Net.Medic and the eCommerce market

1
Policy-Based Management MIB
Steve Waldbusser Jon Saperia Thippanna Hongal
2
Policy-Based Management

• Provides a method of aggregating management
  operations
• Applies operations globally to all elements that
  share certain characteristics
• Of the form
• if (element has certain characteristics) then
  (apply action to that element)
• Or if (policyFilter) then (policyAction)

3
Examples

• If (interface is fast ethernet and is a
  trunk) then (apply full-duplex mode)
• if (interface is access) then
  (apply security filters)
• if (gold service paid for on circuit) then
  (apply special queueing)

4
Framework
Policy Specifications
Policy Server
SNMP/Policy MIB
Policy MIB
Various Local/SNMP/...
Managed System
5
Framework
Policy Specifications
Policy Server
SNMP/Policy MIB
Policy MIB
Various Local (using MIB names and values)
Managed System
6
Architecture
Policy Specifications
Policy Server
PolicyFilter
PolicyAction
SNMP/Policy MIB
ifType FastEthernet roleString trunk
fullDuplexMode ON
Policy MIB
ifType Ethernet roleString GOLD
Set QOS parametersto provide EF PHB
Various Local/SNMP/...
Managed System
7
Leverages existing SNMP MIBs
Policy Table
SNMP MIBs
SNMP MIBs
8
Example
PolicyFilter
PolicyAction
ifType FastEthernet roleString trunk
fullDuplexMode ON
ifType Ethernet roleString GOLD
Set QOS parametersto provide EF PHB
ifTypeFastEthernet roleStringTrunk ...
FullDuplex
EF PHB
EF PHB
EF PHB
ifTypeEthernet roleStringGOLD ...
ifTypeEthernet roleStringGOLD ...
ifTypeEthernet roleStringGOLD ...
9
Whats Needed?

• Core Architecture
• PolicyTable
• Contains objects for communicating policies
• Policy Filter Language
• Supporting Infrastructure
• RoleTable
• Capability
• Time
• Operational Considerations

10
PolicyTable

• PmPolicyEntry SEQUENCE
• pmPolicyIndex Integer32,
• pmPolicyFilter OCTET STRING,
• pmPolicyAction OCTET STRING?,
• pmPolicyDescription SnmpAdminString,
• pmPolicyMatches Gauge32,
• pmPolicyStatus RowStatus

11
Policy Filter Expressions

• Need to define a way to express a filter
• Probably a parenthesized logical and arithmetic
  expression
• Probably doesnt need iteration
• Strong preference for simplicity and
  obviousness

12
Whats Needed?

• Core Architecture
• PolicyTable
• Contains objects for communicating policies
• Policy Filter Language
• Supporting Infrastructure
• RoleTable
• Capabilities
• Time
• Operational Considerations

13
Roles

• There are many characteristics already defined as
  MIB objects that are available to be read by
  policyFilters
• But some necessary concepts for policy have never
  been described in MIB objects - We need to add
  them ourselves
• Political (isExecutive, outsideContractor)
• Financial (goldContract)
• Legal (lifeLine)
• Geographical (California, inSecureConduit)
• Engineered (backup, trunk)

14
RoleStringTable

• Writable table that allows strings to be
  downloaded to agent
• Multiple strings can be assigned to any element

element
subindex
roleString
1
gold
ifIndex.1
2
access
ifIndex.1
3
headquarters
ifIndex.1
1
trunk
ifIndex.99
15
CapabilitiesTable

• We want policies to be executed only on elements
  that have certain capabilities
• Need those capabilities to be in a MIB so that
  filters can read them

index
type
subType
1
WFQ
AcmeWFQ
2
Pentium
3
RoundRobinQ
16
Time

• We want policies to be executed only at certain
  times
• Need time to be in a MIB so that filters can read
  them
• Needs to provide two views of time
• Globally consistent (i.e., UTCTime)
• Local Business Time (i.e., M-F 9-5 local time)

17
Examples
18
Operational Requirements

• Policy Creation
• Need to allow an engineer to debug a policy
• policyActions can be debugged in a lab
• Debugging of policyFilters consists of ensuring
  that the filter selects the intended set of
  elements (not more, not less)
• Need to see where a policy would be executed
• Table that shows where a policy is executed
• For debugging, set policyAction to no-op

19
Operational Requirements

• Troubleshooting in Field
• Engineers will occasionally find that a device is
  misconfigured due to policy
• Need to find out which policy is causing the
  misconfiguration
• Need to see where policies are bound
• Table that shows what policies are executed here

20
Advantages of the Approach

• Built with existing infrastructure and tools
• Leverages existing MIBs
• Flexibility
• Complete Architecture
• Includes operational tools