Subject: Proposed additions to vpn policy schema

From: Mikel Lechner <[email-masked]>
Date: Tue, 22 Jun 1999 21:19:08 -0700

I've been having discussions with Kido Masahiro at NEC
about using policy definitions to limit modifications
of various parameter settings in VPN devices.
The intention is to prevent "dumb" mistakes
and to insure that some basic minimum policy
is always applied.

As an example you might use a policy rule to specify
that DES encryption should not be allowed for IPSEC,
since it is no longer generally regarded as secure.

Another example would be to disallow modification
of parameters via less secure methods (eg. a telnet session).

In line with this ideas we've sketched out the following
possible policy classes for use in the schema.
The policy classes described here are more general than
just VPNs, but since our focus is VPNs, we thought we would
start with this.

Below I've included the definition of new classes,
which would be used to implement this new functionality.

The question is do others in the WG think such policies are
useful for VPNs, or for that matter for more general policy rules?

-- Mikel

======

class DevParamSetPolicyCondition

NAME               DevParamSetPolicyCondition
TYPE               Structural
DERIVED FROM       PolicyCondition
AUXILIARY CLASS    None
MAY                TargetParameter,
                   SettingMethod,
                   SettingRange

NAME      TargetParameter
DESC      Lists the names of device parameters for the condition to be applied
EQUALITY  caseIgnoreMatch
SYNTAX    DirectoryString
MULTI-VALUED
FORMAT    The following values are allowed:
              xxxParam
SEMANTICS xxxParam denotes a particular parameter xxx of a VPN device

NAME      SettingMethod
DESC      Denotes the method of setting for the condition to be applied
EQUALITY  caseIgnoreMatch
SYNTAX    DirectoryString
MULTI-VALUED
FORMAT    The following values are allowed:
              TELNET
              SNMP
SEMANTICS TELNET denotes the telnet protocol.
          SNMP denotes the snmp protocol.

NAME      SettingRange
DESC      Denotes the range of setting for the condition to be applied
EQUALITY  caseExactIA5Match
SYNTAX    IA5String
MULTI-VALUED
FORMAT    String consisting of two colon separated positive
          integers, the second no smaller than the first, or one
          positive integer.  (* Might need to allow a list of values
          or a list of ranges [eg. 1:3,5:7 to denote 1 through 3 and 5
          through 7] *)

NAME             DevParamSetControlAction
TYPE             Structural
DERIVED FROM     PolicyAction
AUXILIARY CLASS  None
MUST             ControlAction
MAY              ReportMethod

NAME      ControlAction
DESC      Control action for the condition
EQUALITY  caseIngoreStringMatch
SYNTAX    DirectoryString
SINGLE-VALUED
FORMAT    The following values are allowed
            Permit
            Deny
SEMANTICS Deny means that the setting must be rejected.
          Permit means that the setting may be accepted.

NAME      ReportMethod
DESC      Report method for the condition
EQUALITY  caseIngoreStringMatch
SYNTAX    DirectoryString
MULTI-VALUED
FORMAT    The following values are allowed
            SendingEMail
            Logging
SEMANTICS SendingEMail means that the report must be sent by E-Mail.
          Logging means that the report must be logged.