draft-ietf-ppvpn-requirements-06.txt

[hardie@qualcomm.com]

Forgive the newbie Meta question but, what is the RFC that this 
becomes going to be used for?
This is striking me in particular because, as Chair of CRISP, I just sent
up a requirements document that contains service requirements.  Those
are present in the CRISP requirements in order to give context for
protocol requirements; the protocol requirements will be used to
select a protocol (or, at worst, build one).  In this case, these requirements
seem to have been written with the explicit caveat that they do not
imply building of a new protocol or protocol mechanisms.  See:

    The specification of any technical means to provide PPVPN services
   is outside the scope of this document. Other documents, such as the
   framework document [PPVPN-FR] and several sets of documents, one set
   per each individual technical approach providing PPVPN services, are
   intended to cover this aspect.


A lot of the text seems to have implications that don't really help
provide context for protocol development (see Section 5.6 and 5.7).
If we're okay with this as a context setting exercise, that's fine.  If
that's not the point,  more back story would help.

Notes:

There are several sets of "Editor's Notes" that need to be removed or
resolved.

The definition of "site" didn't make sense.  Recasting it in
terms of topology would help (even if this is the overlay topology
of the VPN).  This is especially important because the definition of
VPN implies that a site must be a member of a VPN (and may be
a member of many).  This is not a typical presumption in my
experience.  If the topology language won't work, a strong marker
that the text's use of "site" is not the typical use would help.

Section 4.4 seems too vague to be useful, even as a service
description "A range of security feature should be supported..."
doesn't say anything.  Section 4.4.2 has a related problem, because
it doesn't specify a timescale.  As written, a call to the NOC to
ask for a drop-shipped firewall qualifies.  Explicitly indicating
that type of timescale is or is not okay would help.