Subject: [netmod] New Version ACL Yang model

From: "Lisa Huang (yihuan)" <[email-masked]>
Date: Tue, 26 Feb 2013 22:42:23 +0000

Hi,

This is a new version of ACL Yang model I-D. Yesterday, we missed the deadline since I did not read the time zone information carefully enough. As Juergen kindly suggested, I attached the new version in email to make it available to the WG.

Not much has changed, but we did follow up on the action items from last meeting, as stated below, and updated the draft accordingly.

The action items and follow-up are as follows:

     1.  Can this model support ACL Chaining? ACL Chain Support section is added
     to section 3.3 to illustrate how this ACL model could be extended
     to support ACL Chain straightforwardly.

     2.  Are there any compatibility issues related to ACE ordering
      because a YANG user-order list is used instead of sequence IDs?
      This item is closely related to bullet item 3, see below.

      3.  Is an administrative function to test a packet against a
      specified ACL needed?  The server would return an indication of
      permit or deny, and a leaf-list of the ACE entries that were
      evaluated.  We believe that this addition would be valuable and
      have incorporated this suggestion into a new "Additional
      Considerations" section.  We expect to move it into the data model
      in the next revision.

      4.Is the model applicable to multiple implementations - can other
      ACL models be accommodated?  We have followed up with Juniper Yang
      experts, Kent Watsen and Phil Shafer, to review and check for
      applicability to Junos implementation.  The initial feedback from
      Phil indicates that there do not seem to be any showstoppers and
      that the model does seem to be applicable.  However, he suggested
      further scrutiny should occur.  Kent identified additional Juniper
      experts to scrutinize the model more closely; so far no further
      comments have been received.  We also followed up regarding
      whether there are other standardized models of ACLs, for example
      in conjunction with the Desktop Management Task Force's (DMTF) CIM
      (Common Information Model).  ACL is not covered by the
     standardized portion of CIM, but there are vendor-specific
      extensions by vendors.  We inspected one such vendor specific
      model and found that in essence the same design patterns were used
      as in the model specified in this Internet Draft, with an ACL
      corresponding to an ordered list of rules with filters or matching
      criteria, and actions to be taken in response.  It appears that
      mappings between the models can be accommodated in a
      straightforward manner.

Thanks
--- Lisa