Subject: Re: [netmod] Some comments about ACL YANG model.

From: Reinaldo Penno <[email-masked]>
Date: Fri, 10 Oct 2014 12:03:21 -0700

My suggestion would be to keep ACL draft as an intersection of ACL features
found in vendor equipment as opposed to union. Keep it tight and small. One
of the problems of the previous ACL draft is that it tried to cover every
single possible feature.  Folks can always augment ACL document with all
kinds of features they need.

From:  "Lisa Huang (yihuan)" <[email-masked]>
Date:  Friday, October 10, 2014 at 11:30 AM
To:  Yangang <[email-masked]>, "Dana Blair (dblair)" <[email-masked]>,
"[email-masked]" <[email-masked]>, Dean Bogdanovic
<[email-masked]>, "Benoit Claise (bclaise)" <[email-masked]>
Cc:  Zhengguangying <[email-masked]>, "[email-masked]"
<[email-masked]>, Lizhenbin <[email-masked]>
Subject:  Re: [netmod] Some comments about ACL YANG model.

Yanggang, thanks for your review. Response in line.

From: Yangang <[email-masked]>
Date: Friday, October 10, 2014 4:22 AM
To: "Dana Blair (dblair)" <[email-masked]>, Microsoft Office User
<[email-masked]>, "[email-masked]" <[email-masked]>, Dean
Bogdanovic <[email-masked]>, "Benoit Claise (bclaise)"
<[email-masked]>
Cc: "[email-masked]" <[email-masked]>, Zhengguangying
<[email-masked]>, "Liubing (Leo)" <[email-masked]>,
Lizhenbin <[email-masked]>
Subject: Some comments about ACL YANG model.

Hi, 
 
I am reviewing the ACL YANG model. And I got some doubts, maybe somebody can
help me to understand it.
 
1.     There is one field: targets. In my understanding, maybe it is used to
record who reference this ACL. I don¹t know if Is it mandatory or not. Or my
understanding is wrong.

<yihuan>List of targets where ACL is applied. It is optional.

2.     In packet-fields module, It looks the current definition is not so
sufficient. For example, no "!=" definition,

<yihuan>Can you clarify? Do you mean != for port source-port-range or
destination-port-range? The draft doesn't intend to cover all fields in a
packet but allows vendor to augment the model and extend the features.

and no mask in acl-ipv4-header-fields group, etcŠ..

<yihuan> Each leaf in acl-ipv4-header-fields group includes prefix because
of its type. We can enhance the description or the leaf name to avoid
confusion.

leaf destination-ipv4-address {
            type inet:ipv4-prefix;
        }

3.     In this draft, there is acl-type and ace-type. It looks the IP packet
match and Ethernet packet match can be configured together. But it looks
only "OR" relationship is at there, no "AND" relationship.

Thanks
Yangang
_______________________________________________ netmod mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/netmod

---

From: Yangang <[email-masked]>
Date: Sat, 11 Oct 2014 23:36:15 +0000

Hi,

Yes, I agree. Right now, maybe the question is how to define the smallest function set.

If this range is too big, some verders can not support all functions, even current define, the IPV4 and IPV6, even ethernet header match, can be configured in one ACL, but some vendor just support IPV4 ACL, IPV6 ACL, and L2 ACL. It have relation with performance and hardware.

But if this basic functioin is too small. For NMS, there is no difference between "integration with private extension" and "integration with private definition".

I just join this discussion recently, maybe something already is discussed.

Yangang.

________________________________
发件人: Reinaldo Penno [[email-masked]]
发送时间: 2014年10月11日 3:03
收件人: Lisa Huang (yihuan); Yangang; Dana Blair (dblair); [email-masked]; Dean Bogdanovic; Benoit Claise (bclaise)
抄送: Zhengguangying; [email-masked]; Lizhenbin
主题: Re: [netmod] Some comments about ACL YANG model.

My suggestion would be to keep ACL draft as an intersection of ACL features found in vendor equipment as opposed to union. Keep it tight and small. One of the problems of the previous ACL draft is that it tried to cover every single possible feature.  Folks can always augment ACL document with all kinds of features they need.

From: "Lisa Huang (yihuan)" <[email-masked]<mailto:[email-masked]>>
Date: Friday, October 10, 2014 at 11:30 AM
To: Yangang <[email-masked]<mailto:[email-masked]>>, "Dana Blair (dblair)" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Dean Bogdanovic <[email-masked]<mailto:[email-masked]>>, "Benoit Claise (bclaise)" <[email-masked]<mailto:[email-masked]>>
Cc: Zhengguangying <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Lizhenbin <[email-masked]<mailto:[email-masked]>>
Subject: Re: [netmod] Some comments about ACL YANG model.

From: Yangang <[email-masked]<mailto:[email-masked]>>
Date: Friday, October 10, 2014 4:22 AM
To: "Dana Blair (dblair)" <[email-masked]<mailto:[email-masked]>>, Microsoft Office User <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Dean Bogdanovic <[email-masked]<mailto:[email-masked]>>, "Benoit Claise (bclaise)" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Zhengguangying <[email-masked]<mailto:[email-masked]>>, "Liubing (Leo)" <[email-masked]<mailto:[email-masked]>>, Lizhenbin <[email-masked]<mailto:[email-masked]>>
Subject: Some comments about ACL YANG model.

Hi,

I am reviewing the ACL YANG model. And I got some doubts, maybe somebody can help me to understand it.

1.      There is one field: targets. In my understanding, maybe it is used to record who reference this ACL. I don’t know if Is it mandatory or not. Or my understanding is wrong.

2.      In packet-fields module, It looks the current definition is not so sufficient. For example, no "!=" definition,

<yihuan>Can you clarify? Do you mean != for port source-port-range or destination-port-range? The draft doesn't intend to cover all fields in a packet but allows vendor to augment the model and extend the features.

and no mask in acl-ipv4-header-fields group, etc…..

<yihuan> Each leaf in acl-ipv4-header-fields group includes prefix because of its type. We can enhance the description or the leaf name to avoid confusion.

            type inet:ipv4-prefix;
        }

3.      In this draft, there is acl-type and ace-type. It looks the IP packet match and Ethernet packet match can be configured together. But it looks only "OR" relationship is at there, no "AND" relationship.

Thanks
Yangang
_______________________________________________ netmod mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/netmod