Subject: Re: [pcp] draft-ietf-pcp-dhcp: multiple pcp servers

From: "Reinaldo Penno (repenno)" <[email-masked]>
Date: Tue, 1 Oct 2013 10:25:36 +0000

Inline.

On 9/30/13 8:17 AM, "Ted Lemon" <[email-masked]> wrote:

>On Sep 30, 2013, at 11:09 AM, Reinaldo Penno (repenno)
><[email-masked]> wrote:
>> Is this a good formulation of the problem: "what does a client that
>> receives multiple PCP server address should do if it can not (or does
>>not)
>> have code to make use of them?"
>
>I think there are two issues that we are conflating into one:

[RP] And conflating two scenarios as well. The vanilla security camera
will not play on the scenario I discuss below.

>
>1. Under what circumstances

[RP] The scenarios I'm currently facing are: two Firewalls, multi-homed.
But let's backtrack a bit. IT
folks tell that today this problem is solved through old style manual
provisioning.

So, let's suppose you upgrade these firewalls to support PCP. IT folks
also tell me that in these scenarios there is no way PCP Clients will be
able to program 
firewalls without an authorization + policy component

This policy component will program the firewalls (through Netconf, PCP
Third_party, whatnot) or
give PCP Client an access token.

So, I would venture to say that in these scenarios the PCP Client can not
be a PCP-base only client. It will need
to implement PCP-auth or access token. So, the vanilla security camera
will not play in this scenario. It needs
to be one with (much) more capability.

I would also say that the standard today is state synch (whether through
an actual protocol or manual config).

>and through what mechanism would a DHCP client be configured with
>multiple PCP servers?

[RP] IMO we need to discuss whether which scenarios are valid.

>2. How does a PCP client deal with multiple PCP servers?

[RP] If the premise is that a client is receiving multiple servers whether
it likes or not, always choose the first
one. Whether or not things will work is TBD.

>
>As I mentioned to Med, I think privately, I think there is no
>circumstance in which multiple PCP servers make sense for a single
>egress.   The situation where multiple servers do make sense is if the
>network is multihomed, or the client has multiple interfaces.   So I
>think it's actually a multiple provisioning domain problem, and that is
>the only case where we need to deal with this.
>
>(See https://datatracker.ietf.org/doc/draft-anipko-mif-mpvd-arch/ for
>details on the multiple provisioning domain problem.)

---

From: Dan Wing <[email-masked]>
Date: Wed, 2 Oct 2013 12:54:46 -0700

On Sep 30, 2013, at 8:09 AM, Reinaldo Penno (repenno) <[email-masked]> wrote:

> receives multiple PCP server address should do if it can not (or does not)

Before we approach that, I think the WG needs to decide a higher-level question, which is which network element is responsible for promulgating state:  the host or "the network".  Analyzing the pro/con of each approach would improve everyone's understanding.

-d

> 
> 
> On 9/30/13 7:26 AM, "Ted Lemon" <[email-masked]> wrote:
> 
>> On Sep 30, 2013, at 9:39 AM, [email-masked] wrote:
>>> I already answered to a message form Stuart on the deployment model;
>>> please check 
>>> http://www.ietf.org/mail-archive/web/pcp/current/msg03345.html
>> 
>> You explained your deployment model, and I think it was a helpful
>> explanation, but you didn't address the problem he described.
>> 
>> _______________________________________________
>> pcp mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/pcp
> 
> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp