Summary

  • The IETF is taking final comments through 26 September on draft-ietf-ivy-network-inventory-topology-11, a proposed-standard candidate that maps topology nodes and termination points to physical inventory. It remains an Internet-Draft, not an RFC or deployment result.
  • ne-ref, port-ref and link-type are writable. The draft prefers automatic discovery but permits manual overrides in exceptional cases; port-breakout, by contrast, is hardware-determined and must not be configured manually.
  • A mapping can guide provisioning without proving current capacity, installed state or service outcome. Daniel Kade proposes a protected, expiring override receipt; that record is editorial analysis, not an IETF requirement.

Last Call reaches the seam between two models

The Datatracker history records revision 11 after Area Director review and shows the document in IETF Last Call, with comments requested by 26 September. The requested destination is Proposed Standard. That is a decision now under review, not one already made. The current record can change, and the text still depends on a separate base-inventory Internet-Draft.

The revision 11 text addresses a practical seam. RFC 8345 gives operators a common model for network topologies: networks, nodes, links and termination points. The IVY base model describes the devices and components a management system knows to be installed. Revision 11 supplies references that let a system move from one representation to the other.

That movement is operationally consequential. A topology node can carry ne-ref, pointing to a network element. A termination point can carry port-ref, pointing to a physical component. link-type offers a lightweight description of media such as fibre, copper, microwave or wireless LAN. A port-breakout container reports which logical channels a physical port can support.

These fields do not merely decorate a diagram. They let a controller ask what hardware sits beneath a logical path. Once an answer is used to accept work, postpone maintenance or reject a candidate, the mapping becomes part of a decision chain.

One reference can redirect a provisioning choice

The draft’s service-provisioning example starts with candidate service attachment points. For each candidate, an orchestrator follows its parent termination point to the inventory topology’s port-ref, locating the physical port. It may then consult another topology model to assess whether the port has enough capacity. If not, it can try another attachment point and return more precise inventory information about the bottleneck.

That is a useful join, but four statements must remain separate. The topology object identifies a logical candidate. The inventory reference says which physical object the model associates with it. A capacity observation describes a resource at a time and from a source. A successful service requires configuration and observable operation after the choice. None of those statements automatically proves the next.

A stale port-ref can therefore lead a perfectly functioning orchestration algorithm toward the wrong physical object. A correct reference can still meet an old capacity reading. A sound plan can fail during installation. A configured service can behave differently in the data plane. Calling the mapping “inventory” does not collapse those evidence boundaries.

The base inventory draft makes this limitation unusually clear. Network inventory is the collection maintained by a particular management system. It is a read-only view of what its controller knows to be installed, not a warehouse list of spare assets. Even the distinction between a temporarily unreachable element and a removed one depends on the controller’s discovery mechanism. The map represents knowledge under stated conditions; it is not the chassis speaking for itself.

The manual exception is real—and necessary

Revision 11 does not pretend that discovery can populate every relationship. Its operational considerations say ne-ref, port-ref and link-type should normally come from automatic discovery, but may be overridden manually only in exceptional cases. It names customer-premises equipment, leased lines and planned resources as examples.

Those cases make sense. A controller may not be able to discover equipment it does not administer. A third party may supply a leased physical path through commercial records. A planned resource must exist in a model before it exists in a rack. Prohibiting every manual value would turn absence of telemetry into absence of operational knowledge.

Yet the escape hatch changes the meaning of the same field. A discovered port-ref is an observation mediated by a controller and its discovery logic. A manual port-ref is an assertion made under organisational authority. Both may be accurate. Both may be wrong. They fail differently, age differently and require different correction paths.

The data leaf does not explain which path produced its current value. A downstream consumer sees a reference, not the source it displaced, the person or process that approved it, the exception reason, its intended lifetime or the observation that later confirmed it. When the manual value is copied into another controller or cached by an orchestrator, even the local knowledge that it was exceptional can disappear.

Hardware capability draws a sharper line

port-breakout is the useful contrast. The draft marks it read-only because it describes capability determined by hardware. It must always reflect hardware state and must not be configured manually. If a device reports a breakout capability that conflicts with an operator’s plan, the answer is not to authorise a more convenient capability. The operator must repair discovery, identify the device correctly or change the plan.

The inventory-topology presence container sits between the two approaches. A controller usually sets it when it discovers or provisions a network instance representing the physical layer, but an operator may declare it manually when discovery is unavailable. The declaration can be legitimate, while still needing to say that it is a declaration.

This field-by-field difference is governance, not inconsistency. Some facts admit a bounded planning assertion. Some describe physical capability and should resist override. Treating the whole model as either automatically true or freely editable would erase that distinction.

Wrong mappings can expose more than a failed order

The draft’s security section identifies the operational risk directly. An incorrect or stale ne-ref or port-ref can produce mis-provisioning, failed activation, an unexpected traffic path or inaccurate capacity planning. It points implementers to secure transports, mutual authentication and NACM restrictions for NETCONF and RESTCONF access. Its security structure follows the current YANG author guidance in RFC 9907.

Read access also needs restraint. ne-ref can reveal the population of network elements. port-ref can expose internal component names. link-type can disclose an ownership boundary: the draft’s leased-fiber identity distinguishes third-party transport from owned infrastructure. A public audit log that solves provenance by publishing the topology would create a second problem.

The right evidence is therefore protected and minimal. It need not contain a customer name, exact route or full component inventory. It needs enough stable identifiers to show which assertion controlled a decision and enough access control to keep infrastructure detail from becoming a discovery service for outsiders.

Give the exception its own clock

Daniel Kade proposes a mapping-override receipt for every decision-relevant manual ne-ref, port-ref, link-type or manual declaration of an inventory topology. The record would bind the exact model object and value to the last discovery result, discovery source, controller and model version, approving authority, bounded reason, start time, expiry or revalidation trigger, and the decisions allowed to consume it.

When a provisioning action uses the value, the receipt would add the chosen candidate, capacity evidence, configuration result and post-action observation. It would not promote any one step into proof of the rest. A hash and opaque receipt identifier could support a public or cross-organisational statement; the sensitive mapping remains restricted.

For planned resources, expiry may be the date physical commissioning should replace the assertion with discovery. For leased lines, it may be a supplier confirmation or contract change. For customer-premises equipment, it may be a scheduled verification or an ownership handoff. The trigger follows the reason; “manual” is not a permanent data class.

This receipt is not required by the IVY draft, RFC 8345, RFC 8341 or RFC 9907. It is an editorial proposal for the organisational evidence that sits around a useful standard data model. Nor does it make discovery infallible. It makes the difference between discovered and asserted knowledge visible at the moment that difference matters.

The separation follows Heng Lu’s Policy Mirror: authority, rule and evidence should not be compressed into one green state. The Minimum Initial Specification supports keeping the shared mechanism small while leaving stronger local controls possible. Why BTW Media Exists supplies the editorial limit: the Last Call is real, but it is neither an incident nor a guarantee that an inventory mapping is true.

Sources

  1. Inventory Topology Mapping, Working Group revision 11
  2. Current Datatracker record
  3. Datatracker document history
  4. Current base-network-inventory record
  5. Base network-inventory model, revision 18
  6. RFC 8345 — A YANG Data Model for Network Topologies
  7. RFC 8341 — Network Configuration Access Control Model
  8. RFC 9907 — Guidelines for YANG Module Authors
  9. Heng Lu — The Policy Mirror
  10. Heng Lu — Minimum Initial Specification
  11. Heng Lu — Why BTW Media Exists