Subject: RE: [dhcwg] DHCP interconnected to RADIUS for AAA

From: "Chen, Weijing" <[email-masked]>
Date: Tue, 11 Mar 2003 10:21:57 -0600

Thanks you all for the reply.

After review and discussion, we kind of lean toward over John's suggestion:
.1x for authentication, DHCP for address allocation, and all tied together
by RADIUS.  Anyone can point me to the product actually implementing: client
(network device, I think Windows XP is one), access device, RADIUS server
and DHCP server as per John's draft?

--
Weijing Chen
SBC Technology Resources
9505 Arboretum Blvd.
Austin, TX 78759
512 372 5710
[email-masked]

-----Original Message-----
From: John Schnizlein [mailto:[email-masked]] 
Sent: Tuesday, March 11, 2003 9:40 AM
To: Erik Nordmark
Cc: Shankar Agarwal; [email-masked]; Dhcwg; Chen, Weijing
Subject: Re: [dhcwg] DHCP interconnected to RADIUS for AAA

At 08:51 AM 3/11/2003, Erik Nordmark wrote:
>> Right now we don't have a simple username password authentication
>> mechanism for DHCP and we have something very complicated which will not
>> be used in most common deployments. In most of the cases we are happy
>> with either cleartext user name password or may be MD5 encoded username
>> password authentication. If we put this within the current DHCP
>> framework then this will help in replacing the ppp in DSL and cabel
>> modem world where username password is used to pick up the profile of
>> the user.
>
>An alternative would be to figure out how PANA and DHC would work
>together in this case.

Another alternative is to follow the AAA that controls initial access 
at layer 2 (e.g. RADIUS authentication for IEEE 802.1X) with sending
those RADIUS attributes to the DHCP server. This approach protects
the access network and separates the functions of user authentication 
from address (and other parameter) configuration. The mechanism for
interworking this way is in draft-ietf-dhc-agentopt-radius-02.txt.

John
_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Chen, Weijing" <[email-masked]>
Date: Thu, 13 Mar 2003 13:36:45 -0600

Apparently I felt the same way after I read the PANA charter and
requirements.  I think this limitation (or assumption if you prefer) will
keep PANA from deployed in real world.  Regardless, we are investigating of
802.1x coupled with DHCP now.

Weijing Chen

-----Original Message-----
From: Ralph Droms [mailto:[email-masked]] 
Sent: Thursday, March 13, 2003 12:36 PM
To: Erik Nordmark
Cc: Prakash Jayaraman; Erik Nordmark; Shankar Agarwal; [email-masked];
Dhcwg; Chen, Weijing

I don't understand how PANA can be used first - the requirements doc says:

    PANA does not perform any address assignment functions
    but MUST only be invoked after the client has a usable
    IP address (e.g., a link-local address in IPv6 or a
    DHCP-learned address in IPv4)

- Ralph

At 09:45 PM 3/11/2003 +0100, Erik Nordmark wrote:
> > Is there work currently in progress on such an alternative? (triggering
a
> > PANA transaction upon a DHCP message from the client or something
similar).
> > Would this be an appropriate forum to start a discussion?
>
>The simplest thing would be to have them operate independently
>e.g. PANA authentication first then DHC address assignment etc.
>That doesn't allow you to assign different addresses for different classes
>of authenticated devices though.
>
>   Erik
>