Subject: Re: [netmod] Suggestions for draft-huang-netmod-acl-03.txt

From: "Lisa Huang (yihuan)" <[email-masked]>
Date: Tue, 1 Apr 2014 23:52:37 +0000

Steve, Comments in line. --Lisa

From: steve cheng <[email-masked]<mailto:[email-masked]>>
Reply-To: steve cheng <[email-masked]<mailto:[email-masked]>>
Date: Saturday, March 29, 2014 11:11 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [netmod] Suggestions for draft-huang-netmod-acl-03.txt

Hi Lisa/Alex/Andy,

I saw current draft doesn't cover how SPF (ACL) is applied on an interface or other client applications.

<Lisa> Section 3.3.4 of the draft briefly covers how to apply SPF(ACL)  to interface  and also gives an example of how to attach an SPF to an interface.

=========================

We typically call these SPF(ACL) on an interface for packet filtering as Security ACL. For example,
interface foo
    SPF(ACL) bar ingress/egress

Would it make sense to create a new draft?
<Lisa> Yes. You could create a new module which augment interface module and add SPF(ACL) leaf list. Section 3.3.4 has an example of that.

=========================

Another kind of widely deployed SPF(ACL) is in other client applications. QoS, PBR, and routing protocols such as OSPF/BGP are some examples.

  *   For QoS/PBR/other policy based applications, it's used for classification. For example QoS,
     *   class foo: match SPF (ACL),
     *   policy bar: match class foo, rate limiting
     *   policy bar is applied on an interface ingress/egress

<Lisa>One way is:
Import stateless-pf {
prefix "spf";
}
…
List class {
Key "name";
Leaf "name" {
…
}
Leaf-list match {
type "spf:spf-ref";
}
}

  *   For routing protocols, it's used for route/prefix filtering (not packet filtering).

<Lisa> prefix filter is different from access list since it has less filtering options and don't distinguish packet source and destination. Since both filter has similarity, prefix filtering can reuse most of the grouping definition in SPF(ACL).

  *   some other applications can simply use ACL (SPF) to filter out debugging output.

<Lisa>Is this the use case described in CLI?

access-list 101 permit tcp any host 192.168.35.1 range 20 21
access-list 102 permit tcp host 192.168.35.1 any established
interface ethernet 0
access-group 101 out
access-group 102 in

In this case, the configuration is a single unnamed ACE in ACL but ACE name is a mandatory leaf in the draft. The implementation is not in scope of the draft, but one way to implement is to add an adapter of netconf engine and backend. The job of the adapter is to map name based ACE(netconf config) to single no name ACE(system) back and forth.

List access-group {
        Key "spf-name";
        Leaf "spf-name" {
                type "spf:spf-ref";

        }
        Leaf  dirction {
                type enumeration {
                        Enum "in";
                        Enum "out";
                }
        }
}

Any suggestion on how to deal with them?

cheers,

Steve Cheng

---

From: steve cheng <[email-masked]>
Date: Wed, 2 Apr 2014 21:27:06 -0700 (PDT)

Hi Lisa,

Thanks for your reply. 

Please see inline with [Steve].

thanks,

Steve
On Tuesday, April 1, 2014 4:52 PM, Lisa Huang (yihuan) <[email-masked]> wrote:

From: steve cheng <[email-masked]>
Reply-To: steve cheng <[email-masked]>
Date: Saturday, March 29, 2014 11:11 AM
To: "[email-masked]" <[email-masked]>
Subject: [netmod] Suggestions for draft-huang-netmod-acl-03.txt

Hi Lisa/Alex/Andy,

[Steve] OK

[Steve] we can discuss more about this if QoS/PBR YANG modeling is in the picture in the future.
	* For routing protocols, it's used for route/prefix filtering (not packet filtering).
<Lisa> prefix filter is different from access list since it has less filtering options and don't distinguish packet source and destination. Since both filter has similarity, prefix filtering can reuse most of the grouping definition in SPF(ACL).
[Steve] Agree, prefix list is different from access list. Well many existing routing applications do use ACL (not prefix-list) widely. 

	* some other applications can simply use ACL (SPF) to filter out debugging output.
<Lisa>Is this the use case described in CLI?
access-list 101 permit tcp any host 192.168.35.1 range 20 21 access-list 102 permit tcp host 192.168.35.1 any established interface ethernet 0 access-group 101 out access-group 102 in
In this case, the configuration is a single unnamed ACE in ACL but ACE name is a mandatory leaf in the draft. The implementation is not in scope of the draft, but one way to implement is to add an adapter of netconf engine and backend. The job of the adapter is to map name based ACE(netconf config) to single no name ACE(system) back and forth. 
List access-group {
Key "spf-name";
Leaf "spf-name" {type "spf:spf-ref";
}
Leaf  dirction {
type enumeration {
Enum "in";
Enum "out";
}
}
}
[Steve] No, this is not the case. Logically it could be as simple as this, 
debugging feature filter <ACL>           ====> only debugging msg with ACL defined src/dest ip/port will be displayed.

cheers,

Steve Cheng

---

From: "Lisa Huang (yihuan)" <[email-masked]>
Date: Thu, 3 Apr 2014 17:48:55 +0000

[Steve] Agree, prefix list is different from access list. Well many existing routing applications do use ACL (not prefix-list) widely.
<Lisa>For cases that routing application use the full ACL, most likely ACL is referred by name. A match leaf or leaf-list can be defined in YANG to serve the purpose.
leaf match {
   type "spf:spf-ref";
}

[Steve] Logically it(debugging output) could be as simple as this,
debugging feature filter <ACL>           ====> only debugging msg with ACL defined src/dest ip/port will be displayed.
<Lisa> Do you mean CLI configuration like the following and try to find out how to use the existing stateless-pf.yang data model to model this case?

ip access-list extended host1

  permit ip any host 10.1.1.1 log

  permit ip host 10.1.1.1 any log

debug access-list host1

From: steve cheng <[email-masked]<mailto:[email-masked]>>
Reply-To: steve cheng <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, April 2, 2014 9:27 PM
To: Microsoft Office User <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [netmod] Suggestions for draft-huang-netmod-acl-03.txt

Hi Lisa,

Thanks for your reply.

thanks,

Steve
On Tuesday, April 1, 2014 4:52 PM, Lisa Huang (yihuan) <[email-masked]<mailto:[email-masked]>> wrote:
Steve, Comments in line. --Lisa

Hi Lisa/Alex/Andy,

[Steve] OK

<Lisa>One way is:
Import stateless-pf {
prefix "spf";
}
…
List class {
Key "name";
Leaf "name" {
…
}
Leaf-list match {
type "spf:spf-ref";
}
}

<Lisa> Absolutely.

access-list 101 permit tcp any host 192.168.35.1 range 20 21access-list 102 permit tcp host 192.168.35.1 any established

interface ethernet 0access-group 101 outaccess-group 102 in

List access-group {
Key "spf-name";
Leaf "spf-name" {
type "spf:spf-ref";
}
Leaf  dirction {
type enumeration {
Enum "in";
Enum "out";
}
}
}

cheers,

Steve Cheng

---

From: steve cheng <[email-masked]>
Date: Tue, 8 Apr 2014 14:10:59 -0700 (PDT)

Hi Lisa, 
 
sorry for the late reply. [Steve] Logically it(debugging output) could be as simple as this, 
 
debug access-list host1
 
<< Steve>> 
Logically it's something like this, 
ip access host1
    permit ip any host 10.1.1.1
 
debug fib pkt filter host1
 
We can talk more offline if needed, 
 
Steve
On Thursday, April 3, 2014 10:48 AM, Lisa Huang (yihuan) <[email-masked]> wrote:

  
debug access-list host1 

 
To: Microsoft Office User <[email-masked]>, "[email-masked]" <[email-masked]>

Hi Lisa, 
 
Thanks for your reply.  

thanks, 
 
Steve 

Hi Lisa/Alex/Andy,

[Steve] OK

 
Leaf "spf-name" { type "spf:spf-ref";   

 
 
cheers, 
 
Steve Cheng