[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

snmpconf updated draft



Hi,

I've just submitted the attached document as
draft-ietf-snmpconf-diffpolicy-06.txt

Cheers,

David





Internet Draft  Differentiated Services Configuration MIB      June 2003


Internet Engineering Task Force                            H. Hazewinkel
INTERNET-DRAFT                                                Consultant
Expires December 2003                                         D. Partain
                                                                Ericsson
                                                               June 2003


             The Differentiated Services Configuration MIB
                 draft-ietf-snmpconf-diffpolicy-06.txt
                               June 2003






Status of this Memo

   This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet- Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This document is a product of the IETF's Configuration Management
   with SNMP Working Group.  Comments should be addressed to WG's
   mailing list at snmpconf@snmp.com. The charter for the Working Group
   may be found at http://www.ietf.org/html.charters/snmpconf-
   charter.html

   Distribution of this memo is unlimited.






SNMPCONF WG               Expires December 2003                 [Page 1]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






Copyright Notice

   Copyright (C) The Internet Society (2002).  All Rights Reserved.







Abstract

   This memo describes a MIB module that provides a conceptual layer
   between high-level "network-wide" policy definitions that affect
   configuration of the Differentiated Services (diffserv) subsystem and
   the instance-specific information that would include such details as
   the parameters for all the queues associated with each interface in a
   system.  This essentially provides an interface for configuring
   differentiated services at a conceptually higher layer than that of
   the Differentiated Services MIB.






























SNMPCONF WG               Expires December 2003                 [Page 2]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






Table of Contents

   1 The Internet-Standard Management Framework ...................    4
   2 Introduction .................................................    4
   3 Other Documents ..............................................    4
   4 Relationship to other MIBs ...................................    5
   4.1 The Policy-based Management MIB module .....................    5
   4.2 The Differentiated Services MIB module .....................    5
   5 The Differentiated Services Configuration MIB module design
        ...........................................................    6
   6 Template cloning .............................................    7
   6.1 An Approach to Template Cloning ............................    8
   6.2 Example ....................................................    9
   6.2.1 The initial situation ....................................    9
   6.2.2 The configuration template ...............................   11
   6.2.3 Applying the template ....................................   13
   7 Managed objects definitions (MIB module) .....................   17
   8 Security Considerations ......................................   24
   9 Acknowledgements .............................................   24
   10 Editors' Addresses ..........................................   24
   11 Full Copyright Statement ....................................   25
   12 Informative References ......................................   25
   13 Normative References ........................................   26



























SNMPCONF WG               Expires December 2003                 [Page 3]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






1.  The Internet-Standard Management Framework

   For a detailed overview of the documents that describe the current
   Internet-Standard Management Framework, please refer to section 7 of
   RFC 3410 [RFC3410].

   Managed objects are accessed via a virtual information store, termed
   the Management Information Base or MIB.  MIB objects are generally
   accessed through the Simple Network Management Protocol (SNMP).
   Objects in the MIB are defined using the mechanisms defined in the
   Structure of Management Information (SMI).  This memo specifies a MIB
   module that is compliant to the SMIv2, which is described in STD 58,
   RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
   [RFC2580].


2.  Introduction

   This memo defines a MIB module that can be used to convey management
   information about desired network-wide Differentiated Services based
   policy behavior. This module is designed to integrate with the
   Policy-based Management MIB module [PMMIBDR] as well as the
   Differentiated Services MIB module [RFC3289].  Together, these three
   documents represent an instance of an integrated architecture for
   both device-specific and network-wide policy (configuration)
   management which is fully integrated with the Internet Standard
   Management Framework.

   The Differentiated Services MIB module [RFC3289] operates on a device
   level.  The MIB module in this memo, the DIFFSERV-CONFIG-MIB, creates
   a coherent configuration management view as an umbrella over
   [RFC3289].  That is, the DIFFSERV-CONFIG-MIB provides a conceptual
   API for configuration of Differentiated Services parameters. Since
   the Differentiated Services MIB module is able to maintain
   configuration information, the DIFFSERV-CONFIG-MIB configuration API
   consists only of configuration template information and the start of
   the so-called functional datapath.


3.  Other Documents

   It is assumed that the reader is familiar with Differentiated
   Services ([RFC2474] and [RFC2475]), the Policy-based Management MIB
   ([PMMIBDR]) and the BCP entitled "Configuring Networks and Devices
   With SNMP" ([RFC3512]).  These documents include all of the necessary





SNMPCONF WG               Expires December 2003                 [Page 4]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   terminology for understanding this memo.  [RFC3512] also provides an
   example MIB module which may help in understanding the relationship
   between DIFFSERV-CONFIG-MIB and the Differentiated Services MIB in
   [RFC3289].


4.  Relationship to other MIBs

   In this section we describe the relationship of this MIB module to
   other MIB modules.  The overall architecture used for policy
   configuration management is described in [PMMIBDR].


4.1.  The Policy-based Management MIB module

   [PMMIBDR] defines a MIB module that enables policy-based
   configuration management of infrastructure using the Internet
   Standard Management Framework.  The document includes a table for
   configuring policies to be implemented, tables for storing the roles
   of elements on a particular device, a table for representing the
   capabilities of a device with respect to policy management, a table
   for referencing elements affected by a policy, as well as other
   infrastructure.

   See [PMMIBDR] for a full description of the policy-based
   configuration framework it provides.


4.2.  The Differentiated Services MIB module

   The Differentiated Services MIB module [RFC3289] provides a common
   set of managed objects useful for configuring Differentiated Services
   parameters on a Differentiated Services capable device. This is what
   is referred to as instance-level configuration. It is the alteration
   of the instance-level information in that MIB module which may be
   done via the objects provided by the Differentiated Services
   Configuration MIB module defined in this memo.

   It is recognized that vendors may include additional managed objects
   in their devices (via vendor-specific MIB modules) for configuring
   Differentiated Services parameters. If a vendor chooses to use the
   objects defined in this memo for configuration, the vendor should
   provide additional managed objects in a similar approach as defined
   for the Differentiated Services MIB module.






SNMPCONF WG               Expires December 2003                 [Page 5]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   Since the managed objects of the Differentiated Services MIB
   [RFC3289] are not directly associated with an instance (interface and
   interface direction), the same managed objects can be used for
   traffic treatment configuration templates in a Differentiated
   Services capable device and can then be applied on multiple
   instances.  Therefore, the tables as defined in the Differentiated
   Services MIB can directly be used for template configuration
   purposes.  Those tables are:

       - diffServClfrTable
       - diffServClfrElementTable
       - diffServMultiFieldClfrTable
       - diffServMeterTable
       - diffServTBParamTable
       - diffServActionTable
       - diffServDscpMarkActTable
       - diffServCountActTable
       - diffServAlgDropTable
       - diffServRandomDropTable
       - diffServQTable
       - diffServSchedulerTable
       - diffServMinRateTable
       - diffServMaxRateTable

   Readers familiar with the Differentiated Services MIB will notice
   that these are all templates.  Only the diffServDataPathTable defines
   a managed instance for Differentiated Services traffic treatment by
   its indexes of the interface and its interface direction.  This also
   allows the tables mentioned above to be used as a configuration
   template without defining anything directly related to a managed
   instance.


5.  The Differentiated Services Configuration MIB module design

   The Differentiated Services Configuration MIB module (in this memo)
   of the SNMP-based configuration management framework is positioned
   between the Policy-based Management MIB module and the instance-
   specific Differentiated Services MIB module as described above.

   The MIB module found in this memo is designed to maintain
   configuration templates for the Differentiated Services MIB [RFC3289]
   module.  The module only has a template table that describes a
   Differentiated Services traffic treatment by providing the starting
   pointer of the functional datapath.  The templates represent a





SNMPCONF WG               Expires December 2003                 [Page 6]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   specific configuration of traffic treatment in a functional datapath
   of a Differentiated Services capable device. To avoid duplication of
   managed objects, the actual templates defining the functional
   datapath are defined in the Differentiated Services MIB module.
   These are also used for the management of the instances. Therefore,
   the implementation of the DIFFSERV-CONFIG-MIB module uses the tables
   defined in the Differentiated Services MIB.  As soon as a
   configuration is made active via the POLICY-MANAGEMENT-MIB, the
   configuration defined within this MIB module will be instantiated in
   the DIFFSERV-MIB.

   Note that this is a conceptual process. That is, the configuration
   may not actually go through an API available in the subsystem which
   implements the DIFFSERV-MIB module.  However, configuration via the
   DIFFSERV-CONFIG-MIB module will alter the same instrumentation as the
   DIFFSERV-MIB module whether it does it via the DIFFSERV-MIB module or
   not.

   The Differentiated Services Configuration MIB module only needs to
   define a starting point of a traffic treatment configuration
   template. This table is similar to the diffServDataPathTable
   [RFC3289]. However, it has a semantic difference in that the
   diffServDataPathTable is associated with an instance (interface and
   interface direction), whereas the diffServConfigTable in this memo is
   not.

   Unlike most MIB modules, changes to the managed objects in this MIB
   module do not cause a change in the device.  This MIB module is used
   to set up per-hop-behavior configurations. As soon as configurations
   are made active via the POLICY-MANAGEMENT-MIB, the configurations
   defined within this MIB module will be instantiated in the DIFFSERV-
   MIB.

   The only table in this MIB module is the diffServConfigTable, which
   provides managed objects for registering traffic treatment
   configurations used in differentiated services. The sole purpose of
   this table is to provide the starting point for a traffic treatment
   configuration template.  The traffic treatment itself is performed by
   functional datapath elements [RFC3289].


6.  Template cloning

   The concept of the DIFFSERV-CONFIG-MIB is based on having traffic
   treatment configuration templates. The templates provide a set of





SNMPCONF WG               Expires December 2003                 [Page 7]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   configuration values that provide a certain behavior, such as EF
   traffic treatment, in the functional datapath.  The template (or
   functional datapath) is similar to a linked list from a starting
   point and each (functional datapath) element is connected to the next
   element via a so-called the element.

   The moment a template is activated (instantiated) on an interface and
   its interface direction, the template needs to be copied/cloned, so
   that the template remains as a template.  If the template is no
   longer available as a template after an instantiation, the management
   station has to set up a new equivalent template, and the object
   amplification of configuration with SNMP is gone.

   A literal copy/clone of the template would not be possible, since the
   same indexes inside the element tables cannot be re-used. The
   instantiation process must therefore generate a new index for each
   element. As a result of this, the 'NEXT' pointers also need to be
   updated. Otherwise, those will point to the template.


6.1.  An Approach to Template Cloning

   What should a system containing Differentiated Services capabilities
   and Differentiated Services configuration capabilities do
   conceptually at the moment a template is activated on an interface?
   The following order or approach should not be considered
   implementation guidelines, but rather a conceptual explanation of
   what should be done.

     1) Get the index of the template to be activated
     2) Get RowPointer (current) from
           diffServConfigStart.index
           of the diffServConfigTable
     3) Check if RowPointer (current) exists
     4) Copy/Clone the entry pointed to by RowPointer
           a) Get a new index for the entry
           b) Configure the new entry with the values
              of the entry to be cloned
           c) Update the NEXT pointer with a new RowPointer
              that pointed to the previous entry that was copied
              part of this template
     5) Store RowPointer of cloned entry as previous
     6) Get the RowPointer of the next element in the template
        as current
     7) If current RowPointer does not equal zeroDotZero go to 4





SNMPCONF WG               Expires December 2003                 [Page 8]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






6.2.  Example

   This section provides an example of the process described in the
   previous section. This example will show a Differentiated Services
   capable incoming (ingress) interface that only counts the traffic
   stream. Then, with the policy-based configuration concept as defined
   in this document and in [PMMIBDR], a traffic marking configuration
   will be applied.  The example will walk the reader through all of the
   steps involved in this process.

      NOTE WELL:  For brevity and clarity, the example does not always
      show the complete entry (row) of a table. The only objects shown
      are those needed for creating the row pointers to the next
      functional datapath element or needed to provide information about
      the specific parameters of the functional datapath elements.  The
      column named 'INDEX' always defines the complete index as defined
      for the associated entry. In some cases this is a combined index
      of multiple components. Therefore, the names of the columns are
      omitted.


6.2.1.  The initial situation

   The initial configuration is the existing configuration of an ingress
   interface.

      +------------------------------------------------------------+
      |   ingress functional datapath                              |
      |                        +----------+                        |
   -->|----------->----------->| count    |----------->----------->|-->
      |                        +----------+                        |
      +------------------------------------------------------------+

   This figure depicts a simple traffic treatment functional datapath
   for an ingress interface. The functional datapath only consists of a
   count action.

   Within the DIFFSERV-MIB this would be instantiated as follows in the
   appropriate tables. Note that RowPointer objects must point to the
   first accessible columnar object in the conceptual row.  Thus, while
   perhaps more instructive to use the index value for the RowPointer
   object's value (e.g., diffServCountActId.1) in the example, it would
   nonetheless be incorrect, and the first accessible columnar object
   has been used as should be done (e.g., diffServCountActOctets.1).






SNMPCONF WG               Expires December 2003                 [Page 9]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   diffServDataPathTable
   +-----------------+-----------------------------+
   | INDEX           | diffServDataPathStart       |
   +-----------------+-----------------------------+
   | ifIndex.ingress | diffServActionNext.1        |
   +-----------------+-----------------------------+












































SNMPCONF WG               Expires December 2003                [Page 10]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   diffServActionTable
   +-------+--------------------+-------------------------+
   | INDEX | diffServActionNext |diffServActionSpecific   |
   +-------+--------------------+-------------------------+
   | 1     | 0.0                |diffServCountActOctets.1 |
   +-------+--------------------+-------------------------+

   diffServCountActTable
   +-------+------------------------+
   | INDEX | diffServCountActOctets |
   +-------+------------------------+
   | 1     |                        |
   +-------+------------------------+


6.2.2.  The configuration template

   The following provides an example of a policy configuration in which
   traffic is classified by a specific IP filter. That results in two
   classifiers (1 for the IP filter and the match all). Both streams are
   then metered, marked and counted. This is an example of usage on the
   edge (an ingress interface) of an Differentiated Services domain that
   wants to have EF and AF marked traffic within the Differentiated
   Services domain.

      +------------------------------------------------------------+
      |   ingress functional datapath                              |
      |   +------------+   +-------+   +---------+   +---------+   |
      |   |            |   |       |   | action: |   | action: |   |
   -->|-->| classifier |-->| meter |-->| mark EF |-->| count   |-->|----->
      |   | match <IP> |   |       |   |         |   |         |   |
      |   +------------+   +-------+   +---------+   +---------+   |
      |         |                 \                                |
      |         |                  \      +---------+              |
      |         |                   \     | action: |              |routing
      |         |                    * -->| dropper |              |core
      |         |                   /     |         |              |
      |         |                  /      +---------+              |
      |         V                 /                                |
      |   +------------+   +-------+   +---------+   +---------+   |
      |   |            |   |       |   | action: |   | action: |   |
      |   | classifier |-->| meter |-->| mark AF |-->| count   |-->|----->
      |   | match all  |   |       |   |         |   |         |   |
      |   +------------+   +-------+   +---------+   +---------+   |
      +------------------------------------------------------------+





SNMPCONF WG               Expires December 2003                [Page 11]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   This figure depicts a policy configuration for ingress traffic
   treatment in a Differentiated Services capable device. The
   configuration is represented as follows in DIFFSERV-CONFIG-MIB module
   and the DIFFSERV-MIB module.

   NOTE: the original (existing) traffic treatment of 1) is also in the
   tables.

   diffServConfigTable (in the MIB module in this memo)
   +-------+------------------------+---------------------------+
   | INDEX | diffServConfigStart    | diffServConfigDescr       |
   +-------+------------------------+---------------------------+
   | 1     | diffServClfrStorage.1  | Example traffic treatment |
   +-------+------------------------+---------------------------+

   diffServClfrTable
   +-------+---------------------+
   | INDEX | diffServClfrStorage |
   +-------+---------------------+
   | 1     |                     |
   +-------+---------------------+

   diffServClfrElementTable (shares index with diffServClfrTable)
   +-------+---------------------------+-------------------------------+
   | INDEX | diffServClfrElementNext   | diffServClfrElementPrecedence |
   +-------+---------------------------+-------------------------------+
   | 1.1   |diffServMeterSucceedNext.1 | 1                             |
   | 1.2   |diffServMeterSucceedNext.2 | 2                             |
   +-------+---------------------------+-------------------------------+

   diffServMeterTable
   +-------+--------------------------+-----------------------+
   | INDEX | diffServMeterSucceedNext |diffServMeterFailNext  |
   +-------+--------------------------+-----------------------+
   | 1     | diffServActionNext.2     | diffServAlgDropType.1 |
   | 2     | diffServActionNext.3     | diffServAlgDropType.1 |
   +-------+--------------------------+-----------------------+













SNMPCONF WG               Expires December 2003                [Page 12]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   diffServActionTable
   +-------+----------------------+----------------------------+
   | INDEX | diffServActionNext   | diffServActionSpecific     |
   +-------+----------------------+----------------------------+
   | 1     | 0.0                  | diffServCountActOctets.1   |
   | 2     | diffServActionNext.4 | diffServDscpMarkActDscp.EF |
   | 3     | diffServActionNext.5 | diffServDscpMarkActDscp.AF |
   | 4     | 0.0                  | diffServCountActOctets.2   |
   | 5     | 0.0                  | diffServCountActOctets.3   |
   +-------+----------------------+----------------------------+

   diffServCountActTable
   +-------+------------------------+
   | INDEX | diffServCountActOctets |
   +-------+------------------------+
   | 1     |                        |
   | 2     |                        |
   | 3     |                        |
   +-------+------------------------+

   diffServAlgDropTable
   +-------+---------------------+-------------------------+
   | INDEX | diffServAlgDropType | diffServAlgDropSpecific |
   +-------+---------------------+-------------------------+
   | 1     | alwaysDrop(5)       | 0.0                     |
   +-------+---------------------+-------------------------+

   diffServDscpMarkActTable
   +-------------------------+
   | diffServDscpMarkActDscp |
   +-------------------------+
   | DSCP(EF)                |
   | DSCP(AF)                |
   +-------------------------+


6.2.3.  Applying the template

   Now we have the original ingress interface configuration and the
   policy configuration we want to apply to the actual interface.

   The example policy must provide to all interfaces used by system
   administrators the required Differentiated Services traffic
   treatment. The traffic treatment required is described in 6.2.2
   above.





SNMPCONF WG               Expires December 2003                [Page 13]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   Therefore, we have the following example policy which is configured
   via the POLICY-BASED-MANAGEMENT-MIB module (see [PMMIBDR]):

   if
      return roleMatch("Administrator")
   then
      /*
       * The $0 gets the "element" returned from the previous
       * statement.  the .2 at the end is the egress interface
       * This sets, for example, diffServDataPathStart.3.2 to be
       * diffServActionNext.1 if interface 3 has the role
       * "Administrator".
       */
      setVar("diffServDataPathStart.$0.2",
              "diffServActionNext.1", Oid)

   For our purposes, we only apply this on the outbound (egress)
   direction on the interface.

   Note that although object descriptors are used in this PolicyScript
   example, the object identifiers must be used in the running script.
   For more information on policies and their syntax refer to [PMMIBDR].

   The following tables of this section provide the cloned entries in
   the tables of the DIFFSERV-MIB module.  NOTE: the original (existing)
   traffic treatment of 6.2.1 and 6.2.2 are also in the tables.

   diffServConfigTable
   +-------+-------------------------+---------------------------+
   | INDEX | diffServConfigStart     | diffServConfigDescr       |
   +-------+-------------------------+---------------------------+
   | "foo" | diffServClfrStorage.1   | Example traffic treatment |
   +-------+-------------------------+---------------------------+

   diffServDataPathTable
   +-----------------+-----------------------------+
   | INDEX           | diffServDataPathStart       |
   +-----------------+-----------------------------+
   | ifIndex.ingress | diffServActionNext.2        |
   +-----------------+-----------------------------+










SNMPCONF WG               Expires December 2003                [Page 14]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   diffServClfrTable
   +-------+---------------------+
   | INDEX | diffServClfrStorage |
   +-------+---------------------+
   | 1     |                     |
   | 2     |                     |
   +-------+---------------------+

   diffServClfrElementTable
   +-------+----------------------------+-------------------------------+
   | INDEX | diffServClfrElementNext    | diffServClfrElementPrecedence |
   +-------+----------------------------+-------------------------------+
   | 1.1   | diffServMeterSucceedNext.1 | 1                             |
   | 1.2   | diffServMeterSucceedNext.2 | 2                             |
   | 2.3   | diffServMeterSucceedNext.3 | 1                             |
   | 2.4   | diffServMeterSucceedNext.4 | 2                             |
   +-------+----------------------------+-------------------------------+

   diffServMeterTable
   +-------+--------------------------+-----------------------+
   | INDEX | diffServMeterSucceedNext | diffServMeterFailNext |
   +-------+--------------------------+-----------------------+
   | 1     | diffServActionNext.2     | diffServAlgDropType.1 |
   | 2     | diffServActionNext.3     | diffServAlgDropType.1 |
   | 3     | diffServActionNext.6     | diffServAlgDropType.2 |
   | 4     | diffServActionNext.7     | diffServAlgDropType.2 |
   +-------+--------------------------+-----------------------+

   diffServActionTable
   +-------+----------------------+----------------------------+
   | INDEX | diffServActionNext   | diffServActionSpecific     |
   +-------+----------------------+----------------------------+
   | 1     | 0.0                  | diffServCountActOctets.1   |
   | 2     | diffServActionNext.4 | diffServDscpMarkActDscp.EF |
   | 3     | diffServActionNext.5 | diffServDscpMarkActDscp.AF |
   | 4     | 0.0                  | diffServCountActOctets.2   |
   | 5     | 0.0                  | diffServCountActOctets.3   |
   | 6     | diffServActionNext.8 | diffServDscpMarkActDscp.EF |
   | 7     | diffServActionNext.9 | diffServDscpMarkActDscp.AF |
   | 8     | 0.0                  | diffServCountActOctets.4   |
   | 9     | 0.0                  | diffServCountActOctets.5   |
   +-------+----------------------+----------------------------+








SNMPCONF WG               Expires December 2003                [Page 15]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   diffServCountActTable
   +-------+------------------------+
   | INDEX | diffServActCountOctets |
   +-------+------------------------+
   | 1     |                        |
   | 2     |                        |
   | 3     |                        |
   | 4     |                        |
   | 5     |                        |
   +-------+------------------------+

   diffServAlgDropTable
   +-------+---------------------+-------------------------+
   | INDEX | diffServAlgDropType | diffServAlgDropSpecific |
   +-------+---------------------+-------------------------+
   | 1     | alwaysDrop(5)       | 0.0                     |
   +-------+---------------------+-------------------------+

   diffServDscpMarkActTable
   +-------------------------+
   | diffServDscpMarkActDscp |
   +-------------------------+
   | DSCP(EF)                |
   | DSCP(AF)                |
   +-------------------------+


   As one can see in the example, the main elements from which a
   functional datapath are constructed are duplicated/copied/cloned.
   That process is needed in order to preserve the policy configuration
   for reuse at a later time.

   It is up to the SNMP agent to keep track of which network interfaces
   are under policy control and which policy rules are being used. This
   avoids duplication of policy enforcement.  How the agent does this is
   an implementation issue.

   One can see that the old functional datapath configurations stay in
   the MIB module tables. It is up to the SNMP agent implementation to
   decide whether to delete stale entries or keep them.  Garbage
   collection of stale entries is an implementation issue.









SNMPCONF WG               Expires December 2003                [Page 16]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






7.  Managed objects definitions (MIB module)


   DIFFSERV-CONFIG-MIB DEFINITIONS ::= BEGIN
       IMPORTS

       OBJECT-TYPE, MODULE-IDENTITY, zeroDotZero, mib-2
          FROM SNMPv2-SMI

       RowStatus, StorageType, RowPointer, DateAndTime
          FROM SNMPv2-TC

       MODULE-COMPLIANCE, OBJECT-GROUP
          FROM SNMPv2-CONF

       SnmpAdminString
          FROM SNMP-FRAMEWORK-MIB

       InetAddress, InetAddressType
          FROM INET-ADDRESS-MIB;

   diffServConfigMib MODULE-IDENTITY
       LAST-UPDATED "200205060000Z"
       ORGANIZATION "SNMPCONF WG"
       CONTACT-INFO
          "SNMPCONF Working Group
           http://www.ietf.org/html.charters/snmpconf-charter.html
        WG mailing list: snmpconf@snmp.com

           Editors:

           Harrie Hazewinkel
           Internet Management Consultant
           E-mail: harrie@lisanza.net

           David Partain
           Ericsson AB
           P.O. Box 1248
           SE-581 12 Linkoping
           Sweden
           E-mail: David.Partain@ericsson.com"
       DESCRIPTION
           "This MIB module contains differentiated services
           specific managed objects to perform higher-level
           configuration management. This MIB allows policies





SNMPCONF WG               Expires December 2003                [Page 17]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






           to use 'templates' to be used to instantiate
           Differentiated Services functional datapath
           configurations to be assigned (associated with
           an interface and direction) when a policy is
           activated."
       ::= { mib-2 xxx }  -- Needs to be assigned by before publishing

   diffServConfigMIBObjects OBJECT IDENTIFIER ::= { diffServConfigMib 1 }
   diffServConfigMIBConformance OBJECT IDENTIFIER ::= { diffServConfigMib 2 }

   --
   -- The Differentiated Services configuration objects
   --

   diffServConfigTable OBJECT-TYPE
       SYNTAX       SEQUENCE OF DiffServConfigEntry
       MAX-ACCESS   not-accessible
       STATUS       current
       DESCRIPTION
          "A table which defines the various per-hop-behaviors
          for which the system has default 'templates'."
       ::= { diffServConfigMIBObjects 2 }

   diffServConfigEntry OBJECT-TYPE
       SYNTAX       DiffServConfigEntry
       MAX-ACCESS   not-accessible
       STATUS       current
       DESCRIPTION
          "An entry defining a per-hop-behavior.  Each entry in
          this table combines the various parameters (entries)
          into a specific per-hop-behavior.  Entries in this
          table might be defined by a vendor (pre-configured)
          or defined by a management application."
       INDEX { diffServConfigId }
       ::= { diffServConfigTable 1 }

   DiffServConfigEntry ::= SEQUENCE {
       diffServConfigId           SnmpAdminString,
       diffServConfigDescr        SnmpAdminString,
       diffServConfigOwner        SnmpAdminString,
       diffServConfigLastChange   DateAndTime,
       diffServConfigStart        RowPointer,
       diffServConfigStorage      StorageType,
       diffServConfigStatus       RowStatus
   }





SNMPCONF WG               Expires December 2003                [Page 18]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   diffServConfigId OBJECT-TYPE
       SYNTAX         SnmpAdminString (SIZE(1..116))
       MAX-ACCESS     not-accessible
       STATUS         current
       DESCRIPTION
          "A unique id for the per-hop-behavior policy.  The range
          of up to 116 characters is chosen to stay within the SMI
          limit of 128 subidentifiers in an index."
       ::= { diffServConfigEntry 1 }

   diffServConfigDescr OBJECT-TYPE
       SYNTAX         SnmpAdminString
       MAX-ACCESS     read-create
       STATUS         current
       DESCRIPTION
          "A human-readable description to identify this defined
          per-hop-behavior.  Note that this is an SnmpAdminString,
          which permits UTF-8 strings.  An administratively assigned
          identifier for a template that would be unique within
          an adminstrative domain. It is up to the management
          applications to agree how these are assigned within the
          administrative domain.  Once a description, such as
          'EF' is assigned, that has a certain set of parameters
          that achieve 'EF' from box to box, so management
          application code or Script code can easily scan
          the table to find the proper template and then easily
          assign it."
       ::= { diffServConfigEntry 2 }

   diffServConfigOwner OBJECT-TYPE
       SYNTAX         SnmpAdminString
       MAX-ACCESS     read-create
       STATUS         current
       DESCRIPTION
          "The owner who created this entry."
       ::= { diffServConfigEntry 3 }

   diffServConfigLastChange OBJECT-TYPE
       SYNTAX         DateAndTime
       MAX-ACCESS     read-only
       STATUS         current
       DESCRIPTION
          "The date and time when this entry was last changed."
       ::= { diffServConfigEntry 4 }






SNMPCONF WG               Expires December 2003                [Page 19]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   diffServConfigStart OBJECT-TYPE
       SYNTAX         RowPointer
       MAX-ACCESS     read-create
       STATUS         current
       DESCRIPTION
          "The pointer to a functional datapath configuration template as
          set up in the DIFFSERV-MIB.  This RowPointer should
          point to an instance of one of:
            diffServClfrEntry
            diffServMeterEntry
            diffServActionEntry
            diffServAlgDropEntry
            diffServQEntry

          A value of zeroDotZero in this attribute indicates no
          further Diffserv treatment is performed on traffic of
          this functional datapath. This also means that the
          template described by this row is not defined.

          If the row pointed to does not exist, the treatment
          is as if this attribute contains a value of zeroDotZero."
       REFERENCE
          "Differentiated Services MIB module"
       DEFVAL { zeroDotZero }
       ::= { diffServConfigEntry 5 }

   diffServConfigStorage OBJECT-TYPE
       SYNTAX         StorageType
       MAX-ACCESS     read-create
       STATUS         current
       DESCRIPTION
          "The type of storage used for this row."
       ::= { diffServConfigEntry 6 }

   diffServConfigStatus OBJECT-TYPE
       SYNTAX         RowStatus
       MAX-ACCESS     read-create
       STATUS         current
       DESCRIPTION
          "RowStatus object used for creation and deletion of
          rows in this table."
       ::= { diffServConfigEntry 7 }

   --
   -- MIB Compliance statements.





SNMPCONF WG               Expires December 2003                [Page 20]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   --

   diffServConfigMIBCompliances
      OBJECT IDENTIFIER ::= { diffServConfigMIBConformance 1 }
   diffServConfigMIBGroups
      OBJECT IDENTIFIER ::= { diffServConfigMIBConformance 2 }

   diffServConfigMIBFullCompliance MODULE-COMPLIANCE
       STATUS       current
       DESCRIPTION
          "The full compliance for this MIB module."
       MODULE  -- This module
       MANDATORY-GROUPS {  diffServConfigMIBConfigGroup }
       MODULE DIFFSERV-MIB

       -- The MODULE IF-MIB and DIFFSERV-MIB are to be
       -- implemented in accordance to diffServMIBFullCompliance
       -- as defined in the DIFFSERV-MIB.
       -- This is copied since SMI does not allow a
       -- compliance statement here.
       MODULE IF-MIB -- The interfaces MIB, RFC2863
       MANDATORY-GROUPS {
           ifCounterDiscontinuityGroup
       }

       MODULE DIFFSERV-MIB -- The Differentiated Services MIB
       MANDATORY-GROUPS {
           diffServMIBDataPathGroup, diffServMIBClfrGroup,
           diffServMIBClfrElementGroup, diffServMIBMultiFieldClfrGroup,
           diffServMIBActionGroup, diffServMIBAlgDropGroup,
           diffServMIBQGroup, diffServMIBSchedulerGroup,
           diffServMIBMaxRateGroup, diffServMIBMinRateGroup,
           diffServMIBCounterGroup
       }

       GROUP diffServMIBMeterGroup
       DESCRIPTION
           "This group is mandatory for devices that implement metering
           functions."

       GROUP diffServMIBTBParamGroup
       DESCRIPTION
           "This group is mandatory for devices that implement token-bucket
           metering functions."






SNMPCONF WG               Expires December 2003                [Page 21]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






       GROUP diffServMIBDscpMarkActGroup
       DESCRIPTION
           "This group is mandatory for devices that implement DSCP-Marking
           functions."

       GROUP diffServMIBRandomDropGroup
       DESCRIPTION
           "This group is mandatory for devices that implement Random Drop
           functions."

       OBJECT diffServDataPathStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."

       OBJECT diffServClfrStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."

       OBJECT diffServClfrElementStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."

       OBJECT diffServMultiFieldClfrAddrType
       SYNTAX  InetAddressType { unknown(0), ipv4(1), ipv6(2) }
       DESCRIPTION
           "An implementation is only required to support IPv4 and IPv6
           addresses."

       OBJECT diffServMultiFieldClfrDstAddr
       SYNTAX  InetAddress (SIZE(0|4|16))
       DESCRIPTION
           "An implementation is only required to support IPv4 and globally
           unique IPv6 addresses."

       OBJECT diffServAlgDropStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."





SNMPCONF WG               Expires December 2003                [Page 22]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






       OBJECT diffServRandomDropStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."

       OBJECT diffServQStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."

       OBJECT diffServSchedulerStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."

       OBJECT diffServMinRateStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."

       OBJECT diffServMaxRateStatus
       SYNTAX RowStatus { active(1) }
       WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
       DESCRIPTION
           "Support for createAndWait and notInService is not required."
       ::= { diffServConfigMIBCompliances 1 }

   diffServConfigMIBConfigGroup OBJECT-GROUP
       OBJECTS {  diffServConfigDescr,
                  diffServConfigOwner,
                  diffServConfigLastChange,
                  diffServConfigStart,
                  diffServConfigStorage,
                  diffServConfigStatus
       }
       STATUS current
       DESCRIPTION
          "The per-hop-behavior Group defines the MIB Objects that
          describe the Config template for the per-hop-behavior."
       ::= { diffServConfigMIBGroups 1 }
   END





SNMPCONF WG               Expires December 2003                [Page 23]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






8.  Security Considerations

   There are a number of management objects defined in this MIB module
   with a MAX-ACCESS clause of read-write and/or read-create.  Such
   objects may be considered sensitive or vulnerable in some network
   environments.  The support for SET operations in a non-secure
   environment without proper protection can have a negative effect on
   network operations.

   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example by using IPSec),
   even then, there is no control as to who on the secure network is
   allowed to access and GET/SET (read/change/create/delete) the objects
   in this MIB module.

   It is RECOMMENDED that implementers consider the security features as
   provided by the SNMPv3 framework (see [RFC3410], section 8),
   including full support for the SNMPv3 cryptographic mechanisms (for
   authentication and privacy).

   Further, deployment of SNMP versions prior to SNMPv3 is NOT
   RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
   enable cryptographic security.  It is then a customer/operator
   responsibility to ensure that the SNMP entity giving access to an
   instance of this MIB module is properly configured to give access to
   the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.


9.  Acknowledgements

   The editors gratefully acknowledge the significant contributions to
   this work made by several members of both the SNMPCONF and DiffServ
   working groups.


10.  Editors' Addresses

   Harrie Hazewinkel
   Internet Management Consultant
   Email: harrie@lisanza.net

   David Partain
   Ericsson AB
   P.O. Box 1248





SNMPCONF WG               Expires December 2003                [Page 24]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   SE-581 12 Linkoping
   Sweden
   EMail:  David.Partain@ericsson.com


11.  Full Copyright Statement

   Copyright (C) The Internet Society (2002).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."


12.  Informative References

   [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart,
             "Introduction and Applicability Statements for Internet-
             Standard Management Framework", RFC 3410, December 2002.

   [RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black,
             "Definition of the Differentiated Services Field
             (DS Field) in the IPv4 and IPv6 Headers", RFC 2474,
             December 1998.






SNMPCONF WG               Expires December 2003                [Page 25]
 
Internet Draft  Differentiated Services Configuration MIB      June 2003






   [RFC2475] Blake, S., Black, D., Carlson, M., Davies, E.,
             Wang, Z., and W. Weiss, "An Architecture for
             Differentiated Services", RFC 2475, December 1998.

   [RFC3512] MacFaden M., Partain D., Saperia J., and W. Tackabury,
             "Configuring Networks and Devices with Simple Network
          Management Protocol (SNMP)," RFC 3512, April 2003.


13.  Normative References

   [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
             Rose, M. and S. Waldbusser, "Structure of Management
             Information Version 2 (SMIv2)", STD 58, RFC 2578, April
             1999.

   [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
             Rose, M. and S. Waldbusser, "Textual Conventions for
             SMIv2", STD 58, RFC 2579, April 1999.

   [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
             Rose, M. and S. Waldbusser, "Conformance Statements for
             SMIv2", STD 58, RFC 2580, April 1999.

   [RFC3289] Baker, F., K. Chan, and A. Smith, "Management
             Information Base for the Differentiated Services
             Architecture", RFC 3289, May 2002.

   [PMMIBDR] Waldbusser, S., J. Saperia, and T. Hongal,
             "Policy-based Management MIB",
             draft-ietf-snmpconf-pm-13.txt, Work in Progress,
             March 2003.


















SNMPCONF WG               Expires December 2003                [Page 26]