Subject: RE: Policy Framework and IPsec policy

From: Andrew Milne <[email-masked]>
Date: Mon, 2 Aug 1999 11:42:30 -0400

<snip>

> My main concern here is to make sure that the policy framework doesn't
> prohibit policies to be stored in the repository in a decorrelated
> form so that an inter-domain policy protocol that requires
> decorrelation will still fit into the gereral policy framework.

> Matthew Condell
> BBN Technologies

<snip>

Just noting that our work within TimeStep R&D (IPSec SVPN stuff) on this
issue leaves me wishing wholeheartedly to express my support of this goal.
BBN's SPS draft struck us at the time as an excellent expression of a
well-thought-out mechanism, and the essential logic of having an
organization's policy server

	(1) Cache policy directives received from domains outside that
organization's control, with the assumption made that the server that sent
this directive had arranged that the directive would be an accurate
expression of the policy it enforces in isolation from any other rules
(achieved via decorrelation), and 
	(2) Keep those directives separate from that organization's own,
internal, rules, so that organization can distinguish them and resolve them
properly with its own (a process somewhat different from resolution between
intra-domain rules, as Mr. Condell has previously noted in this thread)

.. is the kind of very workable approach to the problem on which I suspect
all other solutions are likely to converge anyway.

I'll note also that John Schlinzen's earlier comment re keeping policy for
different domains in different subtrees of the DIT does strike me as one
potential mechanism for keeping those rules separate.

As an additional comment, given adoption of such a mechanism, I think we do
need to keep two of these problem areas somewhat discrete for the purposes
of clear discussion: there's (1) decorrelation of rules affecting the same
domain, where those rules were probably all written by the same agent with
the understanding that they are to be understood in a common context
(decorrelation meaning they now work outside the context of the accompanying
rules), and (2) resolution of the sensible action for equipment to take when
rules expressed by different agents, controlling different domains,
conflict. The fact that the mechanism of resolution is likely to be similar
probably shouldn't be allowed to obscure the essential differences between
these problems in discussion or in the text of the drafts.

Andrew Milne
Computer Systems Analyst
TimeStep Inc.
593 Herndon Parkway
Herndon, VA, USA 20170