Subject: Re: Result of the compoundPolicyAction

From: "Mircea Pana" <[email-masked]>
Date: Fri, 11 May 2001 11:47:44 -0400

Do the PCIMe authors have any opinion wrt. this subject?

Here is an example to support the case 2. below. The following NAT rule

"in the packets from 10.10.10.10,
 change *both* the source addr.
 and the source port or,
 if any of the above fails
 then drop the packet"

could be implemented as follows:

Rule: If SourceIP=10.10.10.10 then (ordered, Do_until_success):
  Action_1(compound, unordered, Do_all):
    Action_1_1(simple): Set SourceIP to 1.2.3.4
    Action_1_2(simple): Set SourcePort to 2001
  Action_2: Drop packet

Action_1 (compound, Do_all) should be considered successful only if both
Action_1_1 and Action_1_2 are successful. Then Action_2 is not executed.
If either Action_1_1 or Action_1_2 fails, then Action_1 should be
considered failed and Action_2 should be executed.

Thank You,
Mircea.

> > The result of the execution of a compoundPolicyAction (success or
> > failure) is important for the execution strategy of the aggregating
> > policyRules or compoundPolicyAction. To avoid ambiguity, it may be good
> > to add a clarification to the next release of PCIMe.
> >
> > A suggestion might be:
> >
> > 1. For compoundPolicyAction.executionStrategy=Do_Until_Success:
> > The compoundPolicyAction is successful if an aggregated policyAction is
> > successful. If all the aggregated policyActions fail, then the
> > aggregating compoundPolicyAction is considered failed.
> >
> > 2. For compoundPolicyAction.executionStrategy=Do_All:
> > The compoundPolicyAction is successful if all the aggregated
> > policyActions are successful. If one or more aggregated policyActions
> > fail, then the aggregating compoundPolicyAction is considered failed.
> >
> > (2bis. An alternative to 2 might be:
> > The compoundPolicyAction is successful if one or more aggregated
> > policyActions are successful. If all the aggregated policyActions fail,
> > then the aggregating compoundPolicyAction is considered failed.
> > If both 2. and 2bis are applicable in various situations then it may be
> > useful to add a "Do_Any" execution strategy?)
> >
> > 3. For compoundPolicyAction.executionStrategy=Do_Until_Failure:
> > The compoundPolicyAction is successful if one or more aggregated
> > policyActions are successful. If the first attempt to execute an
> > aggregated policyAction fails, then the aggregating compoundPolicyAction
> > is considered failed.
> >
> > Regards,
> > Mircea.
> >
> > P.S. BTW in PCIMe-01, the example at the end of the paragraph "4.7.2
> > Compound Policy Actions" uses the retired "Mandatory Do All" decision
> > strategy. For consistency with the rest of the document, this should be
> > corrected.

---

From: "Ron Cohen" <[email-masked]>
Date: Sat, 12 May 2001 09:48:29 +0200

Mircea,

This is exactly the purpose of execution strategy. I understand that you
think that this tool is needed in the PCIMe. The authors where not fully in
agreement whether this is a required feature and whether policy entities
(PEPs and PDPs) would be able to implement this. The issue was that some
interpreted this to mean do action_1_1, and if you fail to do so, undo the
operation (which is not always possible), while others (including me)
interpreted this as first check that you can do action_1_1 and action_1_2,
if you can not do both don't do either one and move on to action 2.

Ron

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Mircea Pana
> Sent: Friday, May 11, 2001 5:48 PM
> To: IETF Policy
> Subject: Re: Result of the compoundPolicyAction
>
>