Subject: RE: ISMS working group and charter problems

From: "Fleischman, Eric" <[email-masked]>
Date: Wed, 7 Sep 2005 12:20:03 -0700

>You are correct that, in the current plan, the ISMS model would be 
>TCP-based.  That is what I meant to state by saying "UDP and the 
>current SNMPv3 USM security mechanisms will still work".  ISMS will 
>be TCP-based, but UDP/USM will still work -- in fact, it will still 
>also be mandatory-to-implement for SNMPv3 compliance...  I did not 
>mean to imply that UDP/ISMS will work, or even that it will ever be 
>defined.

Yes, Margaret, we are tracking each other on that point. 

However, the nature of my objection was that I believe that this state
of affairs is unacceptable. Since I have concluded, for the reasons I
partially enumerated in my previous post, that historic SNMPv3 USM is
unusable for very large deployments, what good is devising an ISMS
supplement that is also partly/largely unusable for different reasons
(i.e., transport reasons (ISMS) rather than security reasons SNMPv3
USM))?

I believe that network management is too important a functionality to be
designed such that it can only be usable within highly confined
environmental constraints.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Sep 2005 18:49:58 -0400

>>>>> "Fleischman," == Fleischman, Eric <[email-masked]> writes:

    Fleischman,> I believe that network management is too important a
    Fleischman,> functionality to be designed such that it can only be
    Fleischman,> usable within highly confined environmental
    Fleischman,> constraints.

"must work everywhere," is a highly constraining environment.

You certainly may revisit the UDP vs TCP decision on the IETF list;
doing so is an appropriate last recourse under our process.

However I do not believe it likely that you will get IETF consensus on
a specific UDP direction.  I also do not believe it would be
productive to take this issue back to the working group.  So, I ask
what you believe I should do if you fail to get consensus?  If your
options are no ISMS or ISMS over ssh, which would you pick?

--Sam

---

From: Juergen Quittek <[email-masked]>
Date: Thu, 08 Sep 2005 15:14:51 +0200

> "must work everywhere," is a highly constraining environment.

We should consider that ISMS is about integrating SNMP into user
and key management systems.  Such system usually operate over TCP.
In a highly damaged network ISMS might not be able to help you even
if you had stuck to SNMP transport over UDP.

> options are no ISMS or ISMS over ssh, which would you pick?

The consensus in the WG on this issue was not really rough,
but rather broad and clear.

Thanks,

    Juergen

---

From: Daniel Senie <[email-masked]>
Date: Thu, 08 Sep 2005 10:10:50 -0400

>and key management systems.  Such system usually operate over TCP.

You mean like RADIUS? That's a UDP protocol.

>if you had stuck to SNMP transport over UDP.

So you're arguing we should not bother with the ISMS effort?

>but rather broad and clear.

Based on your email, the consensus of the group is that TCP is good 
enough, since it'll only be interesting to manage networks that are 
operating cleanly. I can't imagine that's what the WG really 
concluded, but that's how your email reads.

---

From: "Tom Petch" <[email-masked]>
Date: Thu, 8 Sep 2005 15:35:29 +0200

<inline>
Tom Petch

----- Original Message -----
From: "Daniel Senie" <[email-masked]>
To: "Juergen Quittek" <[email-masked]>
Cc: "IETF Discussion" <[email-masked]>
Sent: Thursday, September 08, 2005 4:10 PM
Subject: Re: ISMS working group and charter problems

> concluded, but that's how your email reads.

As a WG member, the way I saw it was that TCP became a necessary evil; the
choice of a secure transport - mutual authentication, message integrity,
encryption - came down to TLS+SASL, DTLS+SASL, SSH.  Among these, SSH dominates
in the market place of operators so, for me at least, it was a one horse race.
Then having to have TCP, with all its complications is, well, a necessary evil
(but one that the market place lives with at least for secure remote login).

There is no, and no sign of, a SSH over UDP nor of SSH over any more suitable
transport.  So SNMP over TCP in order to get integrated security is a leap in
the dark.  It could work, it could fail, it may never even make it to an RFC,
but it offers the best if not the only hope of progress.

The issue of TCP in an unreliable network did get discussed several times
without any consensus.  For me, if isms allows safe configuration changes in a
working, reliable network without requiring an SNMP-specific security subsytem,
then that will be such a giant leap forward for SNMP that it will be worth the
effort.  Other WG members want more, secure notifications, Informs, call home
and such like; for me, those can wait.