Policy-based management ain't what it used to be

Over the past year, policy-based management has degenerated from a laudable concept to an almost completely meaningless buzz phrase.

The idea started out ambitiously enough. You tell the policy-based management software your business policies, and the software tells your enterprise's network hardware how to support them. Tied to a network directory, the software could match individual people in the organization with their network addresses. Based on importance to the business, a user or application would get a certain priority, a certain level of quality of service (QoS) and bandwidth, and certain access rights.

This was a new, bold concept - so new and so bold that a standards effort was launched to define how the software should communicate policies to network hardware.

Lately I have been receiving lots of press releases from vendors saying they support policy-based management. But they're not talking about the set of capabilities I outlined above. It's usually a small subset of those capabilities.

So if a switch can divide traffic into a couple of separate queues, the switch vendor will probably call that ability policy-based management. If a firewall lets some people through and denies access to others, it's enforcing policies, right? That's the way many vendors are starting to think, anyway.

In the scramble to add policy-based management as a check-off item in their product literature, vendors are diluting the term's meaning. Vendors are always co-opting the latest jargon because they want to be perceived as hip and fully buzzword-compliant. But here's the irony: Even if you could do full-blown policy management, it might not be desirable.

Though it's a good concept in theory, policy-based management might take more effort than it's worth to put into practice. Consider the Herculean task of getting all the different brands of equipment in your network to work together to support uniform QoS. Or the political headache of figuring out which departments in your organization deserve priority.

In many cases, policy-based management is a can of worms that need not be opened. It was driven in the beginning by financial services companies that want to make sure the customers with fat wallets go to the head of the line during a stock-market panic that causes network congestion.

Some organizations need this kind of policy enforcement, but many others don't. Figure out your organization's needs and focus on them. It's the only way to cut through the noise.

-Jeff Caruso, Senior editor
jcaruso@nww.com