search

oasis-tcs / openc2-apsc-stateless-packet-filter

OASIS OpenC2 TC: A GitHub repository is to provide configuration management and to aid in the development of the first generation OpenC2 firewall profile
https://github.com/oasis-tcs/openc2-apsc-stateless-packet-filter
Other
6 stars 10 forks source link

Persistence issue on some equipment #121

Open alevere opened 4 years ago

alevere commented 4 years ago

For some equipment, this requires committing a device config which can take minutes. I propose we consider relaxing the requirement for these types of devices.

Current language: Normal operations assume any changes to a device are to be implemented persistently. Setting the persistent modifier to FALSE results in a change that is not persistent in the event of a reboot or restart

Proposed language: Normal operations assume any changes to a device are to be implemented persistently. However, it should be noted that some actuators need time to make a permanent change and may write the configuration up to one hour later. Setting the persistent modifier to FALSE may result in a change that is not persistent in the event of a reboot or restart, however this is product dependent.

Vasileios-Mavroeidis commented 4 years ago

The issue here is that the configuration that is going to be saved may have changes that are not applicable to SLPF. The configuration file of a router that has SLPF capability includes everything related to the configuration of the device and not only firewall rules. The above is device/software limitation. I don't think that it would take time at all to save the running configuration (i may be wrong here, my comment is based on the devices that I have used), the actual delay happens when rebooting the device and pushing the stored configuration.

I don't think that we can do something about it. If you want to add this sentence I would suggest at least to remove the amount of time. Also, the proposed language does not seem relaxing the requirements.