Subject: [netmod] Comments and doubts about the draft "draft-bogdanovic-netmod-acl-model-01"

From: Haoweiguo <[email-masked]>
Date: Tue, 5 Aug 2014 12:30:05 +0000

Hi Co-authors,

After reading over the draft, i have some comments and doubts as following.

"There is a default ACE which applies if a packet does not match any of the other ACEs."
[weiguo]: Different vendors may have different implementations for default ACE action. Does it need to define a generic default action?

In ietf-acl module:

[weiguo]: Why match counter can be written? Count base on ACE is enough, Maybe this counter isn't required.

+--rw match-counter? ietf:counter64
| +--rw permit-counter? ietf:counter64
| +--rw deny-counter? ietf:counter64

[weiguo]:  What does "rw targets* string" used for?

[weiguo]:  What does "+--rw matches" used for?

[weiguo]:  In most of the current commercial products, one ACL only has one ACE-type even though there maybe many rules inside the ACL, each rule has same "ace-type". In the draft, each rule has its "ace-type", i think it has too much granularity. Can it be modified as following?

+--rw access-list
+--rw acl-name? string
+--rw acl-oper-data
| +--rw match-counter? ietf:counter64
| +--rw permit-counter? ietf:counter64
| +--rw deny-counter? ietf:counter64
| +--rw targets* string
+--rw acl-type? string
  | +--rw ace-ip-entries* [rule-name]
   | +--rw rule-name string

[weiguo]:  Do we need define matches and actions as container? Can it be modified as following?

+--rw access-list
+--rw acl-name? string
+--rw acl-oper-data
| +--rw match-counter? ietf:counter64
| +--rw permit-counter? ietf:counter64
| +--rw deny-counter? ietf:counter64
| +--rw targets* string
  +--rw acl-type? string
  +--:(ace-ip)
  | +--rw rule-name string
  | +--rw ip-protocol? uint8
  | +--rw destination-ipv4-address? inet:ipv4-prefix
  | +--rw source-ipv4-address? inet:ipv4-prefix
    +--rw action?
  +--:(ace-eth)
  .....
  +--:(ace-ip6)
 ...
Thanks

weiguo