Subject: [netmod] mandatory ACL type (was "comments on acl-model-02")

From: "Sterne, Jason (Jason)" <[email-masked]>
Date: Mon, 13 Apr 2015 14:11:30 +0000

Hi guys,

Extracting my comments about ACL type into its own thread.  I saw Martin also had some comments on this topic.

The ACL type was mandatory in an older version of the draft and I think we should put it back as mandatory.  Implementations that don't *need* that leaf value can work fine whether they get it during ACL creation or not but some implementations need to know the type.

It would also be good to create separate identities for IPv4-access-control-list and IPv6-access-control-list instead of bundling them into IP-access-control-list. If we're separating into types in the model it should be the 3 basic types in the base model:  v4, v6 and enet.

That would also help if we decide to put some constraints that allow/disallow certain matching criteria when the type is a specific value (e.g. don't allow a v6 address match in a v4 list).  We'd have to be careful about how those constraints are formulated though - especially if we want to allow augmentations of the list-type for "mixed" ACLs. A new "mixed-v4-enet" type (identity) would also need to use the destination-ipv4-network matching criteria (can "when" or "must" logic be changed by an augmentation ?  I'm not sure that works).

Regards,
Jason

---

From: "Sterne, Jason (Jason)" <[email-masked]>
Date: Fri, 24 Apr 2015 19:12:59 +0000

Hi all,

To add some more info for my suggestions below:

Cisco IOS-XR has separate lists for ipv4 and ipv6 (probably IOS as well - didn't check):
ipv4 access-list <name>
ipv6 access-list <name>

Junos has separate lists for v4 and v6:
access-list <xyz> ...
ipv6 access-list <abc> ...

ALU SR OS has separate lists for v4 and v6 (and mac):
filter ip-filter <id|name> ...
filter ipv6-filter <id|name> ...
filter mac-filter <id|name> ...

Huawei uses separate lists for v4 and v6:
acl number 3000
acl ipv6 number 3000

Having a mandatory type fits in better with all those models and is fine for implementations that don't need the type.

Regards,
Jason

-----Original Message-----
From: netmod [mailto:[email-masked]] On Behalf Of Sterne, Jason (Jason)
Sent: Monday, April 13, 2015 10:12 AM
To: [email-masked]
Subject: [netmod] mandatory ACL type (was "comments on acl-model-02")

Hi guys,

Regards,
Jason

_______________________________________________
netmod mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netmod