doc: Add RFC documents

1 files changed, 1347 insertions, 0 deletions

diff --git a/doc/rfc/rfc3747.txt b/doc/rfc/rfc3747.txt
new file mode 100644
index 0000000..555c2c5
--- /dev/null
+++ b/doc/rfc/rfc3747.txt
@@ -0,0 +1,1347 @@
+
+
+
+
+
+
+Network Working Group                                 H. Hazewinkel, Ed.
+Request for Comments: 3747                                         I.Net
+Category: Standards Track                                D. Partain, Ed.
+                                                                Ericsson
+                                                              April 2004
+
+
+             The Differentiated Services Configuration MIB
+
+Status of this Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (2004).  All Rights Reserved.
+
+Abstract
+
+   This memo describes a MIB module that provides a conceptual layer
+   between high-level "network-wide" policy definitions that effect
+   configuration of the Differentiated Services (diffserv) subsystem and
+   the instance-specific information that would include such details as
+   the parameters for all the queues associated with each interface in a
+   system.  This essentially provides an interface for configuring
+   differentiated services at a conceptually higher layer than that of
+   the Differentiated Services MIB.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 1]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+Table of Contents
+
+   1.  The Internet-Standard Management Framework . . . . . . . . . .  2
+   2.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
+   3.  Other Documents. . . . . . . . . . . . . . . . . . . . . . . .  3
+   4.  Relationship to other MIBs . . . . . . . . . . . . . . . . . .  3
+       4.1.  The Policy-based Management MIB Module . . . . . . . . .  3
+       4.2.  The Differentiated Services MIB Module . . . . . . . . .  4
+   5.  The Differentiated Services Configuration MIB Module Design. .  5
+   6.  Template Cloning . . . . . . . . . . . . . . . . . . . . . . .  6
+       6.1.  An Approach to Template Cloning. . . . . . . . . . . . .  6
+       6.2.  Example. . . . . . . . . . . . . . . . . . . . . . . . .  7
+             6.2.1.  The Initial Situation. . . . . . . . . . . . . .  8
+             6.2.2.  The Configuration Template . . . . . . . . . . .  9
+             6.2.3.  Applying the Template. . . . . . . . . . . . . . 11
+             6.2.4.  Applying the Template Using SNMP Messages. . . . 14
+   7.  Managed Objects Definitions (MIB Module) . . . . . . . . . . . 15
+   8.  Security Considerations. . . . . . . . . . . . . . . . . . . . 20
+   9.  Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . 22
+   10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 22
+       10.1. Normative References . . . . . . . . . . . . . . . . . . 22
+       10.2. Informative References . . . . . . . . . . . . . . . . . 23
+   11. Editors' Addresses . . . . . . . . . . . . . . . . . . . . . . 23
+   12. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 24
+
+1.  The Internet-Standard Management Framework
+
+   For a detailed overview of the documents that describe the current
+   Internet-Standard Management Framework, please refer to section 7 of
+   RFC 3410 [RFC3410].
+
+   Managed objects are accessed via a virtual information store, termed
+   the Management Information Base or MIB.  MIB objects are generally
+   accessed through the Simple Network Management Protocol (SNMP).
+   Objects in the MIB are defined using the mechanisms defined in the
+   Structure of Management Information (SMI).  This memo specifies a MIB
+   module that is compliant to the SMIv2, which is described in STD 58,
+   RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
+   [RFC2580].
+
+2.  Introduction
+
+   This memo defines a MIB module that can be used to convey management
+   information about desired network-wide Differentiated Services based
+   policy behavior.  This module is designed to integrate with the
+   Differentiated Services MIB module [RFC3289] in order to provide
+   template configurations for the Differentiated Services MIB module.
+   The MIB module defined in this memo (the DIFFSERV-CONFIG-MIB) may be
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 2]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   used in combination with the Policy-based Management MIB module
+   [PMMIBDR], but that is not a requirement.  Without the Policy-based
+   Management MIB module, a management application must emulate behavior
+   provided by the Policy-based Management MIB using equivalent "low-
+   level" SNMP operations in normal manager/agent communication.
+
+   Together, this memo, [RFC3289], and [PMMIBDR] represent an instance
+   of an integrated architecture for both device-specific and network-
+   wide policy (configuration) management, which is fully integrated
+   with the Internet Standard Management Framework.
+
+   The Differentiated Services MIB module [RFC3289] operates on a device
+   level.  The MIB module in this memo, the DIFFSERV-CONFIG-MIB, creates
+   a coherent configuration management view as an umbrella over
+   [RFC3289].  That is, the DIFFSERV-CONFIG-MIB provides a conceptual
+   Application Program Interface (API) for configuration of the
+   Differentiated Services parameters.  Since the Differentiated
+   Services MIB module is able to maintain configuration information,
+   the DIFFSERV-CONFIG-MIB configuration API consists only of
+   configuration template information and the start of the so-called
+   functional datapath.
+
+3.  Other Documents
+
+   It is assumed that the reader is familiar with Differentiated
+   Services ([RFC2474] and [RFC2475]), the Policy-based Management MIB
+   ([PMMIBDR]), and "Configuring Networks and Devices With SNMP"
+   ([RFC3512]).  These documents include all of the necessary
+   terminology for understanding this memo.  However, note that use of
+   the MIB module in this memo does not require the use of [PMMIBDR].
+   [RFC3512] also provides an example MIB module which may help in
+   understanding the relationship between DIFFSERV-CONFIG-MIB and the
+   Differentiated Services MIB in [RFC3289].
+
+4.  Relationship to other MIBs
+
+   In this section, we describe the relationship of this MIB module to
+   other MIB modules.  The overall architecture used for policy
+   configuration management is described in [PMMIBDR].
+
+4.1.  The Policy-based Management MIB Module
+
+   [PMMIBDR] defines a MIB module that enables policy-based
+   configuration management of infrastructure using the Internet
+   Standard Management Framework.  The document includes a table for
+   configuring policies to be implemented, tables for storing the roles
+   of elements on a particular device, a table for representing the
+   capabilities of a device with respect to policy management, a table
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 3]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   for referencing elements affected by a policy, as well as other
+   infrastructure.  There is no requirement that [PMMIBDR] be used in
+   conjunction with the MIB module defined in this memo.
+
+   See [PMMIBDR] for a full description of the policy-based
+   configuration framework it provides.
+
+4.2.  The Differentiated Services MIB Module
+
+   The Differentiated Services MIB module [RFC3289] provides a common
+   set of managed objects useful for configuring Differentiated Services
+   parameters on a Differentiated Services capable device.  This is what
+   is referred to as instance-level configuration.  It is the alteration
+   of the instance-level information in that MIB module which may be
+   done using the objects in the MIB module defined in this memo.
+
+   It is recognized that vendors may include additional managed objects
+   in their devices (via vendor-specific MIB modules) for configuring
+   Differentiated Services parameters.  If a vendor chooses to use the
+   objects defined in this memo for configuration, the vendor should
+   provide additional managed objects in a similar approach as defined
+   for the Differentiated Services MIB module.
+
+   Since the managed objects of the Differentiated Services MIB
+   [RFC3289] are not directly associated with an instance (interface and
+   interface direction), the same managed objects can be used for
+   traffic treatment configuration templates in a Differentiated
+   Services capable device and can then be applied on multiple
+   instances.  Therefore, the tables as defined in the Differentiated
+   Services MIB can be used directly for template configuration
+   purposes.  Those tables are:
+
+      - diffServClfrTable
+      - diffServClfrElementTable
+      - diffServMultiFieldClfrTable
+      - diffServMeterTable
+      - diffServTBParamTable
+      - diffServActionTable
+      - diffServDscpMarkActTable
+      - diffServCountActTable
+      - diffServAlgDropTable
+      - diffServRandomDropTable
+      - diffServQTable
+      - diffServSchedulerTable
+      - diffServMinRateTable
+      - diffServMaxRateTable
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 4]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   Readers familiar with the Differentiated Services MIB will notice
+   that these are all templates.  Only the diffServDataPathTable defines
+   a managed instance for Differentiated Services traffic treatment by
+   its indexes of the interface and its direction.  This also allows the
+   tables mentioned above to be used as a configuration template without
+   defining anything directly related to a managed instance.
+
+5.  The Differentiated Services Configuration MIB Module Design
+
+   The Differentiated Services Configuration MIB module (in this memo)
+   of the SNMP-based configuration management framework is positioned
+   between the Policy-based Management MIB module and the instance-
+   specific Differentiated Services MIB module as described above.
+
+   The MIB module found in this memo is designed to maintain
+   configuration templates for the Differentiated Services MIB [RFC3289]
+   module.  The module only has a template table that describes a
+   Differentiated Services traffic treatment by providing the starting
+   pointer of the functional datapath.  The templates represent a
+   specific configuration of traffic treatment in a functional datapath
+   of a Differentiated Services capable device.  To avoid duplication of
+   managed objects, the actual templates defining the functional
+   datapath are defined in the Differentiated Services MIB module.
+   These are also used for the management of the instances.  Therefore,
+   the implementation of the DIFFSERV-CONFIG-MIB module uses the tables
+   defined in the Differentiated Services MIB.  As soon as a
+   configuration is made active via the POLICY-MANAGEMENT-MIB or using
+   normal SNMP operations, the configuration defined within this MIB
+   module will be instantiated in the DIFFSERV-MIB.
+
+   Note that this is a conceptual process.  That is, the configuration
+   may not actually go through an API available in the subsystem which
+   implements the DIFFSERV-MIB module.  However, configuration via the
+   DIFFSERV-CONFIG-MIB module will alter the same instrumentation as the
+   DIFFSERV-MIB module whether it does it via the DIFFSERV-MIB module or
+   not.
+
+   The Differentiated Services Configuration MIB module only needs to
+   define a starting point of a traffic treatment configuration
+   template.  This table is similar to the diffServDataPathTable
+   [RFC3289].  However, it has a semantic difference in that the
+   diffServDataPathTable is associated with an instance (interface and
+   interface direction), whereas the diffServConfigTable in this memo is
+   not.
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 5]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   Unlike most MIB modules, changes to the managed objects in this MIB
+   module do not cause a change in the external/traffic behavior of the
+   device.  This MIB module is used to set up per-hop-behavior
+   configurations.  As soon as configurations are made active via the
+   POLICY-MANAGEMENT-MIB or SNMP operations, the configurations defined
+   within this MIB module will be instantiated in the DIFFSERV-MIB.
+
+   The only table in this MIB module is the diffServConfigTable, which
+   provides managed objects for registering traffic treatment
+   configurations used in differentiated services.  The sole purpose of
+   this table is to provide the starting point for a traffic treatment
+   configuration template.  The traffic treatment itself is performed by
+   functional datapath elements [RFC3289].
+
+6.  Template Cloning
+
+   The concept of the DIFFSERV-CONFIG-MIB is based on having traffic
+   treatment configuration templates.  The templates provide a set of
+   configuration values that provide a particular behavior, such as
+   Expedited Forwarding traffic treatment, in the functional datapath.
+   The template (or functional datapath) is similar to a linked list
+   from a starting point and each (functional datapath) element is
+   connected to the next element via the so-called next RowPointer.
+
+   The moment a template is activated (instantiated) on an interface and
+   its interface direction, the template needs to be copied/cloned, so
+   that the template remains as a template.  Note that the template is
+   logically "locked" through the cloning process.  That is, the
+   template cannot be changed part way through the cloning process.
+   With the exception of the indices, the cloned template will be
+   identical to the source template.
+
+   A literal copy/clone of the template is not possible, since the same
+   indices inside the element tables cannot be re-used.  The
+   instantiation process must therefore generate a new index for each
+   element.  As a result of this, the 'NEXT' pointers also need to be
+   updated.  Otherwise, those will point to the template.
+
+6.1.  An Approach to Template Cloning
+
+   What should a system containing Differentiated Services capabilities
+   and Differentiated Services configuration capabilities do
+   conceptually at the moment a template is activated on an interface?
+   The following approach should not be considered implementation
+   guidelines, but rather a conceptual explanation of what should be
+   done.
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 6]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+      1) Get the index of the template to be activated
+      2) Get RowPointer (current) from
+            diffServConfigStart.index
+            of the diffServConfigTable
+      3) Check if RowPointer (current) exists
+      4) Logically "lock" the entry (current) pointed to by
+         RowPointer so that its values are not changed part way
+         through the cloning process.
+      5) Copy/Clone the entry (current) pointed to by RowPointer
+            a) Get a new index for the entry
+            b) Configure the new entry with the values
+               of the entry to be cloned
+            c) Update the NEXT pointer with a new RowPointer
+               that pointed to the previous entry that was copied
+               part of this template
+      6) Store RowPointer of cloned entry as (previous) in order to
+         update the NEXT pointer with the next cloned entry.
+      7) Get the RowPointer of the next element in the template
+         as (current)
+      8) If (current) RowPointer does not equal zeroDotZero go to 4
+      9) Logically "unlock" all the locked entries done by step 4).
+
+   If a configuration/template is activated via a means other than a
+   direct SNMP SET request, such as via the Policy-based Management MIB,
+   the handling of the activation and potential error response code must
+   be provided via that mechanism.  If a configuration/template is
+   activated using SNMP SET requests, an accurate error response value
+   must be returned.  For example, if a configuration/template has
+   inconsistent values, the SNMP SET should return an error.  Whether
+   the configuration is already finished is not of direct importance,
+   since the SNMP SET response must be accurate.  On systems where the
+   activation may take a long time, a response may be given prior to
+   completion, but extra mechanisms must be provided to detect any
+   errors.
+
+6.2.  Example
+
+   This section provides an example of the process described in the
+   previous section.  This example will show a Differentiated Services
+   capable incoming (ingress) interface that only counts the traffic
+   stream.  Then, with the policy-based configuration concept as defined
+   in this document and in [PMMIBDR], a traffic marking configuration
+   will be applied.  The example will walk the reader through all of the
+   steps involved in this process.  Again, the use of [PMMIBDR] is
+   simply an example and is not required.
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 7]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+      NOTE WELL:  For brevity and clarity, the example does not always
+      show the complete entry (row) of a table.  The only objects shown
+      are those needed for creating the row pointers to the next
+      functional datapath element or needed to provide information about
+      the specific parameters of the functional datapath elements.  The
+      column named 'INDEX' always defines the complete index as defined
+      for the associated entry.  In some cases, this is a combined index
+      of multiple components.  Therefore, the names of the columns are
+      omitted.
+
+      Also note that the values Assured Forwarding and Expedited
+      Forwarding are abstracted as DSCP(AF) and DSCP(EF) (respectively)
+      or simply as AF and EF.  For the actual values refer to [RFC3289].
+
+6.2.1.  The Initial Situation
+
+   The initial configuration is the existing configuration of an ingress
+   interface.
+
+      +------------------------------------------------------------+
+      |   ingress functional datapath                              |
+      |                        +----------+                        |
+   -->|----------->----------->| count    |----------->----------->|-->
+      |                        +----------+                        |
+      +------------------------------------------------------------+
+
+   This figure depicts a simple traffic treatment functional datapath
+   for an ingress interface.  The functional datapath only consists of a
+   count action.
+
+   Within the DIFFSERV-MIB, this would be instantiated as follows.  Note
+   that RowPointer objects must point to the first accessible columnar
+   object in the conceptual row.  Thus, while perhaps more instructive
+   to use the index value for the RowPointer object's value (e.g.,
+   diffServCountActId.1) in the example, it would nonetheless be
+   incorrect, and the first accessible columnar object has been used as
+   should be done (e.g., diffServCountActOctets.1).
+
+   diffServDataPathTable
+   +-----------------+-----------------------------+--
+   | INDEX           | diffServDataPathStart       |
+   +-----------------+-----------------------------+--
+   | ifIndex.ingress | diffServActionNext.1        |
+   +-----------------+-----------------------------+--
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 8]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   diffServActionTable
+   +-------+--------------------+-------------------------+--
+   | INDEX | diffServActionNext |diffServActionSpecific   |
+   +-------+--------------------+-------------------------+--
+   | 1     | 0.0                |diffServCountActOctets.1 |
+   +-------+--------------------+-------------------------+--
+
+   diffServCountActTable
+   +-------+------------------------+--
+   | INDEX | diffServCountActOctets |
+   +-------+------------------------+--
+   | 1     |                        |
+   +-------+------------------------+--
+
+6.2.2.  The Configuration Template
+
+   The following provides an example of a policy configuration in which
+   traffic is classified by a specific IP filter, that results in two
+   classifiers (one for the IP filter and one for match all).  Both
+   streams are then metered, marked, and counted.  This is an example of
+   usage on the edge (an ingress interface) of a Differentiated Services
+   domain that wants to have Expedited Forwarding and Assured Forwarding
+   marked traffic within the Differentiated Services domain.
+
+   +------------------------------------------------------------+
+   |   ingress functional datapath                              |
+   |   +------------+   +-------+   +---------+   +---------+   |
+   |   |            |   |       |   | action: |   | action: |   |
+-->|-->| classifier |-->| meter |-->| mark EF |-->| count   |-->|----->
+   |   | match <IP> |   |       |   |         |   |         |   |
+   |   +------------+   +-------+   +---------+   +---------+   |
+   |         |                 \                                |
+   |         |                  \      +---------+              |
+   |         |                   \     | action: |              |routing
+   |         |                    * -->| dropper |              |core
+   |         |                   /     |         |              |
+   |         |                  /      +---------+              |
+   |         V                 /                                |
+   |   +------------+   +-------+   +---------+   +---------+   |
+   |   |            |   |       |   | action: |   | action: |   |
+   |   | classifier |-->| meter |-->| mark AF |-->| count   |-->|----->
+   |   | match all  |   |       |   |         |   |         |   |
+   |   +------------+   +-------+   +---------+   +---------+   |
+   +------------------------------------------------------------+
+
+   This figure depicts a policy configuration for ingress traffic
+   treatment in a Differentiated Services capable device.  The
+
+
+
+
+Hazewinkel & Partain        Standards Track                     [Page 9]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   configuration is represented as follows in the DIFFSERV-CONFIG-MIB
+   module and the DIFFSERV-MIB module.
+
+   Note that the original (existing) traffic treatment described in
+   6.2.1 is also in the tables.
+
+   Note also that in the diffServDscpMarkActTable, DSCP(EF) represents
+   the DSCP value for Expedited Forwarding and DSCP(AF) represents the
+   DSCP value for Assured Forwarding.
+
+ diffServConfigTable (in the MIB module in this memo)
+ +-------+-------------------------+---------------------------+--
+ | INDEX | diffServConfigStart     | diffServConfigDescr       |
+ +-------+-------------------------+---------------------------+--
+ | "foo" | diffServClfrStorage.1   | Example traffic treatment |
+ +-------+-------------------------+---------------------------+--
+
+ diffServClfrTable
+ +-------+---------------------+--------------------+
+ | INDEX | diffServClfrStorage | diffServClfrStatus |
+ +-------+---------------------+--------------------+
+ | 1     |                     |                    |
+ +-------+---------------------+--------------------+
+
+ diffServClfrElementTable (shares index with diffServClfrTable)
+ +-------+---------------------------+-------------------------------+--
+ | INDEX | diffServClfrElementNext   | diffServClfrElementPrecedence |
+ +-------+---------------------------+-------------------------------+--
+ | 1.1   |diffServMeterSucceedNext.1 | 1                             |
+ | 1.2   |diffServMeterSucceedNext.2 | 2                             |
+ +-------+---------------------------+-------------------------------+--
+
+ diffServMeterTable
+ +-------+--------------------------+-----------------------+--
+ | INDEX | diffServMeterSucceedNext |diffServMeterFailNext  |
+ +-------+--------------------------+-----------------------+--
+ | 1     | diffServActionNext.2     | diffServAlgDropType.1 |
+ | 2     | diffServActionNext.3     | diffServAlgDropType.1 |
+ +-------+--------------------------+-----------------------+--
+
+
+
+
+
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 10]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+ diffServActionTable
+ +-------+----------------------+----------------------------+--
+ | INDEX | diffServActionNext   | diffServActionSpecific     |
+ +-------+----------------------+----------------------------+--
+ | 1     | 0.0                  | diffServCountActOctets.1   |
+ | 2     | diffServActionNext.4 | diffServDscpMarkActDscp.EF |
+ | 3     | diffServActionNext.5 | diffServDscpMarkActDscp.AF |
+ | 4     | 0.0                  | diffServCountActOctets.2   |
+ | 5     | 0.0                  | diffServCountActOctets.3   |
+ +-------+----------------------+----------------------------+--
+
+ diffServCountActTable
+ +-------+------------------------+--
+ | INDEX | diffServCountActOctets |
+ +-------+------------------------+--
+ | 1     |                        |
+ | 2     |                        |
+ | 3     |                        |
+ +-------+------------------------+--
+
+ diffServAlgDropTable
+ +-------+---------------------+-------------------------+--
+ | INDEX | diffServAlgDropType | diffServAlgDropSpecific |
+ +-------+---------------------+-------------------------+--
+ | 1     | alwaysDrop(5)       | 0.0                     |
+ +-------+---------------------+-------------------------+--
+
+ diffServDscpMarkActTable
+ +-------------------------+
+ | diffServDscpMarkActDscp |
+ +-------------------------+
+ | DSCP(EF)                |
+ | DSCP(AF)                |
+ +-------------------------+
+
+6.2.3.  Applying the Template
+
+   Now we have the original ingress interface configuration and the
+   policy configuration we want to apply to the actual interface.
+
+   The example policy must provide the required Differentiated Services
+   traffic treatment to all interfaces used by system administrators.
+   The traffic treatment required is described in 6.2.2 above.
+
+   Therefore, we have the following example policy which is configured
+   via the POLICY-BASED-MANAGEMENT-MIB module (see [PMMIBDR]):
+
+   if ( roleMatch("Administrator") )
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 11]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   then
+      /*
+       * The $0 gets the "element" returned from the previous
+       * statement.  the .1 at the end is the ingress interface
+       * This sets, for example, diffServDataPathStart.3.1 to be
+       * "diffServConfigStart.3.f.o.o" if interface 3 has the role
+       * "Administrator".
+       */
+      setVar("diffServDataPathStart.$0.1",
+              "diffServConfigStart.3.f.o.o", Oid)
+
+   For our purposes, we only apply this on the inbound (ingress)
+   direction of the interface.
+
+   Note that although object descriptors are used in this PolicyScript
+   example, the object identifiers must be used in the running script.
+   For more information on policies and their syntax refer to [PMMIBDR].
+
+   The following tables in this section provide the cloned entries in
+   the tables of the DIFFSERV-MIB module.  All tables may have columns
+   that contain contents or administrative objects that are not shown.
+   These columns do not determine a function in the datapath and they
+   are not shown for clarity of the cloning mechanism.
+
+   Note that the original (existing) traffic treatment of 6.2.1 and
+   6.2.2 are also in the tables.
+
+diffServConfigTable
++-------+-------------------------+---------------------------+--
+| INDEX | diffServConfigStart     | diffServConfigDescr       |
++-------+-------------------------+---------------------------+--
+| "foo" | diffServClfrStorage.1   | Example traffic treatment |
++-------+-------------------------+---------------------------+--
+
+diffServDataPathTable
++-----------------+-----------------------------+--
+| INDEX           | diffServDataPathStart       |
++-----------------+-----------------------------+--
+| ifIndex.ingress | diffServActionNext.2        |
++-----------------+-----------------------------+--
+
+
+
+
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 12]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+diffServClfrTable
++-------+---------------------+--------------------+
+| INDEX | diffServClfrStorage | diffServClfrStatus |
++-------+---------------------+--------------------+
+| 1     |                     |                    |
+| 2     |                     |                    |
++-------+---------------------+--------------------+
+
+diffServClfrElementTable
++-------+----------------------------+-------------------------------+--
+| INDEX | diffServClfrElementNext    | diffServClfrElementPrecedence |
++-------+----------------------------+-------------------------------+--
+| 1.1   | diffServMeterSucceedNext.1 | 1                             |
+| 1.2   | diffServMeterSucceedNext.2 | 2                             |
+| 2.3   | diffServMeterSucceedNext.3 | 1                             |
+| 2.4   | diffServMeterSucceedNext.4 | 2                             |
++-------+----------------------------+-------------------------------+--
+
+diffServMeterTable
++-------+--------------------------+-----------------------+--
+| INDEX | diffServMeterSucceedNext | diffServMeterFailNext |
++-------+--------------------------+-----------------------+--
+| 1     | diffServActionNext.2     | diffServAlgDropType.1 |
+| 2     | diffServActionNext.3     | diffServAlgDropType.1 |
+| 3     | diffServActionNext.6     | diffServAlgDropType.2 |
+| 4     | diffServActionNext.7     | diffServAlgDropType.2 |
++-------+--------------------------+-----------------------+--
+
+diffServActionTable
++-------+----------------------+----------------------------+--
+| INDEX | diffServActionNext   | diffServActionSpecific     |
++-------+----------------------+----------------------------+--
+| 1     | 0.0                  | diffServCountActOctets.1   |
+| 2     | diffServActionNext.4 | diffServDscpMarkActDscp.EF |
+| 3     | diffServActionNext.5 | diffServDscpMarkActDscp.AF |
+| 4     | 0.0                  | diffServCountActOctets.2   |
+| 5     | 0.0                  | diffServCountActOctets.3   |
+| 6     | diffServActionNext.8 | diffServDscpMarkActDscp.EF |
+| 7     | diffServActionNext.9 | diffServDscpMarkActDscp.AF |
+| 8     | 0.0                  | diffServCountActOctets.4   |
+| 9     | 0.0                  | diffServCountActOctets.5   |
++-------+----------------------+----------------------------+--
+
+
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 13]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+diffServCountActTable
++-------+------------------------+--
+| INDEX | diffServActCountOctets |
++-------+------------------------+--
+| 1     |                        |
+| 2     |                        |
+| 3     |                        |
+| 4     |                        |
+| 5     |                        |
++-------+------------------------+--
+
+diffServAlgDropTable
++-------+---------------------+-------------------------+--
+| INDEX | diffServAlgDropType | diffServAlgDropSpecific |
++-------+---------------------+-------------------------+--
+| 1     | alwaysDrop(5)       | 0.0                     |
++-------+---------------------+-------------------------+--
+
+diffServDscpMarkActTable
++-------------------------+
+| diffServDscpMarkActDscp |
++-------------------------+
+| DSCP(EF)                |
+| DSCP(AF)                |
++-------------------------+
+
+   As one can see in the example, the main elements from which a
+   functional datapath is constructed are duplicated/copied/cloned.
+   That process is needed in order to preserve the policy configuration
+   for reuse at a later time.
+
+   It is up to the SNMP agent to keep track of which network interfaces
+   are under policy control and which policy rules are being used.  This
+   avoids duplication of policy enforcement.  How the agent does this is
+   an implementation issue.
+
+   One can see that the old functional datapath configurations stay in
+   the MIB module tables.  It is up to the SNMP agent implementation to
+   decide whether to delete stale entries or keep them.  Garbage
+   collection of stale entries is an implementation issue.
+
+6.2.4.  Applying the Template Using SNMP Messages
+
+   In this section, the above example is explained by using SNMP
+   communication between the SNMP "manager" and the SNMP "agent".
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 14]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   In order to apply the template to all interfaces that have a role
+   match of "Administrator," the SNMP manager must have a list of the
+   roles of the interface.  This means the SNMP manager must do an
+   SNMP-SET for all those interfaces.  This is expressed in the
+   following pseudo code function.
+
+   set_template_if_administrator_interface(
+            <interface_list>, <template_name>
+   ) {
+      template_oid = SNMP-GET("diffServConfigStart.<template_name>");
+      foreach interface (<ifRole_list>) {
+         if (interface.role == "Administrator") {
+            SNMP-SET("diffServDataPathStart.$interface.1",
+                  Oid, template_oid);
+         }
+      }
+   }
+
+   For example, on a system with 3 interfaces, the following list would
+   be known to the manager.  The first value indicates the interface
+   number (ifIndex) and the second value is its role.
+
+   interface_list IF_LIST = {
+       { 1, ... , "Administrator", ... },
+       { 2, ... , "User", ... },
+       { 3, ... , "Administrator", ... } }
+
+   This will result in the communication between a manager and agent of
+   1 SNMP-GET and 2 SNMP-SETs:
+
+   -  SNMP-GET("diffServConfigStart.3.f.o.o")
+   -  SNMP-SET("diffServDataPathStart.1.1", Oid, "diffServActionNext.1")
+   -  SNMP-SET("diffServDataPathStart.3.1", Oid, "diffServActionNext.1")
+
+7.  Managed Objects Definitions (MIB Module)
+
+DIFFSERV-CONFIG-MIB DEFINITIONS ::= BEGIN
+    IMPORTS
+
+    OBJECT-TYPE, MODULE-IDENTITY,
+    zeroDotZero, mib-2            FROM SNMPv2-SMI          -- [RFC2578]
+
+    RowStatus, StorageType,
+    RowPointer, DateAndTime       FROM SNMPv2-TC           -- [RFC2579]
+
+    MODULE-COMPLIANCE,
+    OBJECT-GROUP                  FROM SNMPv2-CONF         -- [RFC2580]
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 15]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+    SnmpAdminString               FROM SNMP-FRAMEWORK-MIB; -- [RFC3411]
+
+diffServConfigMib MODULE-IDENTITY
+    LAST-UPDATED "200401220000Z" -- 22 January 2004
+    ORGANIZATION "SNMPCONF WG"
+    CONTACT-INFO
+       "SNMPCONF Working Group
+        http://www.ietf.org/html.charters/snmpconf-charter.html
+        WG mailing list: snmpconf@snmp.com
+
+        Editors:
+        Harrie Hazewinkel
+        I.Net
+        via Darwin 85
+        20019 - Settimo Milanese (MI)
+        Italy
+        EMail: harrie@inet.it
+
+        David Partain
+        Ericsson AB
+        P.O. Box 1248
+        SE-581 12 Linkoping
+        Sweden
+        E-mail: David.Partain@ericsson.com"
+    DESCRIPTION
+        "This MIB module contains differentiated services
+        specific managed objects to perform higher-level
+        configuration management.  This MIB allows policies
+        to use 'templates' to instantiate Differentiated
+        Services functional datapath configurations to
+        be assigned (associated with an interface and
+        direction) when a policy is activated.
+
+        Copyright (C) The Internet Society (2004).  This version
+        of this MIB module is part of RFC 3747;  see the RFC
+        itself for full legal notices."
+    REVISION "200401220000Z" -- 22 January 2004
+    DESCRIPTION
+        "Initial version published as RFC 3747"
+    ::= { mib-2 108 }
+
+diffServConfigMIBObjects OBJECT IDENTIFIER ::= { diffServConfigMib 1 }
+diffServConfigMIBConformance OBJECT IDENTIFIER ::=
+                                               { diffServConfigMib 2 }
+
+--
+-- The Differentiated Services configuration objects
+--
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 16]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+diffServConfigTable OBJECT-TYPE
+    SYNTAX       SEQUENCE OF DiffServConfigEntry
+    MAX-ACCESS   not-accessible
+    STATUS       current
+    DESCRIPTION
+       "A table which defines the various per-hop-behaviors
+       for which the system has default 'templates'."
+    ::= { diffServConfigMIBObjects 2 }
+
+diffServConfigEntry OBJECT-TYPE
+    SYNTAX       DiffServConfigEntry
+    MAX-ACCESS   not-accessible
+    STATUS       current
+    DESCRIPTION
+       "An entry defining a per-hop-behavior.  Each entry in
+       this table combines the various parameters (entries)
+       into a specific per-hop-behavior.  Entries in this
+       table might be defined by a vendor (pre-configured)
+       or defined by a management application."
+    INDEX { diffServConfigId }
+    ::= { diffServConfigTable 1 }
+
+DiffServConfigEntry ::= SEQUENCE {
+    diffServConfigId           SnmpAdminString,
+    diffServConfigDescr        SnmpAdminString,
+    diffServConfigOwner        SnmpAdminString,
+    diffServConfigLastChange   DateAndTime,
+    diffServConfigStart        RowPointer,
+    diffServConfigStorage      StorageType,
+    diffServConfigStatus       RowStatus
+}
+
+diffServConfigId OBJECT-TYPE
+    SYNTAX         SnmpAdminString (SIZE(1..116))
+    MAX-ACCESS     not-accessible
+    STATUS         current
+    DESCRIPTION
+      "A unique id for the per-hop-behavior policy for at
+       least the SNMP agent.  For ease of administration the
+       value may be unique within an administrative domain,
+       but this is not required.
+
+       The range of up to 116 octets is chosen to stay within
+       the SMI limit of 128 sub-identifiers in an object
+       identifier."
+    ::= { diffServConfigEntry 1 }
+
+diffServConfigDescr OBJECT-TYPE
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 17]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+    SYNTAX         SnmpAdminString
+    MAX-ACCESS     read-create
+    STATUS         current
+    DESCRIPTION
+       "A human-readable description to identify this defined
+       per-hop-behavior.  Note that this is an SnmpAdminString,
+       which permits UTF-8 strings.  An administratively assigned
+       identifier for a template that would be unique within
+       an administrative domain.  It is up to the management
+       applications to agree how these are assigned within the
+       administrative domain.  Once a description, such as
+       'EF' is assigned, that has a certain set of parameters
+       that achieve 'EF' from box to box. Management
+       application code or script code can then scan
+       the table to find the proper template and then
+       assign it."
+    ::= { diffServConfigEntry 2 }
+
+diffServConfigOwner OBJECT-TYPE
+    SYNTAX         SnmpAdminString
+    MAX-ACCESS     read-create
+    STATUS         current
+    DESCRIPTION
+       "The owner who created this entry."
+    ::= { diffServConfigEntry 3 }
+
+diffServConfigLastChange OBJECT-TYPE
+    SYNTAX         DateAndTime
+    MAX-ACCESS     read-only
+    STATUS         current
+    DESCRIPTION
+       "The date and time when this entry was last changed."
+    ::= { diffServConfigEntry 4 }
+
+diffServConfigStart OBJECT-TYPE
+    SYNTAX         RowPointer
+    MAX-ACCESS     read-create
+    STATUS         current
+    DESCRIPTION
+       "The pointer to a functional datapath configuration template as
+       set up in the DIFFSERV-MIB.  This RowPointer should
+       point to an instance of one of:
+         diffServClfrEntry
+         diffServMeterEntry
+         diffServActionEntry
+         diffServAlgDropEntry
+         diffServQEntry
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 18]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+       A value of zeroDotZero in this attribute indicates no
+       further Diffserv treatment is performed on traffic of
+       this functional datapath.  This also means that the
+       template described by this row is not defined.
+
+       If the row pointed to does not exist, the treatment
+       is as if this attribute contains a value of zeroDotZero."
+    REFERENCE
+       "Differentiated Services MIB module"
+    DEFVAL { zeroDotZero }
+    ::= { diffServConfigEntry 5 }
+
+diffServConfigStorage OBJECT-TYPE
+    SYNTAX         StorageType
+    MAX-ACCESS     read-create
+    STATUS         current
+    DESCRIPTION
+       "The type of storage used for this row.
+
+       Since an entry in this table serves as a starting
+       point for a configuration, it is recommended that
+       all entries comprising the configuration started by
+       diffServConfigStart follow the storage type of this
+       entry.  Otherwise, after agent reboots a configuration
+       may differ.  It may very well be that the agent is
+       not capable of detecting such changes and therefore,
+       the management application should verify the correct
+       configuration after a reboot.  Rows with a StorageType
+       of 'permanent' do not need to allow write access to
+       any of the columnar objects in that row."
+    DEFVAL { nonVolatile }
+    ::= { diffServConfigEntry 6 }
+
+diffServConfigStatus OBJECT-TYPE
+    SYNTAX         RowStatus
+    MAX-ACCESS     read-create
+    STATUS         current
+    DESCRIPTION
+       "RowStatus object used for creation and deletion of
+       rows in this table.  All writable objects in this row
+       may be modified at any time."
+    DEFVAL { notInService }
+    ::= { diffServConfigEntry 7 }
+
+--
+-- MIB Compliance statements.
+--
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 19]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+diffServConfigMIBCompliances
+   OBJECT IDENTIFIER ::= { diffServConfigMIBConformance 1 }
+diffServConfigMIBGroups
+   OBJECT IDENTIFIER ::= { diffServConfigMIBConformance 2 }
+
+diffServConfigMIBFullCompliance MODULE-COMPLIANCE
+    STATUS       current
+    DESCRIPTION
+       "The full compliance for this MIB module.
+
+       For this compliance level the 'diffServMIBFullCompliance'
+       must be met, since this MIB module depends on it in order
+       to provide the configuration entries.
+       "
+    MODULE  -- This module
+    MANDATORY-GROUPS {  diffServConfigMIBConfigGroup }
+
+    OBJECT diffServConfigStatus
+    SYNTAX RowStatus { active(1) }
+    WRITE-SYNTAX RowStatus { createAndGo(4), destroy(6) }
+    DESCRIPTION
+       "Support for createAndWait and notInService is not required."
+
+    ::= { diffServConfigMIBCompliances 1 }
+
+diffServConfigMIBConfigGroup OBJECT-GROUP
+    OBJECTS {  diffServConfigDescr,
+               diffServConfigOwner,
+               diffServConfigLastChange,
+               diffServConfigStart,
+               diffServConfigStorage,
+               diffServConfigStatus
+    }
+    STATUS current
+    DESCRIPTION
+       "The per-hop-behavior Group defines the MIB objects that
+       describe the configuration template for the per-hop-behavior."
+    ::= { diffServConfigMIBGroups 1 }
+END
+
+8.  Security Considerations
+
+   There are a number of management objects defined in this MIB module
+   with a MAX-ACCESS clause of read-write and/or read-create.  Such
+   objects may be considered sensitive or vulnerable in some network
+   environments.  The support for SET operations in a non-secure
+   environment without proper protection can have a negative effect on
+   network operations.  These managed objects are:
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 20]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+   -  The diffServConfigDescr, diffServConfigOwner, and
+      diffServConfigStatus are not security sensitive since these three
+      objects do not affect any direct operational behavior of a
+      diffserv capable device.
+
+   -  Unauthorized change of the diffServConfigStart could lead to a
+      different configuration, and the 'changed' configuration could
+      lead to different traffic treatment for the diffserv capable
+      device than desired.
+
+   -  Unauthorized change of the diffServConfigStorage could lead to
+      unknown behavior of the diffserv capable device after a reboot of
+      the SNMP agent.  This may be caused by 'not having saved changes
+      of the configuration' or unavailable configurations.
+
+   In addition, the managed objects of the DIFFSERV-MIB are also
+   security sensitive, since unauthorized changes may cause
+   configuration changes.  For more detail, refer to [RFC3289].
+
+   Allowing read access to objects in this MIB module is generally not
+   considered sensitive, as read access only provides information that a
+   template exists.  This is due to the fact that the managed objects
+   that actually instantiate the template are in the DIFFSERV-MIB
+   [RFC3289].  However, in environments where the template description
+   (diffServConfigDescr) or owner (diffServConfigOwner) is considered
+   sensitive information, appropriate access control should be exercised
+   for these objects.
+
+   SNMP versions prior to SNMPv3 did not include adequate security.
+   Even if the network itself is secure (for example by using IPSec),
+   there is no control as to who on the secure network is allowed to
+   access and GET/SET (read/change/create/delete) the objects in this
+   MIB module.
+
+   It is RECOMMENDED that implementers consider the security features as
+   provided by the SNMPv3 framework (see [RFC3410], section 8),
+   including full support for the SNMPv3 cryptographic mechanisms (for
+   authentication and privacy).
+
+   Further, deployment of SNMP versions prior to SNMPv3 is NOT
+   RECOMMENDED.  Instead, deployment of SNMPv3 with cryptographic
+   security enabled is RECOMMENDED.  It is then a customer/operator
+   responsibility to ensure that the SNMP entity giving access to an
+   instance of this MIB module is properly configured to give access to
+   the objects only to those principals (users) that have legitimate
+   rights to GET or SET (change/create/delete) them.
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 21]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+9.  Acknowledgments
+
+   The editors gratefully acknowledge the significant contributions to
+   this work made by several members of both the SNMPCONF and DiffServ
+   working groups.
+
+10.  References
+
+10.1.  Normative References
+
+   [RFC2578] McCloghrie, K., Perkins, D. and J. Schoenwaelder,
+             "Structure of Management Information Version 2 (SMIv2)",
+             STD 58, RFC 2578, April 1999.
+
+   [RFC2579] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual
+             Conventions for SMIv2", STD 58, RFC 2579, April 1999.
+
+   [RFC2580] McCloghrie, K., Perkins, D. and J. Schoenwaelder,
+             "Conformance Statements for SMIv2", STD 58, RFC 2580, April
+             1999.
+
+   [RFC3289] Baker, F., Chan, K. and A. Smith, "Management Information
+             Base for the Differentiated Services Architecture", RFC
+             3289, May 2002.
+
+   [RFC3411] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture
+             for Describing Simple Network Management Protocol (SNMP)
+             Management Frameworks", STD 62, RFC 3411, December 2002.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 22]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+10.2.  Informative References
+
+   [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart,
+             "Introduction and Applicability Statements for Internet-
+             Standard Management Framework", RFC 3410, December 2002.
+
+   [RFC2474] Nichols, K., Blake, S., Baker, F. and D. Black, "Definition
+             of the Differentiated Services Field (DS Field) in the IPv4
+             and IPv6 Headers", RFC 2474, December 1998.
+
+   [RFC2475] Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z. and
+             W. Weiss, "An Architecture for Differentiated Services",
+             RFC 2475, December 1998.
+
+   [RFC3512] MacFaden, M., Partain, D., Saperia, J. and W. Tackabury,
+             "Configuring Networks and Devices with Simple Network
+             Management Protocol (SNMP)", RFC 3512, April 2003.
+
+   [PMMIBDR] Waldbusser, S., Saperia, J. and T. Hongal, "Policy-based
+             Management MIB", Work in Progress.
+
+11.  Editors' Addresses
+
+   Harrie Hazewinkel
+   I.Net
+   via Darwin 85
+   20019 - Settimo Milanese (MI)
+   Italy
+
+   EMail: harrie@inet.it
+
+
+   David Partain
+   Ericsson AB
+   P.O. Box 1248
+   SE-581 12 Linkoping
+   Sweden
+
+   EMail: David.Partain@ericsson.com
+
+
+
+
+
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 23]
+
+RFC 3747       Differentiated Services Configuration MIB      April 2004
+
+
+12.  Full Copyright Statement
+
+   Copyright (C) The Internet Society (2004).  This document is subject
+   to the rights, licenses and restrictions contained in BCP 78 and
+   except as set forth therein, the authors retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
+   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
+   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
+   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at ietf-
+   ipr@ietf.org.
+
+Acknowledgement
+
+   Funding for the RFC Editor function is currently provided by the
+   Internet Society.
+
+
+
+
+
+
+
+
+
+Hazewinkel & Partain        Standards Track                    [Page 24]
+