Subject: Re: AuthType in VRRP MIB (fwd)

From: [email-masked] (Lori Mickelson)
Date: Fri, 31 Jul 1998 16:37:01 -0700 (PDT)

I agree with your statements, but what if the Auth type is
set to None or Simple Text Password.  These Authentication Types
don't involve IPSEC.  I realize they are still defined on a per-interface
basis, but shouldn't there be a way to set this through the VRRP MIB?
You have the IP Addresses as part of a separate table, maybe there
should be a separate table for Authentication and have it indexed by
the ifIndex.

Lori

Brian Jewell wrote:

> My interpretation of the 'vrrpOperAuthType' object is as follows:
> 
> - It is defined on a "per-interface basis" (VRRP RFC, page 12), and hence 
> doesn't fit very well into the 'vrrpOperTable'.

> - It is essentially in the 'vrrpOperTable' as it seems to be an important enough 
> attribute of a virtual router, that maybe a network management application would 
> want to know what it has been set to.

> 
> My knowledge of IPSEC is limited, and the VRRP RFC does not go into great detail 
> about where the authentication header (if used) would be validated (in VRRP or 
> elsewhere?). But again, both objects would seem to provide useful information 
> about a virtual router.
> 
> Since, IPSEC is configurable from a different component than VRRP (at least on 
> 3Com routers), it seemed to make sense to make the object "read-only", with the 
> assumption that an equivalent object would exist as a read-write object in an 
> (ifIndex-based) IPSEC MIB somewhere. However, I don't know that an IPSEC MIB 
> exists yet.
> 
> So, I am open to suggestions as to how to deal with 'vrrpOperAuthType' and 
> 'vrrpOperAuthKey' in the MIB.
> 
> As an aside, my interpretation of 'vrrpOperAuthKey' is that it would return a 
> "hashed" value of the authentication key, as opposed to the actual key (for 
> obvious security reasons). So at the very least, I think a more detailed 
> description of this object is in order for the next MIB draft revision.
> 
> In the meantime, I'll see what other input is received from concerned parties.
> 
> Thanks.
> 
> -Brian Jewell
> -3Com, Inc.
> [email-masked]
> 
> Original comments follow:
> > 
> > 
> > Since the vrrpOperAuthType and vrrpOperAuthKey objects are defined as
> > read-only in the VRRP MIB, how is one supposed to set the authentication
> > type and key through snmp?  Are you planning on defining another group
> > in the MIB for the Authentication on a per-interface basis?  Or should
> > the Access for these objects be read-write?
> > 
> > Thanks,
> > Lori
> > 
>