Subject: [netmod] Some comments about ACL YANG model.

From: Yangang <[email-masked]>
Date: Fri, 10 Oct 2014 11:22:13 +0000

Hi,

I am reviewing the ACL YANG model. And I got some doubts, maybe somebody can help me to understand it.

1.      There is one field: targets. In my understanding, maybe it is used to record who reference this ACL. I don't know if Is it mandatory or not. Or my understanding is wrong.

2.      In packet-fields module, It looks the current definition is not so sufficient. For example, no "!=" definition, and no mask in acl-ipv4-header-fields group, etc.....

3.      In this draft, there is acl-type and ace-type. It looks the IP packet match and Ethernet packet match can be configured together. But it looks only "OR" relationship is at there, no "AND" relationship.

Thanks
Yangang

---

From: "Lisa Huang (yihuan)" <[email-masked]>
Date: Fri, 10 Oct 2014 18:30:31 +0000

Yanggang, thanks for your review. Response in line.

From: Yangang <[email-masked]<mailto:[email-masked]>>
Date: Friday, October 10, 2014 4:22 AM
To: "Dana Blair (dblair)" <[email-masked]<mailto:[email-masked]>>, Microsoft Office User <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Dean Bogdanovic <[email-masked]<mailto:[email-masked]>>, "Benoit Claise (bclaise)" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Zhengguangying <[email-masked]<mailto:[email-masked]>>, "Liubing (Leo)" <[email-masked]<mailto:[email-masked]>>, Lizhenbin <[email-masked]<mailto:[email-masked]>>
Subject: Some comments about ACL YANG model.

Hi,

1.      There is one field: targets. In my understanding, maybe it is used to record who reference this ACL. I don’t know if Is it mandatory or not. Or my understanding is wrong.

<yihuan>List of targets where ACL is applied. It is optional.

2.      In packet-fields module, It looks the current definition is not so sufficient. For example, no "!=" definition,

<yihuan>Can you clarify? Do you mean != for port source-port-range or destination-port-range? The draft doesn't intend to cover all fields in a packet but allows vendor to augment the model and extend the features.

and no mask in acl-ipv4-header-fields group, etc…..

<yihuan> Each leaf in acl-ipv4-header-fields group includes prefix because of its type. We can enhance the description or the leaf name to avoid confusion.

leaf destination-ipv4-address {

            type inet:ipv4-prefix;
        }

Thanks
Yangang

---

From: Yangang <[email-masked]>
Date: Sat, 11 Oct 2014 23:20:02 +0000

________________________________
发件人: Lisa Huang (yihuan) [[email-masked]]
发送时间: 2014年10月11日 2:30
收件人: Yangang; Dana Blair (dblair); [email-masked]; Dean Bogdanovic; Benoit Claise (bclaise)
抄送: [email-masked]; Zhengguangying; Liubing (Leo); Lizhenbin
主题: Re: Some comments about ACL YANG model.

Hi,

<yihuan>Can you clarify? Do you mean != for port source-port-range or destination-port-range? The draft doesn't intend to cover all fields in a packet but allows vendor to augment the model and extend the features.
<Yangang>: I understand this draft can not cover all scenarios. But I think the basic capability may be provided at first, like "==", "!=", and this range.

            type inet:ipv4-prefix;
        }

<Yangang>: No understand, how to support the wildcard mask in perfix match? like command: rule [ rule-id ] { deny | permit } source { source-ip-address source-wildcard | any }

Thanks
Yangang