Subject: Re: [netmod] Remove input-interface (metadata) from netmod-acl-model-07 ?

From: "Sterne, Jason (Nokia - CA)" <[email-masked]>
Date: Fri, 1 Apr 2016 21:54:06 +0000

Hi Dean,

From what Acee mentions it doesn’t seem that IOS-XR supports matching on interface for ACLs.

When I look at Brocade I don’t see it either.  Maybe someone from Brocade could provide an example of the config if it is supported ?
https://github.com/YangModels/yang/blob/master/vendor/brocade/brocade-ip-access-list.yang
(I also checked their user guides)

I think it is more relevant to look at ACL functionality for this (not log filtering or other misc. filtering capabilities in areas outside of ACLs).  I really don’t think this has widespread support and it isn’t core functionality -> assigning an ACL to an interface is how it is normally done.

Regards,
Jason

From: EXT Dean Bogdanovic [mailto:[email-masked]]
Sent: Thursday, March 31, 2016 2:26
To: Sterne, Jason (Nokia - CA)
Cc: netmod WG
Subject: Re: [netmod] Remove input-interface (metadata) from netmod-acl-model-07 ?

On Mar 30, 2016, at 9:36 PM, Sterne, Jason (Nokia - CA) <[email-masked]<mailto:[email-masked]>> wrote:

Hi all,

The ACL model is converging on a small core set of functionality that is fairly common.

But I think the matching on input-interface should be removed from the model (or at the least put inside a feature flag).

Matching on basic IPv4/IPv4/MAC header fields is common functionality.  But having that input-interface match on metadata in the core model is out of place.  It should be left to further extension drafts or vendor specific augmentations (along with whatever other metadata might be useful or vendor-specific).

ACLs are typically assigned to interfaces as shown in section A.3. of the ACL draft.   That is the most common use case.

Actually matching on input-interface in the ACL rules themselves is not basic core ACL functionality.  Nokia SR OS does not have that capability.  Does IOS-XR ?  Brocade ?  others ?

Cisco and Juniper support matching on input interface. It is useful when you want to filter on general traffic coming from interface.

Cisco
match input-interface
match input-vlan

Junos
family any {
            filter L2_filter {
                        term t1 {
                                    from {
                                                interface fe-0/0/0.0;
                                    }
                                    then {
                                                policer p1;
                                                count c1;
                                    }
                        }
            }
}

Brocade supports matching based on interface, Dell supports VLAN matching, Arista supports input interface matching, Redback supports matching against input interface for logging, so it is pretty standard across multiple vendors

Dean

     If some major implementations don’t do it, and it isn’t necessary for typical basic ACL use, then it should be removed (or feature flagged).

Regards,
Jason

_______________________________________________
netmod mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netmod

---

From: Dean Bogdanovic <[email-masked]>
Date: Sat, 2 Apr 2016 08:39:56 -0300

Hi Acee,

> On Mar 31, 2016, at 8:17 AM, Acee Lindem (acee) <[email-masked]> wrote:
> 
> Hi Dean, 
> 
> From: netmod <[email-masked] <mailto:[email-masked]>> on behalf of Dean Bogdanovic <[email-masked] <mailto:[email-masked]>>
> Date: Thursday, March 31, 2016 at 5:26 AM
> To: "Sterne, Jason (Nokia - CA)" <[email-masked] <mailto:[email-masked]>>
> Cc: netmod WG <[email-masked] <mailto:[email-masked]>>
>> On Mar 30, 2016, at 9:36 PM, Sterne, Jason (Nokia - CA) <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi all,
>>  
> These are “class-map”  sub-commands - not “access-list" sub-commands. So you are referring to the general functionality rather than specifically functionality supported by access-list? 

According to the Cisco website (http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swacl.html)

Note The ACL must be an extended named ACL.

 <>– match input-interface interface-id-list

 <>– match ip dscp dscp-list

 <>– match ip precedence ip-precedence-list

> 
> 
> 
> Junos
> family any {
> filter L2_filter {
> term t1 {
> from {
> interface fe-0/0/0.0;
> }
> then {
> policer p1;
> count c1;
> }
> }
> }
> }
> 
> Brocade supports matching based on interface, Dell supports VLAN matching, Arista supports input interface matching, Redback supports matching against input interface for logging,
> 
> If you are referring to “log-input”, this indicates to include the input-interface in the log message. Cisco supports this as well. 
> 
> Thanks,
> Acee 
> 
> 
> so it is pretty standard across multiple vendors
> 
> Dean
> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/netmod <https://www.ietf.org/mailman/listinfo/netmod>

---

From: Dean Bogdanovic <[email-masked]>
Date: Sat, 2 Apr 2016 08:48:54 -0300

Hi Jason,

> On Apr 1, 2016, at 6:54 PM, Sterne, Jason (Nokia - CA) <[email-masked]> wrote:
> 
> Hi Dean,
>  

I replied to Acee’s comment in separate email, as I found some examples on the web, but it looks as older versions of software.
> https://github.com/YangModels/yang/blob/master/vendor/brocade/brocade-ip-access-list.yang <https://github.com/YangModels/yang/blob/master/vendor/brocade/brocade-ip-access-list.yang>

Brocade gives examples of using ACLs in route-maps and provide examples
http://www.brocade.com/content/html/en/configuration-guide/netiron-05900-routingguide/GUID-83F457B7-4CFB-4852-AC08-59BCD9E2AF7C.html
> I think it is more relevant to look at ACL functionality for this (not log filtering or other misc. filtering capabilities in areas outside of ACLs).  I really don’t think this has widespread suppo…

I’ll add this item to the open issue and will ask WG at the meeting for opinion.

>  
> Regards,
> Jason
>  
> From: EXT Dean Bogdanovic [mailto:[email-masked] <mailto:[email-masked]>]

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Sat, 2 Apr 2016 12:42:21 +0000

Hi Dean,

From: Dean Bogdanovic <[email-masked]<mailto:[email-masked]>>
Date: Saturday, April 2, 2016 at 7:39 AM
To: Acee Lindem <[email-masked]<mailto:[email-masked]>>
Cc: "Sterne, Jason (Nokia - CA)" <[email-masked]<mailto:[email-masked]>>, netmod WG <[email-masked]<mailto:[email-masked]>>
Subject: Re: [netmod] Remove input-interface (metadata) from netmod-acl-model-07 ?

Hi Acee,

On Mar 31, 2016, at 8:17 AM, Acee Lindem (acee) <[email-masked]<mailto:[email-masked]>> wrote:

Hi Dean,

From: netmod <[email-masked]<mailto:[email-masked]>> on behalf of Dean Bogdanovic <[email-masked]<mailto:[email-masked]>>
Date: Thursday, March 31, 2016 at 5:26 AM
To: "Sterne, Jason (Nokia - CA)" <[email-masked]<mailto:[email-masked]>>
Cc: netmod WG <[email-masked]<mailto:[email-masked]>>
Subject: Re: [netmod] Remove input-interface (metadata) from netmod-acl-model-07 ?

Hi all,

Cisco
match input-interface
match input-vlan

Note The ACL must be an extended named ACL.
________________________________

– match input-interface interface-id-list

– match ip dscp dscp-list

– match ip precedence ip-precedence-list

If you cut the line above this you’d see these are class-map commands as I stated previously.

    With IPv4 QoS ACLs, if you enter the class-map { match-all | match-any } class-map-name global configuration command, you can enter these match commands:

         – match access-group acl-name

         – match input-interface interface-id-list

         – match ip dscp dscp-list

         – match ip precedence ip-precedence-list

    You cannot enter the match access-group acl-index command.

Thanks,
Acee

Junos
family any {
filter L2_filter {
term t1 {
from {
interface fe-0/0/0.0;
}
then {
policer p1;
count c1;
}
}
}
}

Thanks,
Acee

Dean

Regards,
Jason