Guidelines for Considering Operations and Management of New Protocols

By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work in progress.”

Abstract

New protocols or protocol extensions are best designed with due consideration of functionality needed to operate and manage the protocol. Retrofitting operations and management is sub-optimal. The purpose of this document is to provide guidance to authors and reviewers of documents defining new protocols or protocol extensions, covering aspects of operations and management that should be considered.

1. Introduction
    1.1. Terminology
2. Design for Operations and Management
    2.1. IETF Management Framework
3. Operational Considerations
    3.1. Operations Model
    3.2. Installation and Initial Setup
    3.3. Migration Path
    3.4. Requirements on Other Protocols and Functional Components
    3.5. Impact on Network Operation
    3.6. Verifying Correct Operation
4. Management Considerations
    4.1. Interoperability
    4.2. Management Information
    4.3. Fault Management
        4.3.1. Liveness Detection and Monitoring
        4.3.2. Fault Determination
        4.3.3. Fault Isolation
        4.3.4. Corrective Action
    4.4. Configuration Management
        4.4.1. Verifying Correct Operation
        4.4.2. Control of Function and Policy
    4.5. Accounting Management
    4.6. Performance Management
    4.7. Security Management
5. Documentation Guidelines
    5.1. Recommended Discussions
    5.2. Null Manageability Considerations Sections
    5.3. Placement of Operations and Manageability Considerations Sections
6. IANA Considerations
7. Security Considerations
8. Acknowledgements
9. Informative References
Appendix A. Operations and Management Checklist
Appendix B. Open Issues
Appendix C. Change Log

1. Introduction

Often when new protocols or protocol extensions are developed, not enough consideration is given to how the protocol will be deployed, operated and managed. Retrofitting operations and management mechanisms is often hard and architecturally unpleasant, and certain protocol design choices may make deployment, operations, and management particularly hard. Since the ease of operations and management may impact the success of IETF protocols, this document provides guidelines to help protocol designers and working groups consider the operations and management functionality needed by their new IETF protocol or protocol extension at an earlier phase.

This document suggests protocol designers consider operations and management needs and then recommend appropriate standard management protocols and data models to address the relevant operations and management needs. This is similar to a WG considering which security threats are relevant to their protocol, and then recommending appropriate standard security protocols to mitigate the relevant threats.

This document discusses the importance of considering operations and management. Section 3 discusses operational functionality to consider. Section 4 discusses management functionality to consider.

This document sets forth a list of subjective guidelines and a list of objective criteria by which a protocol designer can evaluate whether the protocol that he/she has developed addresses common operations and management needs. Operations and management is highly dependent on the environment in which it is used, so most guidelines are subjective rather than objective. We provide objective criteria to promote interoperability through the use of standard management interfaces, such as "did you design counters in a MIB module for monitoring packets in/out of an interface?", "did you write an XML-based data model for configuring your protocol with Netconf?", and "did you standardize syslog message content and structured data elements for reporting events that might occur when operating your protocol?"

This document only provides guidelines; the (ever-changing membership of the) IESG can make a decision about how the guidelines should be used by the IETF over time.

1.1. Terminology

This document deliberately does not use the (capitalized) key words described in RFC 2119 (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.) [RFC2119]. RFC 2119 states the keywords must only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm (e.g., limiting retransmissions). For example, they must not be used to try to impose a particular method on implementers where the method is not required for interoperability. This document is a set of guidelines based on current practices of protocol designers and operators. This document does not describe requirements, so the key words from RFC2119 have no place here.

2. Design for Operations and Management

"Design for operations and management" means that the operational environment and manageability of the protocol should be considered from the start when new protocols are designed.

When a WG considers operation and management functionality for a protocol, the document should contain enough information to understand how the protocol will be deployed and managed, but the WG should expect that considerations for operations and management may need to be updated in the future, after further operational experience has been gained.

2.1. IETF Management Framework

One factor discussed was the user-unfriendliness of the binary format of SNMP and COPS-PR, and it was recommended that the IETF explore an XML-based Structure of Management Information, and an XML-based protocol for configuration.

Another factor discussed was that deployed tools for event/alarm correlation, root cause analysis and logging are not sufficient, and there is a need to support a human interface and a programmatic interface. The IETF decided to standardize aspects of the defacto standard for system logging, especially security and the need for better programmatic support.

In 2006, the IETF discussed whether the Management Framework should be updated to accommodate multiple IETF standard SMI languages, and multiple IETF standard protocols for doing network management.

This document provides some initial guidelines for considering operations and management in this environment of multiple protocols and multiple data models, with an eye toward being flexible while also striving for interoperability.

3. Operational Considerations

Designers of a new protocol should carefully consider the operational aspects. A protocol that is defined very precisely in a well-written document doesn't guarantee that it is going to be deployable in the real world. Operational aspects will have a serious impact on the actual success of a protocol. Such aspects include bad interactions with existing solutions, a dififcult ugrade path, difficulty of debugging problems, difficulty configuring from a central database, or a complicated state diagram that operations staff will find difficult to understand

[DISCUSS: examples, list of current protocols characteristics and their impact on the network. e.g., burst traffic impact on network congestion.]

Operations and manageability considerations should focus on interoperability of externally observable behaviors. [TODO: expand or eliminate.]

3.1. Operations Model

Protocol designers can analyze the operational environment and mode of work in which the new protocol or extension will work. Such an exercise needs not be reflected directly by text in their document, but could help in visualizing the operational model related to the applicability of the protocol in the Internet environments where it will be deployed. The operational model should take into account factors such as:

Protocol designers should consider how the new protocol will be managed in different deployment scales. It might be sensible to use a local management interface to manage the new protocol on a single device, but in a large network, remote management using a centralized server and/or using distributed management functionality might make more sense. Auto-configuration and default parameters might be possible for some new protocols.

There may be a need to support a human interface, e.g., for troubleshooting, and a programmatic interface, e.g., for automated monitoring and root cause analysis. It might be important that the internal method routines used by the application programming interfaces and the human interfaces should be the same to ensure that data exchanged between these two interfaces is always consistent. [DISCUSS: would the example of inconsistency between non-resettable MIB counters and CLI resettable counters be useful here? ]

Protocol designers should consider what management operations are expected to be performed as a result of the deployment of the protocol - such as whether write operations will be allowed on routers and on hosts, or if notifications for alarms or other events will be expected.

3.2. Installation and Initial Setup

Protocol designers should consider default values that make protocol sense, to simplify configuration, including default modes and parameters. For example, it could be helpful or necessary to specify default values for modes, timers, default state of logical control variables, default transports, and so on. Even if default values are used, it must be possible to retrieve all the actual values or at least an indication that known default values are being used.

Protocol designers should consider how to enable operators to concentrate on the configuration of the network as a whole rather than individual devices.

It is also desirable to discuss the background of chosen default values, or perhaps why a range of values makes sense. In many cases, when technology changes, the values in an RFC might make less and less sense (for example due to increased speeds in the network). It is very useful to understand whether defaults are based on 'best current practice' and are expected to change as technologies advance or whether they have a more universal value and should not be changed lightly.

3.3. Migration Path

If the new protocol is a new version of the protocol, or is replacing another technology, the protocol designer should consider how deployments should transition to the new protocol. This should include co-existence with previously deployed protocols and/or previous versions of the same protocol, incompatibilities between versions, translation between versions, and side effects that might occur. Are older protocols or versions disabled or do they co-exist in the network with the new protocol?

Another point to consider is extensibility of the management approach - How open to future protocol extensions are the management techniques you are defining?

3.4. Requirements on Other Protocols and Functional Components

Protocol designers should consider the requirements that the new protocol might put on other protocols and functional components, and should also document the requirements from other protocols that have been considered in designing the new protocol. [TODO: examples]

These considerations should generally remain illustrative to avoid creating restrictions or dependencies, or potentially impacting the behavior of existing protocols, or restricting the extensibility of other protocols, or assuming other protocols will not be extended in certain ways. [TODO: example]

3.5. Impact on Network Operation

The introduction of a new protocol or extensions to an existing protocol may have an impact on the operation of existing networks. Protocol designers should outline such impacts (which may be positive) including scaling concerns and interactions with other protocols. For example, a new protocol that doubles the number of active, reachable addresses in use within a network might need to be considered in the light of the impact on the scalability of the IGPs operating within the network.

The protocol designer should consider the potential impact on the behavior of other protocols in the network and on the traffic levels and traffic patterns that might change, including specific types of traffic such as multicast. Also consider the need to install new components that are added to the network as result of the changes in the operational model, such as servers performing auto-configuration operations.

The protocol designer should consider also the impact on infrastructure applications like the DNS, registries, or the size of routing tables.

The impact on performance may also be noted - increased delay or jitter in real-time traffic applications, or response time in client-server applications when encryption or filtering are applied.

It must be easy to do consistency checks of versions/revisions of configurations over time. [DISCUSS: probably needs a bit more discussion on database driven configurations. ]

It must be easy to do consistency checks of configurations between the ends of a link in order to determine the differences between two configurations and whether the configurations are consistent. [DISCUSS: this needs rewording to better describe consistency checking 1) over time, and 2) between ends of a link. probably needs a bit more discussion on the need to be able to understand and check what it is happening on the wire actually matches what the Operator tried to configure. Basically, complexity is your enemy here, and that cannot be stressed often enough (no idea how you can verify whether for example a SIP application is actually doing what it is supposed to do due to it's complexity).]

It is important to minimize the impact caused by configuration changes. Given configuration A and configuration B, it should be possible to generate the operations necessary to get from A to B with minimal state changes and effects on network and systems.

3.6. Verifying Correct Operation

The protocol designer should consider techniques for testing the effect that the protocol has had on the network by sending data through the network and observing its behavior. Protocol designers should consider how the correct end-to-end operation of the new protocol in the network can be tested, and how the correct data or forwarding plane function of each network element can be verified to be working properly with the new protocol.

4. Management Considerations

The considerations of manageability should start from describing the operational model, which includes identifying the entities to be managed, how the respective protocol is supposed to be installed, configured and monitored, who are the managers and what type of management interfaces and protocols they would use.

Considerations for management should include a discussion of what needs to be managed, and how to achieve various management tasks. The "write a MIB module" approach to considering management often focuses on monitoring a protocol endpoint on a single device. A MIB module document typically only considers monitoring properties observable at one end, while the document doesn't really cover managing the *protocol* (the coordination of multiple ends), and doesn't even come near managing the *service* (which includes a lot of stuff that's very far away from the box). This is exactly what operators hate - you need to be able to manage both ends. As RFC3535 says, MIB modules can often be characterized as a list of ingredients without a recipe.

WGs should consider how to configure multiple related/co-operating devices and how to back off if one of those configurations fails or causes trouble. NETCONF addresses this ina generic manner by allowing an operator to lock the configuration on multiple devices, perform the configuration settings/changes, check that they are OK (undo if not) and then unlock the devices.

Techniques for debugging protocol interactions in a network should be part of the network management discussion. Implementation source code should be debugged before ever being added to a network, so asserts and memory dumps do not normally belong in management data models. However, debugging on-the-wire interactions is a protocol issue: it is enormously helpful if a protocol has hooks to make debugging of network interactions easy, and/or is designed in such a way that debugging protocol behaviors is easy. Handwaving this away is not something that operators like ...

In a client/server protocol, it may be more important to instrument the server end of a protocol than the client end.

4.1. Interoperability

Just as when deploying protocols that will inter-connect devices, our primary goal in considering management should be interoperability, whether across devices from different vendors, across models from the same vendor, or across different releases of the same product.

Some product designers and protocol designers assume that if a device can be managed individually using a command line interface or a web page interface, that such a solution is enough. But when equipment from multiple vendors is combined into a large network, scalability of management becomes a problem. It is important to have consistency in the management interfaces so network-wide operational processes can be automated. For example, a single switch might be easily managed using an interactive web interface when installed in a single office small business, but when, say, a fast food company installs similar switches from multiple vendors in hundreds or thousands of individual branches and wants to automate monitoring them from a central location, monitoring vendor-and-model-specific web pages would be difficult to automate.

Getting everybody to agree on a certain syntax and the protocol associated with that has proven to be difficult. So management systems tend to speak whatever the boxes support, whether the IETF likes this or not. The IETF is moving from support for a single management data modeling language (SMI) and a single management protocol (SNMP) towards support for additional management protocols and data models suited to different purposes, such as configuration (netconf), usage accounting (ipfix), and logging (syslog). Other Standard Development Organizations (e.g. DMTF, TMF) also define management mechanisms and these mechanisms may be more suitable than IETF mechanisms in some cases.

Interoperability needs to be considered on the syntactic level and the semantic level. While it can be irritating and time-consuming, application designers including operators who write their own scripts can make their processing conditional to accommodate differences across vendors or models or releases of product.

Semantic differences are much harder to deal with on the manager side - once you have the data, its meaning is a function of the managed entity. For example, if a single counter provided by vendor A counts three types of error conditions, while the corresponding counter provided by vendor B counts seven types of error conditions, these counters cannot be compared effectively - they are not interoperable counters.

Information models are helpful to try to focus interoperability on the semantic level - they establish standards for what information should be gathered, and how gathered information might be used regardless of which management interface carries the data or which vendor produces the product. The use of an information model might help improve the ability of operators to correlate messages in different protocols where the data overlaps, such as a SYSLOG message and an SNMP notification about the same event. An information model might identify which error conditions should be counted separately, and which error conditions can be counted together in a single counter. Then, whether the counter is gathered via SNMP or a CLI command or a SYSLOG message, the counter will have similar meaning.

Protocol designers should consider which information might be useful for managing the new protocol or protocol extensions.

             IM                --> conceptual/abstract model
              |                    for designers and operators
   +----------+---------+
   |          |         |
   DM        DM         DM     --> concrete/detailed model
                                   for implementers

Information models should come from the protocol WGs and include lists of events, counters and configuration parameters that are relevant. There are a number of information models contained in protocol WG RFCs. Some examples:

Management protocol standards and management data model standards often contain compliance clauses to ensure interoperability. Manageability considerations should include discussion of which level of compliance is expected to be supported for interoperability.

4.2. Management Information

A management information model should include a discussion of what is manageable, which aspects of the protocol need to be configured, what types of operations are allowed, what protocol-specific events might occur, which events can be counted, and for which events should an operator be notified.

Operators find it important to be able to make a clear distinction between configuration data, operational state, and statistics. They need to determine which parameters were administrative configured and which parameters have changed since configuration as the result of mechanisms such as routing protocols.

It is important to be able to separately fetch configuration data, operational state data, and statistics from devices, and to be able to compare current state to initial state, and to compare data between devices.

What is typically difficult to work through are relationships between abstract objects. Ideally an information model would describe the relationships between the objects and concepts in the information model.

Is there always just one instance of this object or can there be multiple instances? Does this object relate to exactly one other object or may it relate to multiple? When is it possible to change a relationship?

Do objects (such as rows in tables) share fate? For example, if a row in table A must exist before a related row in table B can be created, what happens to the row in table B if the related row in table A is deleted? Does the existence of relationships between objects have an impact on fate sharing?

4.3. Fault Management

The protocol designer should consider how faults information will be propagated. Will it be done using asynchronous notifications or polling of health indicators?

If notifications are used to alert operators to certain conditions, then the protocol designer should discuss mechanisms to throttle notifications to prevent congestion and duplications of event notifications. Will there be a hierarchy of faults, and will the fault reporting be done by each fault in the hierarchy, or will only the lowest fault be reported and the higher levels be suppressed? should there be aggregated status indicators based on concatenation of propagated faults from a given domain or device?

SNMP notifications and SYSLOG messages can alert an operator when an aspect of the new protocol fails or encounters an error condition, and SNMP is frequently used as a heartbeat monitor.

4.3.1. Liveness Detection and Monitoring

Liveness detection and monitoring applies both to the control plane and the data plane. Mechanisms for detecting faults in the control plane or for monitoring its liveness are usually built into the control plane protocols or inherited from underlying data plane or forwarding plane protocols. These mechanisms do not typically require additional management capabilities. However, when a system detects a control plane fault, there is often a requirement to coordinate recovery action through management applications or at least to record the fact in an event log. [TODO: example]

Where the protocol is responsible for establishing data or user plane connectivity, liveness detection and monitoring usually need to be achieved through other mechanisms. In some cases, these mechanisms already exist within other protocols responsible for maintaining lower layer connectivity, but it will often be the case that new procedures are required to detect failures in the data path and to report rapidly, allowing remedial action to be taken.

Protocol designers should always build in basic testing features (e.g. ICMP echo, UDP/TCP echo service, NULL RPC calls) that can be used to test for liveness, with an option to enable and disable them.

4.3.2. Fault Determination

It can be helpful to describe how faults can be pinpointed using management information. For example, counters might record instances of error conditions. Some faults might be able to be pinpointed by comparing the outputs of one device and the inputs of another device looking for anomalies.

[DISCUSS: Ralf: While this sounds good, how do ou distinguish between “faulty messages” and “good messages”? It might require complex functions such as “deviation from normal”, are you sure you want to implement those at the device level?]

4.3.3. Fault Isolation

It might be useful to isolate faults, such as a system that emits malformed messages necessary to coordinate connections properly. Spanning tree comes to mind. This might be able to be done by configuring next-hop devices to drop the faulty messages to prevent them from entering the rest of the network.

4.3.4. Corrective Action

What sort of corrective action can be taken by an operator for each of the fault conditions that are being identified?

4.4. Configuration Management

A number of efforts have existed in the IETF to develop policy-based management. RFC3198 was written to standardize the terminology for policy-based management across these efforts.

It is highly desirable that text processing tools such as diff, and version management tools such as RCS or CVS or SVN, can be used to process configurations. This approach simplifies comparing the current operational state to the initial configuration.

With structured text such as XML, simple text diffs may be found to be inadequate and more sophisticated tools may be needed to make any useful comparison of versions.

To simplify such configuration comparisons, devices should not arbitrarily reorder data such as access control lists. If a protocol designer defines mechanisms for configuration, it would be desirable to standardize the order of elements for consistency of configuration and of reporting across vendors, and across releases from vendors.

[DISCUSS: Ralf: Well, there are two parts to it: 1. An NMS system could optimze ACLs for perfomance reasons 2. Unless the device/NMS systems has corect rules/a lot of experience, reordering ACLs can lead to a huge security issue, therefore I would rephrase this paragraph. "

Network wide configurations are ideally stored in central master databases and transformed into formats that can be pushed to devices, either by generating sequences of CLI commands or complete configuration files that are pushed to devices. There is no common database schema for network configuration, although the models used by various operators are probably very similar. It is desirable to extract, document, and standardize the common parts of these network wide configuration database schemas. A protocol designer should consider how to standardize the common parts of configuring the new protocol, while recognizing the vendors will likely have proprietary aspects of their configurations.

It is important to distinguish between the distribution of configurations and the activation of a certain configuration. Devices should be able to hold multiple configurations. NETCONF [RFC4741] (Enns, R., “NETCONF Configuration Protocol,” December 2006.), for example, differentiates between the "running" configuration and "candidate" configurations.

[DISCUSS: Also add: backup configs, i.e. version n-1 and auto-fallback solutions that automatically return to the previous “known as good config” or adding a backdoor for the operator. One of the worst scenarios is remote device config where the new running config doesn’t work as expected and unlocks the admin. Vendors may have ways to avoid unlocking the operator but this doesn’t have to be vendor specific.]

It is important to enable operators to concentrate on the configuration of the network as a whole rather than individual devices. Support for configuration transactions across a number of devices would significantly simplify network configuration management. The ability to distribute configurations to multiple devices, or modify "candidate configurations on multiple devices, and then activate them in a near-simultaneous manner might help.

[DISCUSS: Ralf: This might be a good place for adding the description of config-templates.]

Consensus of the 2002 IAB Workshop was that textual configuration files should be able to contain international characters. Human-readable strings should utilize UTF-8, and protocol elements should be in case insensitive ASCII.

A mechanism to dump and restore configurations is a primitive operation needed by operators. Standards for pulling and pushing configurations from/to devices are desirable.

Given configuration A and configuration B, it should be possible to generate the operations necessary to get from A to B with minimal state changes and effects on network and systems. It is important to minimize the impact caused by configuration changes.

Many protocol specifications include timers that are used as part of operation of the protocol. These timers may need default values suggested in the protocol specification and do not need to be otherwise configurable.

4.4.1. Verifying Correct Operation

An important function that might be provided is a tool set for verifying the correct operation of a protocol. This may be achieved to some extent through access to information and data models that report the status of the protocol and the state installed on network devices. It may also be valuable to provide techniques for testing the effect that the protocol has had on the network by sending data through the network and observing its behavior.

Protocol designers should consider how to test the correct end-to-end operation of the network, and how to verify the correct data or forwarding plane function of each network element.

4.4.2. Control of Function and Policy

A protocol designer should consider the configurable items that exist for the control of function via the protocol elements described in the protocol specification. For example, Sometimes the protocol requires that timers can be configured by the operator to ensure specific policy-based behavior by the implementation.

4.5. Accounting Management

A protocol designer should consider whether it would be appropriate to collect usage information related to this protocol, and if so, what usage information would be appropriate to collect?

RFC2975 [RFC2975] (Aboba, B., Arkko, J., and D. Harrington, “Introduction to Accounting Management,” October 2000.) Introduction to Accounting Management discusses a number of factors relevant to monitoring usage of protocols for purposes of capacity and trend analysis, cost allocation, auditing, and billing. This document also discusses how RADIUS, TACACS+, and SNMP protocols are used for these purposes. These factors should be considered when designing a protocol whose usage might need to be monitored, or when recommending a protocol to do usage accounting.

4.6. Performance Management

Consider information that would be useful when trying to determine the performance characteristics of a deployed system using the target protocol.

What are the principal performance factors that need to be looked at when measuring the efficiency of the protocol implementations? Is it important to measure setup times? throughput? quality versus throughput? interruptions? end-to-end throughput? end-to-end quality? hop-to-hop throughput?

Consider scalability, such as whether performance will be affected by the number of protocol connections. If so, then it might be useful to provide information about the maximum number of table entries that should be expected to be modeled, how many entries an implementation can support, the current number of instances, and the expected behavior when the current instances exceed the capacity of the implementation. This should be considered in a data-modeling independent manner - what makes managed-protocol sense, not what makes management-protocol-sense. If it is not managed-protocol-dependent, then it should be left for the management-protocol data modelers to decide.

For example, VLAN identifiers have a range of 1..4095 because of the VLAN standards.

Consider operational activity, such as the number of message in and the messages out, the number of received messages rejected due to format problems, the expected behaviors when a malformed message is received.

Consider the expected behaviors for counters - what is a reasonable maximum value for expected usage? should they stop counting at the maximum value and retain the maximum value, or should they rollover? How can users determine if a rollover has occurred, and how can users determine if more than one rollover has occurred?

What information should be maintained across reboots of the device, or restarts of the management system?

Could events, such as hot-swapping a blade in a chassis, cause discontinuities in information? Does this make any difference in evaluating the performance of a protocol?

Consider whether multiple management applications will share a counter; if so, then no one management application should be allowed to reset the value to zero since this will impact other applications.

For performance monitoring, it is often important to report the time spent in a state rather than the current state. Snapshots are of less value for performance monitoring.

The Benchmarking Methodology WG (bmwg) has defined recommendations for the measurement of the performance characteristics of various internetworking technologies in a laboratory environment, including the systems or services that are built from these technologies. Each recommendation describes the class of equipment, system, or service being addressed; discuss the performance characteristics that are pertinent to that class; clearly identify a set of metrics that aid in the description of those characteristics; specify the methodologies required to collect said metrics; and lastly, present the requirements for the common, unambiguous reporting of benchmarking results.

4.7. Security Management

Protocol designers should consider how to monitor and to manage security aspects and vulnerabilities of the new protocol.

There will be security considerations related to the new protocol. To make it possible for operators to be aware of security-related events, it is recommended that system logs should record events, such as failed logins, but the logs must be secured.

Should a system automatically notify operators of every event occurrence, or should an operator-defined threshold control when a notification is sent to an operator?

Should certain statistics be collected about the operation of the new protocol that might be useful for detecting attacks, such as the receipt of malformed messages, or messages out of order, or messages with invalid timestamps? If such statistics are collected, is it important to count them separately for each sender to help identify the source of attacks?

Manageability considerations that are security-oriented might include discussion of the security implications when no monitoring is in place, the regulatory implications of absence of audit-trail or logs in enterprises, exceeding the capacity of logs, and security exposures present in chosen / recommended management mechanisms.

The granularity of access control needed on management interfaces needs to match operational needs. Typical requirements are a role-based access control model and the principle of least privilege, where a user can be given only the minimum access necessary to perform a required task.

It must be possible to do consistency checks of access control lists across devices. Protocol designers should consider information models to promote comparisons across devices and across vendors to permit checking the consistency of security configurations.

Protocol designers should consider how to provide a secure transport, authentication, identity, and access control which integrates well with existing key and credential management infrastructure.

Protocol designers should consider how ACLs (access control lists) are maintained and updated.

An analysis of existing counters might help operators recognize the conditions identified in the security considerations for the new protocol before they can impact the network.

RADIUS and DIAMETER can provide authentication and authorization. A protocol designer should consider which attributes would be appropriate for their protocol.

Different protocols use different assumptions about message security and data access controls. A protocol designer that recommends using different protocols should consider how security will be applied in a balanced manner across multiple management interfaces. SNMP access control is data-oriented, while CLI access control is usually command (task) oriented. Depending on the management function, sometimes data-oriented or task-oriented access control makes more sense. Protocol designers should consider both data-oriented and task-oriented access control.

5. Documentation Guidelines

The purpose of this document is to provide guidance about what to consider when thinking about the management and deployment of a new protocol, and to provide guidance about documenting the considerations. The following guidelines are designed to help writers provide a reasonably consistent format for such documentation. Separate manageability and operational considerations sections are desirable in many cases, but their structure and location is a decision that can be made from case to case.

Making a Management Considerations section a mandatory publication requirement is the responsibility of the IESG, or specific area directors, or working groups, and this document avoids recommending any mandatory publication requirements. For a complex protocol, a completely separate draft on operations and management might be appropriate, or even a completely separate WG.

This document is focused on what to think about, and how to document the considerations of the protocol designer.

5.1. Recommended Discussions

A Manageability Considerations section should include discussion of the management and operations topics raised in this document, and when one or more of these topics is not relevant, it would be useful to contain a simple statement explaining why the topic is not relevant for the new protocol. Of course, additional relevant topics should be included as well.

5.2. Null Manageability Considerations Sections

A protocol designer may seriously consider the manageability requirements of a new protocol, and determine that no management functionality is needed by the new protocol. It would be helpful to those who may update or write extensions to the protocol in the future or to those deploying the new protocol to know the thinking of the working regarding the manageability of the protocol at the time of its design.

If there are no new manageability or deployment considerations, it is recommended that a Manageability Considerations section contain a simple statement such as "There are no new manageability requirements introduced by this document," and a brief explanation of why that is the case. The presence of such a Manageability Considerations section would indicate to the reader that due consideration has been given to manageability and operations.

In the case where the new protocol is an extension, and the base protocol discusses all the relevant operational and manageability considerations, it would be helpful to point out the considerations section in the base document.

5.3. Placement of Operations and Manageability Considerations Sections

If a protocol designer develops a Manageability Considerations section for a new protocol, it is recommended that the section be placed immediately before the Security Considerations section. Reviewers interested in such sections could find it easily, and this placement could simplify the development of tools to detect the presence of such a section.

6. IANA Considerations

This document does not introduce any new codepoints or name spaces for registration with IANA. Note to RFC Editor: this section may be removed on publication as an RFC.

7. Security Considerations

This document is informational and provides guidelines for considering manageability and operations. It introduces no new security concerns.

8. Acknowledgements

This document started from an earlier document edited by Adrian Farrel, which itself was based on work exploring the need for Manageability Considerations sections in all Internet-Drafts produced within the Routing Area of the IETF. That earlier work was produced by Avri Doria, Loa Andersson, and Adrian Farrel, with valuable feedback provided by Pekka Savola and Bert Wijnen.

Some of the discussion about designing for manageability came from private discussions between Dan Romascanu, Bert Wijnen, Juergen Schoenwaelder, Andy Bierman, and David Harrington.

9. Informative References

Appendix A. Operations and Management Checklist

Appendix B. Open Issues

Appendix C. Change Log

Author's Address

Full Copyright Statement

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an “AS IS” basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

[I-D.ietf-ipfix-protocol]	Claise, B., “Specification of the IPFIX Protocol for the Exchange of IP Traffic Flow Information,” draft-ietf-ipfix-protocol-26 (work in progress), September 2007 (TXT).
[I-D.ietf-syslog-protocol]	Gerhards, R., “The syslog Protocol,” draft-ietf-syslog-protocol-23 (work in progress), September 2007 (TXT).
[RFC1052]	Cerf, V., “IAB recommendations for the development of Internet network management standards,” RFC 1052, April 1988 (TXT).
[RFC2119]	Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” BCP 14, RFC 2119, March 1997 (TXT, HTML, XML).
[RFC2578]	McCloghrie, K., Ed., Perkins, D., Ed., and J. Schoenwaelder, Ed., “Structure of Management Information Version 2 (SMIv2),” STD 58, RFC 2578, April 1999 (TXT).
[RFC2863]	McCloghrie, K. and F. Kastenholz, “The Interfaces Group MIB,” RFC 2863, June 2000 (TXT).
[RFC2865]	Rigney, C., Willens, S., Rubens, A., and W. Simpson, “Remote Authentication Dial In User Service (RADIUS),” RFC 2865, June 2000 (TXT).
[RFC2975]	Aboba, B., Arkko, J., and D. Harrington, “Introduction to Accounting Management,” RFC 2975, October 2000 (TXT).
[RFC3060]	Moore, B., Ellesson, E., Strassner, J., and A. Westerinen, “Policy Core Information Model -- Version 1 Specification,” RFC 3060, February 2001 (TXT).
[RFC3084]	Chan, K., Seligson, J., Durham, D., Gai, S., McCloghrie, K., Herzog, S., Reichmeyer, F., Yavatkar, R., and A. Smith, “COPS Usage for Policy Provisioning (COPS-PR),” RFC 3084, March 2001 (TXT).
[RFC3139]	Sanchez, L., McCloghrie, K., and J. Saperia, “Requirements for Configuration Management of IP-based Networks,” RFC 3139, June 2001 (TXT).
[RFC3159]	McCloghrie, K., Fine, M., Seligson, J., Chan, K., Hahn, S., Sahita, R., Smith, A., and F. Reichmeyer, “Structure of Policy Provisioning Information (SPPI),” RFC 3159, August 2001 (TXT).
[RFC3165]	Levi, D. and J. Schoenwaelder, “Definitions of Managed Objects for the Delegation of Management Scripts,” RFC 3165, August 2001 (TXT).
[RFC3290]	Bernet, Y., Blake, S., Grossman, D., and A. Smith, “An Informal Management Model for Diffserv Routers,” RFC 3290, May 2002 (TXT).
[RFC3317]	Chan, K., Sahita, R., Hahn, S., and K. McCloghrie, “Differentiated Services Quality of Service Policy Information Base,” RFC 3317, March 2003 (TXT).
[RFC3410]	Case, J., Mundy, R., Partain, D., and B. Stewart, “Introduction and Applicability Statements for Internet-Standard Management Framework,” RFC 3410, December 2002 (TXT).
[RFC3413]	Levi, D., Meyer, P., and B. Stewart, “Simple Network Management Protocol (SNMP) Applications,” STD 62, RFC 3413, December 2002 (TXT).
[RFC3418]	Presuhn, R., “Management Information Base (MIB) for the Simple Network Management Protocol (SNMP),” STD 62, RFC 3418, December 2002 (TXT).
[RFC3444]	Pras, A. and J. Schoenwaelder, “On the Difference between Information Models and Data Models,” RFC 3444, January 2003 (TXT).
[RFC3460]	Moore, B., “Policy Core Information Model (PCIM) Extensions,” RFC 3460, January 2003 (TXT).
[RFC3535]	Schoenwaelder, J., “Overview of the 2002 IAB Network Management Workshop,” RFC 3535, May 2003 (TXT).
[RFC3585]	Jason, J., Rafalow, L., and E. Vyncke, “IPsec Configuration Policy Information Model,” RFC 3585, August 2003 (TXT).
[RFC3588]	Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. Arkko, “Diameter Base Protocol,” RFC 3588, September 2003 (TXT).
[RFC3644]	Snir, Y., Ramberg, Y., Strassner, J., Cohen, R., and B. Moore, “Policy Quality of Service (QoS) Information Model,” RFC 3644, November 2003 (TXT).
[RFC3670]	Moore, B., Durham, D., Strassner, J., Westerinen, A., and W. Weiss, “Information Model for Describing Network Device QoS Datapath Mechanisms,” RFC 3670, January 2004 (TXT).
[RFC3805]	Bergman, R., Lewis, H., and I. McDonald, “Printer MIB v2,” RFC 3805, June 2004 (TXT).
[RFC4011]	Waldbusser, S., Saperia, J., and T. Hongal, “Policy Based Management MIB,” RFC 4011, March 2005 (TXT).
[RFC4133]	Bierman, A. and K. McCloghrie, “Entity MIB (Version 3),” RFC 4133, August 2005 (TXT).
[RFC4502]	Waldbusser, S., “Remote Network Monitoring Management Information Base Version 2,” RFC 4502, May 2006 (TXT).
[RFC4668]	Nelson, D., “RADIUS Authentication Client MIB for IPv6,” RFC 4668, August 2006 (TXT).
[RFC4669]	Nelson, D., “RADIUS Authentication Server MIB for IPv6,” RFC 4669, August 2006 (TXT).
[RFC4710]	Siddiqui, A., Romascanu, D., and E. Golovinsky, “Real-time Application Quality-of-Service Monitoring (RAQMON) Framework,” RFC 4710, October 2006 (TXT).
[RFC4741]	Enns, R., “NETCONF Configuration Protocol,” RFC 4741, December 2006 (TXT).
[RFC4825]	Rosenberg, J., “The Extensible Markup Language (XML) Configuration Access Protocol (XCAP),” RFC 4825, May 2007 (TXT).
[RFC4930]	Hollenbeck, S., “Extensible Provisioning Protocol (EPP),” RFC 4930, May 2007 (TXT).

	David Harrington
	Huawei Technologies USA
	1700 Alma Dr, Suite 100
	Plano, TX 75075
	USA
Phone:	+1 603 436 8634
Fax:
EMail:	dharrington@huawei.com
URI:

Guidelines for Considering Operations and Management of New Protocolsdraft-ietf-opsawg-operations-and-management-02

Status of This Memo