlZmluZSBkaWZmZXJlbnQgdHlwZXMg b2YgdGVsZW1ldHJ5IGRhdGEgYXMgIlNpbXBsZSBEYXRhIiBhbmQgdGhlbiAiQ3VzdG9tIERhdGEi LiAgTWlnaHQgSSBzdWdnZXN0IHlvdSByZW5hbWUgQ3VzdG9tIERhdGEgdG8gQ29tcGxleCBEYXRh IGFzICJjb21wbGV4IiB0ZW5kcyB0byB0eXBpY2FsbHkgcmVmZXIgdG8gc29tZSBsZXZlbCBvZiBt dWx0aXBsZSBjb21iaW5hdGlvbiBvciBhZ2dyZWdhdGlvbi4NCg0KPT09DQoNClNlY3Rpb24gNC4y Og0KDQpDYW4geW91IHRhbGsgbW9yZSBhYm91dCB3aGF0IHlvdSBtZWFuIGJ5IHNvY2lhbCBkYXRh IGFuZCB3aHkgZW52aXJvbm1lbnRhbCBpcyBkZWZpbmVkIHRvIGJlIGV4dGVybmFsPyAgSSBjYW4g aGF2ZSBvbi1ib2FyZCBzZW5zb3JzIHRoYXQgcmVsYXkgaW50ZXJuYWwgZW52aXJvbm1lbnRhbCBk YXRhLg0KDQpXaHkgaXMgZXh0ZXJuYWwgZGF0YSBub3Qgb2ZmZXJlZCBvdmVyIEhUVFA/ICBJIGlt YWdpbmUgInNvY2lhbCIgd291bGQgYmUgSFRUUCwgYnV0IHdpdGhvdXQgbW9yZSBkZWZpbml0aW9u LCBJJ20gbm90IHN1cmUuDQoNCj09PQ0KDQpTZWN0aW9uIDQuNDoNCg0KV2h5IGlzbid0IGdSUEMg bGlzdGVkIGluIHRoZSBTaW1wbGUgRGF0YSBxdWVyeT8NCg0KVW5kZXIgQ3VzdG9tIERhdGEgUXVl cnksIHRoZXJlIGlzIGEg4oCcWUFORyBGU03igJ0gZHJhZnQgYXMgYW4gaW5kaXZpZHVhbCBkcmFm dCBpbiBuZXRtb2QsIGJ1dCBpdOKAmXMgbm90IGNsZWFyIHdoYXQgdGhlIGZ1dHVyZSBpcy4gIFRo ZXJlIHNlZW1zIHRvIGJlIGEgZ2VuZXJhbCB0aG91Z2h0IHRoYXQgZXZlbnQtZHJpdmVuIFlBTkcg aXMgdXNlZnVsLCBidXQgaWYgdGhhdCB3aWxsIGJlIGFuIEZTTSBwZXIgc2UgaXMgeWV0IHRvIGJl IHNlZW4uDQoNCldoYXQgaXMgUEJUPyAgSSBkaWRuJ3Qgc2VlIGl0IGluIGdsb3NzYXJ5Lg0KDQo9 PT0NCg0KVGhhdCdzIGl0IGZvciBub3cuICBJIHRoaW5rIHRoaXMgd2lsbCBnaXZlIHlvdSBhIGxv dCB0byBjaGV3IG9uLg0KDQpKb2UNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCk9QU0FXRyBtYWlsaW5nIGxpc3QNCk9QU0FXR0BpZXRmLm9yZw0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9vcHNhd2cNCg== From nobody Wed Apr 17 06:52:34 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFDD9120156 for ; Wed, 17 Apr 2019 06:52:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jqUC9plhx6q9 for ; Wed, 17 Apr 2019 06:52:31 -0700 (PDT) Received: from orange.com (mta136.mail.business.static.orange.com [80.12.70.36]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAD74120104 for ; Wed, 17 Apr 2019 06:52:30 -0700 (PDT) Received: from opfednr01.francetelecom.fr (unknown [xx.xx.xx.65]) by opfednr24.francetelecom.fr (ESMTP service) with ESMTP id 44kkFT1XKBz1y7Q for ; Wed, 17 Apr 2019 15:52:29 +0200 (CEST) Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.32]) by opfednr01.francetelecom.fr (ESMTP service) with ESMTP id 44kkFT0rLXzDq7S for ; Wed, 17 Apr 2019 15:52:29 +0200 (CEST) Received: from OPEXCAUBMA2.corporate.adroot.infra.ftgroup ([fe80::e878:bd0:c89e:5b42]) by OPEXCAUBM7C.corporate.adroot.infra.ftgroup ([fe80::2c53:f99a:e2a9:19c6%21]) with mapi id 14.03.0439.000; Wed, 17 Apr 2019 15:52:24 +0200 From: To: "opsawg@ietf.org" CC: JACQUENET Christian TGI/OLN Thread-Topic: draft-boucadair-radext-tcpm-converter Thread-Index: AdT1JMdqfjfTxyrRTM+Z1ryGjVxQ8A== Date: Wed, 17 Apr 2019 13:52:23 +0000 Message-ID: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.245] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [OPSAWG] draft-boucadair-radext-tcpm-converter X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Apr 2019 13:52:33 -0000 Dear all,=20 Stefan (chair of radext wg) kindly suggested to get in touch with opsawg to= check if there is interest in adopting https://datatracker.ietf.org/doc/dr= aft-boucadair-radext-tcpm-converter/. Hence this note.=20 FWIW, the 0-RTT Convert protocol is currently defined within tcpm wg (https= ://datatracker.ietf.org/meeting/104/materials/slides-104-tcpm-0-rtt-tcp-con= vert-protocol-00) and is endorsed by other SDOs (3GPP and BBF) for access a= ggregation purposes.=20 The RADIUS extension is used to achieve the following (excerpt from draft-i= etf-tcpm-converters):=20 o The network provider may enforce a policy based upon Access Control Lists (ACLs), e.g., at a Broadband Network Gateway (BNG) to control the hosts that are authorized to communicate with a Transport Converter. These ACLs may be installed as a result of RADIUS exchanges, e.g. [I-D.boucadair-radext-tcpm-converter]. This method does not require any interaction with the Transport Converter. o A device that embeds a Transport Converter may also host a RADIUS client that will solicit an AAA server to check whether connections received from a given source IP address are authorized or not [I-D.boucadair-radext-tcpm-converter].=20 Thoughts and comments are more than welcome.=20 Cheers, Med > -----Message d'origine----- > De=A0: Stefan Winter [mailto:stefan.winter@restena.lu] > Envoy=E9=A0: mardi 16 avril 2019 10:20 > =C0=A0: BOUCADAIR Mohamed TGI/OLN > Objet=A0: Re: Consider a call for adoption: draft-boucadair-radext-tcpm- > converter >=20 > Hello, >=20 > > Now that the converter spec > > (https://datatracker.ietf.org/doc/draft-ietf-tcpm-converters/) is about > > to be LCed in the tcpm wg, I'm sending this note to ask for considering > > a call for adoption of this spec in radext: > > https://datatracker.ietf.org/doc/draft-boucadair-radext-tcpm-converter/= . > > > > > > > > FWIW, the document integrates comments received in the past I the radex= t > > mailing list. >=20 > radext is shutting down (slowly). We don't take new documents any more. > The agreed plan with the then-ADs was to submit documents to opsarea or > opsawg instead. >=20 > Please get in touch with those groups. >=20 > Greetings, >=20 > Stefan Winter >=20 From nobody Sun Apr 21 17:53:42 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7AC7120141 for ; Sun, 21 Apr 2019 17:53:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Y9zmYkd3fbd for ; Sun, 21 Apr 2019 17:53:38 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43C7B120046 for ; Sun, 21 Apr 2019 17:53:38 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id ED675B82064; Sun, 21 Apr 2019 17:53:16 -0700 (PDT) To: lear@cisco.com, rdroms@gmail.com, dromasca@gmail.com, ibagdona@gmail.com, warren@kumari.net, jclarke@cisco.com, zhoutianran@huawei.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: cheshire@apple.com, opsawg@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20190422005316.ED675B82064@rfc-editor.org> Date: Sun, 21 Apr 2019 17:53:16 -0700 (PDT) Archived-At: Subject: [OPSAWG] [Editorial Errata Reported] RFC8520 (5702) X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Apr 2019 00:53:40 -0000 The following errata report has been submitted for RFC8520, "Manufacturer Usage Description Specification". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5702 -------------------------------------- Type: Editorial Reported by: Stuart Cheshire Section: 16 Original Text ------------- implementors should take into account what other information they are advertising through mechanisms such as Multicast DNS (mDNS) [RFC6872] Corrected Text -------------- implementors should take into account what other information they are advertising through mechanisms such as Multicast DNS (mDNS) [RFC6762] Notes ----- Incorrect reference for Multicast DNS (mDNS). Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8520 (draft-ietf-opsawg-mud-25) -------------------------------------- Title : Manufacturer Usage Description Specification Publication Date : March 2019 Author(s) : E. Lear, R. Droms, D. Romascanu Category : PROPOSED STANDARD Source : Operations and Management Area Working Group Area : Operations and Management Stream : IETF Verifying Party : IESG From nobody Sun Apr 21 20:49:20 2019 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 78C601201EC; Sun, 21 Apr 2019 20:49:11 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Joseph Salowey via Datatracker To: Cc: opsawg@ietf.org, iesg@ietf.org, draft-ietf-opsawg-tacacs.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.95.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Joseph Salowey Message-ID: <155590495142.9736.10585624358883108199@ietfa.amsl.com> Date: Sun, 21 Apr 2019 20:49:11 -0700 Archived-At: Subject: [OPSAWG] Secdir last call review of draft-ietf-opsawg-tacacs-13 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Apr 2019 03:49:12 -0000 Reviewer: Joseph Salowey Review result: Serious Issues As the draft mentions the MD5 based stream cipher used by TACACS+ is completely insecure. I think there is too much discussion in the security considerations that may lead one to think that in some cases it provides sufficient protection. Section 10.1 - There have been plenty of analysis of the problems with the TACACS+ message protection. This section should just simply say the encryption/obfuscation mechanism provides no integrity protection, no privacy protection and no replay protection. An attacker with access to the data stream should be assumed to be able to read and modify all TACACS+ packets. There are just too many flaws to to enumerate in this document and the rest of the information in this section is wrong or incomplete at best. Section 10.2 - Why not MUST NOT for TAC_PLUS_AUTHEN_STATUS_FOLLOW? Is this really still used? Section 10.2, 10.3, 10.4 - You can probably replace most of these sections with "TACACS+ MUST be used with an addition security mechanism to protection of the communication such as IPSEC or a secure network such as described in 10.5. " Section 10.5.1 and 10.5.2 - Why should I care about secrets if they are just providing obfuscation? Are you relying on these secrets for something other than obfuscation? Section 10.5.3 - Use "less weak" instead of stronger when referring to CHAP, MS-CHAP, and MSCHAPv2. Its pretty debatable how much better they are than plaintext passwords. From nobody Sun Apr 21 20:57:06 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8084F1201DB; Sun, 21 Apr 2019 20:56:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i9XkAKevJiiv; Sun, 21 Apr 2019 20:56:55 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FF141200B4; Sun, 21 Apr 2019 20:56:55 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1hIQ4b-0002sn-I2; Mon, 22 Apr 2019 03:56:53 +0000 Date: Sun, 21 Apr 2019 20:56:52 -0700 Message-ID: From: Randy Bush To: Joseph Salowey via Datatracker Cc: , opsawg@ietf.org, iesg@ietf.org, draft-ietf-opsawg-tacacs.all@ietf.org In-Reply-To: <155590495142.9736.10585624358883108199@ietfa.amsl.com> References: <155590495142.9736.10585624358883108199@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-tacacs-13 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Apr 2019 03:56:57 -0000 > "TACACS+ MUST be used with an addition security mechanism to > protection of the communication such as IPSEC or a secure network such > as described in 10.5. " not operationaly viable randy From nobody Mon Apr 22 11:24:44 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB0EE120132; Mon, 22 Apr 2019 11:24:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.701 X-Spam-Level: X-Spam-Status: No, score=-1.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral (1024-bit key) reason="invalid (public key: does not support hash algorithm 'sha256')" header.d=ota.si Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b2KuenUapQTv; Mon, 22 Apr 2019 11:24:26 -0700 (PDT) Received: from mta2.toshio.eu (mta2.toshio.eu [IPv6:2001:470:99f7::b423]) by ietfa.amsl.com (Postfix) with ESMTP id 2F17F120092; Mon, 22 Apr 2019 11:24:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mta2.toshio.eu (Postfix) with ESMTP id A94DC17829; Mon, 22 Apr 2019 18:24:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ota.si; h= message-id:references:content-transfer-encoding:date:date :in-reply-to:from:from:subject:subject:mime-version:content-type :content-type:received; s=toshio; t=1555957439; x=1557771840; bh=m/Mzp39GuiHtPxN4cRJdy1V3oRT1Ihpllg7fkp5DD/I=; b=rpu+j6kgzMDK LdgRrKFAROpsf/AeevznKriWwFqQFe1hk70Irwr+gaXPErNDhVFSuiIvqu4yVPok +4Vl8X6D//3j2qF7kJHVR+Aecg5KhgVXo112vZZSOyJIJCRpxUuKzfr1Ngzp/yRl ieZpfJztuSY4U4US8tdyNg3mRw42EkE= X-Virus-Scanned: amavisd-new at toshio.org Received: from mta2.toshio.eu ([89.143.197.195]) by localhost (srv-fe-3.dom.ota.si [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id pd99ivsENu02; Mon, 22 Apr 2019 18:23:59 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Andrej Ota In-Reply-To: <155590495142.9736.10585624358883108199@ietfa.amsl.com> Date: Mon, 22 Apr 2019 19:24:17 +0100 Cc: secdir@ietf.org, opsawg@ietf.org, iesg@ietf.org, draft-ietf-opsawg-tacacs.all@ietf.org Content-Transfer-Encoding: quoted-printable References: <155590495142.9736.10585624358883108199@ietfa.amsl.com> To: Joseph Salowey Message-Id: <20190422182358.B69FB17821@mta2.toshio.eu> Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-tacacs-13 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Apr 2019 18:24:29 -0000 Hi Joseph, Thank you for taking time to review the document. Answers are in-line. > On 22 Apr 2019, at 04:49, Joseph Salowey via Datatracker = wrote: >=20 > Reviewer: Joseph Salowey > Review result: Serious Issues >=20 > As the draft mentions the MD5 based stream cipher used by TACACS+ is=20= > completely insecure. I think there is too much discussion in the = security > considerations that may lead one to think that in some cases it = provides > sufficient protection. >=20 > Section 10.1 - > There have been plenty of analysis of the problems with the TACACS+ = message > protection. This section should just simply say the = encryption/obfuscation > mechanism provides no integrity protection, no privacy protection and = no replay > protection. An attacker with access to the data stream should be = assumed to be > able to read and modify all TACACS+ packets. There are just too many = flaws to > to enumerate in this document and the rest of the information in this = section > is wrong or incomplete at best. Agreed to replace the section with a simple statement that obfuscation = provides no integrity or replay protection. I'm assuming this refers = just to 10.1 and not the whole of 10. I think we should still press the point that everyone MUST use = obfuscation as even though the privacy is almost non-existent, it's = still slightly better than plain-text and ROT13. >=20 > Section 10.2 - > Why not MUST NOT for TAC_PLUS_AUTHEN_STATUS_FOLLOW? Is this really = still used? I think Douglas is best positioned to answer this question. >=20 > Section 10.2, 10.3, 10.4 - > You can probably replace most of these sections with > "TACACS+ MUST be used with an addition security mechanism to = protection of the > communication such as IPSEC or a secure network such as described in = 10.5. " Agreed. >=20 > Section 10.5.1 and 10.5.2 - > Why should I care about secrets if they are just providing = obfuscation? Are > you relying on these secrets for something other than obfuscation? Shared secrets also serve to "authenticate" a NAS to a server and vice = versa. Which may or may not matter when we state that secure transport MUST be = used. I would like to err on the safe side because mistakes happen and = sometimes unauthorized devices do connect to otherwise secured networks = - intentionally or unintentionally (lab devices and similar come to my = mind). >=20 > Section 10.5.3 - > Use "less weak" instead of stronger when referring to CHAP, MS-CHAP, = and > MSCHAPv2. Its pretty debatable how much better they are than = plaintext > passwords. >=20 I think "less weak" is acceptable. When you wrote that their value is debatable, did that refer to safety = of the authentication session (as in it can be successfully attacked), = to ability of a network attacker (active or passive) to deduce the = user's password, or both? My understanding is that they're still viable for the purpose of = limiting the loss of user's password from MiTM attacks. If I'm wrong = about this, let me know so we can be explicit about it in the document = as well. Andrej.= From nobody Mon Apr 22 14:19:47 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0677C120178 for ; Mon, 22 Apr 2019 14:19:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fO8aibci-lHs for ; Mon, 22 Apr 2019 14:19:30 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF6E01200FC for ; Mon, 22 Apr 2019 14:19:26 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id n81so3440798qke.2 for ; Mon, 22 Apr 2019 14:19:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=b2Si+H/Gt+CxCpKYL13cPo2PHRAIZrpyYkE6+jYorgI=; b=T8SNj8aLIVMTBlxB6pGQOnO2doywJUlUaYfqetWK4aASvWtvbS9R1sf8ySfEgTH951 9pSQq0M5n7needndRQ1pgTqd/tvDnlaDXZpxIn0/3Q0AnRa3ypXBqzD+Oi6LfT2ZE8Wo eV3wHyl4AGVDGKJvaRT+rwVJwEwbfC/fIn/RtsDI1SQH77EPaS94iScCaVmYnMJK0vaV rUsCTpvZ/UBxfblzPU++4x29RZRMjz+GCQ/6Fu/RlRWz2qBSTiDlNnBsk5gWxV3UNp+1 +SA/E1Nh9lsZiKi+I8Hxq/VsW4h0tDJtNNTg3yxL985h7w510xzmOYvKso1SNoOCGPsf IDzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=b2Si+H/Gt+CxCpKYL13cPo2PHRAIZrpyYkE6+jYorgI=; b=QiOgWy748YGkOwuMv0oOOyThUwhBtgiDOr0qEct6rra0Akfvb6pwt07BOBlxlDJdwI UpNPI0AzhUSAtCh0JpnWwEnjZuySoF0tRWxESoyrtax4eQP2X3yGHSr2LvfX2R01YThm ryH4o/IsGbkXUzMVo9iDg592l2Tew+e8luUEX9HkbKTP6lJ1hjS+5YvcEQeGRhIO2wDO /UkbZCgPftSo5SgHr4Wo8RazRWxiN1tikMNPzmYym+UvI2Mb7po2NT0o2EpqV60LIVW5 tYlIB0CRFLNxBe1hikL9LfqL6hpgjV4y5AoWEQGKGnCNTWYXmklRLcwbkAbp8BvD3nAH EfLA== X-Gm-Message-State: APjAAAU1UnX1qmQJe9inuLSPUcpzAs6nVBUSRMk54QixKDM4sPje3sZA r7qacjVutggdsUfpZ7bTd2PZ+ftVrXh8PyIQJZ9ADwk1hPc= X-Google-Smtp-Source: APXvYqz0jXRhX/YuLLpsbZoUtdKNu/iQBOWW3BBQS3F70ec/YRi/zYIyPtPkfAQnqiVN4AIxMoJ0HFuc9ZiTFsm4go0= X-Received: by 2002:a05:620a:16b5:: with SMTP id s21mr15685289qkj.321.1555967965806; Mon, 22 Apr 2019 14:19:25 -0700 (PDT) MIME-Version: 1.0 References: <155590495142.9736.10585624358883108199@ietfa.amsl.com> <20190422182358.B69FB17821@mta2.toshio.eu> In-Reply-To: <20190422182358.B69FB17821@mta2.toshio.eu> From: Joseph Salowey Date: Mon, 22 Apr 2019 14:19:14 -0700 Message-ID: To: Andrej Ota Cc: secdir , opsawg@ietf.org, The IESG , draft-ietf-opsawg-tacacs.all@ietf.org Content-Type: multipart/alternative; boundary="000000000000e255c205872505e5" Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-tacacs-13 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Apr 2019 21:19:33 -0000 --000000000000e255c205872505e5 Content-Type: text/plain; charset="UTF-8" On Mon, Apr 22, 2019 at 11:24 AM Andrej Ota wrote: > Hi Joseph, > > Thank you for taking time to review the document. Answers are in-line. > > > On 22 Apr 2019, at 04:49, Joseph Salowey via Datatracker < > noreply@ietf.org> wrote: > > > > Reviewer: Joseph Salowey > > Review result: Serious Issues > > > > As the draft mentions the MD5 based stream cipher used by TACACS+ is > > completely insecure. I think there is too much discussion in the > security > > considerations that may lead one to think that in some cases it provides > > sufficient protection. > > > > Section 10.1 - > > There have been plenty of analysis of the problems with the TACACS+ > message > > protection. This section should just simply say the > encryption/obfuscation > > mechanism provides no integrity protection, no privacy protection and no > replay > > protection. An attacker with access to the data stream should be > assumed to be > > able to read and modify all TACACS+ packets. There are just too many > flaws to > > to enumerate in this document and the rest of the information in this > section > > is wrong or incomplete at best. > > Agreed to replace the section with a simple statement that obfuscation > provides no integrity or replay protection. I'm assuming this refers just > to 10.1 and not the whole of 10. > > [Joe] I think you could probably replace a large portion of 10.2, 3 and 4 as well. > I think we should still press the point that everyone MUST use obfuscation > as even though the privacy is almost non-existent, it's still slightly > better than plain-text and ROT13. > > [Joe] The current mechanism is roughly equivalent to ROT13 when compared to current encryption mechanisms. I don't think making it a must helps confidentiality, perhaps it helps with authentication below. > > > > Section 10.2 - > > Why not MUST NOT for TAC_PLUS_AUTHEN_STATUS_FOLLOW? Is this really > still used? > > I think Douglas is best positioned to answer this question. > > > > > Section 10.2, 10.3, 10.4 - > > You can probably replace most of these sections with > > "TACACS+ MUST be used with an addition security mechanism to protection > of the > > communication such as IPSEC or a secure network such as described in > 10.5. " > > Agreed. > > > > > Section 10.5.1 and 10.5.2 - > > Why should I care about secrets if they are just providing obfuscation? > Are > > you relying on these secrets for something other than obfuscation? > > Shared secrets also serve to "authenticate" a NAS to a server and vice > versa. > > Which may or may not matter when we state that secure transport MUST be > used. I would like to err on the safe side because mistakes happen and > sometimes unauthorized devices do connect to otherwise secured networks - > intentionally or unintentionally (lab devices and similar come to my mind). > > [Joe] I don't think this section talks about authentication as a goal at all. If this is a goal it should be stated. There will still be some limitations here in that an attacker who can observe the communication will be able to forge and replay messages. I think it could be useful to detect misconfiguration, but there should to be some other mechanism in place to provide stronger authentication. > > > > > Section 10.5.3 - > > Use "less weak" instead of stronger when referring to CHAP, MS-CHAP, and > > MSCHAPv2. Its pretty debatable how much better they are than plaintext > > passwords. > > > > I think "less weak" is acceptable. > > When you wrote that their value is debatable, did that refer to safety of > the authentication session (as in it can be successfully attacked), to > ability of a network attacker (active or passive) to deduce the user's > password, or both? > > My understanding is that they're still viable for the purpose of limiting > the loss of user's password from MiTM attacks. If I'm wrong about this, let > me know so we can be explicit about it in the document as well. > > [Joe] If an attacker can obtain the challenge and response in these mechanisms they can typically carry out an offline dictionary attack to recover the password. They're unsafe to use without a transport that provides confidentiality. > > > Andrej. --000000000000e255c205872505e5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Apr 22, 2019 at 11:24 AM Andr= ej Ota <andrej@ota.si= > wrote:
= Hi Joseph,

Thank you for taking time to review the document. Answers are in-line.

> On 22 Apr 2019, at 04:49, Joseph Salowey via Datatracker <noreply@ietf.org> wro= te:
>
> Reviewer: Joseph Salowey
> Review result: Serious Issues
>
> As the draft mentions the MD5 based stream cipher used by TACACS+ is <= br> > completely insecure.=C2=A0 I think there is too much discussion in the= security
> considerations that may lead one to think that in some cases it provid= es
> sufficient protection.
>
> Section 10.1 -
> There have been plenty of analysis of the problems with the TACACS+ me= ssage
> protection.=C2=A0 This section should just simply say the encryption/o= bfuscation
> mechanism provides no integrity protection, no privacy protection and = no replay
> protection.=C2=A0 An attacker with access to the data stream should be= assumed to be
> able to read and modify all TACACS+ packets.=C2=A0 There are just too = many flaws to
> to enumerate in this document and the rest of the information in this = section
> is wrong or incomplete at best.

Agreed to replace the section with a simple statement that obfuscation prov= ides no integrity or replay protection. I'm assuming this refers just t= o 10.1 and not the whole of 10.

[Joe] I think you could probably replace a large port= ion of 10.2, 3 and 4 as well.=C2=A0
=C2=A0
I think we should still press the point that everyone MUST use obfuscation = as even though the privacy is almost non-existent, it's still slightly = better than plain-text and ROT13.

[Joe] The current mechanism is roughly equivalent to = ROT13 when compared to current encryption mechanisms.=C2=A0 =C2=A0I don'= ;t think making it a must helps confidentiality, perhaps it helps with auth= entication below.
=C2=A0
>
> Section 10.2 -
> Why not MUST NOT for TAC_PLUS_AUTHEN_STATUS_FOLLOW?=C2=A0 Is this real= ly still used?

I think Douglas is best positioned to answer this question.

>
> Section 10.2, 10.3, 10.4 -
> You can probably replace most of these sections with
> "TACACS+ MUST be used with an addition security mechanism to prot= ection of the
> communication such as IPSEC or a secure network such as described in 1= 0.5. "

Agreed.

>
> Section 10.5.1 and 10.5.2 -
> Why should I care about secrets if they are just providing obfuscation= ?=C2=A0 =C2=A0Are
> you relying on these secrets for something other than obfuscation?

Shared secrets also serve to "authenticate" a NAS to a server and= vice versa.

Which may or may not matter when we state that secure transport MUST be use= d. I would like to err on the safe side because mistakes happen and sometim= es unauthorized devices do connect to otherwise secured networks - intentio= nally or unintentionally (lab devices and similar come to my mind).


[Joe] I don't think this section t= alks about authentication as a goal at all.=C2=A0 =C2=A0If this is a goal i= t should be stated.=C2=A0 =C2=A0There will still be some limitations here i= n that an attacker who can observe the communication will be able to forge = and replay messages.=C2=A0 =C2=A0I think it could be useful to detect misco= nfiguration,=C2=A0 but there should to be some other mechanism in place to = provide stronger authentication.=C2=A0
=C2=A0

>
> Section 10.5.3 -
> Use "less weak" instead of stronger when referring to CHAP, = MS-CHAP, and
> MSCHAPv2.=C2=A0 =C2=A0Its pretty debatable how much better they are th= an plaintext
> passwords.
>

I think "less weak" is acceptable.

When you wrote that their value is debatable, did that refer to safety of t= he authentication session (as in it can be successfully attacked), to abili= ty of a network attacker (active or passive) to deduce the user's passw= ord, or both?

My understanding is that they're still viable for the purpose of limiti= ng the loss of user's password from MiTM attacks. If I'm wrong abou= t this, let me know so we can be explicit about it in the document as well.=


[Joe] If an attacker can obtain the ch= allenge and response in these mechanisms they can typically carry out an of= fline dictionary attack to recover the password.=C2=A0 They're unsafe t= o use without a transport that provides confidentiality.=C2=A0=C2=A0
<= div>=C2=A0


Andrej.
--000000000000e255c205872505e5-- From nobody Mon Apr 22 18:25:14 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25B5F120113; Mon, 22 Apr 2019 18:25:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b5WfGD9GKsV6; Mon, 22 Apr 2019 18:25:04 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A8D31200F7; Mon, 22 Apr 2019 18:25:04 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1hIkB8-0000EB-99; Tue, 23 Apr 2019 01:24:58 +0000 Date: Mon, 22 Apr 2019 18:24:56 -0700 Message-ID: From: Randy Bush To: Joseph Salowey Cc: Andrej Ota , opsawg@ietf.org, The IESG , draft-ietf-opsawg-tacacs.all@ietf.org, secdir In-Reply-To: References: <155590495142.9736.10585624358883108199@ietfa.amsl.com> <20190422182358.B69FB17821@mta2.toshio.eu> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.2 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-tacacs-13 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Apr 2019 01:25:06 -0000 >> Agreed to replace the section with a simple statement that >> obfuscation provides no integrity or replay protection. I'm assuming >> this refers just to 10.1 and not the whole of 10. >> > [Joe] I think you could probably replace a large portion of 10.2, 3 and 4 > as well. hyperbole is not constructive creaky as it is, this is an informational draft which is documenting an extremely widely used and distributed protocol. no one is gonna change millions of devices and thousands of servers for tweaks. no one moves for a 10% improvement, especially if there is no functional improvement. we need to document it so we can put this in the can and move forward to modernizing it. then, if we have a seriously functionally improved and modernized protocol, we will start the 42 year process of rolling it out. randy From nobody Tue Apr 23 01:03:25 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38B9E1202D2; Tue, 23 Apr 2019 01:03:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nEoo4L1qVEGs; Tue, 23 Apr 2019 01:03:21 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 181C3120072; Tue, 23 Apr 2019 01:03:21 -0700 (PDT) Received: from mb.local ([IPv6:2601:647:4201:4561:4980:15b:fa1a:79bf]) (authenticated bits=0) by nagasaki.bogus.com (8.15.2/8.15.2) with ESMTPA id x3N83Kb0011035; Tue, 23 Apr 2019 08:03:20 GMT (envelope-from joelja@bogus.com) X-Authentication-Warning: nagasaki.bogus.com: Host [IPv6:2601:647:4201:4561:4980:15b:fa1a:79bf] claimed to be mb.local To: Randy Bush , Joseph Salowey via Datatracker Cc: opsawg@ietf.org, iesg@ietf.org, draft-ietf-opsawg-tacacs.all@ietf.org, secdir@ietf.org References: <155590495142.9736.10585624358883108199@ietfa.amsl.com> From: joel jaeggli Openpgp: preference=signencrypt Autocrypt: addr=joelja@bogus.com; prefer-encrypt=mutual; keydata= mQGiBD832SIRBADVEfzsfIX+fuN2XUPyyEXP4Mq8dqpjmcy+XTIHzZLVKzxmP+17zJYTj9MR dMA5vuZRsRpzFoeDMOJyHVVyaQeSwEApO3FJOej+CNAXpaTLYgobL1XcsQXMTbeNT5x9ZK+R ZQtoC8Vunv6UTygY+kHUHvNijhVtJtCcAW0NE2fiWwCgjKPAldaGNbPg6SKvSTFipsPPqoUE ALKjZApjCG/3Yi4kHgzCQw65mfE9u8O7bZcrvmzzRgmwShyQjrRNgxhwl2q9+e8Uo6kuk56q 0Q4On6y873W6EtBRYLTU5MiIK3mspi5YYpIi/F2XTkcW6Dx/C/ZQQ8WddAyX6QLAXHYMus86 x7tzjGM3HVlvJpWTb4CqcDOcvZakA/9aJhMEffleJx+6xrjZTUYvAQDYUSRWNmc+ehyAuh/B KH0DKqhkLlm0SBdsnKvQHXbdjhu9m9K4E6aR/s117QK60jZo1XNrVKJ1oM3X+2DNmDBl/K33 e/tPSC8byvD77doezHvWvE5n50KIEZezVgMkYWDSPWb0nefdXLY5+rgfmrQfSm9lbCBKYWVn Z2xpIDxqb2VsamFAYm9ndXMuY29tPohjBBMRAgAjAhsDBgsJCAcDAgQVAggDBBYCAwECHgEC F4AFAk3mKPcCGQEACgkQ8AA1q7Z/VrJ6vgCfYITQSd0+WXcYjEoj8+tNys5egPcAn3OUUHVt JElVkSSARJ4XWjRYqKiauQQNBD8320MQEACTNxol/GIZW4CGUnyIlr+13Dqx8aHZfbd96UQE Ys9mZkBxwP2V7D00tOETcY5apr9tr9oHf5p4xA2l2oE8KR4xbF6+0XIpeYzRcl5d0iUaSMwm HcX3J/+XyZegJqTG7zMEK72c1tPVrra9DRNZP+rhKFLJJornDiQJFQVhtQE37WA1kmC6rlyR KHA2RMYS3IugAgJfuy5pZn/5jKCv+ZxIv7tnk7GUQWwfPdr4PokPCBxSXUYch98Rcq3dbCio 8FPmrfI6K2Z9NMa/gXGpF3ynmxDJLY31aPgbUiv9VllZoeMkotbXHW1zrsXte/1MEgFrlkiQ WDJ/dHjlCdlFASfaPvVXxdiUgH7LV3cW+BOY2z4VVwhYM6/kTDoLKWZ3opBeN9KcAHPRFCkA fxwAu8PNgi74lMjcFzu66U8vVM37YqSYpXsi+mlwZDhzCJ8qm9FDwaH2bB1LJ7m41F098B29 SRG3s/XXgTCSt0js/yUp9EXRPQpME99GvwiBNFN9p9e45ZqS85Wll6GqHh+Jyvq0ODWH6XOz uop3UUqw6I2Q8rG7e/uxKWcFnt1q48uhdTHA0TfnYC5HpHf/tAuR+ui6s16xrENgFgeeu4b/ q/jA4N1ZuJU7IbnO5f28YTlJOef/HywY3OXBsrdhEXKLIc5xRj6NC4WphyQ9MQrx8cS1bwAD BQ//WNM1WUlr6tIn8/7SIqqHRg3UmzVNu4u+r9rK9LJkYRLA4xKb/TrqDhP9oyO7Oz2S5CsF wjiPc1vzGzfRgIOArPJrejM4BzHQ03tl1qb/5YNDaB1QzfPv6dT9OkhMMuth0tcmH5sjfbiF Nc41aKU5w4FFkTv3XmrXciz4+PWbAYGB7pYbhGmsx//9C2bS56Bu1QkFeSCzN5AvWAmJfyPU yMXFKDe21DlImMdkrn/K838Lm8o0CLOKbJBX8K0pE4rGEf20FLfmHx/bLZRcWhTm8cB/vHNd 8GhwFlvHylj6+5QtR0Tc0hBcOG8SZktjE/hEiYi+dAZCrwT9i8Hjulnx/vu+Knt40+5CB2hk L1VQwdGWLYO4FGqWwwv0Y8XhWOudLYCZQWrgOsIzYezahC5b9iobFx8dgAElXNPTxI/dymrI d/6foyBrGnzzOnV/gfWfQp7N1rbrh0mQXRhwwwQIjlmbUyz8fTlaTcAo8ocXTVUb6WY7U5nr ufzKsFceR/olFnvZKKhbGVG6VvqNLS1r5lcRR1J7GVZM+Sb2ZNKgnwiUf8yxKfWg84NUPt/b etviJ73LVPdjV1PNZgcxfPRO3XL6Y9FaBP9oB4f58ujuhzOLUt+6I0KuzY8H5RBBaIrJJptl DEOnxFn1J7Q0uxQ2BzqfZdKTwJS4OCjm+OsLd8GIRgQYEQIABgUCPzfbQwAKCRDwADWrtn9W soUzAJ4zatxnKYcGdyoFojBc1Y2jqaHZsQCbB25DmeFRx14xxuxdAXb0wsKf35w= Message-ID: <12014b5b-3fe4-c046-9fba-3d9f7a6a123a@bogus.com> Date: Tue, 23 Apr 2019 01:03:19 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="gLNYCDbIuMirEp2Gq1UejLDr3KuTrC8Lj" Archived-At: Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-tacacs-13 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Apr 2019 08:03:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gLNYCDbIuMirEp2Gq1UejLDr3KuTrC8Lj Content-Type: multipart/mixed; boundary="ORS2zou0wgQ3heqZ51SRTOkJvQTs2iRuj"; protected-headers="v1" From: joel jaeggli To: Randy Bush , Joseph Salowey via Datatracker Cc: opsawg@ietf.org, iesg@ietf.org, draft-ietf-opsawg-tacacs.all@ietf.org, secdir@ietf.org Message-ID: <12014b5b-3fe4-c046-9fba-3d9f7a6a123a@bogus.com> Subject: Re: [OPSAWG] Secdir last call review of draft-ietf-opsawg-tacacs-13 References: <155590495142.9736.10585624358883108199@ietfa.amsl.com> In-Reply-To: --ORS2zou0wgQ3heqZ51SRTOkJvQTs2iRuj Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 4/21/19 20:56, Randy Bush wrote: >> "TACACS+ MUST be used with an addition security mechanism to >> protection of the communication such as IPSEC or a secure network such= >> as described in 10.5. " >=20 > not operationaly viable I don't deploy tacacs+ plus anymore, but when I did, concerted efforts were in place to insure that the management network and it's traffic inclusive of the tacacs traffic remained isolated from our production network as well as the internet as whole. that's more or less in keeping with the sentiments of 10.5. securiting it with ah or esp ipsec isn't going to to happen except in the context of route based vpns. > randy >=20 > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg >=20 --ORS2zou0wgQ3heqZ51SRTOkJvQTs2iRuj-- --gLNYCDbIuMirEp2Gq1UejLDr3KuTrC8Lj Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iF0EARECAB0WIQRcbgEEuvBAsFvTw4vwADWrtn9WsgUCXL7GxwAKCRDwADWrtn9W slzKAJ9IvQYI0eu36KPmBe2GnGYHtQI1egCfQUjaQC+b73C5sxUkqzXxrLCAyFU= =Li+r -----END PGP SIGNATURE----- --gLNYCDbIuMirEp2Gq1UejLDr3KuTrC8Lj-- From nobody Wed Apr 24 06:32:02 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46C451200C1 for ; Wed, 24 Apr 2019 06:32:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K0sovqNnGMki for ; Wed, 24 Apr 2019 06:31:59 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0593120020 for ; Wed, 24 Apr 2019 06:31:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1310; q=dns/txt; s=iport; t=1556112719; x=1557322319; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=DrfGMEe45z+oKrb64KGyJbMfvIZmBN6Z3ehbNsfVAOE=; b=ZF//CrlJXUcxjbfu84pBFZbgIasX4gzApAnmx81Bp55mfEkngZW2Gau1 A4KXg6SDKIU5JitF0WEEowfVxS/3K5ZXbgd7BjoE8mQxyndpEiZ9Vscs8 Sg+0K0+MPAgwxiqQsT7kMWKfex3z71JDjd6UCXgDHEWKQLQiFFQtoHWwm I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AEAADdY8Bc/5ldJa1mGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBUQUBAQEBCwGCEGiBBCgKhAWIHIsDgg2YSxSBZw4BASOESgI?= =?us-ascii?q?XhhgjNAkOAQMBAQQBAQIBAm0cDIVKAQEBAQIBIxFFBQsCAQgYAgIRFQICAjA?= =?us-ascii?q?VEAIEDgWDIgGBeQ8PqEKBL4o1gQsnAYtJF4FAP4E4H4JMPoEEgntFP4JLMYI?= =?us-ascii?q?mBIp3FoF0LJkpCQKCCJIqG5UUoD8CERWBMB84gVZwFWUBgkEJgh6Ia4U/QTG?= =?us-ascii?q?PUYEhAQE?= X-IronPort-AV: E=Sophos;i="5.60,389,1549929600"; d="scan'208";a="539747793" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 24 Apr 2019 13:31:58 +0000 Received: from XCH-RCD-014.cisco.com (xch-rcd-014.cisco.com [173.37.102.24]) by rcdn-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x3ODVwf6021119 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 24 Apr 2019 13:31:58 GMT Received: from xch-rcd-015.cisco.com (173.37.102.25) by XCH-RCD-014.cisco.com (173.37.102.24) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 24 Apr 2019 08:31:57 -0500 Received: from xch-rcd-015.cisco.com ([173.37.102.25]) by XCH-RCD-015.cisco.com ([173.37.102.25]) with mapi id 15.00.1473.003; Wed, 24 Apr 2019 08:31:57 -0500 From: "Joe Clarke (jclarke)" To: RFC Errata System CC: Eliot Lear , "rdroms@gmail.com" , "dromasca@gmail.com" , "ibagdona@gmail.com" , "warren@kumari.net" , "zhoutianran@huawei.com" , "cheshire@apple.com" , "opsawg@ietf.org" Thread-Topic: [Editorial Errata Reported] RFC8520 (5702) Thread-Index: AQHU+KXOkXUF9Jg+eUet/GpFH2+kCKZLpq8A Date: Wed, 24 Apr 2019 13:31:57 +0000 Message-ID: References: <20190422005316.ED675B82064@rfc-editor.org> In-Reply-To: <20190422005316.ED675B82064@rfc-editor.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.118.87.86] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.24, xch-rcd-014.cisco.com X-Outbound-Node: rcdn-core-2.cisco.com Archived-At: Subject: Re: [OPSAWG] [Editorial Errata Reported] RFC8520 (5702) X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Apr 2019 13:32:01 -0000 DQoNCj4gT24gQXByIDIxLCAyMDE5LCBhdCAyMDo1MywgUkZDIEVycmF0YSBTeXN0ZW0gPHJmYy1l ZGl0b3JAcmZjLWVkaXRvci5vcmc+IHdyb3RlOg0KPiANCj4gVGhlIGZvbGxvd2luZyBlcnJhdGEg cmVwb3J0IGhhcyBiZWVuIHN1Ym1pdHRlZCBmb3IgUkZDODUyMCwNCj4gIk1hbnVmYWN0dXJlciBV c2FnZSBEZXNjcmlwdGlvbiBTcGVjaWZpY2F0aW9uIi4NCj4gDQo+IC0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+IFlvdSBtYXkgcmV2aWV3IHRoZSByZXBvcnQgYmVsb3cg YW5kIGF0Og0KPiBodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2VycmF0YS9laWQ1NzAyDQo+IA0K PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KPiBUeXBlOiBFZGl0b3Jp YWwNCj4gUmVwb3J0ZWQgYnk6IFN0dWFydCBDaGVzaGlyZSA8Y2hlc2hpcmVAYXBwbGUuY29tPg0K PiANCj4gU2VjdGlvbjogMTYNCj4gDQo+IE9yaWdpbmFsIFRleHQNCj4gLS0tLS0tLS0tLS0tLQ0K PiAgIGltcGxlbWVudG9ycyBzaG91bGQgdGFrZSBpbnRvDQo+ICAgYWNjb3VudCB3aGF0IG90aGVy IGluZm9ybWF0aW9uIHRoZXkgYXJlIGFkdmVydGlzaW5nIHRocm91Z2gNCj4gICBtZWNoYW5pc21z IHN1Y2ggYXMgTXVsdGljYXN0IEROUyAobUROUykgW1JGQzY4NzJdDQo+IA0KPiBDb3JyZWN0ZWQg VGV4dA0KPiAtLS0tLS0tLS0tLS0tLQ0KPiAgIGltcGxlbWVudG9ycyBzaG91bGQgdGFrZSBpbnRv DQo+ICAgYWNjb3VudCB3aGF0IG90aGVyIGluZm9ybWF0aW9uIHRoZXkgYXJlIGFkdmVydGlzaW5n IHRocm91Z2gNCj4gICBtZWNoYW5pc21zIHN1Y2ggYXMgTXVsdGljYXN0IEROUyAobUROUykgW1JG QzY3NjJdDQoNClRoaXMgc2VlbXMgZGVhZCBvbiB0byBtZS4gIEkgZGlkbuKAmXQgdGhpbmsgeW91 IG1lYW50IHNvbWVob3cgcmVmZXJlbmNlIENMRiBmb3IgU0lQLg0KDQpKb2U= From nobody Wed Apr 24 06:39:20 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BD301200DE; Wed, 24 Apr 2019 06:39:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NgnMa7EVewGU; Wed, 24 Apr 2019 06:39:18 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22819120020; Wed, 24 Apr 2019 06:39:18 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 90911B821D2; Wed, 24 Apr 2019 06:39:10 -0700 (PDT) To: cheshire@apple.com, lear@cisco.com, rdroms@gmail.com, dromasca@gmail.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: ibagdona@gmail.com, iesg@ietf.org, opsawg@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20190424133910.90911B821D2@rfc-editor.org> Date: Wed, 24 Apr 2019 06:39:10 -0700 (PDT) Archived-At: Subject: [OPSAWG] [Errata Verified] RFC8520 (5702) X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Apr 2019 13:39:20 -0000 The following errata report has been verified for RFC8520, "Manufacturer Usage Description Specification". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5702 -------------------------------------- Status: Verified Type: Editorial Reported by: Stuart Cheshire Date Reported: 2019-04-22 Verified by: Ignas Bagdonas (IESG) Section: 16 Original Text ------------- implementors should take into account what other information they are advertising through mechanisms such as Multicast DNS (mDNS) [RFC6872] Corrected Text -------------- implementors should take into account what other information they are advertising through mechanisms such as Multicast DNS (mDNS) [RFC6762] Notes ----- Incorrect reference for Multicast DNS (mDNS). -------------------------------------- RFC8520 (draft-ietf-opsawg-mud-25) -------------------------------------- Title : Manufacturer Usage Description Specification Publication Date : March 2019 Author(s) : E. Lear, R. Droms, D. Romascanu Category : PROPOSED STANDARD Source : Operations and Management Area Working Group Area : Operations and Management Stream : IETF Verifying Party : IESG From nobody Wed Apr 24 06:43:25 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94D7912011A for ; Wed, 24 Apr 2019 06:43:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T7-yvxVGdwyP for ; Wed, 24 Apr 2019 06:43:20 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5519C120020 for ; Wed, 24 Apr 2019 06:43:20 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id y16so6128296ljg.1 for ; Wed, 24 Apr 2019 06:43:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZVWMfQlIcLmnWFkJ93Mi4HoXf8ON5yFPWA1uRxuYLd8=; b=uSOdBCKBrAUtSbs66BxhDCvQhJ9DEszx0tFvY4zhV880/ejX7FOU1aGz+Mh0HCDLtC jJLuV5s4YE3/zuMazmr1NxgzxejuE5NyYhpn9eRZ6IGqpfUnVktZsMfhi+l4F8rs3ed5 bloWm4DtoeGtsEEDY1G+Zq13RiOfyKteEqEFhqqv7Dgo8NUzQZwt5S+NxJFF5ismeU5D hJIPXzbSSQB1PjvKOW7cT2+KSYoGgAD/auyL7bMIebU2dJ8qfNx5JPVH0zzdWZJvSiUp zQoGyOrXziOQnjo54FwcR5EBJG7aS2o+QYYCBxcAHA5T9CRNs3FNDlTU1ruZFZLwcJjI qGtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZVWMfQlIcLmnWFkJ93Mi4HoXf8ON5yFPWA1uRxuYLd8=; b=l9lIcTkFjbNVfqrYA7oDVK+XEQQxHO8V8bJe1A6G26sQvlYoavYd10vG/ux9SKF5u1 akDfECSMt2+DCd8hK0dBOCiGeKv1cFG4B1T9+gdvkKAuLK48jV4Z8ZwA4OonT+IoExA5 TATIYx04kd7HVWskcSQWHO486mnkQnAI8M2AbQnfPDGqPZoLtMSsOUuxwwEo+KJUMuv8 clxBgqnJhMidn0pjkR76T8J+3Ao91tgWdlhrc+PSNo/E07wiyyRhdKdd38yoy1XYAIK4 TStBo4eyJFbAXOf23jVEsVoNc8WTMVk/vC3Y8T2WmWSe+VSbvtlV/m0tVSayoOLRwfrT X3xw== X-Gm-Message-State: APjAAAU3556SzhAFiCukYTR+UXJCHUEw3KNRKPrGyQJht5xpAncRenoo 9E1TUBQUFYlZl0iGhPip7lvVbmuoomMy+RXjrRo= X-Google-Smtp-Source: APXvYqzLEU9t7mNfgGJ5vrE44dXOc12THEFjWge2IFdQYuU3MMsARz12e8009pHkhaEoXC8nr5s/JA/vXsBQ6g+V+NU= X-Received: by 2002:a2e:858f:: with SMTP id b15mr3425593lji.144.1556113398343; Wed, 24 Apr 2019 06:43:18 -0700 (PDT) MIME-Version: 1.0 References: <20190422005316.ED675B82064@rfc-editor.org> In-Reply-To: From: Ignas Bagdonas Date: Wed, 24 Apr 2019 14:43:06 +0100 Message-ID: To: "Joe Clarke (jclarke)" Cc: RFC Errata System , Eliot Lear , "rdroms@gmail.com" , "dromasca@gmail.com" , "warren@kumari.net" , "zhoutianran@huawei.com" , "cheshire@apple.com" , "opsawg@ietf.org" Content-Type: multipart/alternative; boundary="00000000000056ac11058746e215" Archived-At: Subject: Re: [OPSAWG] [Editorial Errata Reported] RFC8520 (5702) X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Apr 2019 13:43:23 -0000 --00000000000056ac11058746e215 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Verified. Thank you. On Wed, Apr 24, 2019 at 2:32 PM Joe Clarke (jclarke) wrote: > > > > On Apr 21, 2019, at 20:53, RFC Errata System > wrote: > > > > The following errata report has been submitted for RFC8520, > > "Manufacturer Usage Description Specification". > > > > -------------------------------------- > > You may review the report below and at: > > http://www.rfc-editor.org/errata/eid5702 > > > > -------------------------------------- > > Type: Editorial > > Reported by: Stuart Cheshire > > > > Section: 16 > > > > Original Text > > ------------- > > implementors should take into > > account what other information they are advertising through > > mechanisms such as Multicast DNS (mDNS) [RFC6872] > > > > Corrected Text > > -------------- > > implementors should take into > > account what other information they are advertising through > > mechanisms such as Multicast DNS (mDNS) [RFC6762] > > This seems dead on to me. I didn=E2=80=99t think you meant somehow refer= ence CLF > for SIP. > > Joe --00000000000056ac11058746e215 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Verified.
Thank you. =C2=A0
=


On Wed, Apr 24, 2019 at 2:32 PM Joe Clarke (jclarke) <jclarke@cisco.com> wrote:


> On Apr 21, 2019, at 20:53, RFC Errata System <rfc-editor@rfc-editor.org>= wrote:
>
> The following errata report has been submitted for RFC8520,
> "Manufacturer Usage Description Specification".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5702
>
> --------------------------------------
> Type: Editorial
> Reported by: Stuart Cheshire <cheshire@apple.com>
>
> Section: 16
>
> Original Text
> -------------
>=C2=A0 =C2=A0implementors should take into
>=C2=A0 =C2=A0account what other information they are advertising throug= h
>=C2=A0 =C2=A0mechanisms such as Multicast DNS (mDNS) [RFC6872]
>
> Corrected Text
> --------------
>=C2=A0 =C2=A0implementors should take into
>=C2=A0 =C2=A0account what other information they are advertising throug= h
>=C2=A0 =C2=A0mechanisms such as Multicast DNS (mDNS) [RFC6762]

This seems dead on to me.=C2=A0 I didn=E2=80=99t think you meant somehow re= ference CLF for SIP.

Joe
--00000000000056ac11058746e215-- From nobody Mon Apr 29 18:25:55 2019 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D01FF12004C for ; Mon, 29 Apr 2019 18:25:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4QmLAy1C98Nh for ; Mon, 29 Apr 2019 18:25:51 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CB02120044 for ; Mon, 29 Apr 2019 18:25:51 -0700 (PDT) Received: from lhreml701-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id D3FB12C686601F145C77 for ; Tue, 30 Apr 2019 02:25:48 +0100 (IST) Received: from SJCEML701-CHM.china.huawei.com (10.208.112.40) by lhreml701-cah.china.huawei.com (10.201.108.42) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 30 Apr 2019 02:25:48 +0100 Received: from SJCEML521-MBS.china.huawei.com ([169.254.2.150]) by SJCEML701-CHM.china.huawei.com ([169.254.3.250]) with mapi id 14.03.0439.000; Mon, 29 Apr 2019 18:25:42 -0700 From: Haoyu song To: Joe Clarke , "opsawg@ietf.org" Thread-Topic: [OPSAWG] Review of draft-song-opsawg-ntf-03 Thread-Index: AQHU7hgGqHGbb5saEkunx/Ok2oZqjqZUAxLg Date: Tue, 30 Apr 2019 01:25:41 +0000 Message-ID: <78A2745BE9B57D4F9D27F86655EB87F9376B3FC7@sjceml521-mbs.china.huawei.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.209.217.121] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [OPSAWG] Review of draft-song-opsawg-ntf-03 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Apr 2019 01:25:54 -0000 SGkgSm9lLA0KDQpJJ20gd29ya2luZyBvbiByZXZpc2luZyB0aGUgZHJhZnQuIA0KDQpCZWxvdyBh cmUgc29tZSB0aG91Z2h0cyBvbiB0aGUgaXNzdWVzIHlvdSByYWlzZWQgYWJvdXQgU2VjdGlvbiAy Og0KDQoxKSBJJ2xsIHBvc2l0aW9uIEFJIGEgbW9yZSBmb3J3YXJkIGxvb2tpbmcgdGVjaG5pcXVl IHRoYXQgY2FuIHRha2UgYWR2YW50YWdlIG9mIG5ldHdvcmsgdGVsZW1ldHJ5Lg0KDQoyKSBOTVJH IGlzIHdvcmtpbmcgb24gIHByb3ZpZGUgYSBmb3JtYWwgZGVmaW5pdGlvbiBvZiAiaW50ZW50IiBz byBJIHRoaW5rIHdlIGNhbiB1c2UgdGhhdCBhcyBhIHJlZmVyZW5jZSB0byBjbGFyaWZ5IHRoZSBi dXp6IHdvcmQuDQoNCjMpIFdoZW4gSSBzYXkgInRoZSBzeXN0ZW0gYm90dGxlbmVjayBpcyBzaGlm dGluZyBmcm9tIGRhdGEgY29uc3VtcHRpb24gdG8gZGF0YSBzdXBwbHkiLCAgd2hhdCBJIG1lYW4g aXMgIHRoYXQgbm93IHRoZSBkYXRhIHByb2Nlc3NpbmcgY2FwYWJpbGl0eSBpcyBncmVhdGx5IGlt cHJvdmVkIGFuZCBtYW55IGFwcGxpY2F0aW9ucyBhcmUgaHVuZ3J5IGZvciBtb3JlIGRhdGEgeWV0 IHRoZSBuZXR3b3JrICBsYWdzIGJlaGluZCBpbiBwcm92aWRpbmcgZW5vdWdoIGhpZ2ggcXVhbGl0 eSBkYXRhIGluIGEgdGltZWx5IG1hbm5lci4gSSBhZ3JlZSB3ZSBtdXN0IGhhdmUgYSB3YXkgdG8g dHJhbnNsYXRlIHRoYXQgZGF0YSBpbnRvIHVzZWZ1bCwgYWN0aW9uYWJsZSBpbmZvcm1hdGlvbi4g SSB0aGluayB0aGlzIGlzIGFsc28gYSBwYXJ0IG9mIGpvYiBvZiBuZXR3b3JrIHRlbGVtZXRyeS4g TmV0d29yayB0ZWxlbWV0cnkgaXMgbm90IGp1c3Qgc3VwcGx5aW5nIHJhdyBkYXRhLCBidXQgc3Vw cGx5aW5nIHVzZWZ1bCBhbmQgYWN0aW9uYWJsZSBkYXRhLg0KDQpCZXN0IHJlZ2FyZHMsDQpIYW95 dQ0KIA0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IE9QU0FXRyBbbWFpbHRvOm9w c2F3Zy1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgSm9lIENsYXJrZQ0KU2VudDogTW9u ZGF5LCBBcHJpbCAwOCwgMjAxOSA3OjMxIEFNDQpUbzogb3BzYXdnQGlldGYub3JnDQpTdWJqZWN0 OiBbT1BTQVdHXSBSZXZpZXcgb2YgZHJhZnQtc29uZy1vcHNhd2ctbnRmLTAzDQoNCkFzIEkgcHJv bWlzZWQgYXQgdGhlIG1pYyBhdCAxMDQsIEkgaGF2ZSBhIG1vcmUgY29tcHJlaGVuc2l2ZSByZXZp ZXcgb2YgdGhpcyBkcmFmdC4NCg0KSSdsbCB0YWNrbGUgdGhpcyBzZWN0aW9uLWJ5LXNlY3Rpb24u ICBUaGVzZSBhcmUgYSBjb21iaW5hdGlvbiBvZiBuaXRzIGFuZCBtb3JlIHN1YnN0YW50aXZlIGNv bW1lbnRzLg0KDQo9PT0NCg0KSW4gdGhlIGFic3RyYWN0LCB5b3UgaGF2ZSBhIHNlbnRlbmNlOg0K DQpOZXR3b3JrIHRlbGVtZXRyeSBwcm9taXNlcyBiZXR0ZXIgZmxleGliaWxpdHksIHNjYWxhYmls aXR5LCBhY2N1cmFjeSwgY292ZXJhZ2UsIGFuZCBwZXJmb3JtYW5jZS4uLg0KDQpUaGlzIGxlZnQg bWUgd29uZGVyaW5nLCAidGhhbiB3aGF0PyIgIFRoYXQgaXMsIEkgdGhpbmsgeW914oCZcmUgdHJ5 aW5nIHRvIHNheSB0aGF0IHdpdGggcmVzcGVjdCB0byB0cmFkaXRpb25hbCBwb2xsLWJhc2VkIG5l dHdvcmsgbW9uaXRvcmluZywgdGVsZW1ldHJ5IHByb3ZpZGVzIHRoZXNlIGFkdmFudGFnZXMuICBJ ZiB5b3UncmUgZ29pbmcgdG8gc2F5IHNvbWV0aGluZyBpcyBiZXR0ZXIsIGl0IHdvdWxkIGhlbHAg dG8gY29tcGFyZSB0aGF0IHRvIHNvbWV0aGluZyBlbHNlIGluIG9yZGVyIHRvIHByb3ZpZGUgYmV0 dGVyIGNsYXJpdHkucHINCg0KPT09DQoNClNlY3Rpb24gMToNCg0Kcy9pZGVhbCBtZWFuL2lkZWFs IG1lYW5zLw0KDQpzL3RlbGVtZXRyeSByZW1haW4vdGVsZW1ldHJ5IHJlbWFpbnMvDQoNCj09PQ0K DQpTZWN0aW9uIDI6DQoNClRoZSBmaXJzdCBzZW50ZW5jZSBvZiB5b3VyIG1vdGl2YXRpb24gYm90 aGVycyBtZS4gIEkgZG9u4oCZdCBidXkgaXQuICBZZXMsIHNvbWUgYXJlIHVzaW5nIG1hY2hpbmUg bGVhcm5pbmcgdG8gcHVsbCBpbnNpZ2h0cyBvdXQgb2Yg4oCcYmlnIGRhdGEs4oCdIGJ1dCB0aGUg d2F5IHRoaXMgcmVhZHMsIEFJIGlzIGNvbW1vbnBsYWNlIGluIG5ldHdvcmtpbmcuICBJIHdvdWxk IHNheSB0aGlzIGlzIHN0aWxsIHZlcnkgbXVjaCBpbiBuaWNoZSBhcmVhcyBhbmQgcmVzZWFyY2gu ICBPbmUga2V5IGlzc3VlIHdpdGggdGhlIHZhc3QgYW1vdW50cyBvZiBkYXRhIHRoYXQgc29tZSBu ZXR3b3JrcyBwcm9kdWNlIGlzIHNvcnRpbmcgdGhyb3VnaCBpdCB0byBmaW5kIHVzZWZ1bCBpbmZv cm1hdGlvbi4gIExhcmdlIG9wZXJhdG9ycyBtYXkgaGF2ZSB0aGUgbWVhbnMgdG8gZG8gTUwsIGJ1 dCBvdGhlcnMgc3RydWdnbGUgdG8gbWFrZSBzZW5zZSBvZiB0aGlzIGRhdGEuDQoNCllvdSB1c2Ug dGhlIHRlcm0gImludGVudC1kcml2ZW4gYXV0b25vbW91cyBuZXR3b3JrLiIgIEkgYXNrZWQgYXJv dW5kIHdpdGggc29tZSBvcGVyYXRvcnMgYW5kIG90aGVyIHZlbmRvcnMsIGFuZCB0aGlzIGlzIDEw MCUgYnV6eiB3b3JkLg0KUGVvcGxlIGVpdGhlciBkb24ndCBrbm93IHdoYXQgaXQgbWVhbnMgb3Ig ZGVmaW5lIGl0IHVzaW5nIGV2ZW4gbW9yZSBidXp6d29yZHMuICBJIGtub3cgZWFjaCB2ZW5kb3Ig aGFzIHRoZWlyIG93biBtZWFuaW5nIGZvciB0aGlzLCBidXQgdGhlc2UgdGVybXMgb24gbm90IHdp ZGVseSBrbm93bi4gIFlvdXIgZG9jdW1lbnQgYWltcyB0byBjbGFyaWZ5IHRheG9ub215LiAgSSB3 b3VsZCBjbGFyaWZ5IHRoaXMgYnV6enkgcGhyYXNlLg0KDQpJbiB5b3VyIHRoaXJkIHBhcmFncmFw aCwgeW91IHNheSwgInRoZSBzeXN0ZW0gYm90dGxlbmVjayBpcyBzaGlmdGluZyBmcm9tIGRhdGEg Y29uc3VtcHRpb24gdG8gZGF0YSBzdXBwbHkuIiAgSSBkaXNhZ3JlZS4gIFRlbGVtZXRyeSBpcyBm dXJ0aGVyaW5nIHRoZSBkYXRhIGNvbnN1bXB0aW9uIHByb2JsZW0uICBNb3JlIGRhdGEgZG9lc24n dCBtZWFuIG1vcmUgaW5zaWdodC4gIE1vcmUgZGF0YSBtZWFucyBtb3JlIGhlYWRhY2hlLiAgSW4g YWRkaXRpb24gdG8gZ2V0dGluZyBtb3JlIGRhdGEgbW9yZSBlYXNpbHksIHdlIF9tdXN0XyBoYXZl IGEgd2F5IHRvIHRyYW5zbGF0ZSB0aGF0IGRhdGEgaW50byB1c2VmdWwsIGFjdGlvbmFibGUgaW5m b3JtYXRpb24uICBUaGlzIGdvZXMgdG8gQmVub2l0J3MgdGFsayBvbiB0ZWxlbWV0cnkgb24gVGh1 cnNkYXkgYXQgMTA0LiAgSG93IGRvIHdlIHVwLWxldmVsIHRoZSB2YWx1ZSBvZiB0ZWxlbWV0cnk/ DQoNCj09PQ0KDQpTZWN0aW9uIDIuMToNCg0Kcy9BbiBpbnRlbnRzL0FuIGludGVudC8NCg0KPT09 DQoNClNlY3Rpb24gMi4yOg0KDQpUaGUgc2VudGVuY2UgIlRoZXNlIGNvbnZlbnRpb24gdGVjaG5p cXVlcyBhcmUgbm90IHN1ZmZpY2llbnQgdG8gc3VwcG9ydCB0aGUgYWJvdmUgdXNlIGNhc2VzIGZv ciB0aGUgZm9sbG93aW5nIHJlYXNvbnM6IiBkb2Vzbid0IG1ha2Ugc2Vuc2UuDQpUaGVyZSBhcmUg c29tZSBncmFtbWF0aWNhbCBpc3N1ZXMgaGVyZS4gIENvbnNpZGVyIHJlcGhyYXNpbmcuICBNYXli ZSwgIlRoZXNlIGNvbnZlbnRpb25hbCB0ZWNobmlxdWVzIi4NCg0KPT09DQoNClNlY3Rpb24gMi4z Og0KDQpZb3UgZGVmaW5lIElETiBhcyBJbnRlbnQtRHJpdmVuIE5ldHdvcmssIGJ1dCBJIHdvdWxk IGFnYWluIHNheSB5b3UgbmVlZCB0byBkZWZpbmUgdGhpcyBpbiBpdHMgZW50aXJldHkgc28gdGhl IHJlYWRlciBpcyBjbGVhci4gIFlvdSBkbyBkZWZpbmUsICJhbiBpbnRlbnQiIGJ1dCBJRE4vSUJO IGlzIG1vcmUgY29tcHJlaGVuc2l2ZSB0aGFuIHRoYXQuDQoNCj09PQ0KDQpTZWN0aW9uIDQuMToN Cg0Kcy9hdmFpYWJsZS9hdmFpbGFibGUvDQoNCllvdSBkZWZpbmUgZGlmZmVyZW50IHR5cGVzIG9m IHRlbGVtZXRyeSBkYXRhIGFzICJTaW1wbGUgRGF0YSIgYW5kIHRoZW4gIkN1c3RvbSBEYXRhIi4g IE1pZ2h0IEkgc3VnZ2VzdCB5b3UgcmVuYW1lIEN1c3RvbSBEYXRhIHRvIENvbXBsZXggRGF0YSBh cyAiY29tcGxleCIgdGVuZHMgdG8gdHlwaWNhbGx5IHJlZmVyIHRvIHNvbWUgbGV2ZWwgb2YgbXVs dGlwbGUgY29tYmluYXRpb24gb3IgYWdncmVnYXRpb24uDQoNCj09PQ0KDQpTZWN0aW9uIDQuMjoN Cg0KQ2FuIHlvdSB0YWxrIG1vcmUgYWJvdXQgd2hhdCB5b3UgbWVhbiBieSBzb2NpYWwgZGF0YSBh bmQgd2h5IGVudmlyb25tZW50YWwgaXMgZGVmaW5lZCB0byBiZSBleHRlcm5hbD8gIEkgY2FuIGhh dmUgb24tYm9hcmQgc2Vuc29ycyB0aGF0IHJlbGF5IGludGVybmFsIGVudmlyb25tZW50YWwgZGF0 YS4NCg0KV2h5IGlzIGV4dGVybmFsIGRhdGEgbm90IG9mZmVyZWQgb3ZlciBIVFRQPyAgSSBpbWFn aW5lICJzb2NpYWwiIHdvdWxkIGJlIEhUVFAsIGJ1dCB3aXRob3V0IG1vcmUgZGVmaW5pdGlvbiwg SSdtIG5vdCBzdXJlLg0KDQo9PT0NCg0KU2VjdGlvbiA0LjQ6DQoNCldoeSBpc24ndCBnUlBDIGxp c3RlZCBpbiB0aGUgU2ltcGxlIERhdGEgcXVlcnk/DQoNClVuZGVyIEN1c3RvbSBEYXRhIFF1ZXJ5 LCB0aGVyZSBpcyBhIOKAnFlBTkcgRlNN4oCdIGRyYWZ0IGFzIGFuIGluZGl2aWR1YWwgZHJhZnQg aW4gbmV0bW9kLCBidXQgaXTigJlzIG5vdCBjbGVhciB3aGF0IHRoZSBmdXR1cmUgaXMuICBUaGVy ZSBzZWVtcyB0byBiZSBhIGdlbmVyYWwgdGhvdWdodCB0aGF0IGV2ZW50LWRyaXZlbiBZQU5HIGlz IHVzZWZ1bCwgYnV0IGlmIHRoYXQgd2lsbCBiZSBhbiBGU00gcGVyIHNlIGlzIHlldCB0byBiZSBz ZWVuLg0KDQpXaGF0IGlzIFBCVD8gIEkgZGlkbid0IHNlZSBpdCBpbiBnbG9zc2FyeS4NCg0KPT09 DQoNClRoYXQncyBpdCBmb3Igbm93LiAgSSB0aGluayB0aGlzIHdpbGwgZ2l2ZSB5b3UgYSBsb3Qg dG8gY2hldyBvbi4NCg0KSm9lDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQpPUFNBV0cgbWFpbGluZyBsaXN0DQpPUFNBV0dAaWV0Zi5vcmcNCmh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vb3BzYXdnDQo=