RFC 3139
Requirements for Configuration Management of IP-based Networks
Requirements for Configuration Management of IP-based Networks 💖
Network Working Group 🧚 This one is RFC 3139 🎀 and it's Informational, so it's just here to give the Internet community info, not a standard 💅. It came out in June 2001 ✨. The authors are L. Sanchez (Megisto), K. McCloghrie (Cisco), and J. Saperia (JDS Consultant) 🫶. It doesn't list any RFCs it obsoletes or updates 🙈.
Status of this Memo ✨
Okay so this memo is info for the Internet community 🌸. It does not specify an Internet standard of any kind 🙈. Distribution of this memo is unlimited 💅.
Copyright Notice 🎀
Copyright (C) The Internet Society (2001). All Rights Reserved. 💜
Abstract 🦋
Basically, this memo talks about different approaches to configure networks, and it identifies a set of configuration management requirements for IP-based networks 🧚.
Table of Contents 🌈
1.0 Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1 Motivation, Scope and Goals of this document . . . . . . . 2
1.2 Requirements Terminology . . . . . . . . . . . . . . . . . 3
1.3 Audience . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.4 Definition of Technical Terms. . . . . . . . . . . . . . . 3
2.0 Statement of the Problem . . . . . . . . . . . . . . . . . . 4
3.0 Requirements for an IP-based Configuration Management System . 7
4.0 Security Considerations . . . . . . . . . . . . . . . . . . . 9
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 9
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Authors' Addresses. . . . . . . . . . . . . . . . . . . . . . . . 10
Full Copyright Statement. . . . . . . . . . . . . . . . . . . . . 111.0 Introduction 🌈
1.1 Motivation, Scope and Goals of this document
Okay so a bunch of IETF working groups came up with new technologies that offer integrated and differentiated services 💅. To support these, working group members realized they had new requirements for configuring them 🤓. One of those new requirements was the provisioning (configuration) of behavior at the network level 🔥.
Like, picture instructing all routers in a network to provide 'gold' service to a particular set of customers 👑. Depending on the specific network equipment and the definition of 'gold' service, that one request might turn into different configuration parameters on different vendors' equipment and a bunch of individual configuration commands at the router 💀. This higher level of configuration management has commonly come to be known as policy based management 🫶.
The working groups behind these new technologies felt that the existing SNMP based management framework was adequate for fault, configuration management at the individual instance (e.g., interface) level, performance, and other management functions commonly associated with it, but it just wasn't able to meet these new needs 😭. So they started working on new solutions and approaches ✨.
COPS [COPS] for RSVP [RSVP] lets routers ask their Policy Server for an admit/reject decision for a particular RSVP session 🎀. This model lets routers outsource their resource allocation decisions to some other entity 💅. BUT this model does not work with DiffServ [DSARCH], where there is no signalling protocol 🙈. Therefore, the policies that affect resource allocation decisions must be provisioned to the routers 📦. It became evident that there was a need for coordinating both RSVP-based and DiffServ-based policies to provide end2end QoS 🦋. Working groups began to extend and leverage approaches such as COPS for RSVP to support Diffserv policies, and this gave birth to COPS-PR [COPS-PR] 👑.
These extensions caused concern that the IETF was about to develop a set of fragmented solutions, locally optimized for specific technologies and not well integrated in the existing Internet Management Framework 😬. So some of the Area Directors associated with the Operations and Management, Transport, and General areas, plus some IAB members, organized a two day meeting in mid September 1999 🌸. The primary purpose of the meeting was to examine the requirements for configuration management and evaluate the COPS/PIB and SNMP/MIB approaches in light of those requirements 🧚.
At the end of the two day meeting there was no consensus on several issues, so a number of 'design teams' were created 💀. This document is the output of the design team chartered with identifying a global set of configuration management requirements 🫶. It has benefited from feedback received during the Configuration Management BOF that took place on November 11, 1999 during the 46th IETF in Washington DC, USA 🌍. It has also benefited from comments sent to the confmgt@ops.ietf.org mailing list 💜.
1.2 Requirements Terminology
Okay, so the keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT" and "MAY" that show up in this document are to be interpreted as described in RFC 2119 [Bra97] 🤓✨.
1.3 Audience
The target audience is system designers, implementers of network configuration and management technology, and anyone who wants a general background understanding of the issues related to configuration management in general, and to the Internet in particular, along with the associated requirements 💅. This document assumes the reader is familiar with the Internet Protocol, related networking technology, and general network management terms and concepts 🎀.
1.4 Definition of Terms
Device-Local Configuration 🍓
Configuration data that is specific to a particular network device 🧚. This is the finest level of granularity for configuring network devices 🔍.
Network-Wide Configuration 🌐
Configuration data that is not specific to any particular network device, and from which multiple device-local configurations can be derived 💫. Network-wide configuration provides a level of abstraction above device-local configurations ✨.
Configuration Data Translator 🦋
A function that transforms Configuration Management Data (high-level policies) or Network-wide configuration data (middle-level policies) into device local configurations (low-level policies), based on the generic capabilities of network devices 🔄. This function can be performed either by the devices themselves or by some intermediate entity 💜.
2.0 Statement of the Problem ✨
okay so, configuring big networks is getting harder every single day 😭 Networks are growing in more than one direction at once. There are more devices, more kinds of devices, and each device keeps getting more features and more complexity. The number of devices, the time scales for configuring them, and everything else are all scaling up together, so the job gets messier in every way 💀
Back in the day, configuring a network device was a three-step process 🎀 First, the network operator, engineer, or whoever was in charge of the network built a model of the network and how it was supposed to behave. Next, that model plus its expected behavior got written down as high-level policies. Finally, those policies got translated into device-local configurations and pushed out to every device so they could enforce them 💜
Any high-level policy change (a change to the network's topology and/or how it's supposed to behave) had to be translated and pushed to every device it touched. Figure 1 shows this model and how high-level policies could be turned into four device-local configurations. In this setup, the operators and engineers were the configuration data translators. They were the ones turning high-level policies into device-local configuration data 🧚
A configuration data translator takes a topology-independent behavior description, like high-level policies (that's the first input), and combines it with topology information (the second input) and status, performance, and monitoring information (the third input). Then it spits out device-local configurations 🦋 There can be several configuration data translators working together in tandem across a set of devices. But only one configuration data translator can be operating on a particular device at any given instant ✨
Configuration Management
Data (High-level Policies)
|
|
|
|
Network V Network
Topology -----> Configuration <---- Status/performance
Information Data Translator(s) Information
|
|
|
|
-------------------------------------------------
| | | |
Device Device Device Device
Local Local Local Local
Conf(1) Conf(2) Conf(3) Conf(4)
Figure 1. Current model for configuring network devices.Historically, operators and engineers used protocols and mechanisms like SNMP and CLI applications to provision or configure network devices. In their current versions, though, these mechanisms are hard to use 😩 That's because they work at a really low level of granularity and they're tied to specific devices. It gets even worse when you need to provision several devices that each need huge amounts of configuration data 💅
It's pretty clear that network administrators and the configuration management software they have can't keep up with how complex networks are getting. So an efficient, integrated configuration management solution is needed 🌸 Several IETF Working Groups tackling this problem came together around the same idea: add a layer of abstraction to the traditional configuration management process from Figure 1. Figure 2 shows what that process looks like with the abstraction layer in place. Same as before, the network operator, engineer, or responsible entity first builds a model of the network and its expected behavior. That gets formalized and recorded as high-level policies.
Those policies are then combined with topology information and status and performance information to generate network-wide configuration data. These middle-level policies are simpler to manage, and they capture behaviors that multiple network devices share 🍓
Configuration Management
Data (High-level Policies)
|
|
|
|
Network V Network
Topology -----> Network-Wide <---- Status/performance
Information Configuration Information
Data
|
|
|
|
V
Configuration
Data Translator(s)
|
|
|
|
-------------------------------------------------
| | | |
Device Device Device Device
Local Local Local Local
Conf(1) Conf(2) Conf(3) Conf(4)
Figure 2. Proposed model for configuring network devices.Device-local configurations are now generated by automated configuration data translators, and they get supplied to each network device so the device can enforce them 🤖 Here's the cool part: this model only describes what the configuration data translators do. It doesn't say where they have to live. So translators might sit outside the devices (in Figure 1 they were humans, after all), or they might be collocated with each device 🌈
Just like in the previous model, any high-level policy change (a change to the network's topology and/or its expected behavior) still needs to be propagated to every network device it affects. But with the model in Figure 2, network operators and engineers can describe how the network should behave in a much simpler way, which cuts down on how much device-specific knowledge they need 🫶
Okay, but keep in mind that in some cases, per-instance device-local configuration is still needed on network devices. An integrated solution MUST allow room for this 🎀 Also, bringing in automated configuration data translators assumes that all the information needed to make an error-free conversion from network-wide configuration data into device-local configuration data is actually available. If that data isn't available, the solution MUST detect this and act accordingly 🙈
3.0 Requirements for an IP-based Configuration Management System 👑
Every IETF Working Group active in this area agrees on the following requirements for configuration management. An integrated configuration management solution MUST:
- provide ways to specify the network's behavior at a higher level of abstraction (network-wide configuration) than a set of configuration information specific to individual devices,
- be able to translate network-wide configurations into device-local configuration. Which subset of the network-wide policies gets downloaded depends on each device's capabilities,
- be able to interpret device-local configuration, status, and monitoring information within the context of network-wide configurations,
- be capable of provisioning (for example, adding, modifying, deleting, dumping, and restoring) complete or partial configuration data to network devices at the same time or in a synchronized way, as needed,
- 4a. be able to provision multiple device-local configurations to support fast switch-overs, without needing to download potentially large configuration changes to lots of devices,
- provide ways for network devices to send feedback to the management system (configuration data confirmation, network status and monitoring information, specific events, and so on),
- be capable of provisioning complete or partial configuration data to network devices dynamically, as a result of network-specific or network-wide events,
- provide efficient and reliable ways, compared to today's mechanisms (CLI and SNMP), to provision large amounts of configuration data,
- provide secure ways to provision configuration data. The system must provide support for access control, authentication, integrity checking, replay protection, and/or privacy security services. The minimum level of granularity for access control and authentication is host-based. The system SHOULD support user- and role-based access control and authentication for users in different roles with different access privileges,
- provide expiration time and effective time capabilities for configuration data. It is required that some configuration data items be set to expire, and other items be set to never expire,
- provide error detection (including data-specific errors) and failure recovery mechanisms (including preventing inappropriately partial configurations when needed) for provisioning configuration data,
- eliminate the potential for mis-configuration caused by concurrent shared write access to a device's configuration data,
- provide facilities (with host- and user-based authentication granularity) to help trace back configuration changes,
- allow for the use of redundant components, both network elements and configuration application platforms, and for the configuration of redundant network elements,
- be flexible and extensible to accommodate future needs. Configuration management data models are not fixed forever. They evolve like any other management data model. So it's necessary to expect that changes will be needed, even though it's impossible to know exactly what those changes will be. Such changes could affect the configuration data model, the supported message types, the data types, and so on. The system needs mechanisms that can handle these changes effectively, without causing interoperability problems or forcing teams to replace or update large amounts of fielded networking devices 🦋,
- leverage knowledge of the existing SNMP management infrastructure. The system MUST leverage knowledge of and experience with MIBs and SMI ✨
Security Considerations 🔐
This document reflects the current requirements that the IETF believes configuration management systems MUST have in order to properly support IP-based networks. The authors believe that a configuration management system MUST provide mechanisms by which one can ascertain the integrity and authenticity of the configuration data at all times. In some cases the privacy of the data is important, so a configuration management system MUST provide facilities to support these services as required, not only while the data is stored but also during provisioning or reception. Requirements eight and twelve capture the required security services. This part is seriously important, bestie, so don't skip it 💜
Acknowledgments 🙏✨
okay bestie, big thank yous first 🫶 The authors shoutout Juergen Schoenwaelder for his contributions to this document 💖 They also thank Walter Weiss and Andrew Smith for giving feedback on the early versions 🌸 And finally, the authors thank the IESG for motivating and supporting this work 👑
References 📚
okay so here are the references. these are the docs this one leans on, so keep them handy 🦋
[Bra97] Bradner, S., "Key Words for use in RFCs to indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[COPS] Boyle, J., Cohen, R., Durham, D., Herzog, S., Rajan, R.
and A. Sastry, "The COPS (Common Open Policy Service)
Protocol", RFC 2748, August 1999.
[RSVP] Braden, R., Editor, et al., "Resource ReSerVation
Protocol (RSVP) Version 1 - Functional Specification",
RFC 2205, September 1997.
[COPS-RSVP] Boyle, J., Cohen, R., Durham, D., Herzog, S., Rajan, R.
and A. Sastry, "COPS usage for RSVP", RFC 2749, June
1999.
[COPS-PROV] Chan, K., Seligson, J., Durham, D., Gai, S., McCloghrie,
K., Herzog, S., Reichmeyer, F., Yavatkar, R. and A.
Smith, "COPS Usage for Policy Provisioning (COPS-PR)",
RFC 3084, March 2001.Authors' Addresses 🎀
and now the crew who wrote this, with their contact info 💅
Keith McCloghrie
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
Phone: +1 (408) 526-5260
EMail: kzm@cisco.com
Luis A. Sanchez
Megisto Systems
20251 Century Boulevard
Germantown, MD 02138
USA
Phone: +1 (301) 444-1747
EMail: lsanchez@megisto.com
Jon Saperia
JDS Consulting, Inc.
174 Chapman Street
Watertown, MA 02472
USA
Phone: +1 (617) 744-1079
EMail: saperia@jdscons.comFull Copyright Statement ⚖️
okay this part is the legal stuff, so I'm keeping it word for word so nobody gets confused 🙈
Copyright (C) The Internet Society (2001). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 🌈
funding for the RFC Editor function is currently provided by the Internet Society 💜
That's the whole doc, bestie! You made it through 🎉🦋
📦 where this page comes from
- ietf: rfc3139 2001-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms