Forwarding and Control Element Separation (ForCES) Framework
draft-ietf-forces-framework-13

IESG comments from Russ Housley:

As a matter of taste, I would like to see the usual RFC 2119 text
inside Section 1, which is all about definitions.

In section 4.2.2, the document says that a security protocol will
be used for authentication. Clearly, an authorization decision
needs to be made following successful authentication. Section 4.3
needs to discuss authorization as well.

Section 4.2.2 contains a forward reference to section 9. I suspect
that this should be a reference to section 7.

In section 4.2.5, there is no discussion of security. Given the
authentication (and needed authorization) discussion in section
4.2.2, it seems that authentication and authorization need to be
discussed in the context of the proxy.

Section 7.1.2 needs to include authorization too.

In section 7.2, the phrase "inside a box" should be expanded to
include a physically secure room.

In the 2nd paragraph of section 7.2.3 please change "Ipsec's" to "IPsec's"

Section 7.2 suggests the use of IPsec or TLS for security between
the ForCES components. It seems that there are advantages to using
a layer 2 security protocol. In particular, a protocol like SDE
(IEEE 802.10b) would limit participation to components attached
directly to the LAN segment.

Comments:

- Section 5.7
  I would strongly suggest to change
  "SNMP management agent" into "SNMP agent".

- Sect 9
  Reference [4] is pointing to SNMPv1 (RFC1157) which is now
  Historic. I think they should point to RFC3410 or RFC3411
  instead, or maybe even both.