Subject: [midcom] multiple agents accessing the same policy rule

From: Juergen Quittek <[email-masked]>
Date: Tue, 20 May 2003 11:45:58 +0200

Dear all,

After working again on the semantics for some days,
I ran into a potential problem related to the point that
multiple agents may access the same policy rule on a middlebox.

An example scenario contains a 'regular' agent authorized
to access just the policies rules created by itself and an
'administrator' agent authorized to access all policies
created by any agent.

Another exampe contains be a 'regular' agent and a 'fail-over'
agent running stand-by until the regular one fails.

In both scenarios (and several others) it is possible that at a
time two or more agents have an open session with the middlebox
and there is a set of policy rules that both may access.

Let's now assume that an agent deletes a policy rule that is
also accessible to another agent with an open session. The agent
deleting the policy rule sends a request for deletion and gets
a successful reply. What happens with the other agent?

I think that according to requirement 2.1.5 (known and stable
state) the middlebox must send an ARD (Asynchronous Rule Deletion)
notification to the other agent in order to tell it that one of
the policies it can access was terminated.

IS THIS AGREED BY THE WORKING GROUP?

Consequences would be that:

  1. Everytime a policy rule is terminated, each agent with open
     sessions that can access this policy need to receive an
     individual notification about this event.

  2. Not just termiation of policy rules, but also creation and
     modification need to be reported to all these agents.
     Besides our ARD notification we would have to add one or
     more notifications to the semantics covering at least
     policy rule creation and lifetime change.

If we agree on this, here are suggestion for modifying the
semantics:

   - Replace the Asynchronous Policy Rule Deletion (ARD)
     transaction (that so far just indicated policy rule
     termination) by a more general Asynchronous Policy Rule
     Lifetime Event (ALE) notification that notifies the
     agent about
        - policy rule lifetime changes initiatd by other agents,
          indicating the new remaining lifetime,
        - policy rule termination by other agents, indicating a
          new remaining lifetime of zero,
        - policy rule termination by the middlebox, indicating a
          new remaining lifetime of zero,
        - regular policy rule termination by lifetime expiration,
          indicating the remaining lifetime of zero,

   - Add a new Asynchronous Policy Rule Creation (APC) transaction
     that indicates the new policy with all its properties to all
     agents in open sessions that did not create the policy rule
     but that can access it.

    Juergen
-- 
Juergen Quittek        [email-masked]        Tel: +49 6221 90511-15
NEC Europe Ltd.,       Network Laboratories        Fax: +49 6221 90511-55
Kurfuersten-Anlage 36, 69115 Heidelberg, Germany   http://www.ccrle.nec.de
_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom