[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: snmpconf General Functional Questions - AKA Policy Overrides.



on 07/12/2000 4:24 PM, Joel M. Halpern at joel@mcquillan.com wrote:

> I think I understand what you are asking for.  If there were a way without
> excessive violence to the system to cause the "user" to get an error if he
> tried to change something that was under policy control without first removing
> it, I would at least be sympathetic to the two step process.
> 
> But, if we make it a two step process without such coupling, what happens is
> that the "user" makes a change, gets no error, and comes back later and
> discovers it is gone.  The "user" involved may well not be familiar with the
> policy mechanisms (someone else takes care of that).  He needs to make the
> change.  Forcing him to try to go through audit logs to figure out what
> happened is not sensible, particularly since network management is NOT this
> "user"s primary task.  he is a network engineer trying to fix a customer
> problem. Whether this "user" is aware of the organizations desired policies is
> an organizational issue, not a protocol issue.  Making sure that there is
> someway to tell that he has overriden the policy (the flag that can be
> checked, and the logs to say who set the flag) is a protocol issue.
> 
> It may be that different organizations desire different behaviors in this
> regard.  Experience suggests to me however that the larger organizations which
> most want policy also have folks who need to make changes without significant
> hinderance.  And adding more options to the behavior does not seem like a good
> way out of this mess.  That will just give our users more ways to get
> confused.

In preparing for the upcoming meeting, I see that there were some notes from
Steve Waldbusser and Joel that I had not properly responded to. I choose to
respond to this note since I think Joel summarizes the issue well.

The issue we have had is that some of us do not want the person who needs to
override a policy on an element to have to know which object to set in the
Policy MIB Module and thus a lot of details not relevant to the operational
task at hand. Steve wanted to have an explicit object to set to cause people
to know that they are overriding a policy also a good goal.

I do see a way that a CLI could be implemented such that it could ask a user
to 'confirm' their action if the action includes changing the value of an
element under policy control. This would be a implementation detail not part
of the protocol. Obviously SNMP-based managers can do even more. I still
think it would be best not to require the user to have to write a specific
SNMP object to override a policy.

I am sure we will have some fun with this at the meeting :-)
/jon