Re: Distributing site-wide RFC 3484 policy

[Perry Lorier <perry@coders.net>]

> This is a standard issue in any policy distribution mechanism -
> if there are two sources for policy (e.g. local and central),
> which one wins? That needs to be defined in the mechanism.
> Sometimes, the site-wide policy will win, because the IT Management
> has authority.
Non-local policy belongs to an Interface.  The "Home network interface" 
policy discusses what you can do via that interface, the "Corporate VPN" 
policy describes what you can use the Corporate VPN for.

Local policy is how you merge these policies.  eg say I have three 
interfaces on my laptop at the moment:

* Wireless to my home network.
The policy for this says "prefer me preferentially for the local network 
stuffs" "I provide a native v6 internet connection (ie, globally scoped 
addresses can be sent this way", etc

* VPN to my corporate workplace
The policy for this says "You can connect to local corporate services 
preferentially" "Provide non-preferential access to some services such 
as an Internet connection"

* IP over the cellular network (GPRS, CDMA, EVDO whatever)
This policy for this says "I can provide an internet connection"

Local policy says "treat wireless + vpn as equal, then below that prefer 
cellular connection".  Thus the policies all get merged together to end 
up with:

If it's for the local home network use the wireless      High Priority
If it's for the company addresses, use the VPN            High Priority

If it's for a normal (globally scoped) address, use the wireless      
Medium Priority

If it's for a globally scoped address, use the VPN         Low Priority
If it's for a globally scoped address, use the expensive, slow 
cellphone   Low Priority

Thus a networks responsibility is to present what features it has and 
how that network wants to be used (what source addresses it recommends 
for what, what connections it's willing to provide). Local policy is how 
to choose between different networks on it's various interfaces.  Local 
policy could in theory override one given to it by the network, but of 
course if it tries to do something the network doesn't provide 
reachability towards it won't work.