Subject: [OPS-AREA] again about ietf-outcomes

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 10 Feb 2010 11:49:26 +0100

David Harrington put some work in improving the content of the wiki page
at http://trac.tools.ietf.org/misc/outcomes/wiki/IetfOperations in what
concerns SNMP and SMI. It would be good if other folks have a look and
especially if they can spare some time adding more exact and detailed
information related to the other management protocols. 

Dan

---

From: "David Harrington" <[email-masked]>
Date: Wed, 10 Feb 2010 08:33:57 -0500

Hi,

Be aware tyat if somebody edits it while you are editing it, your
edits might need to be discarded.
Work incrementally (i.e. save your changes often) to minimize the
chance of conflict.
Trac doesn't have a concept of locking work that is checked out.
I lost about an hour's worth of work when Dave Crocker added the link
to the legends page.

dbh

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Romascanu, Dan (Dan)
> Sent: Wednesday, February 10, 2010 5:49 AM
> To: [email-masked]; [email-masked]
> Subject: [OPS-AREA] again about ietf-outcomes
> 
> at 
> http://trac.tools.ietf.org/misc/outcomes/wiki/IetfOperations in what
> _______________________________________________
> OPS-AREA mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ops-area
>

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 10 Feb 2010 07:05:50 -0800

>>>>> On Wed, 10 Feb 2010 08:33:57 -0500, "David Harrington" <[email-masked]> said:

DH> I lost about an hour's worth of work when Dave Crocker added the link
DH> to the legends page.

With all group collaboration projects, frequent check-ins are
encouraged.

Good wiki software like mediawiki at least warns you about conflicts...
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 10 Feb 2010 07:09:02 -0800

>>>>> On Wed, 10 Feb 2010 11:49:26 +0100, "Romascanu, Dan (Dan)" <[email-masked]> said:

DR> David Harrington put some work in improving the content of the wiki page
DR> at http://trac.tools.ietf.org/misc/outcomes/wiki/IetfOperations in what
DR> concerns SNMP and SMI. It would be good if other folks have a look and
DR> especially if they can spare some time adding more exact and detailed
DR> information related to the other management protocols. 

Being the project leader of a major SNMP stack, I find it odd that we've
marked SNMPv3 as "poor adoption".  It's definitely deployed and adopted
from the perspective of what my users ask questions about.  It's
definitely confusing to many (or they wouldn't ask questions) and it's
definitely not as big of a percentage as we'd like (hence the need for
ISMS), but to say that it's "poor adoption" is a bit odd.  "Some" would
be a better marking, IMHO.  Definitely not "massive".  Unfortunately, we
don't have an "ehhh" marking.

---

From: "David Harrington" <[email-masked]>
Date: Wed, 10 Feb 2010 11:39:51 -0500

Hi,

I didn't change the adoption column that was already set for snmpv3; I
have an obvious conflict of interest as snmpv3 wg chair. I would be
happy to see the ops area reach consensus on what the adoption column
should say.

I have discussed snmpv3 with a number of service provider operators
who tell me they definitely use snmpv3.

Here are my impressions, with very little evidence to support those
impressions:
There is the distinction between deployment and usage.
I believe snmpv3 is found in many devices. 
It had a slower adoption rate in NMS systems, but I think the major
NMS systems now support snmpv3. 
Many of the features are not used widely, and many are not used fully.
(I remember one case where VACM's per-user authorization was
supported, but they only allowed one user.)

Some environments are far more concerned about security than others,
and SNMPv3 gets used in security-conscious environments. 
Some environments have strict controls over management traffic using
techniques such as management VLANS, and operators for those networks
may feel that they have "enough" security using those approaches to
allow snmpv1/v2 to be used in a secure-enough manner, and they
obviously don't have demand for the additional features of SNMPv3.)

I would support "some adoption" with a target market of "environments
that require secure management".

dbh

> [mailto:[email-masked]] On Behalf Of Wes Hardaker
> Sent: Wednesday, February 10, 2010 10:09 AM
> To: Romascanu, Dan (Dan)
> Cc: [email-masked]; [email-masked]
> Subject: Re: [OPS-AREA] again about ietf-outcomes
> 
> DR> at

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 10 Feb 2010 09:59:53 -0800

> I lost about an hour's worth of work when Dave Crocker added the link

oh crap.  very sorry.  yeah, it's a limitation of this wiki software that it 
does not signal a conflict very well and doesn't retain the 'dropped' change. 
(If it any comfort, I've had major work also lost from this problem.)

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Fred Baker <[email-masked]>
Date: Wed, 10 Feb 2010 10:04:17 -0800

Along the lines of "secure management", Cisco's Lawful Intercept  
offering is controlled using SNMPv3, so anyone that uses it has to  
deploy and use SNMPv3. There is a recent Black hat discussion  
regarding that, and US Cert is likely to come back to your working  
group with a request for a change in the access control procedure -  
the message responding to an accepted access is different than the  
response to a denied access, which reveals information to an attacker.

>> don't have an "ehhh" marking.

http://www.ipinc.net/IPv4.GIF

---

From: Dave CROCKER <[email-masked]>
Date: Thu, 11 Feb 2010 12:40:20 -0800

On 2/10/2010 10:04 AM, Fred Baker wrote:
> deploy and use SNMPv3.

David H modified the wiki entry concerning this, but folks might want to take a 
look, and see whether they believe it needs more refinement:

    <http://trac.tools.ietf.org/misc/outcomes/wiki/IetfOperations>

d/
-- 

   Dave Crocker