On Thu, Nov 02, 2017 at 06:13:04AM +0630, Mahesh Jethanandani wrote: > > Take the case where the desired selection is l2,-l3, ipv4 and ipv6. The > current tree looks like this: >
[...] > whereas, if the design went with one match container with each group of leafs > in their own container (to support the if-feature statement for that > container), the tree would look like this: [...] > The difference though is small and comes down to a preference. Select one > feature statement and get one container with everything in it, or define > multiple feature statements and assemble together the pieces to define the > ACE entry. Well, you leave out all the duplication you have and you leave out that the client needs to calculate where to configure an acl based on the feature set of a server. Copying the acl from one system to another requires to adjust containers for not good reason. The number of feature combinations will grow soon out of control and things get worse if vendors follow the direction and define vendor specific feature combinations and associated containers. > > BTW, how do I filter on TCP flags in combination with > > a source IP address? There seem to be reasonable combinations of > > features not even covered. > > If the platform has declared support for feature that includes ipv4 (and/or > ipv6) and tcp-acl, for a given ACE entry, it should be able to define a match > filter that includes both the source IP address and the TCP flags. Do you see > something that prevents it? So if tcp-acl can be combined with other acls, why do I need in other places of the data model combinations like l2-l3-ipv4-ipv6-acl? Why do I not have tcp-acl, eth-acl, ipv4-acl, and ipv6-acl? (Note that l2-acl is somewhat a misnomer - hence I used eth-acl instead.) /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1 | 28759 Bremen | Germany Fax: +49 421 200 3103 <http://www.jacobs-university.de/> _______________________________________________ netmod mailing list [email protected] https://www.ietf.org/mailman/listinfo/netmod
