Subject: Re: [netmod] FW: New Version Notification for draft-bogdanovic-netmod-acl-model-01.txt

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 08 Jul 2014 17:26:11 +0200

Hi,

I think a data model for route filters will be badly needed before long,
and since route filters are based on the same ACL model, perhaps it
would be useful to generalize this draft to include route filters as
well.

Lada

"Lisa Huang (yihuan)" <[email-masked]> writes:

> The document contains a base ACL model that could be flexibly extended or
> adapted by different vendors. It is with cross-company support. We will be
> presenting this work at the netmod WG meeting.
>
> We wish to acknowledge the helpful contributions, comments, and
> suggestions from Alex Clem and Andy Bierman on ACL model, who also
> co-authored draft-huang-netmod-acl.
>
> Thanks,
>
> Lisa
>
> On 6/26/14 11:54 AM, "Dana Blair (dblair)" <[email-masked]> wrote:
>
>>FYI and comments Š
>>
>>Here is an initial draft proposal for a YANG model for an Access Control
>>List.
>>
>>
>>I need to clarify Cisco's position on this proposal for an Access Control
>>List yang model since
>>there was an expired draft, draft-huang-netmod-acl-03.txt, which had Cisco
>>authorship.
>>
>>Cisco's position is to support this new draft,
>>draft-bogdanovic-netmod-acl-model-01.txt,
>>and not support the expired draft, draft-huang-netmod-acl-03.txt.
>>
>>Changes from version 00 to 01 of draft-bogdanovic-netmod-acl-model.
>>1.  Complete the list of authors
>>2.  Add grouping timerange
>>3.  Fix the XML example
>>4.  Remove some terms from "Definitions and Acronyms" which were not used.
>>
>>thanks,
>>Dana
>>
>>
>>On 6/26/14 12:49 PM, "[email-masked]" <[email-masked]>
>>wrote:
>>
>>>
>>>A new version of I-D, draft-bogdanovic-netmod-acl-model-01.txt
>>>has been successfully submitted by Dean Bogdanovic and posted to the
>>>IETF repository.
>>>
>>>Name:		draft-bogdanovic-netmod-acl-model
>>>Revision:	01
>>>Title:		ACL YANG model
>>>Document date:	2014-06-26
>>>Group:		Individual Submission
>>>Pages:		17
>>>URL:            
>>>http://www.ietf.org/internet-drafts/draft-bogdanovic-netmod-acl-model-01.
>>>t
>>>xt
>>>Status:         
>>>https://datatracker.ietf.org/doc/draft-bogdanovic-netmod-acl-model/
>>>Htmlized:       
>>>http://tools.ietf.org/html/draft-bogdanovic-netmod-acl-model-01
>>>Diff:           
>>>http://www.ietf.org/rfcdiff?url2=draft-bogdanovic-netmod-acl-model-01
>>>
>>>Abstract:
>>>   This document describes information and data model of Access Control
>>>   List (ACL) basic building blocks.
>>>
>>>                 
>>>        
>>>
>>>
>>>Please note that it may take a couple of minutes from the time of
>>>submission
>>>until the htmlized version and diff are available at tools.ietf.org.
>>>
>>>The IETF Secretariat
>>>
>>
>>_______________________________________________
>>netmod mailing list
>>[email-masked]
>>https://www.ietf.org/mailman/listinfo/netmod
>
> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C

---

From: "Dana Blair (dblair)" <[email-masked]>
Date: Tue, 8 Jul 2014 15:50:02 +0000

Can you provide a route filters example ?  We'll take a look.

Dana

---

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 8 Jul 2014 18:14:41 +0200

> Can you provide a route filters example ?  We'll take a look.

Cisco IOS:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/command/iri-cr-book/iri-cr-a1.html#wp2791314648

Junos:

https://www.juniper.net/techpubs/en_US/junos14.1/topics/usage-guidelines/policy-configuring-route-lists-for-use-in-routing-policy-match-conditions.html

BIRD:

http://bird.network.cz/?get_doc&f=bird-5.html

Lada

---

From: Dean Bogdanovic <[email-masked]>
Date: Tue, 8 Jul 2014 16:25:28 +0000

Dana,

The route filters have the same structure as firewall filters. There can be multiple ACEs in one ACL. Each ACE has match condition followed by action.

example for Juniper

policy-statement hosts-only {
	term1 {
		from {
			route-filter 10.0.0.0/16 upto /31 reject;
		}
		then accept;
	}
}

So we can use the same containers match and action, but have to add new ace-type route-filter in the match container. See which match statements are common between vendors and which would go into vendor specific module.

Dean

---

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 8 Jul 2014 18:36:40 +0200

Hi Dean,

> So we can use the same containers match and action, but have to add new ace-type route-filter in the match container. See which match statements are common between vendors and which would go into v…

Exactly. In terms of YANG module structure, one module should define only the ACL-ACE framework, and other modules should augment it with specific match conditions and action types.

Thanks, Lada

---

From: "Dana Blair (dblair)" <[email-masked]>
Date: Wed, 9 Jul 2014 14:11:04 +0000

On 7/8/14 12:25 PM, "Dean Bogdanovic" <[email-masked]> wrote:

>Dana,
>
>The route filters have the same structure as firewall filters. There can
>be multiple ACEs in one ACL. Each ACE has match condition followed by
>action.
>
>example for Juniper
>
>So we can use the same containers match and action, but have to add new
>ace-type route-filter in the match container. See which match statements
>are common between vendors and which would go into vendor specific module.

OK.  Makes sense.  So the next step is to a yang augmentation which
defines the route-filter.

thanks,
Dana

>>>> adapted by different vendors. It is with cross-company support. We
>>>>will
>>>> be
>>>>>>http://www.ietf.org/internet-drafts/draft-bogdanovic-netmod-acl-model
>>>>>>-0
>>>>>> 1.
>>>>>> t
>>>>>> xt
>>>>>> Status: