Subject: [Netconf] status of the new NETCONF WG charter

From: "Bert (IETF) Wijnen" <[email-masked]>
Date: Sat, 07 Aug 2010 15:06:54 +0200

Based on comments from we have received from Dan, Juergen,
Andy, and a few others, we now have the following text.

The text has been shortened. We removed a lot of old
work-items and milestones. These are all saved in
the multiple versions of the charter that we see on our
WG charter page these days. So no need to keep carrying it
forward. We do explain the basics of the published
NETCONF protocol, and then describe the work we need to do
in the next phase.

Content wise in terms of work to do, this is the same as
what we did send out end of July. But have clarified some
that the any YANG modules we do MUST be NETCONF specific.

We are still planning to hand this to Dan asap, so hopefully
he can still put it on the IESG agenda for August 12.
So we intend to send the formal request to him coming
Monday morning (Aug 9th).

Bert and Mehmet

----------------- draft

Network Configuration (netconf)
-------------------------------

  Charter

  Current Status: Active

  Chairs:
      Bert Wijnen <[email-masked]>
      Mehmet Ersue <[email-masked]>

  Operations and Management Area Directors:
      Dan Romascanu <[email-masked]>
      Ronald Bonica <[email-masked]>

  Operations and Management Area Advisor:
      Dan Romascanu <[email-masked]>

  Mailing Lists:
      General Discussion: [email-masked]
      To Subscribe:       [email-masked]
         or:              https://www.ietf.org/mailman/listinfo/netconf
      Archive:            http://www.ietf.org/mail-archive/web/netconf/

Description of Working Group:

   Configuration of networks of devices has become a critical requirement
   for operators in today's highly interoperable networks. Operators from
   large to small have developed their own mechanisms or used vendor
   specific mechanisms to transfer configuration data to and from a
   device, and for examining device state information which may impact
   the configuration. Each of these mechanisms may be different in
   various aspects, such as session establishment, user authentication,
   configuration data exchange, and error responses.

   The NETCONF Working Group has produced a protocol suitable for
   network configuration, with the following characteristics:

   - Provides retrieval mechanisms which can differentiate between
     configuration data and non-configuration data
   - Is extensible enough so that vendors can provide access to all
     configuration data on the device using a single protocol
   - Has a programmatic interface (avoids screen scraping and
     formatting-related changes between releases)
   - Uses an XML-based data representation, that can be easily manipulated
     using non-specialized XML manipulation tools.
   - Supports integration with existing user authentication methods
   - Supports integration with existing configuration database systems
   - Supports multiple (e.g. candidate and running) data-stores to
     optimize configuration preparation and activation
   - Supports network wide configuration transactions (with features such
     as locking and rollback capability)
   - Is in principle transport-independent, but mandates the use of a
     secure transport. Runs by default over SSH but currently also runs
     over TLS, BEEP, and SOAP.
   - Provides support for asynchronous notifications.

   The NETCONF protocol is using XML for data encoding purposes.

   The NETCONF protocol has been designed independent of the data
   modeling language. The IETF recommends to use YANG as the NETCONF
   modeling language, which introduces advanced language features for
   configuration management.

   In the current phase of the incremental development of NETCONF the
   workgroup will focus on following items:

   1. NETCONF implementations have shown that the specification in RFC4741
      is not 100% clear and has lead to different interpretations and
      implementations. Also some errors have been uncovered. So the WG
      will do an rfc4741bis with following constraints:

        - bug fixes are to be done
        - clarifications can be done
        - extensions can be done only when needed to fix bugs
          or inconsistencies (i.e. we are not doing a NETCONF V2)
        - The work was started based on the discussion in IETF #73 (see
          http://www.ietf.org/proceedings/08nov/slides/netconf-3.pdf).

   2. A technical errata has been posted on rfc4742. The work on
      rfc4741bis also uncovered some additional fixes/clarifications that
      need to be made to rfc4742, the WG has been working on rfc4742bis
      and is nearly done with this work item.

   3. Netconf Access Control Model (NACM) Requirements and Solution.

      There is a need for standard mechanisms to restrict
      NETCONF protocol access for particular users to a pre-
      configured (by operator) subset of all available NETCONF
      operations and content.

      The WG will produce a document which identifies the access
      control requirements specific to the NETCONF protocol, as
      defined in [4741bis].  This document will also provide a
      standard YANG data model which addresses these
      requirements.

      It is possible that the WG will not reach solution consensus
      on every possible requirement identified in the document.
      In this case, it is expected that the solution will evolve
      over time to meet the the remaining unmet requirements.

   4. The NETCONF server may want to notify interested clients about
      particular NETCONF protocol/server events.  The WG will work on
      a NETCONF specific YANG module(s) to define suitable
      notifications.

   5. As implementation and deployment experience gained with the
      NETCONF monitoring data model, the WG may revise the NETCONF
      monitoring data model to add additional objects that can be used
      to check the status of the server and to discover additional
      information about the server implementation. The WG may choose
      to revise the NETCONF monitoring data model.

Goals and Milestones:
   Aug 2010 - Send with-defaults to IESG for consideration as Proposed Standard
   Aug 2010 - WG Last Call on rfc4741bis
   Sep 2010 - rfc4741bis to IESG for consideration as Proposed Standard
   Sep 2010 - Send rfc4742bis to IESG for consideration as proposed Standard.
   Sep 2010 - first WG draft (rev 00) on NACM posted
   Sep 2010 - first WG draft (rev 00) on NETCONF specific YANG modules posted
   Jan 2011 - WGLC for NACM document
   Jan 2011 - WGLC for NETCONF specific YANG modules document
   Mar 2011 - (if needed last) WGLC for NACM document
   Mar 2011 - (if needed last) WGLC for NETCONF specific YANG modules document
   Apr 2011 - submit NACM document to IESG for consideration as Proposed Standard
   Apr 2011 - submit NETCONF specific YANG modules document to IESG for consideration as Proposed Standard

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 9 Aug 2010 11:14:38 +0200

> Andy, and a few others, we now have the following text.

[...]

> Monday morning (Aug 9th).

Some minor suggested edits after reading the charter once more (I can
live with the charter as is as well - so feel free to ignore the
 
>      over TLS, BEEP, and SOAP.

I would replace this with the following (I believe this captures the
important thing and avoid the vague "in principle
transport-independent" phrase):

     - Runs by default over SSH but can currently also run over TLS,
       BEEP, and SOAP.

>    The NETCONF protocol is using XML for data encoding purposes.

I would remove this sentence since this has already been stated
before.

Finally, unless the phrase "NETCONF specific YANG modules document"
has been choosen on purpose in the milestones, I would call this
"NETCONF specific notifications document" since this aligns more
clearly with work item #4.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "Bert (IETF) Wijnen" <[email-masked]>
Date: Mon, 09 Aug 2010 13:44:15 +0200

>      - Runs by default over SSH but can currently also run over TLS,

Mmm... I do want to express that a secure transport is mandatory (or 
such is my understanding)
How about:

     - Runs over a secure transport, by default over SSH but can 
       currently also run over TLS, BEEP, and SOAP.

I am also a bit worried of "default". We have made implementation ove 
SSH the mandatory one.
But does that also means that it does so "by default". On some 
implemntation probably so,
I could see that some other use another one by default, even though they 
do support
ssh (at least if they want to claim compliance).

> I would remove this sentence since this has already been stated

I see that too now. Will remove it.

> clearly with work item #4.
I see what you want. Would you allow a few data nodes if such were to be 
used in those
notifications? If so, then I can live with that.

I guess you assume that if any non-notification stuff needs to be 
defined that we would do so
by a revision to the monitoring document. 

I can live with that.

Bert

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 9 Aug 2010 13:57:54 +0200

On Mon, Aug 09, 2010 at 01:44:15PM +0200, Bert (IETF) Wijnen wrote:

> I am also a bit worried of "default". We have made implementation
> ove SSH the mandatory one.  But does that also means that it does so
> "by default". On some implemntation probably so, I could see that
> some other use another one by default, even though they do support

The lets say what the facts are:

     - Runs over a secure transport; SSH is mandatory to implement
       while TLS, BEEP, and SOAP are optional transports.

> defined that we would do so by a revision to the monitoring
> document.

Yes. And the drafted WG charter allows to revise the monitoring
document if that is deemed useful by the WG.

/js

---

From: "Bert (IETF) Wijnen" <[email-masked]>
Date: Mon, 09 Aug 2010 14:31:51 +0200

My responses to Juergen inline.

If anyone else has comments, you have time till approx 2pm Tuesday 
(Netherlands time, i.e. noon UTC).
After that I have to hand it to Dan for IESG processing, so we can get 
it approved before the end of
August.

Bert

>        while TLS, BEEP, and SOAP are optional transports.
Deal!
> document if that is deemed useful by the WG.

OK, changed accordingly.

Bert

---

From: "t.petch" <[email-masked]>
Date: Tue, 10 Aug 2010 10:10:45 +0200

I am unclear where with-defaults got to.  There was a Last Call which seemed to
peter out, a new version appeared picking up some but not all of the comments
and ...

I still have problems of comprehension with this I-D, as perhaps Martin alluded
to in his comments.

Two areas.

Data nodes.  This I-D references the YANG I-D, and so users of it might know
that a data node is part of the schema tree and nothing to do with the data
tree.  Which makes its use here potentially confusing to me since most if not
all uses of it seem to refer to nodes/leaves in the data tree..  As
(head-banging) Randy has pointed out, you cannot not have a meta-model of the
data for an I-D like this one, and if it is different to YANG, then I think that
that needs spelling out.  A few years ago, I would have said that this was
unnecessary but the YANG I-D with its different (to me) definition of data node
has changed that.

An allied problem is that this references RFC4741 for a definition of datastore
and yet that term is not defined there.  Rather, RFC4741 (almost) always uses
configuration datastore so I think that this I-D should do so as well or else
(re-)define datastore.

And whatever is in that data node seems to be described in many ways; if these
are the same, then I find that confusing, if different, I am confused.  I see
these thingies in the data tree having a 'match' or 'set' or 'contain' or 'has'
or 'represent' or ... relationship to the default values e.g.

 have a large number of default values
 a data node that contains its schema default
 any data node set to its schema default value to be default data.
 represented by a schema default value
  they match the schema default value

Whatever the relationship is, I think that only one verb should be used to
portray it, unless a distinction is being drawn (which there could be in some
but not all uses of 'set') ie we have a 'data tree', it consists of 'leaf (foo/
bar/  ...) nodes' and they 'have (/contain/ ...)' values.

This probably seems trivial to you who have lived with this for several months,
but to someone coming to it afresh, or coming back after a hiatus of some
months, I think this a significant problem of comprehension.  And it is not as
if the semantics being described are familiar or easy to follow!

Tom Petch