UBR 7200 QOS Enforce-rules

Hey Community,
I'm attempting to configure a UBR 7200 with qos enforce-rules to use with bandwidth management.  The main issue is configuring monitoring-basics for docsis 1.1 modems.
1.  When setting monitoring basics I to docsis10, I am able to set qos registered [indexnum] without issue.  However if I choose docsis11, I get the following error when attempting to set qos registered:
(config)#cable qos enforce-rule testprofile
(enforce-rule)#monitoring-basics legacy docsis11
(enforce-rule)#qos registered 2
Already defined to do monitoring based on service class names
(enforce-rule)#
We don't use/have service classes defined on the ubr, we have different config files that are pervisioned to modems that have qos settings built in based on the speed they're supposed to have.  The modem is then [supposed to] create the qos profile on the ubr upon registering.  I don't see this actually happening... we have 5 speeds, 2, 5, 10, 15, 20mbps.  Furthermore.. we have around 10 of these 7200s and the qos profiles don't match across them.  Sometimes there are profiles created by cm for the speeds we offer, sometimes, there isn't.  What seems to match all of the cmtses is that 99% of the modems appear to be registered with the default cmts created qos profile 2, which is 1mbps... Since we have several thousand customers on this specific group of cmtses, we know that our customers are actually getting the speeds they are supposed to.
2.  According to the qos docs (http://www.cisco.com/en/US/docs/cable/cmts/feature/ubsubmon.html#wp1057697) setting docsis10 will only monitor 1.0 modems, and docsis11 will handle 1.1 only.  It also specifies the service-class enforce command as optional. But it appears the ubr is requiring it when monitoring docsis11 modems... is there any way around this?  I am trying to deal with some holiday traffic and enforce new qos profiles on problem customers.
We're running ubr7200-ik9su2-mz.123-23.BC3.bin
cisco uBR7246VXR (UBR7200-NPE-G1) processor (revision B)
Unfortunately our company came to acquire these cmtses from a provider that ran out of business, well before my time, and I've been tasked with managing them until we can upgrade our hardware here.
Any help  would be appreciated.
Thanks

Hi David,
Unfortunately you must use service-classes for the DOCSIS 1.1 monitoring in the enforce-rule. The documentation link you provided indicates this in the restrictions section:
Only DOCSIS 1.1 modems that register with a service class name are monitored.
Only primary upstream and downstream service flows are supported.
With docsis 1.1 qos registration the CMTS does not create a QOS profile. QOS profiles are applicable to D1.0 provisioning modes only.
I recommend moving forward to consider switching to service-class names defined on the CMTS to reflect your offerings. You will need to program in your CM configuration files for each US/DS flow a specific class name (TLV {24|25}.2), qos parameter, and service flow reference number.
If the class name is also on CMTS, then the CM will pick up the service class parameters as defined on the cmts.
Here's an example
cable qos enforce-rule TEST
monitoring-basics legacy docsis11
penalty-period 10080
service-class registered silver_up
cable service class 100 name silver_up
cable service class 100 upstream
cable service class 100 max-concat-burst 8192
cable service class 100 tos-overwrite 20 20
cable service class 100 max-rate 2200000
cable service class 100 max-burst 5000000
cable service class 100 priority 1
HTH,
Jack

Similar Messages

  • UBR 7200 strange behaviour

    Our good old Cisco UBR-7223 is experiencing a very strange problem:
    There are two modem cards installed (MC-11 and MC14C). From time to time (no pattern, sometimes twice in an hour, sometimes once in a week) all the modems on the MC14C card would go offline and will show a receive power at the uBR side of -20, -30 and below dBm.
    All the upstreams to the MC14C are also combined and go to the MC11, which operates fine at the same times, thus eliminating suggestions about RF plant issues (noise, power, etc.)
    Also, rebooting the uBR solves the problem immediately (just to have it reappear in again a random time), but still I haven't managed to solve the problem without rebooting it. Clearing or shutting down the relevant interface doesn't help. We've driven down the modulation back to QPSK - it changes nothing.
    These problems are appearing from about half an year, and are becoming more frequent rapidly to the level where customer disgrace is getting higher. The problem have no obvious connection whatsoever with the number of modems online, the ammount of traffic going through the uBR or something else. The uBR is collocated in a constant-temperature UPS-powered colo, so it couldn't be environment problem too.
    I'm currently searching for a replacement card to try and see if it's the card itself. Meanwhile - anyone any suggestiongs at what might I look at to debug this problem (if there's any chance it's not a hardware one)?

    Sarah, to help the knowlegable users here please advise which model G5 iMac you have & include this info in your system info preference by clicking on the "My Settings" link in the right hand column.-->
    This way, you won't have to keep repeating yourself and the knowlegable users will be able to provide you with the correct trouble shooting information/solutions if the problem is your computer.
    Also, it will be helpful if you will advise which version of Word, Photoshop you have, which email program & the type of printer you are using.
    Thank you.

  • Implementing JFrame Resizing Rules?

    Recently I've needed to enforce rules on a JFrame's dimensions (for example: preserving an aspect ratio).
    The obvious solution is to call setSize() from ComponentListener's componentResize() method. This is functional, but looking at the Java source, it's pretty inelegant. It actually starts a setSize() -> componentResized() -> setSize() loop that only terminates when setSize() is called with dimensions matching the current dimensions (see Component.reshape()). Also, its visually ugly because when maximized you can see the window snap back to the "fixed" size.
    It would seem that a more elegant way to add this functionality would be to have a method like "public Dimension checkDimensions(Dimension)" available for overriding.
    Does something like this already exist that I've missed?
    I've tried following the source, but I can't find the place where JFrame resizing is handled.

    The optimal solution would be to use a Look&Feel which doesn't have to use the OS window decorations, so the resize events are only generated in Java (not optimal in the fact that you don't get to have the OS frame decorations of course). Then you should be able to add your own RootPaneUI which simple doesn't allow resizing beyond a maximum size or auto resizing respecting an aspect ratio.
    See JFrame#isDefaultLookAndFeelDecorated and (for example) MetalRootPaneUI#MouseInputHandler. Perhaps there are thrid party look and feel where you can more easily replace a similar handler.

  • How to enforce developers to override toString() method

    Hi,
    Right now we are in design stage of our application. I want that all our BO classes should override toString(), equals() and hashCode() methods.
    We expect that our application would be running for next 5 to 10 years, and so looking for ways to enforce these rules to developers.
    One way to do is let ant script handle such validations. Another way could be using PMD to enforce rules.
    These could be good ways of doing this, but my manager doesnot quite like to depend on external tools like these ... as 5 years down the line you donot know state of these tools.
    Can someone suggest if java provides any such provision ...
    If someone has some smart solution do let me know ... your help is much appreciated ... and thanks in advance.
    Regards,
    Rana Biswas

    This is interesting.
    toString() method is already implemented in class Object, which is inherited by all other class.
    What happens if we make toString() method abstract. I tried it and compiler allows to do it ... was wondering if it would have any side effect.
    Regards,
    Rana Biswas

  • BM 3.9 extra rules

    Running virtual BM 3.8sp5 on a NW6.5sp8 server - ok abends every few days.
    So - created a virtual BM 3.9sp2 on a NW6.5sp8 server - with several problems:
    1) Trying to go to a https:\\ site gives "Internet Explorer cannot display the webpage" error. (Not a BM error)
    Why can I not go to a https site?
    2) iManager is showing 12 rules. Whenever I modify one, click apply changes, then unload/reload BM, the server shows ALCHECK.NLM read 17 rules form NDS. I can add a rule to make it 13, then ALCHECK shows 18. Delete the rule, back to 12 and 17.
    This would not bother me, but the rules are not working.
    3) When BM is loading, we keep getting a bunch of errors: Get IP addr failed for hostname: http://hulu.com or http://shutterfly,.com
    I can ping each one form the server with no problem.
    Why am I getting these errors?
    Thanks for any help,
    Rick

    Applied BM 3.9sp2_ir1, restarted server.
    I checked the OU where the new BM server was created - found 5 rules. Deleted them. Now showing the correct number of rules in iManager and on the server console screen when BM loads.
    Still can NOT https:
    Made the first acccess rule: Allow Any HTTP Any - still could not do a https:
    Unchecked Enforce access rules - now I CAN assess https:
    (The browser IS configured to go thru proxy, port 8080)
    Per the above, it would appear that one of the rules is not allowing https:
    I've looked at each rule - nothing stands out that would block https:
    Any more ideas or should I delete all the rules, then start adding them one at a time?
    Thanks,
    Rick
    >>> Mysterious<[email protected]> 12/15/2010 3:37 AM >>>
    On 14/12/10 16:57, Rick Remynse wrote:
    > Running virtual BM 3.8sp5 on a NW6.5sp8 server - ok abends every few days.
    > So - created a virtual BM 3.9sp2 on a NW6.5sp8 server - with several
    > problems:
    First apply bm39sp2_ir1
    > 1) Trying to go to a https:\\ site gives "Internet Explorer cannot
    > display the webpage" error. (Not a BM error)
    > Why can I not go to a https site?
    configure browser to go thru proxy.
    > 2) iManager is showing 12 rules. Whenever I modify one, click apply
    > changes, then unload/reload BM, the server shows ALCHECK.NLM read 17
    > rules form NDS. I can add a rule to make it 13, then ALCHECK shows 18.
    > Delete the rule, back to 12 and 17.
    > This would not bother me, but the rules are not working.
    1. Look at the rules on the server object and container. You may have
    rules at container level
    2. Check that browser is configure to go thru proxy
    3. Check the "enforce rule" checkbox in iman
    > 3) When BM is loading, we keep getting a bunch of errors: Get IP addr
    > failed for hostname: http://hulu.com or http://shutterfly,.com
    > I can ping each one form the server with no problem.
    > Why am I getting these errors?
    Aclcheck can not resolve the name you enter. Either your dns is wrong or
    the name you use on the access rules is wrong or nonexistent

  • QoS for voice tagged traffic

    I am trying to confirm my assumption that given voice traffic arriving at an AP or wireless bridge is already tagged with COS (and TOS) precedence, the wireless device will properly deal with it by default.
    It appears from the documentation, but isn't explicitly stated, that the only QoS configuration required is to classify and tag (COS) packets. If they are tagged already, no configuration is required.
    Is this correct?
    Also, are COS precedence values preserved across a wireless bridge link, or must they be re-tagged at the far end?

    Hi there,
    in "Configuring QoS" of the Aironet 1310 Configuration Guide
    http://www.cisco.com/en/US/products/ps5861/products_configuration_guide_chapter09186a00804ed713.html
    it reads:
    "Precedence of QoS Settings
    When you enable QoS, the access point/bridge queues packets based on the Layer 2 class of service value for each packet. The access point/bridge applies QoS policies in this order:
    1. Packets already classified—When the access point/bridge receives packets from a QoS-enabled switch or router that has already classified the packets with non-zero 802.1Q/P user_priority values, the access point/bridge uses that classification and does not apply other QoS policy rules to the packets. An existing classification takes precedence over all other policies on the access point/bridge.
    Note Even if you have not configured a QoS policy, the access point always honors tagged 802.1P packets that it receives over the radio interface."
    Hope this helps
    Martin

  • Worklist - Manage Rules

    While trying to manage rules, it appears that they only apply to incoming tasks.
    For example, if I want to reassign all tasks from user1 to user2, I set up the rule for user1. If I go look at the existing tasks for user1, user1 still has all the tasks assigned to it. However, if a new task is assigned to user1, the task is then reassigned to user2 just fine.
    Is there a way to enforce rules for existing tasks? I have tried setting "Rule should only apply from" which does not seem to enforce the rule on existing tasks with the time frame.
    Also, delegating a view is not a viable option, since the requirement is to take away all responsibility from the original user.
    Thanks,
    Guhn

    Hi.
    Any suggestions?
    TIA,
    Mick

  • Best Practice for Securing Web Services in the BPEL Workflow

    What is the best practice for securing web services which are part of a larger service (a business process) and are defined through BPEL?
    They are all deployed on the same oracle application server.
    Defining agent for each?
    Gateway for all?
    BPEL security extension?
    The top level service that is defined as business process is secure itself through OWSM and username and passwords, but what is the best practice for security establishment for each low level services?
    Regards
    Farbod

    It doesnt matter whether the service is invoked as part of your larger process or not, if it is performing any business critical operation then it should be secured.
    The idea of SOA / designing services is to have the services available so that it can be orchestrated as part of any other business process.
    Today you may have secured your parent services and tomorrow you could come up with a new service which may use one of the existing lower level services.
    If all the services are in one Application server you can make the configuration/development environment lot easier by securing them using the Gateway.
    Typical probelm with any gateway architecture is that the service is available without any security enforcement when accessed directly.
    You can enforce rules at your network layer to allow access to the App server only from Gateway.
    When you have the liberty to use OWSM or any other WS-Security products, i would stay away from any extensions. Two things to consider
    The next BPEL developer in your project may not be aware of Security extensions
    Centralizing Security enforcement will make your development and security operations as loosely coupled and addresses scalability.
    Thanks
    Ram

  • Incorrect and Un-Changeable 'Video Kind' for Videos Purchased From iTMS

    Since I can't seem to find any other way to contact Apple except through paid support channels, their suggestion is to post something here. Hopefully this re-wording of other posts I've read will shed more light on the problem.
    To Apple:
    Some videos purchased from the iTunes music store have an incorrect 'Video Kind' which means they are sorted incorrectly in iTunes using Apple's new interface in version 7.
    Old Battlestar Galactica episodes have a 'Video Kind' of 'Movie' instead of 'TV Show', so they don't appear in the iTunes smart category as TV shows. They appear in 'Movies', and they shouldn't.
    The field for these files is locked/ghosted/unchangeable, I'm assuming because of ridiculous DRM requirements or an oversight. But you are enforcing rules which cause your program to incorrectly sort files, and not allowing your customers to fix the problem.
    I want all my TV shows to list in your 'TV Shows' top category, but I can't change the 'Video Kind' for those files (bought via the iTunes music store). I have expected this problem to work itself out in the last few iTunes updates, but it hasn't yet. And there are many threads about this in your discussion forums.
    Please unlock the 'Video Kind' field in iTunes for videos downloaded from the iTunes music store (Prison Break Season 1, Battlestar Galactica, The Office Season 1, Surface, etc), or give us some kind of utility that will allow us to correct the mis-categorization.
    Thank you!
    -Tony

    I quite agree. I'm not sure how much attention, if any, the iTunes dev. team pay to these groups however. The formal feedback route is via iTunes Feedback, where sadly, I suspect, not much attention is paid either.
    tt2

  • Verizon Wireless is About to Cost Me a Home!!!!!!!!!

    This is EXTREMELY frustrating and I'm about to lose the home I really want to buy.
    I applied for a mortgage this month (January 2014) and that's when I realized there's collections activity on all 3 credit bureaus with Verizon that I already paid. These collections are affecting my loan approval and now my mortgage loan is on hold. I have a bid on a house that I'm about to lose because Verizon's recovery department can't get their act together and is giving me the runaround. I PAID THIS ACCOUNT LAST SUMMER.
    Last summer, I had a balance outstanding with Verizon on a  couple subaccounts. I called recovery and they said I had a balance of  $643.19. I paid this full amount about a week after the phone call (all  documented).
    When I discovered the collections on my credit bureaus. I immediately checked my bank account dating back to last summer and it shows the payment POSTED clearly saying "Verizon Wireless Bill Pay" etc.... I called recovery the next day after being transferred 3 times and wait times totaling 43 minutes while I'm at work. I explain my long story to the rep and she asked me to fax in the bank statement that shows it cleared and she said they'll call me within 48 hours (this was last week. I faxed it immediately and also attached a blank check to show it's my account (accounts numbers match).
    Of course I didn't get a call back so I called them on Friday to get an update because the realtor, the mortgage lender, the seller and myself are all waiting on this. There are no updates and the rep asked me to call back Monday. This is after I had to explain to whole entire story again. After explaining the story each time, the rep always tries to fix it even though I adamantly tell them they can't fit it and just to check the notes and give me an update.
    Fast forward to Thursday and two more phone calls, two more times of explaining the story to new reps, two more supervisors, I STILL haven't had a resolution yet. Now they're asking for my full credit card number to search the payment. WHY SHOULD I GIVE MY CREDIT CARD NUMBER AGAIN WHEN THIS IS NOT MY MISTAKE AND IS VERIZON'S MISTAKE????? I made the payment, it says it clearly on my bank statement, my bank will back me up on this!! I'm about to lose the home I want to purchase because Verizon lost my payment! I want this escalated to someone that CAN help with a sense of urgency since nobody else seems to care that Verizon's mistake is about to cost me a home. The rep told me to email the "Contact Us" link on the website. Are you kidding???? THat's how I escalate to someone higher up? To email a general email address that thousands of other customers are emailing?? Unacceptable....
    I have been given 3 days to get this cleared up or I lose the bid on the home. If that happens, this WILL become news. If they cannot locate my payment after over a week, I don't think they will and I will lose this house. Even if I lose it and apply for another home, these collections WILL still show on my credit bureau and I'm still screwed over by Verizon. Desperate cry for help online...is there ANYONE that can actually help or did I just waste a week and lose a home? If this remains on my credit report and I can't get a mortgage, then this WILL go viral online and make news. It's only fair I get it credited and it gets removed from my credit report. I've sent in a bank statement, a screenshot, a blank check showing matching account numbers and now they want my credit card number. This is completely unacceptable and people need to be aware of this...

    http://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/fair-debt-collection-practices-act-text
    First off the non payment to verizon was indeed correct. You admit this in your post.
    Secondly, correct information even if paid in full will stay on your credit report for 7-10 years. Any subsequent posting to the trade line will again make it show longer. Read the link it is the law.
    Your state of residence may have credit reporting laws similar to the Federal Law.
    A mortgage lender can in most cases overlook certain debts that have been paid. It varies from lender to lender. I know a couple that had a electric company bill posted on his credit report, not a big invoice just $90 the electric company never sent the invoice after they moved or the post office did not forward it. In any case the bank only needed a letter from the creditor stating that the invoice has been paid in full.
    They received their mortgage and the credit bureaus show it as paid.
    However verizon wireless will not be able to assist you with such documents because of just where and who in this large company can produce the document you need? And they will not remove the information from your three credit bureaus. The information that you were late, or went to collections, or charged off is factual so it will remain.
    When we bought our home we had the credit union give us an advanced copy to see where we stood. They even said they would use the report from the best one we liked. Needless to say we have no negative dings so getting mortgage and personal lines of credit are no problem. You have to watch your report very carefully and often.
    I know that is no comfort to you now. The good part about this is *IF* because of Verizon's not reporting properly or it being in error that could have been fixed, you can get a lawyer and sue for three times the amount of the mortgage you lost due to their error. However if the information is correct be it paid or unpaid the black mark will stand.
    Good Luck

  • How can I get rid of ms Paint in windows 7?

    None of the topics dealt with my question.  I need to competely get rid of mspaint in windows 7 64bit.  There has to be some way to do it! I just can'seem to find the way!

    Since I see no reason to remove MSPaint I will at least tell you how to disable it, that way it can always be re-enabled in the future if need be.
    I am assuming your using 64bit I'm going to assume your using at the very minimum Windows 7 Professional, while there does not seem to be a way to remove it without using a third party application it is possible to use Applocker policy to make it completely
    none functional.
    1. Open your start menu and type Local Policy in the search it should show the
    Local Security Policy editor, select it.
    2. In there open Application Control Policies (near bottom of list) under this you will
    find Applocker, double click it.
    3. Next double click Executable Rules so you see the right panel show blank space.
    4. Now right click Executable Rules and select create new rule, this will pop a wizard up for you to use.
    5. On the permissions page select "deny" Everyone, click next.
    6. On the Conditions page select Publisher, click next.
    7. In the browse window go here ----> C:\Windows\System32\mspaint.exe, now move the slider up to
    File Name. Once you've done that click Create at the bottom of the window.
    8. Now that you have created the rule, over on the left (back in the menu)
    click on Applocker again, on the right in the center box click Configure rule enforcement this will pop a small window. Place a check in configured under Executable Rules, make sure the dropdown box says Enforce Rules click OK.
    YOUR DONE!
    P.S. If your really adamant about removing it then just use step 7 to find the file and delete it, but the above mentioned steps WILL make sure it can not be used at all even by someone that knows where this executable it even though it is still in it's
    proper location.
    Please remember to flag a post that helps you as "answer" so that it may help others with same problems.

  • Multi layer table view/navigation controller hierarchy best practice

    Hi,
    I am new to iPad/iPhone development and wondering what the best practice for multiple layers of table views is? I understand the principle of a navigation controller providing the framework for moving up and down a list but have not yet quite got my head around if you should have one navigation controller for the whole tree or several navigation controllers.
    In my app I need to have the following:
    Main view -> window view showing some interactive elements (picker, buttons etc.)
    Setup view -> Hierarchy managed by nav controller/table views
    The setup view needs to manage the following hierarchy...
    - Level A:
    - Global app variables (one table view)
    - Level B Items (table view showing list of items at belonging to Level B)
    - Level B Item 1 (table view showing list of items at level C belonging to level B item 1)
    - Level C Item 1 (table view showing list of items at level D belonging to level C item 1)
    - Level D Item 1 (table view showing list of items at level E belonging to level D item 1)
    - Level E item (table view for properties of item at Level E)
    - Level D Item n
    - Level C Item n
    - Level B Item n
    Each level in this has some properties and then a list of child items.
    What would be the best way of structuring this? I would assume that creating a class that extends a view controller for each level is a given but what about the control of the navigation? Should this be handled by one navigation controller or one per level? I think I know the right answer but have not seen a neat way of implementing
    I think I am also best off having each level in it's own xib but, once again, am not 100% sure that this is the best design pattern.
    Many thanks in advance for any help/pointers!
    Cheers
    jez

    Hi Julian,
    I have struggled with the same questions you are addressing. On a previous project we tried to model based on packages, but during the course of the project we encountered some problems that grew overtime. The main problems were:
    1. It is hard to enforce rules on package assignments
    2. With multiple developers on the project and limited time we didn't have time to review package assignment
    3. Devopelers would click away warnings that an object was already part of another project and just continue
    4. After go-live the maintenance partner didn't care.
    So, my experience is is that it is a nice feature, but only from a high level design point of view. In real life it will get messy and above all, it doesn't add much value to the development. On my neew assignment we are just working with packages based on functional area and that works just fine.
    Roy

  • Best practice for loading config params for web services in BEA

    Hello all.
    I have deployed a web service using a java class as back end.
    I want to read in config values (like init-params for servlets in web.xml). What
    is the best practice for doing this in BEA framework? I am not sure how to use
    the web.xml file in WAR file since I do not know how the name of the underlying
    servlet.
    Any useful pointers will be very much appreciated.
    Thank you.

    It doesnt matter whether the service is invoked as part of your larger process or not, if it is performing any business critical operation then it should be secured.
    The idea of SOA / designing services is to have the services available so that it can be orchestrated as part of any other business process.
    Today you may have secured your parent services and tomorrow you could come up with a new service which may use one of the existing lower level services.
    If all the services are in one Application server you can make the configuration/development environment lot easier by securing them using the Gateway.
    Typical probelm with any gateway architecture is that the service is available without any security enforcement when accessed directly.
    You can enforce rules at your network layer to allow access to the App server only from Gateway.
    When you have the liberty to use OWSM or any other WS-Security products, i would stay away from any extensions. Two things to consider
    The next BPEL developer in your project may not be aware of Security extensions
    Centralizing Security enforcement will make your development and security operations as loosely coupled and addresses scalability.
    Thanks
    Ram

  • Using Identity Management for Securing Web Services

    My goal is to associate my services with an Oracle Internet Directory. I made some attempts to set up SAML authentication for the web services, but it didn't have the right outcome.
    (My identity management server and OID is up and running and I have successfully made authentication modules for other web applications)
    Here is what I did:
    1. I wrote a simple java file, used jdeveloper tools to create and deploy it as a web service to OC4J. I associated an identity management server with this service through OC4J web tools as security provider.
    2. I made a data control for the web service and put it in an ADF application . (client)
    3. I deployed the client project(2) to OC4J.
    I could use the web service through the page.
    Then
    I secured the webservice to expect SAML for authentication.
    Surprisingly, the client could still communicate with the webservice, Why? Shouldn't it have rejected the request because of the problem in SAML token? (The proxy and the data control were not secured, and didn't provide any SAML tokens)
    4.
    I added login page to my client project (through ADF security wizard). It used idenity management for authentication successfully. login process completes and web service data control is displayed.
    5. I want the authentication information to be propagated through the page so that the web service receives the data and uses Identity Management.
    I know I should add <property name="oracle.security.wss.propagate.identity" value ="true"/>
    to one of the configuration files, but don't know where exactly.
    Best Regards,
    Farbod

    It doesnt matter whether the service is invoked as part of your larger process or not, if it is performing any business critical operation then it should be secured.
    The idea of SOA / designing services is to have the services available so that it can be orchestrated as part of any other business process.
    Today you may have secured your parent services and tomorrow you could come up with a new service which may use one of the existing lower level services.
    If all the services are in one Application server you can make the configuration/development environment lot easier by securing them using the Gateway.
    Typical probelm with any gateway architecture is that the service is available without any security enforcement when accessed directly.
    You can enforce rules at your network layer to allow access to the App server only from Gateway.
    When you have the liberty to use OWSM or any other WS-Security products, i would stay away from any extensions. Two things to consider
    The next BPEL developer in your project may not be aware of Security extensions
    Centralizing Security enforcement will make your development and security operations as loosely coupled and addresses scalability.
    Thanks
    Ram

  • Best Practice: Usage of the ABAP Packages Concept?

    Hi SDN folks,
      I've just started on a new project - I have significant ABAP development experience (15 years+) - but one thing that I have never seen used correctly is the Package concept in ABAP - for any of the projects that I have worked on.
    I would like to define some best practices - about when we should create packages - and about how they should be structured.
    My understanding of the package concept is that they allow you to bundle all of the related objects of a piece of development work together. In previous projects - and almost every project I have ever worked on - we just have packages ZBASIS, ZMM, ZSD, ZFI and so on. But this to me is a very crude usage of packages, and really it seems that we have not moved on passed the 4.6 usage of the old development class concept - and it means that packages do not really add much value.
    I read in the SAP PRESS Next Generation ABAP book (Thomas Ljung, Rich Hellman) (I only have the 1st edition) - that we should use packages for defining separation of concern for an application. So it seems there they are recommending that for each and every application we write - we define at the least 3 packages - one for Model, one for Controller and one for view based objects. It occurs to me that following this approach will lead to a tremendous number of packages over the life cycle of an implementation, which could potentially lead to confusion - and so also add little value. Is this really the best practice approach? Has anyone tried this approach across a full blown implementation?
    As we are starting a new implementation - we will be running with 7 EHP2 and I would really like to get the most out of the functionality that is provided. I wonder what others have for experience in the definition of packages.
    One possible usage occurs to me that you could define the packages as a mirror image of the application business object class hierarchy (see below). But perhaps this is overcomplicating their usage - and would lead to issues later in terms of transportation conflicts etc.:
                                          ZSD
                                            |
                    ZSOrder    ZDelivery   ZBillingDoc
    Does anyone have any good recommendations for the usage of the ABAP Package concept - from real life project experience?
    All contributions are most welcome - although please refrain from sending links on how to create packages in SE80
    Kind Regards,
    Julian

    Hi Julian,
    I have struggled with the same questions you are addressing. On a previous project we tried to model based on packages, but during the course of the project we encountered some problems that grew overtime. The main problems were:
    1. It is hard to enforce rules on package assignments
    2. With multiple developers on the project and limited time we didn't have time to review package assignment
    3. Devopelers would click away warnings that an object was already part of another project and just continue
    4. After go-live the maintenance partner didn't care.
    So, my experience is is that it is a nice feature, but only from a high level design point of view. In real life it will get messy and above all, it doesn't add much value to the development. On my neew assignment we are just working with packages based on functional area and that works just fine.
    Roy

Maybe you are looking for

  • BI Best Practices for Customization

    Dear Experts, When I am developing BI reports by using mix of Standard BI Content and customized datasources at R/3 side. In Standard BI Content also I am adding additional columns whereever required. Now at BI side since I am changing structure/Upda

  • Display linked info in a datatip

    hiya I have a chart and in the chart I have a dates on the horizontal axis, and the series is a numeric value. I have a renderer to show the value, but i also want to show a linked datafield in the datatips. My arraycollection comes from a database t

  • Pdf file not opening on pushing fdf file with F key in Adobe  Reader

    Well i am a novice developer in case of PDF Development. The problem which i am facing is:- In our application a PDF document submits the data to server and server sends back FDF to client with f key as http path of PDF which is present on web server

  • T400s Microphone muting button and Windows 7

    Hello, I have a brand new Lenovo T400s. It had Windows Vista operating system but a few days ago I installed Windows 7 on it. It was Vista Premium and for that reason I had to install Windows 7 from a scratch. Therefore all drivers were lost. I used

  • Problems exporting to PDF with AI placed files

    I have a 24 page document with placed illustrator files. When I go to export to PDF it takes hours to export. When I change all the placed images to JPG it exports fine. Anyone know why this is happening. I thought the whole point of the newer versio