draft-ietf-policy-terminology-04.txt   rfc3198.txt 
Policy Framework Working Group A. Westerinen Network Working Group A. Westerinen
INTERNET-DRAFT J. Schnizlein Request for Comments: 3198 J. Schnizlein
Category: Informational Cisco Systems Category: Informational Cisco Systems
John Strassner J. Strassner
IntelliDEN Intelliden Corporation
Mark Scherling M. Scherling
xCert xCert
Bob Quinn B. Quinn
Celox Networks Celox Networks
Shai Herzog S. Herzog
IP Highway PolicyConsulting
An-Ni Huynh A. Huynh
Lucent Technologies Lucent Technologies
Mark Carlson M. Carlson
Sun Microsystems Sun Microsystems
Jay Perry J. Perry
Steve Waldbusser Network Appliance
July 2001 S. Waldbusser
November 2001
Terminology for Policy-Based Management
<draft-ietf-policy-terminology-04.txt>
Friday, July 20, 2001, 9:06 AM
Status of this Memo
This document is an Internet-Draft and is in full conformance
with all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Terminology for Policy-Based Management
Engineering Task Force (IETF), its areas, and its working
groups. Note that other groups may also distribute working
documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six Status of this Memo
months and may be updated, replaced, or obsoleted by other
documents at any time. It is inappropriate to use Internet-
Drafts as reference material or to cite them other than as "work
in progress."
The list of current Internet-Drafts can be accessed at This memo provides information for the Internet community. It does
http://www.ietf.org/ietf/1id-abstracts.txt not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
The list of Internet-Draft Shadow Directories can be accessed at Copyright Notice
http://www.ietf.org/shadow.html
Copyright Notice Copyright (C) The Internet Society (2001). All Rights Reserved.
Copyright (C) The Internet Society (2000). All Rights Reserved. Abstract
Abstract This document is a glossary of policy-related terms. It provides
abbreviations, explanations, and recommendations for use of these
terms. The document takes the approach and format of RFC 2828, which
defines an Internet Security Glossary. The intent is to improve the
comprehensibility and consistency of writing that deals with network
policy, particularly Internet Standards documents (ISDs).
This document is a glossary of policy-related terms. It Table of Contents
provides abbreviations, explanations, and recommendations for
use of these terms. The document takes the approach and format
of RFC2828 [R2828], which defines an Internet Security Glossary.
The intent is to improve the comprehensibility and consistency
of writing that deals with network policy, particularly Internet
Standards documents (ISDs).
Table of Contents 1. Introduction................................................... 2
2. Explanation of Paragraph Markings.............................. 3
3. Terms.......................................................... 3
4. Intellectual Property.......................................... 16
5. Acknowledgements............................................... 17
6. Security Considerations........................................ 17
7. References..................................................... 17
8. Authors' Addresses............................................. 19
9. Full Copyright Statement....................................... 21
1. Introduction.................................................3 1. Introduction
2. Explanation of Paragraph Markings............................4
3. Terms........................................................4
4. Intellectual Property.......................................17
5. Acknowledgements............................................17
6. Security Considerations.....................................17
7. References..................................................18
8. Authors' Addresses..........................................19
9. Full Copyright Statement....................................21
1. Introduction
This document provides abbreviations, definitions, and This document provides abbreviations, definitions, and explanations
explanations of terms related to network policy. All definitions of terms related to network policy. All definitions are provided in
are provided in Section 3, with the terms listed in alphabetical Section 3, with the terms listed in alphabetical order.
order.
The intent is to improve the comprehensibility and consistency The intent is to improve the comprehensibility and consistency of
of Internet Standards documents (ISDs)--i.e., RFCs, Internet- Internet Standards documents (ISDs) -- i.e., RFCs, Internet-Drafts,
Drafts, and other material produced as part of the Internet and other material produced as part of the Internet Standards Process
Standards Process [R2026]. Benefits across the ISDs are well- [RFC2026]. Benefits across the ISDs are well-stated in the
stated in the Introduction to RFC2828 [R2828]: Introduction to RFC 2828 [RFC2828]:
o "Clear, Concise, and Easily Understood Documentation" - o "Clear, Concise, and Easily Understood Documentation" - Requires
Requires that the set of terms and definitions be consistent, that the set of terms and definitions be consistent, self-
self-supporting and uniform across all ISDs. supporting and uniform across all ISDs.
o Technical Excellence - Where all ISDs use terminology o Technical Excellence - Where all ISDs use terminology accurately,
accurately, precisely, and unambiguously. precisely, and unambiguously.
o Prior Implementation and Testing - Requires that terms are o Prior Implementation and Testing - Requires that terms are used in
used in their plainest form, that private and "made-up" terms their plainest form, that private and "made-up" terms are avoided
are avoided in ISDs, and that new definitions are not created in ISDs, and that new definitions are not created that conflict
that conflict with established ones. with established ones.
o "Openness, Fairness, and Timeliness" - Where ISDs avoid terms o "Openness, Fairness, and Timeliness" - Where ISDs avoid terms that
that are proprietary or otherwise favor a particular vendor, are proprietary or otherwise favor a particular vendor, or that
or that create a bias toward a particular technology or create a bias toward a particular technology or mechanism.
mechanism.
Common and/or controversial policy terms are defined. These Common and/or controversial policy terms are defined. These terms
terms are directly related and specific to network policy. are directly related and specific to network policy.
Wherever possible, this draft takes definitions from existing Wherever possible, this document takes definitions from existing
ISDs. It should be noted that: ISDs. It should be noted that:
o Expired Internet-Drafts are not referenced, nor are their o Expired Internet-Drafts are not referenced, nor are their
terminology and definitions used in this document. terminology and definitions used in this document.
o Multiple definitions may exist across the ISDs. Each o Multiple definitions may exist across the ISDs. Each definition
definition is listed, with its source. is listed, with its source.
2. Explanation of Paragraph Markings 2. Explanation of Paragraph Markings
Section 3 marks terms and definitions as follows: Section 3 marks terms and definitions as follows:
o Capitalization: Only terms that are proper nouns are o Capitalization: Only terms that are proper nouns are capitalized.
capitalized.
o Paragraph Marking: Definitions and explanations are stated in o Paragraph Marking: Definitions and explanations are stated in
paragraphs that are marked as follows: paragraphs that are marked as follows:
- "P" identifies basic policy-related terms. - "P" identifies basic policy-related terms.
- "T" identifies various techniques to create or convey - "T" identifies various techniques to create or convey policy-
policy-related information in a network. For example, related information in a network. For example, COPS and an
COPS and an "Information Model" are two techniques for "Information Model" are two techniques for communicating and
communicating and describing policy-related data. SNMP describing policy-related data. SNMP and MIBs are another.
and MIBs are another.
- "A" identifies specific Work Groups and general "areas of - "A" identifies specific Work Groups and general "areas of use"
use" of policy. For example, AAA and QoS are two "areas of policy. For example, AAA and QoS are two "areas of use"
of use" where policy concepts are extremely important to where policy concepts are extremely important to their function
their function and operation. and operation.
3. Terms 3. Terms
Note: In providing policy definitions, other "technology Note: In providing policy definitions, other "technology specific"
specific" terms (for example, related to Differentiated terms (for example, related to Differentiated Services) may be used
Services) may be used and referenced. These non-policy terms and referenced. These non-policy terms will not be defined in this
will not be defined in this document, and the reader is document, and the reader is requested to go to the referenced ISD for
requested to go to the referenced ISD for additional detail. additional detail.
$ AAA $ AAA
See "Authentication, Authorization, Accounting." See "Authentication, Authorization, Accounting".
$ abstraction levels $ abstraction levels
See "policy abstraction." See "policy abstraction".
$ action $ action
See "policy action." See "policy action".
$ Authentication, Authorization, Accounting (AAA) $ Authentication, Authorization, Accounting (AAA)
(A) AAA deals with control, authentication, authorization and (A) AAA deals with control, authentication, authorization and
accounting of systems and environments based on policies accounting of systems and environments based on policies set
set by the administrators and users of the systems. The use by the administrators and users of the systems. The use of
of policy may be implicit - as defined by RADIUS [R2138]. policy may be implicit - as defined by RADIUS [RFC2138]. In
In RADIUS, a network access server sends dial-user RADIUS, a network access server sends dial-user credentials to
credentials to an AAA server, and receives authentication an AAA server, and receives authentication that the user is
that the user is who he/she claims, along with a set of who he/she claims, along with a set of attribute-value pairs
attribute-value pairs authorizing various service features. authorizing various service features. Policy is implied in
Policy is implied in both the authentication, which can be both the authentication, which can be restricted by time of
restricted by time of day, number of sessions, calling day, number of sessions, calling number, etc., and the
number, etc., and the attribute-values authorized. attribute-values authorized.
$ CIM $ CIM
See "Common Information Model." See "Common Information Model".
$ Common Information Model (CIM) $ Common Information Model (CIM)
(T) An object-oriented information model published by the DMTF (T) An object-oriented information model published by the DMTF
(Distributed Management Task Force) [DMTF]. It consists of (Distributed Management Task Force) [DMTF]. It consists of a
a Specification detailing the abstract modeling constructs Specification detailing the abstract modeling constructs and
and principles of the Information Model, and a textual principles of the Information Model, and a textual language
language definition to represent the Model. CIM's schemas definition to represent the Model. CIM's schemas are defined
are defined as a set of files, written in the language of as a set of files, written in the language of the
the Specification, with graphical renderings using UML Specification, with graphical renderings using UML [UML].
[UML]. Sets of classes and associations represent CIM's Sets of classes and associations represent CIM's Core and
Core and Common Models, defining an information model for Common Models, defining an information model for the
the "enterprise" - addressing general concepts (in Core), "enterprise" - addressing general concepts (in Core), and
and systems, devices, users, software distribution, the systems, devices, users, software distribution, the physical
physical environment, networks and policy (in the Common environment, networks and policy (in the Common Models). (See
Models). (See also "information model.") also "information model".)
$ Common Open Policy Service (COPS) $ Common Open Policy Service (COPS)
(T) A simple query and response TCP-based protocol that can be (T) A simple query and response TCP-based protocol that can be
used to exchange policy information between a Policy used to exchange policy information between a Policy Decision
Decision Point (PDP) and its clients (Policy Enforcement Point (PDP) and its clients (Policy Enforcement Points, PEPs)
Points, PEPs). [R2748] The COPS protocol is used to provide [RFC2748]. The COPS protocol is used to provide for the
for the outsourcing of policy decisions for RSVP. [R2749] outsourcing of policy decisions for RSVP [RFC2749]. Another
Another usage is for the provisioning of policy. [R3084] usage is for the provisioning of policy [RFC3084]. (See also
(See also "Policy Decision Point" and "Policy Enforcement "Policy Decision Point" and "Policy Enforcement Point".)
Point.")
$ condition $ condition
See "policy condition." See "policy condition".
$ configuration $ configuration
(P) "Configuration" can be defined from two perspectives: (P) "Configuration" can be defined from two perspectives:
- The set of parameters in network elements and other - The set of parameters in network elements and other systems
systems that determine their function and operation. that determine their function and operation. Some
Some parameters are static, such as packet queue parameters are static, such as packet queue assignment and
assignment and can be predefined and downloaded to a can be predefined and downloaded to a network element.
network element. Others are more dynamic, such as the Others are more dynamic, such as the actions taken by a
actions taken by a network device upon the occurrence of network device upon the occurrence of some event. The
some event. The distinction between static distinction between static (predefined) "configuration" and
(predefined) "configuration" and the dynamic state of the dynamic state of network elements blurs as setting
network elements blurs as setting parameters becomes parameters becomes more responsive, and signaling controls
more responsive, and signaling controls greater degrees greater degrees of a network device's behavior.
of a network device's behavior.
- A static setup of a network element, done before
shipment to a customer and which cannot be modified by
the customer.
The first is the accepted usage in the Internet community.
$ COPS - A static setup of a network element, done before shipment
See "Common Open Policy Service." to a customer and which cannot be modified by the customer.
The first is the accepted usage in the Internet community.
$ data model $ COPS
(T) A mapping of the contents of an information model into a See "Common Open Policy Service".
form that is specific to a particular type of data store or
repository. A "data model" is basically the rendering of
an information model according to a specific set of
mechanisms for representing, organizing, storing and
handling data. It has three parts [DecSupp]:
- A collection of data structures such as lists, tables,
relations, etc.
- A collection of operations that can be applied to the
structures such as retrieval, update, summation, etc.
- A collection of integrity rules that define the legal
states (set of values) or changes of state (operations
on values).
(See also "information model.")
$ DEN $ data model
See "Directory Enabled Networks." (T) A mapping of the contents of an information model into a form
that is specific to a particular type of data store or
repository. A "data model" is basically the rendering of an
information model according to a specific set of mechanisms
for representing, organizing, storing and handling data. It
has three parts [DecSupp]:
- A collection of data structures such as lists, tables,
relations, etc.
- A collection of operations that can be applied to the
structures such as retrieval, update, summation, etc.
- A collection of integrity rules that define the legal
states (set of values) or changes of state (operations on
values).
(See also "information model".)
$ Differentiated Services (DS) $ DEN
(T) The IP header field, called the DS-field. In IPv4, it See "Directory Enabled Networks".
defines the layout of the ToS (Type of Service) octet; in
IPv6, it is the Traffic Class octet. [R2474] $ Differentiated Services (DS)
(T) The IP header field, called the DS-field. In IPv4, it defines
the layout of the ToS (Type of Service) octet; in IPv6, it is
the Traffic Class octet [RFC2474].
(A) "Differentiated Services" is also an "area of use" for QoS (A) "Differentiated Services" is also an "area of use" for QoS
policies. It requires policy to define the correspondence policies. It requires policy to define the correspondence
between codepoints in the packet's DS-field and individual between codepoints in the packet's DS-field and individual
per-hop behaviors (to achieve a specified per-domain per-hop behaviors (to achieve a specified per-domain
behavior). In addition, policy can be used to specify the behavior). In addition, policy can be used to specify the
routing of packets based on various classification routing of packets based on various classification criteria.
criteria. (See also "Quality of Service" and "filter.") (See also "Quality of Service" and "filter".)
$ diffserv $ diffserv
See "Differentiated Services." See "Differentiated Services".
$ Directory Enabled Networks (DEN) $ Directory Enabled Networks (DEN)
(T) A data model that is the LDAP mapping of CIM (the Common (T) A data model that is the LDAP mapping of CIM (the Common
Information Model). Its goals are to enable the deployment Information Model). Its goals are to enable the deployment
and use of policy by starting with common service and user and use of policy by starting with common service and user
concepts (defined in the information model), specifying concepts (defined in the information model), specifying their
their mapping/storage in an LDAP-based repository, and mapping/storage in an LDAP-based repository, and using these
using these concepts in vendor/device-independent policy concepts in vendor/device-independent policy rules [DMTF].
rules. [DMTF] (See also "Common Information Model" and (See also "Common Information Model" and "data model".)
"data model.")
$ domain $ domain
(P) A collection of elements and services, administered in a (P) A collection of elements and services, administered in a
coordinated fashion. (See also "policy domain.") coordinated fashion. (See also "policy domain".)
$ DS
See "Differentiated Services."
$ filter $ DS
See "Differentiated Services".
$ filter
(T) A set of terms and/or criteria used for the purpose of (T) A set of terms and/or criteria used for the purpose of
separating or categorizing. This is accomplished via separating or categorizing. This is accomplished via single-
single- or multi-field matching of traffic header and/or or multi-field matching of traffic header and/or payload data.
payload data. "Filters" are often manipulated and used in "Filters" are often manipulated and used in network operation
network operation and policy. For example, packet filters and policy. For example, packet filters specify the criteria
specify the criteria for matching a pattern (for example, for matching a pattern (for example, IP or 802 criteria) to
IP or 802 criteria) to distinguish separable classes of distinguish separable classes of traffic.
traffic.
$ goal $ goal
See "policy goal." See "policy goal".
$ information model $ information model
(T) An abstraction and representation of the entities in a (T) An abstraction and representation of the entities in a managed
managed environment, their properties, attributes and environment, their properties, attributes and operations, and
operations, and the way that they relate to each other. It the way that they relate to each other. It is independent of
is independent of any specific repository, software usage, any specific repository, software usage, protocol, or
protocol, or platform. platform.
$ Management Information Base (MIB) $ Management Information Base (MIB)
(T) A collection of information that can be accessed via (T) A collection of information that can be accessed via the
the Simple Network Management Protocol. Management Simple Network Management Protocol. Management information is
information is defined in MIB modules using the rules defined in MIB modules using the rules contained in SNMP's
contained in SNMP's Structure of Management Information Structure of Management Information (SMI) specifications
(SMI) specifications. [R2570] Management information is [RFC2570]. Management information is an abstract concept, and
an abstract concept, and definitions can be created for definitions can be created for high level policy
high level policy specifications, low level policy, as specifications, low level policy, as well as technology and
well as technology and vendor specific configurations, vendor specific configurations, status and statistics. (See
status and statistics. (See also "Simple Network also "Simple Network Management Protocol" and "Structure of
Management Protocol" and "Structure of Management Management Information".)
Information.")
$ MIB $ MIB
See "Management Information Base." See "Management Information Base".
$ MPLS $ MPLS
See "Multiprotocol Label Switching." (Also, MPLS may refer See "Multiprotocol Label Switching". (Also, MPLS may refer to
to Multi-Protocol Lambda Switching in optical networks. But, Multi-Protocol Lambda Switching in optical networks. But, this is
this is unrelated to policy and not discussed further in this unrelated to policy and not discussed further in this document.)
document.)
$ Multiprotocol Label Switching (MPLS) $ Multiprotocol Label Switching (MPLS)
(T) Integrates a label swapping and switching framework with (T) Integrates a label swapping and switching framework with
network layer routing [R2702]. The basic idea involves network layer routing [RFC2702]. The basic idea involves
assigning short fixed length labels to packets at the assigning short fixed length labels to packets at the ingress
ingress to an MPLS cloud. Throughout the interior of the to an MPLS cloud. Throughout the interior of the MPLS domain,
MPLS domain, the labels attached to packets are used to the labels attached to packets are used to make forwarding
make forwarding decisions (usually without recourse to the decisions (usually without recourse to the original packet
original packet headers). headers).
$ outsourced policy $ outsourced policy
(P) An execution model where a policy enforcement device (P) An execution model where a policy enforcement device issues a
issues a query to delegate a decision for a specific policy query to delegate a decision for a specific policy event to
event to another component, external to it. For example, in another component, external to it. For example, in RSVP, the
RSVP, the arrival of a new RSVP message to a PEP requires a arrival of a new RSVP message to a PEP requires a fast policy
fast policy decision (not to delay the end-to-end setup). decision (not to delay the end-to-end setup). The PEP may use
The PEP may use COPS-RSVP to send a query to the PDP, COPS-RSVP to send a query to the PDP, asking for a policy
asking for a policy decision. [R2205, R2748] "Outsourced decision [RFC2205, RFC2748]. "Outsourced policy" is
policy" is contrasted with "provisioned policy", but they contrasted with "provisioned policy", but they are not
are not mutually exclusive and operational systems may mutually exclusive and operational systems may combine the
combine the two. two.
$ PCIM $ PCIM
See "Policy Core Information Model." See "Policy Core Information Model".
$ PDP $ PDP
See "Policy Decision Point." See "Policy Decision Point".
$ PEP $ PEP
See "Policy Enforcement Point." See "Policy Enforcement Point".
$ PIB $ PIB
See "Policy Information Base." See "Policy Information Base".
$ policy $ policy
(P) "Policy" can be defined from two perspectives: (P) "Policy" can be defined from two perspectives:
- A definite goal, course or method of action to guide and - A definite goal, course or method of action to guide and
determine present and future decisions. "Policies" are determine present and future decisions. "Policies" are
implemented or executed within a particular context implemented or executed within a particular context (such
(such as policies defined within a business unit). as policies defined within a business unit).
- Policies as a set of rules to administer, manage, and - Policies as a set of rules to administer, manage, and
control access to network resources. [R3060] control access to network resources [RFC3060].
Note that these two views are not contradictory since
individual rules may be defined in support of business
goals. (See also "policy goal", "policy abstraction" and
"policy rule.")
$ policy abstraction Note that these two views are not contradictory since
(P) Policy can be represented at different levels, ranging individual rules may be defined in support of business goals.
from business goals to device-specific configuration (See also "policy goal", "policy abstraction" and "policy
parameters. Translation between different levels of rule".)
"abstraction" may require information other than policy,
such as network and host parameter configuration and
capabilities. Various documents and implementations may
specify explicit levels of abstraction. However, these do
not necessarily correspond to distinct processing entities
or the complete set of levels in all environments. (See
also "configuration" and "policy translation.")
$ policy action $ policy abstraction
(P) Policy can be represented at different levels, ranging from
business goals to device-specific configuration parameters.
Translation between different levels of "abstraction" may
require information other than policy, such as network and
host parameter configuration and capabilities. Various
documents and implementations may specify explicit levels of
abstraction. However, these do not necessarily correspond to
distinct processing entities or the complete set of levels in
all environments. (See also "configuration" and "policy
translation".)
$ policy action
(P) Definition of what is to be done to enforce a policy rule, (P) Definition of what is to be done to enforce a policy rule,
when the conditions of the rule are met. Policy actions when the conditions of the rule are met. Policy actions may
may result in the execution of one or more operations to result in the execution of one or more operations to affect
affect and/or configure network traffic and network and/or configure network traffic and network resources.
resources. - In [RFC3060], a rule's actions may be ordered.
- In [R3060], a rule's actions may be ordered.
$ policy condition $ policy condition
(P) A representation of the necessary state and/or (P) A representation of the necessary state and/or prerequisites
prerequisites that define whether a policy rule's actions that define whether a policy rule's actions should be
should be performed. This representation need not be performed. This representation need not be completely
completely specified, but may be implicitly provided in an specified, but may be implicitly provided in an implementation
implementation or protocol. When the policy condition(s) or protocol. When the policy condition(s) associated with a
associated with a policy rule evaluate to TRUE, then policy rule evaluate to TRUE, then (subject to other
(subject to other considerations such as rule priorities considerations such as rule priorities and decision
and decision strategies) the rule should be enforced. strategies) the rule should be enforced.
(T) In [R3060], a rule's conditions can be expressed as either (T) In [RFC3060], a rule's conditions can be expressed as either
an ORed set of ANDed sets of statements (disjunctive normal an ORed set of ANDed sets of statements (disjunctive normal
form), or an ANDed set of ORed sets of statements form), or an ANDed set of ORed sets of statements (conjunctive
(conjunctive normal form). Individual condition statements normal form). Individual condition statements can also be
can also be negated. negated.
$ policy conflict $ policy conflict
(P) Occurs when the actions of two rules (that are both (P) Occurs when the actions of two rules (that are both satisfied
satisfied simultaneously) contradict each other. The entity simultaneously) contradict each other. The entity
implementing the policy would not be able to determine implementing the policy would not be able to determine which
which action to perform. The implementers of policy systems action to perform. The implementers of policy systems must
must provide conflict detection and avoidance or resolution provide conflict detection and avoidance or resolution
mechanisms to prevent this situation. "Policy conflict" is mechanisms to prevent this situation. "Policy conflict" is
contrasted with "policy error." contrasted with "policy error".
$ policy conversion $ policy conversion
See "policy translation." See "policy translation".
$ Policy Core Information Model (PCIM) [R3060] $ Policy Core Information Model (PCIM) [RFC3060]
(T) An information model describing the basic concepts of (T) An information model describing the basic concepts of policy
policy groups, rules, conditions, actions, repositories and groups, rules, conditions, actions, repositories and their
their relationships. This model is described as a "core" relationships. This model is described as a "core" model
model since it cannot be applied without domain-specific since it cannot be applied without domain-specific extensions
extensions (for example, extensions for QoS or IPsec). PCIM (for example, extensions for QoS or IPsec). PCIM is "core"
is "core" with respect to the area of policy. However, it with respect to the area of policy. However, it is a "Common
is a "Common Model," with respect to CIM - in that it Model," with respect to CIM - in that it extends the basic CIM
extends the basic CIM concepts for policy. (See also concepts for policy. (See also "Common Information Model".)
"Common Information Model.")
$ policy decision $ policy decision
(P) Two perspectives of "policy decision" exist: (P) Two perspectives of "policy decision" exist:
- A "process" perspective that deals with the evaluation of - A "process" perspective that deals with the evaluation of a
a policy rule's conditions policy rule's conditions
- A "result" perspective that deals with the actions for - A "result" perspective that deals with the actions for
enforcement, when the conditions of a policy rule are enforcement, when the conditions of a policy rule are TRUE
TRUE
$ Policy Decision Point (PDP) $ Policy Decision Point (PDP)
(P) A logical entity that makes policy decisions for itself (P) A logical entity that makes policy decisions for itself or for
or for other network elements that request such decisions. other network elements that request such decisions [RFC2753].
[R2753] (See also "policy decision.") (See also "policy decision".)
$ policy domain $ policy domain
(P) A collection of elements and services, and/or a portion (P) A collection of elements and services, and/or a portion of an
of an Internet over which a common and consistent set of Internet over which a common and consistent set of policies
policies are administered in a coordinated fashion. [R2474] are administered in a coordinated fashion [RFC2474]. This
This definition of a policy domain does not preclude definition of a policy domain does not preclude multiple
multiple sources of policy creation within an organization, sources of policy creation within an organization, but does
but does require that the resultant policies be require that the resultant policies be coordinated.
coordinated. - Policies defined in the context of one domain may need to
- Policies defined in the context of one domain may need to be communicated or negotiated outside of that domain. (See
be communicated or negotiated outside of that domain. also "policy negotiation".)
(See also "policy negotiation.")
$ policy enforcement $ policy enforcement
(P) The execution of a policy decision. (P) The execution of a policy decision.
$ Policy Enforcement Point (PEP) $ Policy Enforcement Point (PEP)
(P) A logical entity that enforces policy decisions. [R2753] (P) A logical entity that enforces policy decisions [RFC2753].
(See also "policy enforcement.") (See also "policy enforcement".)
$ policy error $ policy error
(P) "Policy errors" occur when attempts to enforce policy (P) "Policy errors" occur when attempts to enforce policy actions
actions fail, whether due to temporary state or permanent fail, whether due to temporary state or permanent mismatch
mismatch between the policy actions and the device between the policy actions and the device enforcement
enforcement capabilities. This is contrasted with "policy capabilities. This is contrasted with "policy conflict".
conflict."
$ policy goal $ policy goal
(P) Goals are the business objectives or desired state (P) Goals are the business objectives or desired state intended to
intended to be maintained by a policy system. As the be maintained by a policy system. As the highest level of
highest level of abstraction of policy, these goals are abstraction of policy, these goals are most directly described
most directly described in business rather than technical in business rather than technical terms. For example, a goal
terms. For example, a goal might state that a particular might state that a particular application operate on a network
application operate on a network as though it had its own as though it had its own dedicated network, despite using a
dedicated network, despite using a shared infrastructure. shared infrastructure. 'Policy goals' can include the
'Policy goals' can include the objectives of a service objectives of a service level agreement, as well as the
level agreement, as well as the assignment of resources to assignment of resources to applications or individuals. A
applications or individuals. A policy system may be created policy system may be created that automatically strives to
that automatically strives to achieve a goal through achieve a goal through feedback regarding whether the goal
feedback regarding whether the goal (such as a service (such as a service level) is being met.
level) is being met.
$ Policy Information Base (PIB) $ Policy Information Base (PIB)
(T) Collections of related PRovisioning Classes (PRCs), (T) Collections of related PRovisioning Classes (PRCs), defined as
defined as a module. (See also "PRovisioning Class.") a module. (See also "PRovisioning Class".)
$ policy mapping $ policy mapping
See "policy translation." See "policy translation".
$ policy negotiation $ policy negotiation
(P) Exposing the desired or appropriate part of a policy to (P) Exposing the desired or appropriate part of a policy to
another domain. This is necessary to support partial another domain. This is necessary to support partial
interconnection between domains, which are operating with interconnection between domains, which are operating with
different sets of policies. different sets of policies.
$ policy repository $ policy repository
(P) "Policy repository" can be defined from three (P) "Policy repository" can be defined from three perspectives:
perspectives: - A specific data store that holds policy rules, their
- A specific data store that holds policy rules, their conditions and actions, and related policy data. A
conditions and actions, and related policy data. A database or directory would be an example of such a store.
database or directory would be an example of such a - A logical container representing the administrative scope
store. and naming of policy rules, their conditions and actions,
- A logical container representing the administrative and related policy data. A "QoS policy" domain would be an
scope and naming of policy rules, their conditions and example of such a container.
actions, and related policy data. A "QoS policy" domain - In [RFC3060], a more restrictive definition than the prior
would be an example of such a container. one exists. A PolicyRepository is a model abstraction
- In [R3060], a more restrictive definition than the prior representing an administratively defined, logical container
one exists. A PolicyRepository is a model abstraction for reusable policy elements.
representing an administratively defined, logical
container for reusable policy elements.
$ policy request $ policy request
(P) A message requesting a policy-related service. This may (P) A message requesting a policy-related service. This may refer
refer to a request to retrieve a specific set of policy to a request to retrieve a specific set of policy rules, to
rules, to determine the actions to enforce, or other policy determine the actions to enforce, or other policy requests.
requests. When sent by a PEP to a PDP, it is more When sent by a PEP to a PDP, it is more accurately qualified
accurately qualified as a "policy decision request." as a "policy decision request" [RFC2753]. (See also "policy
[R2753] (See also "policy decision.") decision".)
$ policy rule $ policy rule
(P) A basic building block of a policy-based system. It is (P) A basic building block of a policy-based system. It is the
the binding of a set of actions to a set of conditions - binding of a set of actions to a set of conditions - where the
- conditions are evaluated to determine whether the actions are
where the conditions are evaluated to determine whether the performed [RFC3060].
actions are performed. [R3060]
$ policy server $ policy server
(P) A marketing term whose definition is imprecise. (P) A marketing term whose definition is imprecise. Originally,
Originally, [R2753] referenced a "policy server." As the [RFC2753] referenced a "policy server". As the RFC evolved,
RFC evolved, this term became more precise and known as the this term became more precise and known as the Policy Decision
Policy Decision Point (PDP). Today, the term is used in Point (PDP). Today, the term is used in marketing and other
marketing and other literature to refer specifically to a literature to refer specifically to a PDP, or for any entity
PDP, or for any entity that uses/services policy. that uses/services policy.
$ policy translation $ policy translation
(P) The transformation of a policy from a representation (P) The transformation of a policy from a representation and/or
and/or level of abstraction, to another representation or level of abstraction, to another representation or level of
level of abstraction. For example, it may be necessary to abstraction. For example, it may be necessary to convert PIB
convert PIB data to a command line format. In this data to a command line format. In this "conversion," the
"conversion," the translation to the new representation is translation to the new representation is likely to require a
likely to require a change in the level of abstraction change in the level of abstraction (becoming more or less
(becoming more or less specific). Although these are specific). Although these are logically distinct tasks, they
logically distinct tasks, they are (in most cases) blurred are (in most cases) blurred in the act of
in the act of translating/converting/mapping. Therefore, translating/converting/mapping. Therefore, this is also known
this is also known as "policy conversion" or "policy as "policy conversion" or "policy mapping".
mapping."
$ PolicyGroup $ PolicyGroup
(T) An abstraction in the Policy Core Information Model (T) An abstraction in the Policy Core Information Model [RFC3060].
[R3060]. It is a class representing a container, It is a class representing a container, aggregating either
aggregating either policy rules or other policy groups. It policy rules or other policy groups. It allows the grouping
allows the grouping of rules into a Policy, and the of rules into a Policy, and the refinement of high-level
refinement of high-level Policies to lower-level or Policies to lower-level or different (i.e., converted or
different (i.e., converted or translated) peer groups. translated) peer groups.
$ PRC $ PRC
See "PRovisioning Class." See "PRovisioning Class".
$ PRI $ PRI
See "PRovisioning Instance." See "PRovisioning Instance".
$ provisioned policy $ provisioned policy
(P) An execution model where network elements are pre- (P) An execution model where network elements are pre-configured,
configured, based on policy, prior to processing events. based on policy, prior to processing events. Configuration is
Configuration is pushed to the network device, e.g., based pushed to the network device, e.g., based on time of day or at
on time of day or at initial booting of the device. The initial booting of the device. The focus of this model is on
focus of this model is on the distribution of configuration the distribution of configuration information, and is
information, and is exemplified by Differentiated Services exemplified by Differentiated Services [RFC2475]. Based on
[R2475]. Based on events received, devices use downloaded events received, devices use downloaded (pre-provisioned)
(pre-provisioned) mechanisms to implement policy. mechanisms to implement policy. "Provisioned policy" is
"Provisioned policy" is contrasted with "outsourced contrasted with "outsourced policy".
policy."
$ PRovisioning Class (PRC) $ PRovisioning Class (PRC)
(T) An ordered set of attributes representing a type of policy (T) An ordered set of attributes representing a type of policy
data. PRCs are defined in PIB modules (encoded using SPPI) data. PRCs are defined in PIB modules (encoded using SPPI)
and registered in the Object Identifier tree. Instances of and registered in the Object Identifier tree. Instances of
each PRC are organized in tables, similar to conceptual each PRC are organized in tables, similar to conceptual tables
tables in SMIv2. (See also "Structure of Policy in SMIv2. (See also "Structure of Policy Provisioning
Provisioning Information" and "Policy Information Base.") Information" and "Policy Information Base".)
The acronym, PRC, has evolved from "policy rule class" to The acronym, PRC, has evolved from "policy rule class" to
"provisioning class." The reason for the change is that a "provisioning class". The reason for the change is that a
discrepancy existed between the use of the words, "policy discrepancy existed between the use of the words, "policy
rule" in the PRC context versus other uses in PCIM and the rule" in the PRC context versus other uses in PCIM and the
industry. In the latter, rules are If/Then statements - a industry. In the latter, rules are If/Then statements - a
binding of conditions to actions. PRCs are not "rules" by binding of conditions to actions. PRCs are not "rules" by
this definition, but the encoding of (network-wide) this definition, but the encoding of (network-wide)
configuration information for a device. configuration information for a device.
$ PRovisioning Instance (PRI) $ PRovisioning Instance (PRI)
(T) An instantiation of a PRovisioning Class. (See also (T) An instantiation of a PRovisioning Class. (See also
"PRovisioning Class.") "PRovisioning Class".)
$ QoS $ QoS
See "Quality of Service." See "Quality of Service".
$ Quality of Service (QoS) $ Quality of Service (QoS)
(A) At a high level of abstraction, "Quality of Service" (A) At a high level of abstraction, "Quality of Service" refers to
refers to the ability to deliver network services according the ability to deliver network services according to the
to the parameters specified in a Service Level Agreement. parameters specified in a Service Level Agreement. "Quality"
"Quality" is characterized by service availability, delay, is characterized by service availability, delay, jitter,
jitter, throughput and packet loss ratio. At a network throughput and packet loss ratio. At a network resource
resource level, "Quality of Service" refers to a set of level, "Quality of Service" refers to a set of capabilities
capabilities that allow a service provider to prioritize that allow a service provider to prioritize traffic, control
traffic, control bandwidth, and network latency. There are bandwidth, and network latency. There are two different
two different approaches to "Quality of Service" on IP approaches to "Quality of Service" on IP networks: Integrated
networks: Integrated Services [R1633], and Differentiated Services [RFC1633], and Differentiated Service [RFC2475].
Service [R2475]. Integrated Services require policy control Integrated Services require policy control over the creation
over the creation of signaled reservations, which provide of signaled reservations, which provide specific quantitative
specific quantitative end-to-end behavior for a (set of) end-to-end behavior for a (set of) flow(s). In contrast,
flow(s). In contrast, Differentiated Services require Differentiated Services require policy to define the
policy to define the correspondence between codepoints in correspondence between codepoints in the packet's DS-field and
the packet's DS-field and individual per-hop behaviors (to individual per-hop behaviors (to achieve a specified per-
achieve a specified per-domain behavior). A maximum of 64 domain behavior). A maximum of 64 per-hop behaviors limit the
per-hop behaviors limit the number of classes of service number of classes of service traffic that can be marked at any
traffic that can be marked at any point in a domain. These point in a domain. These classes of service signal the
classes of service signal the treatment of the packets with treatment of the packets with respect to various QoS aspects,
respect to various QoS aspects, such as flow priority and such as flow priority and packet drop precedence. In
packet drop precedence. In addition, policy can be used to addition, policy can be used to specify the routing of packets
specify the routing of packets based on various based on various classification criteria. Policy controls the
classification criteria. Policy controls the set of set of configuration parameters and routing for each class in
configuration parameters and routing for each class in Differentiated Service, and the admission conditions for
Differentiated Service, and the admission conditions for reservations in Integrated Services. (See also "policy
reservations in Integrated Services. (See also "policy abstraction" and "Service Level Agreement".)
abstraction" and "Service Level Agreement.")
$ Resource reSerVation Protocol (RSVP) $ Resource reSerVation Protocol (RSVP)
(T) A setup protocol designed for an Integrated Services (T) A setup protocol designed for an Integrated Services Internet,
Internet, to reserve network resources for a path. [R2205] to reserve network resources for a path [RFC2205]. And, a
And, a signaling mechanism for managing application signaling mechanism for managing application traffic's QoS in
traffic's QoS in a Differentiated Service network. a Differentiated Service network.
$ role $ role
(P) "Role" is defined from three perspectives: (P) "Role" is defined from three perspectives:
- A business position or function, to which people and - A business position or function, to which people and
logical entities are assigned [X.500] logical entities are assigned [X.500]
- The labeled endpoints of a UML (Unified Modeling - The labeled endpoints of a UML (Unified Modeling Language)
Language) association. Quoting from [UML], "When a association. Quoting from [UML], "When a class
class participates in an association, it has a specific participates in an association, it has a specific role that
role that it plays in that relationship; a role is just it plays in that relationship; a role is just the face the
the face the class at the near end of the association class at the near end of the association presents to the
presents to the class at the other end of the class at the other end of the association". The Policy
association." The Policy Core Information Model [R3060] Core Information Model [RFC3060] uses UML to depict its
uses UML to depict its class hierarchy. class hierarchy. Relationships/associations are significant
Relationships/associations are significant in the model. in the model.
- An administratively specified characteristic of a - An administratively specified characteristic of a managed
managed element (for example, an interface). It is a element (for example, an interface). It is a selector for
selector for policy rules and PRovisioning Classes policy rules and PRovisioning Classes (PRCs), to determine
(PRCs), to determine the applicability of the rule/PRC to the applicability of the rule/PRC to a particular managed
a particular managed element. [R3060] element [RFC3060].
Only the third definition (roles as selectors of policy) is Only the third definition (roles as selectors of policy) is
directly related to the management of network policy. directly related to the management of network policy. However,
However, the first definition (roles as business positions the first definition (roles as business positions and
and functions) may be referenced in policy conditions and functions) may be referenced in policy conditions and actions.
actions.
$ role combination $ role combination
(P) A lexicographically ordered set of roles that characterize (P) A lexicographically ordered set of roles that characterize
managed elements and indicate the applicability of policy managed elements and indicate the applicability of policy
rules and PRovisioning Classes (PRCs). A policy system rules and PRovisioning Classes (PRCs). A policy system uses
uses the set of roles reported by the managed element to the set of roles reported by the managed element to determine
determine the correct rules/PRCs to be sent for the correct rules/PRCs to be sent for enforcement. That
enforcement. That determination may examine all applicable determination may examine all applicable policy rules
policy rules identified by the role combination, its sub- identified by the role combination, its sub-combinations and
combinations and the individual roles in the combination. the individual roles in the combination [RFC3060]. In the
[R3060] In the case of PRCs, a PRC must explicitly match case of PRCs, a PRC must explicitly match the role combination
the role combination of the managed element in order to be of the managed element in order to be applicable and/or
applicable and/or enforced. (The comparison is typically enforced. (The comparison is typically case-sensitive.) The
case-sensitive.) The final set of rules/PRCs for final set of rules/PRCs for enforcement are defined by the
enforcement are defined by the policy system, as policy system, as appropriate for the specified role
appropriate for the specified role combination of the combination of the managed element.
managed element.
$ RSVP $ RSVP
See "Resource reSerVation Protocol." See "Resource reSerVation Protocol".
$ rule $ rule
See "policy rule." See "policy rule".
$ rule based engine $ rule based engine
(T) A rule based engine is able to evaluate policy (T) A rule based engine is able to evaluate policy condition(s)
condition(s) and trigger appropriate policy actions. A and trigger appropriate policy actions. A particular rule
particular rule based engine may only be capable of acting based engine may only be capable of acting upon policy rules
upon policy rules that are formatted in a specified way or that are formatted in a specified way or adhere to a specific
adhere to a specific language. language.
$ schema $ schema
(T) Two different perspectives of schema are defined: (T) Two different perspectives of schema are defined:
- A set of rules that determines what data can be stored - A set of rules that determines what data can be stored in a
in a database or directory service [DirServs] database or directory service [DirServs]
- A collection of data models that are each bound to the - A collection of data models that are each bound to the same
same type of repository. type of repository.
The latter is the preferred and recommended one for The latter is the preferred and recommended one for Internet
Internet Standards documents. (See also "data model.") Standards documents. (See also "data model".)
$ service $ service
(P) The behavior or functionality provided by a network, (P) The behavior or functionality provided by a network, network
network element or host [DMTF, R2216]. Quoting from RFC element or host [DMTF, RFC2216]. Quoting from RFC 2216
2216 [R2216], in order to completely specify a "service", [RFC2216], in order to completely specify a "service", one
one must define the "functions to be performed ..., the must define the "functions to be performed ..., the
information required ... to perform these functions, and information required ... to perform these functions, and the
the information made available by the element to other information made available by the element to other elements of
elements of the system." Policy can be used to configure a the system". Policy can be used to configure a "service" in a
"service" in a network or on a network element/host, invoke network or on a network element/host, invoke its
its functionality, and/or coordinate services in an functionality, and/or coordinate services in an interdomain or
interdomain or end-to-end environment. end-to-end environment.
$ Service Level Agreement (SLA) $ Service Level Agreement (SLA)
(P) The documented result of a negotiation between a (P) The documented result of a negotiation between a
customer/consumer and a provider of a service, that customer/consumer and a provider of a service, that specifies
specifies the levels of availability, serviceability, the levels of availability, serviceability, performance,
performance, operation or other attributes of the service. operation or other attributes of the service [RFC2475]. (See
(See also "Service Level Objective.") [R2475] also "Service Level Objective".)
$ Service Level Objective (SLO) $ Service Level Objective (SLO)
(P) Partitions an SLA into individual metrics and operational (P) Partitions an SLA into individual metrics and operational
information to enforce and/or monitor the SLA. "Service information to enforce and/or monitor the SLA. "Service Level
Level Objectives" may be defined as part of an SLA, an SLS, Objectives" may be defined as part of an SLA, an SLS, or in a
or in a separate document. It is a set of parameters and separate document. It is a set of parameters and their
their values. The actions of enforcing and reporting values. The actions of enforcing and reporting monitored
monitored compliance can be implemented as one or more compliance can be implemented as one or more policies. (See
policies. (See also "Service Level Agreement.") also "Service Level Agreement".)
$ Service Level Specification (SLS) $ Service Level Specification (SLS)
(P) Specifies handling of customer's traffic by a network (P) Specifies handling of customer's traffic by a network
provider. It is negotiated between a customer and the provider. It is negotiated between a customer and the
provider, and (for example) in a DiffServ environment, provider, and (for example) in a DiffServ environment, defines
defines parameters such as specific Code Points and the parameters such as specific Code Points and the Per-Hop-
Per-Hop-Behavior, profile characteristics and treatment of Behavior, profile characteristics and treatment of the traffic
the traffic for those Code Points. An SLS is a specific SLA for those Code Points. An SLS is a specific SLA (a negotiated
(a negotiated agreement) and its SLOs (the individual agreement) and its SLOs (the individual metrics and
metrics and operational data to enforce) to guarantee operational data to enforce) to guarantee quality of service
quality of service for network traffic. (See also "Service for network traffic. (See also "Service Level Agreement" and
Level Agreement" and "Service Level Objective.") "Service Level Objective".)
$ Simple Network Management Protocol (SNMP)
$ Simple Network Management Protocol (SNMP)
(T) SNMP is a framework (including a protocol) for managing (T) SNMP is a framework (including a protocol) for managing
systems in a network environment. [R2570] It can be used systems in a network environment [RFC2570]. It can be used
for policy-based configuration and control using a specific for policy-based configuration and control using a specific
MIB Module designed to execute policies on managed elements MIB Module designed to execute policies on managed elements
via scripts. The elements (instances) in a network device via scripts. The elements (instances) in a network device are
are evaluated using a policy filter, to determine where evaluated using a policy filter, to determine where policy
policy will be applied. will be applied.
$ SLA $ SLA
See "Service Level Agreement." See "Service Level Agreement".
$ SLO $ SLO
See "Service Level Objective." See "Service Level Objective".
$ SLS $ SLS
See "Service Level Specification." See "Service Level Specification".
$ SMIv2 $ SMIv2
See "Structure of Management Information." See "Structure of Management Information".
$ SNMP $ SNMP
See "Simple Network Management Protocol." See "Simple Network Management Protocol".
$ SPPI $ SPPI
See "Structure of Policy Provisioning Information." See "Structure of Policy Provisioning Information".
$ Structure of Policy Provisioning Information (SPPI) $ Structure of Policy Provisioning Information (SPPI)
(T) An adapted subset of SNMP's Structure of Management (T) An adapted subset of SNMP's Structure of Management
Information (SMIv2) that is used to encode collections of Information (SMIv2) that is used to encode collections of
related PRovisioning Classes as a PIB. (See also "Policy related PRovisioning Classes as a PIB [RFC3159]. (See also
Information Base" and "PRovisioning Class.") "Policy Information Base" and "PRovisioning Class".)
$ Structure of Management Information, version 2 (SMIv2) $ Structure of Management Information, version 2 (SMIv2)
(T) An adapted subset of OSI's Abstract Syntax Notation One, (T) An adapted subset of OSI's Abstract Syntax Notation One, ASN.1
ASN.1 (1988) used to encode collections of related objects (1988) used to encode collections of related objects as SNMP
as SNMP Management Information Base (MIB) modules. [R2578] Management Information Base (MIB) modules [RFC2578].
$ subject $ subject
(P) An entity, or collection of entities, which originates a (P) An entity, or collection of entities, which originates a
request, and is verified as authorized/not authorized to request, and is verified as authorized/not authorized to
perform that request. perform that request.
$ target $ target
(P) An entity, or collection of entities, which is affected (P) An entity, or collection of entities, which is affected by a
by a policy. For example, the "targets" of a policy to policy. For example, the "targets" of a policy to reconfigure
reconfigure a network device are the individual services a network device are the individual services that are updated
that are updated and configured. and configured.
4. Intellectual Property 4. Intellectual Property
The IETF takes no position regarding the validity or scope of The IETF takes no position regarding the validity or scope of any
any intellectual property or other rights that might be claimed intellectual property or other rights that might be claimed to
to pertain to the implementation or use of the technology pertain to the implementation or use of the technology described in
described in this document or the extent to which any license this document or the extent to which any license under such rights
under such rights might or might not be available; neither does might or might not be available; neither does it represent that it
it represent that it has made any effort to identify any such has made any effort to identify any such rights. Information on the
rights. Information on the IETF's procedures with respect to IETF's procedures with respect to rights in standards-track and
rights in standards-track and standards-related documentation standards-related documentation can be found in BCP-11.
can be found in BCP-11.
Copies of claims of rights made available for publication and Copies of claims of rights made available for publication and any
any assurances of licenses to be made available, or the result assurances of licenses to be made available, or the result of an
of an attempt made to obtain a general license or permission for attempt made to obtain a general license or permission for the use of
the use of such proprietary rights by implementers or users of such proprietary rights by implementers or users of this
this specification can be obtained from the IETF Secretariat. specification can be obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention The IETF invites any interested party to bring to its attention any
any copyrights, patents or patent applications, or other copyrights, patents or patent applications, or other proprietary
proprietary rights which may cover technology that may be rights which may cover technology that may be required to practice
required to practice this standard. Please address the this standard. Please address the information to the IETF Executive
information to the IETF Executive Director. Director.
5. Acknowledgements 5. Acknowledgements
This document builds on the work of previous terminology drafts. This document builds on the work of previous terminology drafts. The
The authors of these drafts were Fran Reichmeyer, Dan Grossman, authors of these documents were Fran Reichmeyer, Dan Grossman, John
John Strassner, Ed Ellesson and Matthew Condell. Also, Strassner, Ed Ellesson and Matthew Condell. Also, definitions for
definitions for the general concepts of policy and policy rule the general concepts of policy and policy rule include input from
include input from Predrag Spasic. Very helpful comments and Predrag Spasic. Very helpful comments and suggestions were received
suggestions were received from Juergen Schoenwaelder, Joe from Juergen Schoenwaelder, Joe Salowey, Jon Saperia, Ravi Sahita,
Salowey, Jon Saperia, Ravi Sahita, Bob Moore, Guus Sliepen, Bob Moore, Guus Sliepen, T.H. Jonatan and Dave Perkins.
T.H. Jonatan and Dave Perkins.
6. Security Considerations 6. Security Considerations
This document only defines policy-related terms. It does not This document only defines policy-related terms. It does not
describe in detail the vulnerabilities of, threats to, or describe in detail the vulnerabilities of, threats to, or mechanisms
mechanisms that protect specific policy implementations or that protect specific policy implementations or policy-related
policy-related Internet protocols. Internet protocols.
7. References 7. References
[DecSupp] Building Effective Decision Support Systems. R. [DecSupp] Building Effective Decision Support Systems. R.
Sprague, and E. Carleson. Prentice Hall, 1982. Sprague, and E. Carleson. Prentice Hall, 1982.
[DirServs] Understanding and Deploying LDAP Directory Services. [DirServs] Understanding and Deploying LDAP Directory Services. T.
T. Howes, M. Smith, and G. Good. MacMillan Technical Howes, M. Smith, and G. Good. MacMillan Technical
Publications, 1999. Publications, 1999.
[DMTF] Common Information Model (CIM) Schema, version 2.x. [DMTF] Common Information Model (CIM) Schema, version 2.x.
Distributed Management Task Force, Inc. The components of Distributed Management Task Force, Inc. The components
the CIM v2.x schema are available via links on the following of the CIM v2.x schema are available via links on the
DMTF web page: following DMTF web page:
http://www.dmtf.org/standards/standard_cim.php. http://www.dmtf.org/standards/standard_cim.php.
[R1633] Integrated Services in the Internet Architecture: An [RFC1633] Braden, R., Clark, D. and S. Shenker, "Integrated
Overview. R. Braden, D. Clark, and S. Shenker. June 1994. Services in the Internet Architecture: An Overview", RFC
1633, June 1994.
[R2026] The Internet Standards Process -- Revision 3. S. [RFC2026] Bradner, S., "The Internet Standards Process -- Revision
Bradner. October 1996. 3", BCP 9, RFC 2026, October 1996.
[R2138] Remote Authentication Dial In User Service (RADIUS). C. [RFC2138] Rigney, C., Rubens, A., Simpson, W. and S. Willens,
Rigney, A. Rubens, W. Simpson, and S. Willens. April 1997. "Remote Authentication Dial In User Service (RADIUS)",
RFC 2138, April 1997.
[R2205] Resource ReSerVation Protocol (RSVP) -- Version 1 [RFC2205] Braden, R., Zhang, L., Berson, S., Herzog, S. and S.
Functional Specification. R. Braden, L. Zhang, S. Berson, Jamin, "Resource ReSerVation Protocol (RSVP) -- Version
S. Herzog, and S. Jamin. September 1997. 1 Functional Specification", RFC 2205, September 1997.
[R2216] Network Element Service Specification Template. S. [RFC2216] Shenker, S. and J. Wroclawski, "Network Element Service
Shenker, and J. Wroclawski. September 1997. Specification Template", September 1997.
[R2474] Definition of the Differentiated Services Field (DS [RFC2474] Nichols, K., Blake, S., Baker, F. and D. Black,
Field) in the IPv4 and IPv6 Headers. K. Nichols, S. Blake, "Definition of the Differentiated Services Field (DS
F. Baker, and D. Black. December 1998. Field) in the IPv4 and IPv6 Headers", RFC 2474, December
1998.
[R2475] An Architecture for Differentiated Service. S. Blake, [RFC2475] Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z.
D. Black, M. Carlson, E. Davies, Z. Wang, and W. Weiss. and W. Weiss, "An Architecture for Differentiated
December 1998. Service", RFC 2475, December 1998.
[R2570] Introduction to Version 3 of the Internet-standard [RFC2570] Case, J., Mundy, R., Partain, D. and B. Stewart,
Network Management Framework. J. Case, R. Mundy, D. Partain, "Introduction to Version 3 of the Internet-standard
and B. Stewart. April 1999. Network Management Framework", RFC 2570, April 1999.
[R2578] Structure of Management Information Version 2 (SMIv2). [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case,
K. McGloughrie, D. Perkins, J. Schoenwaelder, J. Case, M. J., Rose, M. and S.Waldbusser, "Structure of Management
Rose, and S. Waldbusser. April 1999. Information Version 2 (SMIv2)", RFC 2578, April 1999.
[R2702] Requirements for Traffic Engineering Over MPLS. D. [RFC2702] Awduche, D., Malcolm, J., Agogbua, J., O'Dell, M. and J.
Awduche, J. Malcolm, J. Agogbua, M. O'Dell, and J. McManus. McManus, "Requirements for Traffic Engineering Over
September 1999. MPLS", RFC 2702, September 1999.
[R2748] The COPS (Common Open Policy Service) Protocol. D. [RFC2748] Durham, D., Boyle, J., Cohen, R., Herzog, S., Rajan, R.
Durham, J. Boyle, R. Cohen, S. Herzog, R. Rajan, and A. and A. Sastry, "The COPS (Common Open Policy Service)
Sastry. January 2000. Protocol", RFC 2748, January 2000.
[R2749] COPS Usage for RSVP. J. Boyle, R. Cohen, D. Durham, S. [RFC2749] Herzog, S., Boyle, J., Cohen, R., Durham, D., Rajan, R.
Herzog, R. Rajan, and A. Sastry. January 2000. and A. Sastry, "COPS Usage for RSVP", RFC 2749, January
2000.
[R2753] A Framework for Policy-based Admission Control. R. [RFC2753] Yavatkar, R., Pendarakis, D. and R. Guerin, "A Framework
Yavatkar, D. Pendarakis, and R. Guerin. January 2000. for Policy-based Admission Control", RFC 2753, January
2000.
[R2828] Internet Security Glossary. R. Shirey. May 2000. [RFC2828] Shirey, R., "Internet Security Glossary", FYI 36, RFC
2828, May 2000.
[R3060] Policy Core Information Model -- Version 1 [RFC3060] Moore, B., Ellesson, E., Strassner, J. and A.
Specification. B. Moore, E. Ellesson, J. Strassner, and A. Westerinen, "Policy Core Information Model -- Version 1
Westerinen. February 2001. Specification", RFC 3060, February 2001.
[R3084] COPS Usage for Policy Provisioning (COPS-PR). K. Chan, [RFC3084] Chan, K., Seligson, J., Durham, D., Gai, S., McCloghrie,
J. Seligson, D. Durham, S. Gai, K. McCloghrie, S. Herzog, F. K., Herzog, S., Reichmeyer, F., Yavatkar, R. and A.
Reichmeyer, R. Yavatkar, and A. Smith. March 2001. Smith, "COPS Usage for Policy Provisioning (COPS-PR)",
RFC 3084, February 2001.
[UML] The Unified Modeling Language User Guide. G. Booch, J. [RFC3159] McCloghrie, K., Fine, M., Seligson, J., Chan, K., Hahn,
Rumbaugh, and I. Jacobson. Addison-Wesley, 1999. S., Sahita, R., Smith, A. and F. Reichmeyer, "Structure
of Policy Provisioning Information," RFC 3159, August
2001.
[X.500] Data Communications Networks Directory, Recommendations [UML] The Unified Modeling Language User Guide. G. Booch, J.
X.500-X.521, Volume VIII - Fascicle VIII.8. CCITT, IXth Rumbaugh, and I. Jacobson. Addison-Wesley, 1999.
Plenary Assembly, Melbourne. November 1988.
8. Authors' Addresses [X.500] Data Communications Networks Directory, Recommendations
X.500-X.521, Volume VIII - Fascicle VIII.8. CCITT, IXth
Plenary Assembly, Melbourne. November 1988.
8. Authors' Addresses
Andrea Westerinen Andrea Westerinen
Cisco Systems, Bldg 20 Cisco Systems, Bldg 20
725 Alder Drive 725 Alder Drive
Milpitas, CA 95035 Milpitas, CA 95035
E-mail: andreaw@cisco.com
EMail: andreaw@cisco.com
John Schnizlein John Schnizlein
Cisco Systems Cisco Systems
9123 Loughran Road 9123 Loughran Road
Fort Washington, MD 20744 Fort Washington, MD 20744
E-mail: john.schnizlein@cisco.com
EMail: john.schnizlein@cisco.com
John Strassner John Strassner
IntelliDEN, Inc. Intelliden Corporation
90 South Cascade Avenue 90 South Cascade Avenue
Colorado Springs, CO 80903 Colorado Springs, CO 80903
Phone: +1-719-785-0648 Phone: +1-719-785-0648
E-mail: john.strassner@intelliden.com
EMail: john.strassner@intelliden.com
Mark Scherling Mark Scherling
Xcert International Inc. Xcert International Inc.
Suite 300 Suite 300
505 Burrard Street 505 Burrard Street
Vancouver, BC Vancouver, BC
V7X 1M3 V7X 1M3
E-mail: mscherling@xcert.com
EMail: mscherling@xcert.com
Bob Quinn Bob Quinn
Celox Networks Celox Networks
One Cabot Road 2 Park Central Drive
Hudson, MA 01749 Southborough, MA 01772
E-mail: bquinn@celoxnetworks.com
EMail: bquinn@celoxnetworks.com
Jay Perry Jay Perry
E-mail: jay@jandg.net Network Appliance
495 East Java Drive
Sunnyvale, CA 94089
EMail: jay.perry@netapp.com
Shai Herzog Shai Herzog
IPHighway PolicyConsulting.com
55 New York Avenue 200 Clove Rd.
Framingham, MA 01701 New Rochelle, NY 10801
E-mail: herzog@iphighway.com
EMail: herzog@PolicyConsulting.com
An-Ni Huynh An-Ni Huynh
Lucent Technologies Lucent Technologies
2139 Route 35 2139 Route 35
Holmdel, NJ 07733 Holmdel, NJ 07733
E-mail: ahuynh@lucent.com
Mark Carlson Mark Carlson
Sun Microsystems Sun Microsystems, Inc.
3030 S. Technology Ct. Bldg B. 500 Eldorado Boulevard
Broomfield, CO 80021 Broomfield, CO 80021
Email: mark.carlson@sun.com
Steve Waldbusser EMail: mark.carlson@sun.com
Email: waldbusser@nextbeacon.com
9. Full Copyright Statement
Copyright (C) The Internet Society (2000). All Rights Reserved. Steve Waldbusser
This document and translations of it may be copied and furnished Phone: +1-650-948-6500
to others, and derivative works that comment on or otherwise Fax: +1-650-745-0671
explain it or assist in its implementation may be prepared, EMail: waldbusser@nextbeacon.com
copied, published and distributed, in whole or in part, without
restriction of any kind, provided that the above copyright
notice and this paragraph are included on all such copies and
derivative works. However, this document itself may not be
modified in any way, such as by removing the copyright notice or
references to the Internet Society or other Internet
organizations, except as needed for the purpose of developing
Internet standards in which case the procedures for copyrights
defined in the Internet Standards process must be followed, or
as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not 9. Full Copyright Statement
be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided Copyright (C) The Internet Society (2001). All Rights Reserved.
on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR This document and translations of it may be copied and furnished to
IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE others, and derivative works that comment on or otherwise explain it
OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY or assist in its implementation may be prepared, copied, published
IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A and distributed, in whole or in part, without restriction of any
PARTICULAR PURPOSE. kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
 End of changes. 177 change blocks. 
778 lines changed or deleted 745 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/