Subject: [OPS-AREA] Request for input from operators - identification of interfaces

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 23 Aug 2007 13:58:00 +0200

During the final review phases of the review of
http://www.ietf.org/internet-drafts/draft-ietf-midcom-mib-09.txt the
issue described below surfaced. It is actually not completely new, it
was discussed in the past in a form or another, and it is not
necessarily specific to this document and MIB module only, but also to
other MIB modules. We believe that input from network operators can
help, and we solicit this input.

The MIDCOM-MIB defines tables containing firewall rules, indexed by
ifIndex. ifIndex values can change when interfaces are swapped or
devices reboot, and this could lead to rules being applied to the wrong
interface.

How do you, network operators, prefer interfaces be identified? 
 - Is ifIndex the preferred choice even though the indices can change on
reboot? 
 - Is ifName a better choice for identifying interfaces in rules, since
it is set by the device and remains fairly stable across reboots and is
guaranteed to be unique? 
 - is ifAlias a better choice, since it can be set by operators,
although it is not guaranteed to be unique?

 We would appreciate inputs and thank you for your cooperation.

Dan

_______________________________________________
OPS-AREA mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ops-area

---

From: Simon Leinen <[email-masked]>
Date: Tue, 28 Aug 2007 21:50:35 +0200

>  - Is ifIndex the preferred choice even though the indices can change on

IfIndex used to be all we had (until management tools added the logic
to map different types of identifiers).  They have become more
manageable since vendors started to make them persistent over
reboots.

>  - Is ifName a better choice for identifying interfaces in rules,
> since it is set by the device and remains fairly stable across
> reboots and is guaranteed to be unique?

IfName is cool.  We usually refer to interfaces by (abbreviated)
ifName when we talk about them.  Our DNS interface naming scheme is
also based on ifName - I believe this is not uncommon, although not
predominant either.  So that's a natural way to name interfaces.

> although it is not guaranteed to be unique?

We use ifAlias to include comments, and change them from time to time.
I wouldn't like to use them as stable identifiers, although substrings
(tags) inside ifAlias could be used that way.

In general, I'm not sure the MIDCOM MIB designers should jump through
hoops to make the naming scheme maximally operator-friendly.  Instead,
management applications will allow interfaces to be specified in
appropriate ways (maybe based on configured addresses or other
parameters) and map those to appropriate low-level identifiers (node
identifier, ifIndex, etc.).
-- 
Simon.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 28 Aug 2007 21:58:37 +0200

> identifier, ifIndex, etc.).

Well, the problem is that you install policies on devices where the
policies are applied to interfaces identified by ifIndex. Once ifIndex
changes, you potentially apply the wrong policy without any management
application involved that can fix that (unless you assume that you
have this super smart monitor that detects all such changes and takes
immediate corrective action).

Note, I am not pushing for rewriting the MIDCOM MIB. Documenting the
issue should be good enough in this particular case. I was more
interested to hear from operators what they like to use as "natural"
interface identifiers. You said ifName - any other operators here to
second that or to question that?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Toby Rodwell <[email-masked]>
Date: Wed, 29 Aug 2007 09:46:11 +0100

Hi Juergen/all,

Juergen Schoenwaelder wrote:
... I was more
> second that or to question that?

I second IfName.  I wouldn't claim to be an expert on the full range of
equipment vendors but it would certainly be the best option for Cisco
and Juniper.

regards
Toby

-- 
______________________________________________________________________

Toby Rodwell
Network Engineer

DANTE - www.dante.net

Tel: +44 (0)1223 371 300
Fax: +44 (0)1223 371 371
Email: [email-masked]
PGP Key ID: 0xB864694E

City House, 126-130 Hills Road
Cambridge CB2 1PQ
UK
_____________________________________________________________________