draft-ietf-bfd-mpls-mib-01.txt | draft-ietf-bfd-mpls-mib-02.txt | |||
---|---|---|---|---|
Network Working Group | Network Working Group | |||
INTERNET-DRAFT Sam Aldrin | INTERNET-DRAFT Sam Aldrin | |||
Intended Status: Standards Track Huawei Technologies | Intended Status: Standards Track Huawei Technologies | |||
Expires: June 29, 2013 M.Venkatesan | Expires: December 30, 2013 M.Venkatesan | |||
Dell Inc. | Dell Inc. | |||
Kannan KV Sampath | Kannan KV Sampath | |||
Redeem Software | Redeem Software | |||
Thomas D. Nadeau | Thomas D. Nadeau | |||
Juniper Networks | Juniper Networks | |||
December 26, 2012 | June 28, 2013 | |||
BFD Management Information Base (MIB) extensions | BFD Management Information Base (MIB) extensions | |||
for MPLS and MPLS-TP Networks | for MPLS and MPLS-TP Networks | |||
draft-ietf-bfd-mpls-mib-01 | draft-ietf-bfd-mpls-mib-02 | |||
Abstract | Abstract | |||
This draft defines a portion of the Management Information Base (MIB) | This draft defines a portion of the Management Information Base (MIB) | |||
for use with network management protocols in the Internet community. | for use with network management protocols in the Internet community. | |||
In particular, it extends the BFD Management Information Base BFD- | In particular, it extends the BFD Management Information Base BFD- | |||
STD-MIB and describes the managed objects for modeling Bidirectional | STD-MIB and describes the managed objects for modeling Bidirectional | |||
Forwarding Detection (BFD) protocol for MPLS and MPLS-TP networks. | Forwarding Detection (BFD) protocol for MPLS and MPLS-TP networks. | |||
Status of this Memo | Status of this Memo | |||
skipping to change at page 1, line 48 | skipping to change at page 1, line 48 | |||
and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
The list of current Internet-Drafts can be accessed at | The list of current Internet-Drafts can be accessed at | |||
http://www.ietf.org/ietf/1id-abstracts.txt. | http://www.ietf.org/ietf/1id-abstracts.txt. | |||
The list of Internet-Draft Shadow Directories can be accessed at | The list of Internet-Draft Shadow Directories can be accessed at | |||
http://www.ietf.org/shadow.html. | http://www.ietf.org/shadow.html. | |||
This Internet-Draft will expire on December 29, 2012. | This Internet-Draft will expire on December 30, 2013. | |||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2012 IETF Trust and the persons identified as the | Copyright (c) 2013 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
(http://trustee.ietf.org/license-info) in effect on the date of | (http://trustee.ietf.org/license-info) in effect on the date of | |||
publication of this document. Please review these documents | publication of this document. Please review these documents | |||
carefully, as they describe your rights and restrictions with respect | carefully, as they describe your rights and restrictions with respect | |||
to this document. Code Components extracted from this document must | to this document. Code Components extracted from this document must | |||
include Simplified BSD License text as described in Section 4.e of | include Simplified BSD License text as described in Section 4.e of | |||
the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
skipping to change at page 2, line 33 | skipping to change at page 2, line 33 | |||
2. The Internet-Standard Management Framework . . . . . . . . . . 3 | 2. The Internet-Standard Management Framework . . . . . . . . . . 3 | |||
3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 | 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 | |||
3.1 Conventions used in this document . . . . . . . . . . . . . 3 | 3.1 Conventions used in this document . . . . . . . . . . . . . 3 | |||
3.2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . 3 | 3.2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . 3 | |||
4. Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 | 4. Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
5. Brief description of MIB Objects . . . . . . . . . . . . . . . 4 | 5. Brief description of MIB Objects . . . . . . . . . . . . . . . 4 | |||
5.1. Extensions to the BFD session table (bfdSessionTable) . . . 4 | 5.1. Extensions to the BFD session table (bfdSessionTable) . . . 4 | |||
5.2. Example of BFD session configuration . . . . . . . . . . . 6 | 5.2. Example of BFD session configuration . . . . . . . . . . . 6 | |||
5.2.1 Example of BFD Session configuration for MPLS TE | 5.2.1 Example of BFD Session configuration for MPLS TE | |||
tunnel . . . . . . . . . . . . . . . . . . . . . . . . . 6 | tunnel . . . . . . . . . . . . . . . . . . . . . . . . . 6 | |||
5.2.2 Example of BFD Session configuration for Maintenance | 5.2.2 Example of BFD Session configuration for ME of MPLS-TP | |||
Entity of MPLS-TP TE tunnel . . . . . . . . . . . . . . 7 | TE tunnel . . . . . . . . . . . . . . . . . . . . . . . 7 | |||
5.3. BFD objects for session performance counters . . . . . . . 9 | 5.3. BFD objects for session performance counters . . . . . . . 9 | |||
5.4. Notification Objects . . . . . . . . . . . . . . . . . . . 9 | 5.4. Notification Objects . . . . . . . . . . . . . . . . . . . 9 | |||
6. BFD MPLS-MPLS-TP MIB Module Definition . . . . . . . . . . . . 10 | 6. BFD MPLS-MPLS-TP MIB Module Definition . . . . . . . . . . . . 10 | |||
7. Security Considerations . . . . . . . . . . . . . . . . . . . . 17 | 7. Security Considerations . . . . . . . . . . . . . . . . . . . . 18 | |||
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 18 | 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 20 | |||
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18 | 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 20 | |||
9.1 Normative References . . . . . . . . . . . . . . . . . . . . 18 | 9.1 Normative References . . . . . . . . . . . . . . . . . . . . 20 | |||
9.2 Informative References . . . . . . . . . . . . . . . . . . . 18 | 9.2 Informative References . . . . . . . . . . . . . . . . . . . 21 | |||
10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 19 | 10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 21 | |||
11. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 19 | 11. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 21 | |||
1 Introduction | 1 Introduction | |||
Current MIB for BFD as defined by BFD-STD-MIB is used for neighbor | Current MIB for BFD as defined by BFD-STD-MIB is used for neighbor | |||
monitoring in IP networks. The BFD session association to the | monitoring in IP networks. The BFD session association to the | |||
neighbors being monitored is done using the source and destination IP | neighbors being monitored is done using the source and destination IP | |||
addresses of the neighbors configured using the respective MIB | addresses of the neighbors configured using the respective MIB | |||
objects. | objects. | |||
To monitor MPLS/MPLS-TP paths like tunnels or Pseudowires, there is a | To monitor MPLS/MPLS-TP paths like tunnels or Pseudowires, there is a | |||
skipping to change at page 4, line 19 | skipping to change at page 4, line 19 | |||
LSP: Label Switching Path | LSP: Label Switching Path | |||
LSR: Label Switching Router | LSR: Label Switching Router | |||
MIB: Management Information Base | MIB: Management Information Base | |||
MPLS: Multi-Protocol Label Switching | MPLS: Multi-Protocol Label Switching | |||
MPLS-TP: MPLS Transport Profile | MPLS-TP: MPLS Transport Profile | |||
ME: Maintenance Entity | ME: Maintenance Entity | |||
MEG: Maintenance Entity Group | MEG: Maintenance Entity Group | |||
MEP: Maintenance Entity End-Point | MEP: Maintenance Entity End-Point | |||
PW: Pseudowire | PW: Pseudowire | |||
TP: Transport Profile | TP: Transport Profile | |||
LOC: Loss Of Continuity | ||||
5. Brief description of MIB Objects | 5. Brief description of MIB Objects | |||
The objects described in this section support the functionality | The objects described in this section support the functionality | |||
described in documents [BFD-MPLS] and [RFC6428]. The objects are | described in documents [BFD-MPLS] and [RFC6428]. The objects are | |||
defined as an extension to the BFD base MIB defined by BFD-STD-MIB. | defined as an extension to the BFD base MIB defined by BFD-STD-MIB. | |||
5.1. Extensions to the BFD session table (bfdSessionTable) | 5.1. Extensions to the BFD session table (bfdSessionTable) | |||
The BFD session table used to identify a BFD session between a pair | The BFD session table used to identify a BFD session between a pair | |||
skipping to change at page 7, line 43 | skipping to change at page 7, line 43 | |||
= mplsTunnelName.100.1.3221225985.3221225987, | = mplsTunnelName.100.1.3221225985.3221225987, | |||
bfdSessRowStatus = createAndGo | bfdSessRowStatus = createAndGo | |||
} | } | |||
Similarly BFD session would be configured on the tail-end of | Similarly BFD session would be configured on the tail-end of | |||
the tunnel. Creating the above row will trigger | the tunnel. Creating the above row will trigger | |||
the bootstrapping of the session using LSP Ping and its | the bootstrapping of the session using LSP Ping and its | |||
subsequent establishment over the path by de-multiplexing of | subsequent establishment over the path by de-multiplexing of | |||
the control packets using the BFD session discriminators. | the control packets using the BFD session discriminators. | |||
5.2.2 Example of BFD Session configuration for Maintenance Entity of | 5.2.2 Example of BFD Session configuration for ME of MPLS-TP TE tunnel | |||
MPLS-TP TE tunnel | ||||
This example considers the OAM identifiers configuration on a | This example considers the OAM identifiers configuration on a | |||
head-end LSR to manage and monitor a co-routed bidirectional MPLS | head-end LSR to manage and monitor a co-routed bidirectional MPLS | |||
tunnel. | tunnel. | |||
Only relevant objects which are applicable for IP based OAM | Only relevant objects which are applicable for IP based OAM | |||
identifiers of co-routed MPLS tunnel are illustrated here. | identifiers of co-routed MPLS tunnel are illustrated here. | |||
In mplsOamIdMegTable: | In mplsOamIdMegTable: | |||
{ | { | |||
skipping to change at page 10, line 27 | skipping to change at page 10, line 23 | |||
RowPointer,TruthValue,TEXTUAL-CONVENTION | RowPointer,TruthValue,TEXTUAL-CONVENTION | |||
FROM SNMPv2-TC -- [RFC2579] | FROM SNMPv2-TC -- [RFC2579] | |||
MODULE-COMPLIANCE, OBJECT-GROUP | MODULE-COMPLIANCE, OBJECT-GROUP | |||
FROM SNMPv2-CONF -- [RFC2580] | FROM SNMPv2-CONF -- [RFC2580] | |||
bfdSessIndex | bfdSessIndex | |||
FROM BFD-STD-MIB; | FROM BFD-STD-MIB; | |||
bfdMplsMib MODULE-IDENTITY | bfdMplsMib MODULE-IDENTITY | |||
LAST-UPDATED "201204190000Z" -- April 19 2012 | LAST-UPDATED "201306260000Z" -- June 26 2013 | |||
ORGANIZATION "IETF Bidirectional Forwarding Detection | ORGANIZATION "IETF Bidirectional Forwarding Detection | |||
Working Group" | Working Group" | |||
CONTACT-INFO | CONTACT-INFO | |||
" | " | |||
Sam Aldrin | Sam Aldrin | |||
Huawei Technologies | Huawei Technologies | |||
2330 Central Express Way, | 2330 Central Express Way, | |||
Santa Clara, CA 95051, USA | Santa Clara, CA 95051, USA | |||
Email: aldrin.ietf@gmail.com | Email: aldrin.ietf@gmail.com | |||
Venkatesan Mahalingam | Venkatesan Mahalingam | |||
Dell Inc. | Dell Inc. | |||
350 Holger Way, | 350 Holger Way, | |||
San Jose, CA 95134, USA | San Jose, CA 95134, USA | |||
Email: venkat.mahalingams@gmail.com | Email: venkat.mahalingams@gmail.com | |||
Kannan KV Sampath | Kannan KV Sampath | |||
Aricent | Redeem Software | |||
India | India | |||
Email: Kannan.Sampath@aricent.com | Email: kannankvs@gmail.com | |||
Thomas D. Nadeau | Thomas D. Nadeau | |||
Juniper Networks | Juniper Networks | |||
10 Technology Park Drive, Westford, MA 01886 | 10 Technology Park Drive, Westford, MA 01886 | |||
Email: tnadeau@juniper.net" | Email: tnadeau@juniper.net" | |||
DESCRIPTION | DESCRIPTION | |||
" Copyright (c) 2012 IETF Trust and the persons identified | " Copyright (c) 2013 IETF Trust and the persons identified | |||
as the document authors. All rights reserved. | as the document authors. All rights reserved. | |||
This MIB module is an initial version containing objects | This MIB module is an initial version containing objects | |||
to provide a proactive mechanism to detect faults using | to provide a proactive mechanism to detect faults using | |||
BFD for MPLS and MPLS-TP networks" | BFD for MPLS and MPLS-TP networks" | |||
REVISION "201204190000Z" -- April 19 2012 | REVISION "201306260000Z" -- June 26 2013 | |||
DESCRIPTION | DESCRIPTION | |||
" Initial version published as RFC xxx " | " Initial version published as RFC xxx " | |||
-- RFC Ed.: RFC-editor pls fill in xxxx | -- RFC Ed.: RFC-editor pls fill in xxxx | |||
::= { mib-2 XXX } -- XXX to be replaced with correct value | ::= { mib-2 XXX } -- XXX to be replaced with correct value | |||
-- RFC Ed.: assigned by IANA | -- RFC Ed.: assigned by IANA | |||
-- ------------------------------------------------------------ | -- ------------------------------------------------------------ | |||
-- groups in the MIB | -- groups in the MIB | |||
-- ------------------------------------------------------------ | -- ------------------------------------------------------------ | |||
skipping to change at page 11, line 45 | skipping to change at page 11, line 42 | |||
nonTeIpv4(1), -- mapping into LDP IPv4 | nonTeIpv4(1), -- mapping into LDP IPv4 | |||
nonTeIpv6(2), -- mapping into LDP IPv6 | nonTeIpv6(2), -- mapping into LDP IPv6 | |||
teIpv4(3), -- mapping into TE IPv4 | teIpv4(3), -- mapping into TE IPv4 | |||
teIpv6(4), -- mapping into TE IPv6 | teIpv6(4), -- mapping into TE IPv6 | |||
pw(5), -- mapping into Pseudowires | pw(5), -- mapping into Pseudowires | |||
mep(6) -- mapping into MEPs in MPLS-TP | mep(6) -- mapping into MEPs in MPLS-TP | |||
} | } | |||
DefectActionTC ::= TEXTUAL-CONVENTION | ||||
STATUS current | ||||
DESCRIPTION | ||||
"The action to be taken when the mis-connectivity/loss of | ||||
connectivity defect occurs in the MPLS or MPLS-TP | ||||
path associated to the session" | ||||
SYNTAX INTEGER { | ||||
alarmOnly(1), -- Alarm only | ||||
alarmAndBlockData(2) -- Alarm and block the data | ||||
} | ||||
-- ------------------------------------------------------------------ | -- ------------------------------------------------------------------ | |||
-- BFD session table extensions for BFD on MPLS and MPLS-TP | -- BFD session table extensions for BFD on MPLS and MPLS-TP | |||
-- ------------------------------------------------------------------ | -- ------------------------------------------------------------------ | |||
-- bfdMplsSessTable - bfdSessTable Extension | -- bfdMplsSessTable - bfdSessTable Extension | |||
bfdMplsSessTable OBJECT-TYPE | bfdMplsSessTable OBJECT-TYPE | |||
SYNTAX SEQUENCE OF BfdMplsSessEntry | SYNTAX SEQUENCE OF BfdMplsSessEntry | |||
MAX-ACCESS not-accessible | MAX-ACCESS not-accessible | |||
STATUS current | STATUS current | |||
DESCRIPTION | DESCRIPTION | |||
"This table is an extension to the bfdSessTable for | "This table is an extension to the bfdSessTable for | |||
configuring BFD sessions for MPLS or MPLS-TP paths." | configuring BFD sessions for MPLS or MPLS-TP paths." | |||
::= { bfdMplsObjects 1 } | ::= { bfdMplsObjects 1 } | |||
skipping to change at page 12, line 28 | skipping to change at page 12, line 36 | |||
DESCRIPTION | DESCRIPTION | |||
"A row in this table extends a row in bfdSessTable." | "A row in this table extends a row in bfdSessTable." | |||
INDEX { bfdSessIndex } | INDEX { bfdSessIndex } | |||
::= { bfdMplsSessTable 1 } | ::= { bfdMplsSessTable 1 } | |||
BfdMplsSessEntry ::= SEQUENCE { | BfdMplsSessEntry ::= SEQUENCE { | |||
bfdMplsSessRole INTEGER, | bfdMplsSessRole INTEGER, | |||
bfdMplsSessMode INTEGER, | bfdMplsSessMode INTEGER, | |||
bfdMplsSessTmrNegotiate TruthValue, | bfdMplsSessTmrNegotiate TruthValue, | |||
bfdMplsSessMapType SessionMapTypeTC, | bfdMplsSessMapType SessionMapTypeTC, | |||
bfdMplsSessMapPointer RowPointer | bfdMplsSessMapPointer RowPointer, | |||
bfdMplsSessMisConnectivityDefectAction DefectActionTC, | ||||
bfdMplsSessLOCDefect DefectActionTC | ||||
} | } | |||
bfdMplsSessRole OBJECT-TYPE | bfdMplsSessRole OBJECT-TYPE | |||
SYNTAX INTEGER { | SYNTAX INTEGER { | |||
active(1), | active(1), | |||
passive(2) | passive(2) | |||
} | } | |||
MAX-ACCESS read-create | MAX-ACCESS read-create | |||
STATUS current | STATUS current | |||
DESCRIPTION | DESCRIPTION | |||
skipping to change at page 14, line 33 | skipping to change at page 14, line 46 | |||
instance does not currently exist then no valid | instance does not currently exist then no valid | |||
path is associated with this session entry. | path is associated with this session entry. | |||
If this object contains zeroDotZero then no valid path is | If this object contains zeroDotZero then no valid path is | |||
associated with this BFD session entry till it is | associated with this BFD session entry till it is | |||
populated with a valid pointer consistent with | populated with a valid pointer consistent with | |||
the value of bfdMplsSessMapType as explained above." | the value of bfdMplsSessMapType as explained above." | |||
DEFVAL { zeroDotZero } | DEFVAL { zeroDotZero } | |||
::= { bfdMplsSessEntry 5 } | ::= { bfdMplsSessEntry 5 } | |||
bfdMplsSessMisConnectivityDefectAction OBJECT-TYPE | ||||
SYNTAX DefectActionTC | ||||
MAX-ACCESS read-create | ||||
STATUS current | ||||
DESCRIPTION | ||||
"This object indicates the action to be taken when | ||||
the mis-connectivity defect is detected on | ||||
this BFD session." | ||||
DEFVAL { alarmOnly } | ||||
::= { bfdMplsSessEntry 6 } | ||||
bfdMplsSessLOCDefect OBJECT-TYPE | ||||
SYNTAX DefectActionTC | ||||
MAX-ACCESS read-create | ||||
STATUS current | ||||
DESCRIPTION | ||||
"This object indicates the action to be taken when | ||||
the loss of continuity defect is detected on | ||||
this BFD session." | ||||
DEFVAL { alarmOnly } | ||||
::= { bfdMplsSessEntry 7 } | ||||
-- ------------------------------------------------------------------ | -- ------------------------------------------------------------------ | |||
-- BFD Objects for Session performance | -- BFD Objects for Session performance | |||
-- ----------------------------------------------------------------- | -- ----------------------------------------------------------------- | |||
-- bfdMplsSessPerfTable - bfdSessPerfTable Extension | -- bfdMplsSessPerfTable - bfdSessPerfTable Extension | |||
bfdMplsSessPerfTable OBJECT-TYPE | bfdMplsSessPerfTable OBJECT-TYPE | |||
SYNTAX SEQUENCE OF BfdMplsSessPerfEntry | SYNTAX SEQUENCE OF BfdMplsSessPerfEntry | |||
MAX-ACCESS not-accessible | MAX-ACCESS not-accessible | |||
STATUS current | STATUS current | |||
DESCRIPTION | DESCRIPTION | |||
skipping to change at page 18, line 22 | skipping to change at page 18, line 22 | |||
::= { bfdMplsCompliances 2 } | ::= { bfdMplsCompliances 2 } | |||
-- Units of conformance. | -- Units of conformance. | |||
bfdSessionExtGroup OBJECT-GROUP | bfdSessionExtGroup OBJECT-GROUP | |||
OBJECTS { | OBJECTS { | |||
bfdMplsSessRole, | bfdMplsSessRole, | |||
bfdMplsSessMode, | bfdMplsSessMode, | |||
bfdMplsSessTmrNegotiate, | bfdMplsSessTmrNegotiate, | |||
bfdMplsSessMapType, | bfdMplsSessMapType, | |||
bfdMplsSessMapPointer | bfdMplsSessMapPointer, | |||
bfdMplsSessMisConnectivityDefectAction, | ||||
bfdMplsSessLOCDefect | ||||
} | } | |||
STATUS current | STATUS current | |||
DESCRIPTION | DESCRIPTION | |||
"Collection of objects needed for BFD monitoring for | "Collection of objects needed for BFD monitoring for | |||
MPLS and MPLS-TP paths" | MPLS and MPLS-TP paths" | |||
::= { bfdMplsGroups 1 } | ::= { bfdMplsGroups 1 } | |||
bfdSessionExtPerfGroup OBJECT-GROUP | bfdSessionExtPerfGroup OBJECT-GROUP | |||
OBJECTS { | OBJECTS { | |||
bfdMplsSessPerfMisDefCount, | bfdMplsSessPerfMisDefCount, | |||
skipping to change at page 18, line 47 | skipping to change at page 19, line 4 | |||
STATUS current | STATUS current | |||
DESCRIPTION | DESCRIPTION | |||
"Collection of objects needed to monitor the | "Collection of objects needed to monitor the | |||
performance of BFD sessions on MPLS and MPLS-TP | performance of BFD sessions on MPLS and MPLS-TP | |||
paths" | paths" | |||
::= { bfdMplsGroups 2 } | ::= { bfdMplsGroups 2 } | |||
END | END | |||
7. Security Considerations | 7. Security Considerations | |||
As BFD session for MPLS path may be tied into the stability of | ||||
the MPLS network infrastructure, the effects of an attack on a BFD | ||||
session may be very serious. This ultimately has denial-of-service | ||||
effects, as links may be declared to be down (or falsely declared to | ||||
be up.) As such, improper configuration of the objects represented | ||||
by this MIB may result in denial of service to a large number of end- | ||||
users. | ||||
To be added in the next version of this document. | There are a number of management objects defined in this MIB module | |||
with a MAX-ACCESS clause of read-write and/or read-create. Such | ||||
objects may be considered sensitive or vulnerable in some network | ||||
environments. The support for SET operations in a non-secure | ||||
environment without proper protection can have a negative effect on | ||||
network operations. | ||||
There are a number of management objects defined in this MIB module | ||||
with a MAX-ACCESS clause of read-write and/or read-create. Such | ||||
objects may be considered sensitive or vulnerable in some network | ||||
environments. It is thus important to control even GET and/or NOTIFY | ||||
access to these objects and possibly to even encrypt the values of | ||||
these objects when sending them over the network via SNMP. | ||||
o The bfdMplsSessTable may be used to directly configure BFD | ||||
sessions for MPLS path. | ||||
Unauthorized access to objects in this table could result in | ||||
disruption of traffic on the network. This is especially true if | ||||
an unauthorized user configures enough tables to invoke a denial | ||||
of service attack on the device where they are configured, or on | ||||
a remote device where the sessions terminate. | ||||
Some of the readable objects in this MIB module (i.e., objects with a | ||||
MAX-ACCESS other than not-accessible) may be considered sensitive or | ||||
vulnerable in some network environments. It is thus important to | ||||
control even GET and/or NOTIFY access to these objects and possibly | ||||
to even encrypt the values of these objects when sending them over | ||||
the network via SNMP. These are the tables and objects and their | ||||
sensitivity/vulnerability: | ||||
o The bfdSessPerfTable and bfdMplsSessPerfTable both allows access | ||||
to the performance characteristics of BFD sessions for MPLS | ||||
paths. Network administrators not wishing to show | ||||
this information should consider this table sensitive. | ||||
The bfdSessAuthenticationType, bfdSessAuthenticationKeyID, and | ||||
bfdSessAuthenticationKey objects hold security methods and | ||||
associated security keys of BFD sessions for MPLS paths. These | ||||
objects SHOULD be considered highly sensitive objects. In order | ||||
for these sensitive information from being improperly accessed, | ||||
implementers MAY wish to disallow read and create access to these | ||||
objects. | ||||
SNMP versions prior to SNMPv3 did not include adequate security. | ||||
Even if the network itself is secure "for example by using IPSec", | ||||
even then, there is no control as to who on the secure network is | ||||
allowed to access and GET/SET "read/change/create/delete" the objects | ||||
in these MIB modules. | ||||
It is RECOMMENDED that implementers consider the security features as | ||||
provided by the SNMPv3 framework (see [RFC3410], section 8), | ||||
including full support for the SNMPv3 cryptographic mechanisms "for | ||||
authentication and privacy". | ||||
Further, deployment of SNMP versions prior to SNMPv3 is not | ||||
recommended. Instead, it is RECOMMENDED to deploy SNMPv3 and to | ||||
enable cryptographic security. It is then a customer/operator | ||||
responsibility to ensure that the SNMP entity giving access to an | ||||
instance of this MIB module, is properly configured to give access to | ||||
the objects only to those principals "users" that have legitimate | ||||
rights to indeed GET or SET "change/create/delete" them. | ||||
8. IANA Considerations | 8. IANA Considerations | |||
To be added in the next version of this document. | The MIB module in this document uses the following IANA-assigned | |||
OBJECT IDENTIFIER values recorded in the SMI Numbers registry: | ||||
Descriptor OBJECT IDENTIFIER value | ||||
---------- ----------------------- | ||||
bfdMplsMib { mib-2 XXX } | ||||
[Editor's Note (to be removed prior to publication): the IANA is | ||||
requested to assign a value for "XXX" under the 'mib-2' subtree | ||||
and to record the assignment in the SMI Numbers registry. When | ||||
the assignment has been made, the RFC Editor is asked to replace | ||||
"XXX" here and in the MIB module) with the assigned value and | ||||
to remove this note.] | ||||
9. References | 9. References | |||
9.1 Normative References | 9.1 Normative References | |||
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
Requirement Levels", BCP 14, RFC 2119, March 1997. | Requirement Levels", BCP 14, RFC 2119, March 1997. | |||
[BFD] Katz, D. and D. Ward, "Bidirectional Forwarding | [BFD] Katz, D. and D. Ward, "Bidirectional Forwarding | |||
Detection (BFD)", RFC 5880, June 2010. | Detection (BFD)", RFC 5880, June 2010. | |||
skipping to change at page 19, line 33 | skipping to change at page 21, line 20 | |||
[BFD-MH] Katz, D. and D. Ward, "Bidirectional Forwarding | [BFD-MH] Katz, D. and D. Ward, "Bidirectional Forwarding | |||
Detection (BFD) for Multihop Paths", RFC 5883, | Detection (BFD) for Multihop Paths", RFC 5883, | |||
June 2010. | June 2010. | |||
[BFD-MPLS] Aggarwal, R. et.al., "Bidirectional Forwarding | [BFD-MPLS] Aggarwal, R. et.al., "Bidirectional Forwarding | |||
Detection (BFD) for MPLS Label Switched Paths (LSPs)", | Detection (BFD) for MPLS Label Switched Paths (LSPs)", | |||
RFC 5884, June 2010 | RFC 5884, June 2010 | |||
[RFC6428] Allan, D., Swallow, G., Drake, J., "Proactive | [RFC6428] Allan, D., Swallow, G., Drake, J., "Proactive | |||
Connectivity Verification, Continuity Check and Remote | Connectivity Verification, Continuity Check and Remote | |||
Defect indication for MPLS Transport Profile", RFC 6428, | Defect indication for MPLS Transport Profile", RFC | |||
November 2011. | 6428, November 2011. | |||
[RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder, | [RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder, | |||
"Structure of Management Information Version 2 (SMIv2)", | "Structure of Management Information Version 2 (SMIv2)", | |||
STD 58, RFC 2578, April 1999. | STD 58, RFC 2578, April 1999. | |||
[RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder, | [RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder, | |||
"Textual Conventions for SMIv2", STD 58, RFC 2579, April | "Textual Conventions for SMIv2", STD 58, RFC 2579, April | |||
1999. | 1999. | |||
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, | [RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, | |||
skipping to change at page 20, line 7 | skipping to change at page 21, line 43 | |||
April 1999. | April 1999. | |||
9.2 Informative References | 9.2 Informative References | |||
[RFC3410] J. Case, R. Mundy, D. pertain, B.Stewart, "Introduction | [RFC3410] J. Case, R. Mundy, D. pertain, B.Stewart, "Introduction | |||
and Applicability Statement for Internet Standard | and Applicability Statement for Internet Standard | |||
Management Framework", RFC 3410, December 2002. | Management Framework", RFC 3410, December 2002. | |||
10. Acknowledgments | 10. Acknowledgments | |||
The authors would like to thank Jeffrey Haas, Mukund Mani and Lavanya | The authors would like to thank Jeffrey Haas, Mukund Mani, | |||
Srivatsa for their valuable comments. | Lavanya Srivatsa, Muly Ilan and John Salloway for their valuable | |||
comments. | ||||
11. Authors' Addresses | 11. Authors' Addresses | |||
Sam Aldrin | Sam Aldrin | |||
Huawei Technologies | Huawei Technologies | |||
2330 Central Express Way, | 2330 Central Express Way, | |||
Santa Clara, CA 95051, USA | Santa Clara, CA 95051, USA | |||
Email: aldrin.ietf@gmail.com | Email: aldrin.ietf@gmail.com | |||
Venkatesan Mahalingam | Venkatesan Mahalingam | |||
End of changes. 26 change blocks. | ||||
30 lines changed or deleted | 151 lines changed or added | |||
This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ |