1. Policy-Based Management MIB Steve Waldbusser Jon Saperia Thippanna Hongal

2. Policy-Based Management u Provides a method of aggregating management operations u Applies operations globally to all elements that share certain characteristics u Of the form: –if (element has certain characteristics) then (apply action to that element) u Or: if (policyFilter) then (policyAction)

3. Examples u If (interface is fast ethernet and is a trunk) then (apply full-duplex mode) u if (interface is access) then (apply security filters) u if (gold service paid for on circuit) then (apply special queueing)

4. Framework Policy Server Policy MIB Managed System Policy Specifications SNMP/Policy MIB Various: Local/SNMP/...

5. Framework Policy Server Policy MIB Managed System Policy Specifications SNMP/Policy MIB Various: Local (using MIB names and values)

6. Architecture Policy Server Policy MIB Managed System Policy Specifications SNMP/Policy MIB Various: Local/SNMP/... PolicyFilterPolicyAction ifType == FastEthernet && roleString == trunk fullDuplexMode = ON ifType == Ethernet && roleString == GOLD Set QOS parameters to provide EF PHB

7. Leverages existing SNMP MIBs SNMP MIBs PolicyFilterPolicyAction ifType == FastEthernet && roleString == trunk fullDuplexMode = ON ifType == Ethernet && roleString == GOLD Set QOS parameters to provide EF PHB Policy Table SNMP MIBs

8. Example ifType=FastEthernet roleString=Trunk... ifType=Ethernet roleString=GOLD... ifType=Ethernet roleString=GOLD... ifType=Ethernet roleString=GOLD... FullDuplex EF PHB PolicyFilterPolicyAction ifType == FastEthernet && roleString == trunk fullDuplexMode = ON ifType == Ethernet && roleString == GOLD Set QOS parameters to provide EF PHB

9. What’s Needed? u Core Architecture –PolicyTable Contains objects for communicating policies –Policy Filter Language u Supporting Infrastructure –RoleTable –Capability –Time –Operational Considerations

10. PolicyTable PmPolicyEntry ::= SEQUENCE { pmPolicyIndex Integer32, pmPolicyFilter OCTET STRING, pmPolicyAction OCTET STRING?, pmPolicyDescription SnmpAdminString, pmPolicyMatches Gauge32, pmPolicyStatus RowStatus }

11. Policy Filter Expressions u Need to define a way to express a filter –Probably a parenthesized logical and arithmetic expression –Probably doesn’t need iteration –Strong preference for simplicity and “obviousness”

12. What’s Needed? u Core Architecture –PolicyTable Contains objects for communicating policies –Policy Filter Language u Supporting Infrastructure –RoleTable –Capabilities –Time –Operational Considerations

13. Roles u There are many characteristics already defined as MIB objects that are available to be read by policyFilters u But some necessary concepts for policy have never been described in MIB objects - We need to add them ourselves –Political (isExecutive, outsideContractor) –Financial (goldContract) –Legal (lifeLine) –Geographical (California, inSecureConduit) –Engineered (backup, trunk)

14. RoleStringTable elementsubindexroleString ifIndex.1 1gold ifIndex.1 2access ifIndex.1 3headquarters ifIndex.99 1trunk u Writable table that allows strings to be downloaded to agent u Multiple strings can be assigned to any element

15. CapabilitiesTable index 1 2 3 typesubType WFQ Pentium RoundRobinQ AcmeWFQ u We want policies to be executed only on elements that have certain capabilities u Need those capabilities to be in a MIB so that filters can read them

16. Time u We want policies to be executed only at certain times u Need time to be in a MIB so that filters can read them u Needs to provide two views of time –Globally consistent (i.e., UTCTime) –Local “Business Time” (i.e., M-F 9-5 local time)

17. Examples

18. Operational Requirements u Policy Creation –Need to allow an engineer to “debug” a policy –policyActions can be debugged in a lab –Debugging of policyFilters consists of ensuring that the filter selects the intended set of elements (not more, not less) –Need to see where a policy would be executed –Table that shows where a policy is executed For debugging, set policyAction to no-op

19. Operational Requirements u Troubleshooting in Field –Engineers will occasionally find that a device is misconfigured due to policy –Need to find out which policy is causing the misconfiguration –Need to see where policies are bound Table that shows what policies are executed here

20. Advantages of the Approach u Built with existing infrastructure and tools u Leverages existing MIBs u Flexibility u Complete Architecture –Includes operational tools