I2NSF Network Security Function-Facing Interface YANG Data Model
draft-ietf-i2nsf-nsf-facing-interface-dm-29

[Ballot comment]
Please do update the versioned draft's referenced to their latest version, and as the SecDir review suggested, why not use  RFC 9051 as the imaps reference.

[Ballot comment]
Thank you for the work put into this document and for acting on most of my comments on revision -21.

As written in a separate email, I am clearing my previous DISCUSS position but I am balloting ABSTAIN as the IPv6 support in this document is really too low. I understand that authors rely on the YANG modules of RFC 8519 which is clearly not enough for IPv6.

About my own DISCUSS, the change to a "choice layer-3" is still a XOR: either IPv4 or IPv6 and this is not what security practitioners want to do as they do want congruent security policies. As we are kind of circling and not really reaching a final agreement, I will change my ballot from DISCUSS to ABSTAIN.

Special thanks to Linda Dunbar for the shepherd's write-up including the section about the WG consensus.

Special thanks as well to Jean-Michel Combes for his INT directorate review.

Regards,

-éric


# DISCUSS (only kept for archiving)

As noted in https://www.ietf.org/blog/handling-iesg-ballot-positions/, a DISCUSS ballot is a request to have a discussion on the following topics:

## Section 3.3

Many security practitioners prefer to have a congruent condition part for IPv4 and IPv6, so, why having *TWO* conditions rather than one where the destination/source could be either IPv4 or IPv6. Separating the conditions can only make the authoring of policies more complex.


# COMMENTS (only kept for archiving)

## Abstract

The abstract mentions an information model but no reference is given. See also my comment on section 1

## Section 1
There is a mention of an information model in I-D.ietf-i2nsf-capability-data-model but as mentioned in my IESG ballot on that document, it does not contain any information model... Strongly suggest removing all mentions of 'information model' in the abstract and in this section.

## Section 3.3
Is the use of "ethernet" as a generic term for layer 2 appropriate ? Many layer-2 networks do not use Ethernet (so many IEEE standards...). Suggest to rename into "layer2".

Should other "ethernet" fields be used? Like the VLAN or CoS fields ?

If the IPv4 and IPv6 conditions are kept separated (see my DISCUSS above), then please rename the IPv6 "ttl" into "hop-limit" and "protocol" into "next-header".

More generally, and may be have I overlooked some previous explanations, is the cardinality of ethernet, ipv4, ipv6 the most suitable one ? Can't a condition have multiple IPv4 prefixes ?

## Section 4.1

Why is "session-aging-time" only a uint16 ? As its unit is "second", this represents roughly 18 hours and I am sure that some sessions are longer than 18 hours (I have many opened SSH sessions for days).

In "identity reject", when mentioning the ICMP type and code, please specify whether it is ICMPv4 or ICMPv6 ;-)

## Section 5.1

Thank you for the IPv6 example :-) Same comment as Erik Kline on the IPv6 address, may I also suggest to use a more sensible prefix length ? /60 should be more representative.

[Ballot discuss]
Thank you for the work on this document.

Thank you for addressing my previous DISCUSS, the update looks good. However I believe there might be one issue left (easy to fix) that creates the YANG error in the datatracker validation tool:

this line:
                + '{,2})?|[A-Za-z]{4}|[A-Za-z]{5,8})(-[A-Za-z]{4})?'
should be replaced with:
                + '{0,2})?|[A-Za-z]{4}|[A-Za-z]{5,8})(-[A-Za-z]{4})?'

Since, as specified in https://www.w3.org/TR/2004/REC-xmlschema-2-20041028/#regexs S{,2} (which is referenced by 7950) is not a valid regex.

Francesca

[Ballot comment]
Hi,

Thanks for this document.  I have a few relatively minor comments:

3.2.  Event Clause

- It looks like your tree diagram is reproduced twice?

3.3.  Condition Clause

How do the conditions combine?  E.g., if I set both fields in ipv4 and ipv6 in the same rule?  Is the requirements that all fields set in the condition must match for the rule to be evaluated?  Perhaps this could be clarified here, and in the description of the condition container in the YANG module.


In terms of the YANG:

    identity priority-by-order {
      base priority-usage;
      description
        "Identity for priority by order. This indicates the
          priority of a security policy rule follows the order of the
          configuration. The earlier the configuration is, the higher
          the priority is.";
    }
   
Except for the base identities, where it helpful for the description to make it clear that it is a base identity, I don't think that you need text like "Identity for priority by order", although strictly is does no harm either.  I'll leave it to the authors to decide whether they change this, but if you do, then please consistently change it for all non base identities.


    identity disk-alarm {
      base system-alarm;
      description
        "Identity for disk alarm. Disk is the hardware to store
          information for a long period, i.e., Hard Disk and Solid-State
          Drive. A disk-alarm is emitted when the disk usage is
          exceeding a threshold.";
      reference
        "draft-ietf-i2nsf-nsf-monitoring-data-model-14: I2NSF NSF
          Monitoring Interface YANG Data Model - System alarm for disk";
    }
   
Would "storage-alarm" be a better generic name than disk-alarm?


    identity device-type {
      description
        "Base identity for types of device. This identity is used for
          type of the device for the source or destination of a packet
          or traffic flow.";
      reference
        "draft-ietf-i2nsf-capability-data-model-26:
          I2NSF Capability YANG Data Model";
    }
   
I assume that in many cases, particular packet flows, then NSF would not be able to know what type of device it was?  I wasn't quite sure how this would work.


    identity redirection {
      base egress-action;
      description
        "Identity for redirection. This action redirects the packet to
          another destination.";
    }
   
Could the description clarify the difference between redirection and forwarding please?


5.  XML Configuration Examples of Low-Level Security Policy Rules

Should all the example rules have the same name?  Would they be expected to have different names?

Am I right in understanding that a rule in figure 6 (or 7) are combined with the rule in figure 8.  If so, what in the policy actually binds these together so that the NSFs know to work together?  Is it the common name that binds them all together?  If both v4 and v6 are handling by the same device then you can't have two list entries in the same list with the same key.

Regards,
Rob

[Ballot comment]
In Section 3, there's this:

  A default action is used to execute I2NSF policy rule when no rule
  matches a packet.  The default action is defined as pass, drop,
  reject, rate-limit, and mirror.  The default action can be extended
  according to specific vendor action features.  The default action is
  described in detail in [I-D.ietf-i2nsf-capability-data-model].

The second sentence is confusing.  It appears to say the default is all five of those, when I think it means to say is that the default is one of those.

Anywhere "http" or "https" appear as words in prose, but not as part of a URL or part of the YANG module, I believe they should be in all caps since they're acronyms.  See, for instance, the numerous instances of this in Section 5.

A very minor point: I suggest Section 6 be broken into two subsections, one per major action being requested.

[Ballot discuss]
Thank you for the work on this document.

I have one DISCUSS point and two editorial comments.

As noted in https://www.ietf.org/blog/handling-iesg-ballot-positions/, a
DISCUSS ballot is a request to have a discussion; I really think that the
document would be improved with a change here, but can be convinced otherwise.

Francesca

1. -----

leaf description

FP: There is 22 occurrences of the leaf description in the model. If I understand correctly, all 22 of these are meant to contain human readable text. As a result you need to specify language tags for those fields, or justify why language tagging is not needed. For details, see RFC 2277 (BCP 18), Section 4.2. Also note that RFC 5646 becomes a Normative Reference when the ability to tag languages is added.

[Ballot comment]
2. -----

Figure 2

FP: Please fix the copy paste typo in figure 2.

3. -----

Hypertext Transfer Protocol version 1.X
      (HTTP/1.X)

FP: please replace X with 1 (2 occurrences)

[Ballot comment]
Thanks for working on this specification. Thanks to Yoshifumi Nishida for the TSVART review.

A bit of regrets that this specification does not include QUIC as transport protocol. A note in the specification regarding why it does not include QUIC would be nice.

Nits:

  Duplicate https identity in section 4.1

    identity https-2 {
    base application-protocol;
    description
      "The identity for Hypertext Transfer Protocol version 2
      (HTTP/2) over TLS.";
    reference
      "draft-ietf-httpbis-http2bis-07: HTTP/2";}

[Ballot discuss]
Thank you for the work put into this document.

Please find below one blocking DISCUSS points (mainly to start discussion), some non-blocking COMMENT points (but replies would be appreciated even if only for my own education).

Special thanks to Linda Dunbar for the shepherd's write-up including the section about the WG consensus.

I hope that this helps to improve the document,

Regards,

-éric


# DISCUSS

As noted in https://www.ietf.org/blog/handling-iesg-ballot-positions/, a DISCUSS ballot is a request to have a discussion on the following topics:

## Section 3.3

Many security practitioners prefer to have a congruent condition part for IPv4 and IPv6, so, why having *TWO* conditions rather than one where the destination/source could be either IPv4 or IPv6. Separating the conditions can only make the authoring of policies more complex.

[Ballot comment]
# COMMENTS

## Abstract

The abstract mentions an information model but no reference is given. See also my comment on section 1

## Section 1
There is a mention of an information model in I-D.ietf-i2nsf-capability-data-model but as mentioned in my IESG ballot on that document, it does not contain any information model... Strongly suggest removing all mentions of 'information model' in the abstract and in this section.

## Section 3.3
Is the use of "ethernet" as a generic term for layer 2 appropriate ? Many layer-2 networks do not use Ethernet (so many IEEE standards...). Suggest to rename into "layer2".

Should other "ethernet" fields be used? Like the VLAN or CoS fields ?

If the IPv4 and IPv6 conditions are kept separated (see my DISCUSS above), then please rename the IPv6 "ttl" into "hop-limit" and "protocol" into "next-header".

More generally, and may be have I overlooked some previous explanations, is the cardinality of ethernet, ipv4, ipv6 the most suitable one ? Can't a condition have multiple IPv4 prefixes ?

## Section 4.1

Why is "session-aging-time" only a uint16 ? As its unit is "second", this represents roughly 18 hours and I am sure that some sessions are longer than 18 hours (I have many opened SSH sessions for days).

In "identity reject", when mentioning the ICMP type and code, please specify whether it is ICMPv4 or ICMPv6 ;-)

## Section 5.1

Thank you for the IPv6 example :-) Same comment as Erik Kline on the IPv6 address, may I also suggest to use a more sensible prefix length ? /60 should be more representative.

[Ballot comment]
Thanks to Yoshi for the TSVART review, and the authors for both addressing his comments and switching to heavy reliance on RFC8519. I'm glad we're reusing YANG models instead of reinventing slightly different ones.

It appears the RFC8519 port model is inadequate because it doesn't support multiple ranges; would it better to update RFC8519 to include the construct here, or is there some different use case where port lists are needless complexity?

[Ballot comment]
Thank you to the authors and the WG for this document - it seems useful and complete.

Also, thank you to Joe for the OpsDir review, and to the authors for addressing his comments.

Finally, I wanted to note that this was a really good Document Shepherd writeup, and was very helpful.

(1) What type of RFC is being requested (BCP, Proposed Standard, Internet Standard, Informational, Experimental, or Historic)? Why is this the proper type of RFC? Is this type of RFC indicated in the title page header?

This document defines a YANG model for configuring security policy rules on Network Security Functions (NSF), and thus a standard track document is appropriate. The standards track is noted in the header of the document.

(2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections:

Technical Summary:

This document defines a YANG data model for configuring security policy rules on Network Security Functions (NSF) in the I2NSF framework. The YANG data model in this document focuses on security policy configuration for generic network security functions. This YANG data model uses an "Event-Condition-Action" (ECA) policy model that is used as the basis for the design of I2NSF Policy described in [RFC8329].

Working Group Summary:

This document was one of the milestones for the I2NSF WG. The document went through long period discussions within the I2NSF WG and with NETMOD WG participants. Many changes were made to utilize the modules that are already specified by draft-ietf-netmod-acl-model as much as possible.  The document then went through the YANG Doctor review process. Got good comments and feedback from YANG Doctor Review. The authors addressed feedbacks promptly until the YANG Doctor are satisfied with the YANG models and entered READY for the document.

Document Quality:

This document has gone through multiple cycles of YANG Doctors' reviews. The comments raised from the SECDIR review during the IETF LastCall are more about the overall philosophical discussion of the IETF ecosystem on the common YANG module, not specific to the draft. Therefore, those comments shouldn't need revision of the draft.

There have been IETF Hackathon implementation and Open source implementation (https://github.com/jaehoonpaul/i2nsf-framework)
for the YANG model specified by this document. In addition, multiple vendors on the co-author list all indicated that they plan to implement.



Personnel:

Who is the Document Shepherd? Who is the Responsible Area Director?

Document Shepherd is Linda Dunbar
The Responsible Area Director is Roman Danyliw

(3) Briefly describe the review of this document that was performed by the Document Shepherd. If this version of the document is not ready for publication, please explain why the document is being forwarded to the IESG.

I have read this document and have provided feedback on previous revisions to the authors.  I feel this document is ready for publication.

(4) Does the document Shepherd have any concerns about the depth or breadth of the reviews that have been performed?

No, I do not.

(5) Do portions of the document need review from a particular or from broader perspective, e.g., security, operational complexity, AAA, DNS, DHCP, XML, or internationalization? If so, describe the review that took place.

I don’t think so.

(6) Describe any specific concerns or issues that the Document Shepherd has with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the WG has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here.

No specific concerns for this document.

(7) Has each author confirmed that any and all appropriate IPR disclosures required for full conformance with the provisions of BCP 78 and BCP 79 have already been filed. If not, explain why?

Yes.  All authors replied.  These responses can be found in the archives of the I2nsf list.

(8) Has an IPR disclosure been filed that references this document? If so, summarize any WG discussion and conclusion regarding the IPR disclosures.

2 IPR disclosures were filed against this document. There were some concerns of the IPR terms. After some discussion, the authors had their respective companies change the IPR terms to satisfy WG participants’ requests.

(9) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it?

Consensus was strong with no vocalized dissension.

(10) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is publicly available.)

Not to my knowledge.

(11) Identify any ID nits the Document Shepherd has found in this document. (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts Checklist). Boilerplate checks are not enough; this check needs to be thorough.

No ID nits found during Shepherd review.

(12) Describe how the document meets any required formal review criteria, such as the MIB Doctor, YANG Doctor, media type, and URI type reviews.

The document has gone through YANG Doctor review. Has revised to address comments received from YANG Doctor review. YANG Doctor thinks this document ready for publication.

(13) Have all references within this document been identified as either normative or informative?

Yes.

(14) Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the plan for their completion?

No. All normative references are published RFCs.

(15) Are there downward normative references references (see RFC 3967)? If so, list these downward references to support the Area Director in the Last Call procedure.

No.

(16) Will publication of this document change the status of any existing RFCs? Are those RFCs listed on the title page header, listed in the abstract, and discussed in the introduction? If the RFCs are not listed in the Abstract and Introduction, explain why, and point to the part of the document where the relationship of this document to the other RFCs is discussed. If this information is not in the document, explain why the WG considers it unnecessary.

No. it will not.

(17) Describe the Document Shepherd's review of the IANA considerations section, especially with regard to its consistency with the body of the document. Confirm that all protocol extensions that the document makes are associated with the appropriate reservations in IANA registries. Confirm that any referenced IANA registries have been clearly identified. Confirm that newly created IANA registries include a detailed specification of the initial contents for the registry, that allocations procedures for future registrations are defined, and a reasonable name for the new registry has been suggested (see RFC 8126).

This document does not define any new IANA registries, but it does request the following URI in the "IETF XML Registry" [RFC3688]:
URI: urn:ietf:params:xml:ns:yang:ietf-i2nsf-policy-rule-for-nsf

This document requests IANA to register the following YANG module in the "YANG Module Names" registry [RFC7950]: name: ietf-i2nsf-policy-rule-for-nsf

All the referenced IANA registries have been clearly identified by the document.

(18) List any new IANA registries that require Expert Review for future allocations. Provide any public guidance that the IESG would find useful in selecting the IANA Experts for these new registries.

None.

(19) Describe reviews and automated checks performed by the Document Shepherd to validate sections of the document written in a formal language, such as XML code, BNF rules, MIB definitions, YANG modules, etc.

This document has passed the automated YANG check, which includes a number of validators.

(20) If the document contains a YANG module, has the module been checked with any of the recommended validation tools (https://trac.ietf.org/trac/ops/wiki/yang-review-tools) for syntax and formatting validation? If there are any resulting errors or warnings, what is the justification for not fixing them at this time? Does the YANG module comply with the Network Management Datastore Architecture (NMDA) as specified in RFC8342?

The YANG module specified by the document has passed the validation and pass the YANG Doctor review.

(Via drafts-lastcall-comment@iana.org): IESG/Authors/WG Chairs:

The IANA Functions Operator has completed its review of draft-ietf-i2nsf-nsf-facing-interface-dm-15. If any part of this review is inaccurate, please let us know.

The IANA Services Operator understands that, upon approval of this document, there are two actions which we must complete.

First, in the ns registry on the IETF XML Registry page located at:

https://www.iana.org/assignments/xml-registry/

a single, new namespace will be registered as follows:

ID: yang:ietf-i2nsf-policy-rule-for-nsf
URI: urn:ietf:params:xml:ns:yang:ietf-i2nsf-policy-rule-for-nsf
Filename: [ TBD-at-Registration ]
Reference: [ RFC-to-be ]

As this document requests registrations in an Expert Review or Specification Required (see RFC 8126) registry, we will initiate the required Expert Review via a separate request. Expert review will need to be completed before your document can be approved for publication as an RFC.  This review must be completed before the document's IANA state can be changed to "IANA OK."

Second, in the YANG Module Names registry on the YANG Parameters registry page located at:

https://www.iana.org/assignments/yang-parameters/

a single, new YANG module will be registered as follows:

Name: ietf-i2nsf-policy-rule-for-nsf
File: [ TBD-at-Registration ]
Maintained by IANA? N
Namespace: urn:ietf:params:xml:ns:yang:ietf-i2nsf-policy-rule-for-nsf
Prefix: nsfintf
Module:
Reference: [ RFC-to-be ]

While the YANG module name will be registered after the IESG approves the document, the YANG module file will be posted after the RFC Editor notifies us that the document has been published.

The IANA Services Operator understands that these are the only actions required to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is meant only to confirm the list of actions that will be performed.

Thank you,

Michelle Cotton
IANA Services

The following Last Call announcement was sent out (ends 2021-11-23):

From: The IESG
To: IETF-Announce
CC: Linda Dunbar , draft-ietf-i2nsf-nsf-facing-interface-dm@ietf.org, dunbar.ll@gmail.com, i2nsf-chairs@ietf.org, i2nsf@ietf.org, rdd@cert.org
Reply-To: last-call@ietf.org
Sender:
Subject: Last Call:  (I2NSF Network Security Function-Facing Interface YANG Data Model) to Proposed Standard


The IESG has received a request from the Interface to Network Security
Functions WG (i2nsf) to consider the following document: - 'I2NSF Network
Security Function-Facing Interface YANG Data Model'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
last-call@ietf.org mailing lists by 2021-11-23. Exceptionally, comments may
be sent to iesg@ietf.org instead. In either case, please retain the beginning
of the Subject line to allow automated sorting.

Abstract


  This document defines a YANG data model for configuring security
  policy rules on Network Security Functions (NSF) in the Interface to
  Network Security Functions (I2NSF) framework.  The YANG data model in
  this document corresponds to the information model for NSF-Facing
  Interface in the I2NSF framework.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-i2nsf-nsf-facing-interface-dm/


The following IPR Declarations may be related to this I-D:

  https://datatracker.ietf.org/ipr/3553/
  https://datatracker.ietf.org/ipr/3603/



The document contains these normative downward references.
See RFC 3967 for additional information:
    draft-ietf-i2nsf-nsf-monitoring-data-model: I2NSF NSF Monitoring Interface YANG Data Model (None - Internet Engineering Task Force (IETF))

(1) What type of RFC is being requested (BCP, Proposed Standard, Internet Standard, Informational, Experimental, or Historic)? Why is this the proper type of RFC? Is this type of RFC indicated in the title page header?

This document defines a YANG model for specifying the YANG data model for security policy rule configuration of Network Security Functions (NSF), and thus a standard track document is appropriate.  The standards track is noted in the header of the document.

(2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections:

Technical Summary:

This document defines a YANG data model for security policy rule configuration of Network Security Functions (NSF) over the NSF facing interface as specified by I2NSF framework. The YANG data model in this document focuses on security policy configuration for generic network security functions. This YANG data model uses an "Event-Condition-Action" (ECA) policy model that is used as the basis for the design of I2NSF Policy described in [RFC8329] and [draft-ietf-i2nsf-capability].

Working Group Summary:

This document was one of the milestones for the I2NSF WG. The document went through long period discussions within the I2NSF WG and with NETMOD WG participants. Many changes were made to utilize the modules that are already specified by draft-ietf-netmod-acl-model as much as possible.  The document then went through the YANG Doctor review process. Got good comments and feedback from YANG Doctor Review. The authors addressed feedbacks promptly until the YANG Doctor are satisfied with the YANG models and entered READY for the document.

Document Quality:

This document is well-written and has gone through a number of working group and external reviews.
The YANG module itself validates without any warnings, and have passed YANG Doctor Review.
There have been Hackathon implementation and Open source implementation for the YANG model specified by this document. In addition, multiple vendors on the co-author list all indicated that they plan to implement.

Personnel:

Who is the Document Shepherd? Who is the Responsible Area Director?

Document Shepherd is Linda Dunbar
The Responsible Area Director is Roman Danyliw

(3) Briefly describe the review of this document that was performed by the Document Shepherd. If this version of the document is not ready for publication, please explain why the document is being forwarded to the IESG.

I have read this document and have provided feedback on previous revisions to the authors.  I feel this document is ready for publication.

(4) Does the document Shepherd have any concerns about the depth or breadth of the reviews that have been performed?

No, I do not.

(5) Do portions of the document need review from a particular or from broader perspective, e.g., security, operational complexity, AAA, DNS, DHCP, XML, or internationalization? If so, describe the review that took place.

I don’t think so.

(6) Describe any specific concerns or issues that the Document Shepherd has with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the WG has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here.

No specific concerns for this document.

(7) Has each author confirmed that any and all appropriate IPR disclosures required for full conformance with the provisions of BCP 78 and BCP 79 have already been filed. If not, explain why?

Yes.  All authors replied.  These responses can be found in the archives of the I2nsf list.

(8) Has an IPR disclosure been filed that references this document? If so, summarize any WG discussion and conclusion regarding the IPR disclosures.

2 IPR disclosures were filed against this document. There were some concerns of the IPR terms. After some discussion, the authors had their respective companies change the IPR terms to satisfy WG participants’ requests.

(9) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it?

Consensus was strong with no vocalized dissension.

(10) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is publicly available.)

Not to my knowledge.

(11) Identify any ID nits the Document Shepherd has found in this document. (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts Checklist). Boilerplate checks are not enough; this check needs to be thorough.

No ID nits found during Shepherd review.

(12) Describe how the document meets any required formal review criteria, such as the MIB Doctor, YANG Doctor, media type, and URI type reviews.

The document has gone through YANG Doctor review. Has revised to address comments received from YANG Doctor review. YANG Doctor thinks this document ready for publication.

(13) Have all references within this document been identified as either normative or informative?

Yes.

(14) Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the plan for their completion?

No. All normative references are published RFCs.

(15) Are there downward normative references references (see RFC 3967)? If so, list these downward references to support the Area Director in the Last Call procedure.

No.

(16) Will publication of this document change the status of any existing RFCs? Are those RFCs listed on the title page header, listed in the abstract, and discussed in the introduction? If the RFCs are not listed in the Abstract and Introduction, explain why, and point to the part of the document where the relationship of this document to the other RFCs is discussed. If this information is not in the document, explain why the WG considers it unnecessary.

No. it will not.

(17) Describe the Document Shepherd's review of the IANA considerations section, especially with regard to its consistency with the body of the document. Confirm that all protocol extensions that the document makes are associated with the appropriate reservations in IANA registries. Confirm that any referenced IANA registries have been clearly identified. Confirm that newly created IANA registries include a detailed specification of the initial contents for the registry, that allocations procedures for future registrations are defined, and a reasonable name for the new registry has been suggested (see RFC 8126).

This document does not define any new IANA registries, but it does request the following URI in the "IETF XML Registry" [RFC3688]:
URI: urn:ietf:params:xml:ns:yang:ietf-i2nsf-policy-rule-for-nsf

This document requests IANA to register the following YANG module in the "YANG Module Names" registry [RFC7950]: name: ietf-i2nsf-policy-rule-for-nsf

All the referenced IANA registries have been clearly identified by the document.

(18) List any new IANA registries that require Expert Review for future allocations. Provide any public guidance that the IESG would find useful in selecting the IANA Experts for these new registries.

None.

(19) Describe reviews and automated checks performed by the Document Shepherd to validate sections of the document written in a formal language, such as XML code, BNF rules, MIB definitions, YANG modules, etc.

This document has passed the automated YANG check, which includes a number of validators.

(20) If the document contains a YANG module, has the module been checked with any of the recommended validation tools (https://trac.ietf.org/trac/ops/wiki/yang-review-tools) for syntax and formatting validation? If there are any resulting errors or warnings, what is the justification for not fixing them at this time? Does the YANG module comply with the Network Management Datastore Architecture (NMDA) as specified in RFC8342?

The YANG module specified by the document has passed the validation and pass the YANG Doctor review.

(1) What type of RFC is being requested (BCP, Proposed Standard, Internet Standard, Informational, Experimental, or Historic)? Why is this the proper type of RFC? Is this type of RFC indicated in the title page header?

This document defines a YANG model for specifying the YANG data model for security policy rule configuration of Network Security Functions (NSF), and thus a standard track document is appropriate.  The standards track is noted in the header of the document.

(2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections:

Technical Summary:

This document defines a YANG data model for security policy rule configuration of Network Security Functions (NSF) over the NSF facing interface as specified by I2NSF framework. The YANG data model in this document focuses on security policy configuration for generic network security functions. This YANG data model uses an "Event-Condition-Action" (ECA) policy model that is used as the basis for the design of I2NSF Policy described in [RFC8329] and [draft-ietf-i2nsf-capability].

Working Group Summary:

This document was one of the milestones for the I2NSF WG. The document went through long period discussions within the I2NSF WG and with NETMOD WG participants. Many changes were made to utilize the modules that are already specified by draft-ietf-netmod-acl-model as much as possible.  The document then went through the YANG Doctor review process. Got good comments and feedback from YANG Doctor Review. The authors addressed feedbacks promptly until the YANG Doctor are satisfied with the YANG models and entered READY for the document.

Document Quality:

This document is well-written and has gone through a number of working group and external reviews.
The YANG module itself validates without any warnings, and have passed YANG Doctor Review.
There have been Hackathon implementation and Open source implementation for the YANG model specified by this document. In addition, multiple vendors on the co-author list all indicated that they plan to implement.

Personnel:

Who is the Document Shepherd? Who is the Responsible Area Director?

Document Shepherd is Linda Dunbar
The Responsible Area Director is Roman Danyliw

(3) Briefly describe the review of this document that was performed by the Document Shepherd. If this version of the document is not ready for publication, please explain why the document is being forwarded to the IESG.

I have read this document and have provided feedback on previous revisions to the authors.  I feel this document is ready for publication.

(4) Does the document Shepherd have any concerns about the depth or breadth of the reviews that have been performed?

No, I do not.

(5) Do portions of the document need review from a particular or from broader perspective, e.g., security, operational complexity, AAA, DNS, DHCP, XML, or internationalization? If so, describe the review that took place.

I don’t think so.

(6) Describe any specific concerns or issues that the Document Shepherd has with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the WG has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here.

No specific concerns for this document.

(7) Has each author confirmed that any and all appropriate IPR disclosures required for full conformance with the provisions of BCP 78 and BCP 79 have already been filed. If not, explain why?

Yes.  All authors replied.  These responses can be found in the archives of the I2nsf list.

(8) Has an IPR disclosure been filed that references this document? If so, summarize any WG discussion and conclusion regarding the IPR disclosures.

2 IPR disclosures were filed against this document. There were some concerns of the IPR terms. After some discussion, the authors had their respective companies change the IPR terms to satisfy WG participants’ requests.

(9) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it?

Consensus was strong with no vocalized dissension.

(10) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is publicly available.)

Not to my knowledge.

(11) Identify any ID nits the Document Shepherd has found in this document. (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts Checklist). Boilerplate checks are not enough; this check needs to be thorough.

No ID nits found during Shepherd review.

(12) Describe how the document meets any required formal review criteria, such as the MIB Doctor, YANG Doctor, media type, and URI type reviews.

The document has gone through YANG Doctor review. Has revised to address comments received from YANG Doctor review. YANG Doctor thinks this document ready for publication.

(13) Have all references within this document been identified as either normative or informative?

Yes.

(14) Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the plan for their completion?

No. All normative references are published RFCs.

(15) Are there downward normative references references (see RFC 3967)? If so, list these downward references to support the Area Director in the Last Call procedure.

No.

(16) Will publication of this document change the status of any existing RFCs? Are those RFCs listed on the title page header, listed in the abstract, and discussed in the introduction? If the RFCs are not listed in the Abstract and Introduction, explain why, and point to the part of the document where the relationship of this document to the other RFCs is discussed. If this information is not in the document, explain why the WG considers it unnecessary.

No. it will not.

(17) Describe the Document Shepherd's review of the IANA considerations section, especially with regard to its consistency with the body of the document. Confirm that all protocol extensions that the document makes are associated with the appropriate reservations in IANA registries. Confirm that any referenced IANA registries have been clearly identified. Confirm that newly created IANA registries include a detailed specification of the initial contents for the registry, that allocations procedures for future registrations are defined, and a reasonable name for the new registry has been suggested (see RFC 8126).

This document does not define any new IANA registries, but it does request the following URI in the "IETF XML Registry" [RFC3688]:
URI: urn:ietf:params:xml:ns:yang:ietf-i2nsf-policy-rule-for-nsf

This document requests IANA to register the following YANG module in the "YANG Module Names" registry [RFC7950]: name: ietf-i2nsf-policy-rule-for-nsf

All the referenced IANA registries have been clearly identified by the document.

(18) List any new IANA registries that require Expert Review for future allocations. Provide any public guidance that the IESG would find useful in selecting the IANA Experts for these new registries.

None.

(19) Describe reviews and automated checks performed by the Document Shepherd to validate sections of the document written in a formal language, such as XML code, BNF rules, MIB definitions, YANG modules, etc.

This document has passed the automated YANG check, which includes a number of validators.

(20) If the document contains a YANG module, has the module been checked with any of the recommended validation tools (https://trac.ietf.org/trac/ops/wiki/yang-review-tools) for syntax and formatting validation? If there are any resulting errors or warnings, what is the justification for not fixing them at this time? Does the YANG module comply with the Network Management Datastore Architecture (NMDA) as specified in RFC8342?

The YANG module specified by the document has passed the validation and pass the YANG Doctor review.