Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: George Tsirtsis <[email-masked]>
Date: Mon, 5 Feb 2001 17:00:38 -0500

-----Original Message-----
From: Bernard Aboba [mailto:[email-masked]]
Sent: Monday, February 05, 2001 8:22 PM
To: [email-masked]; DHCPv4 discussion list
Cc: [email-masked]
Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

>One approach is to say that L2s are either shared in which case probably
>802 based or point to point in which case PPP should be used. I would
>disagree with both of the above assumptions.

Just curious about the problem space. Are we talking about access
control for L2s like ATM, Frame Relay, or wireless WAN? 

GT> All of the above and more...I was thinking about a generic L3 access
mechanism...

Note that with 802.11 and Ethernet over DSL, 802 is being used as the
link layer for wireless LANs and xDSL. 

GT> I learned that recently...still, I am sure there are and will be non-802
L2s?

I'm also curious as to the type of access control that you want. 
Is it per-station access control? Per port access control? For
example, on a shared medium do *all* hosts need to authenticate?
Or is the medium assumed to be point to point?

GT> I was thinking about per host access control for both point to point and
shared mediums...

Then again you reply with questions and we can keep going like that for ever
:-) just joking...I am just trying to understand if you think there is
nothing missing in this space or just that what is missing is marginal and
thus not worth bothering about.

Regards
George

---

From: "Bernard Aboba" <[email-masked]>
Date: Mon, 5 Feb 2001 16:57:09 -0800

>I am just trying to understand if you think there is
>nothing missing in this space or just that what is missing 
>is marginal and thus not worth bothering about.

Overall, I think that the major determinant of whether
there is "something missing" will be cost. As I'll 
describe, there are situations in which layer 3 access
control can be implemented at relatively low incremental
cost, and there are circumstances where this might be
too expensive. 

It's hard to make an overall judgement --
since it's a pretty big problem space. For example, there
might be demand for access control in ATM, Frame Relay,
Wireless WAN. There's quite a bit of high priced equipment
in these areas, so layer 3 access control might be fine. 
I'm just not familiar with that part of the world however, 
so perhaps someone else can comment. 

There might also be cases in which layer 3-4 access
control might exhibit better efficiency (e.g. 
authentication requiring certificate chain exchanges). 
Again, I haven't had much hands-on experience with
deployments of such technology so I can't say how
bad existing solutions perform. 

I will say that I've been attending the IEEE 802 
Ethernet Last Mile WG, and find their arguments 
for Ethernet over xDSL compelling. Basically, they 
believe they can dramatically cut the cost of 
xDSL equipment by moving to an Ethernet link layer, 
cutting out ATM and PPP. 

In this kind of scenario the CPE and Backend
are both Ethernet switches. The CPEs typically
have minimal L3 functionality (maybe just
SNMP & syslog support, perhaps RADIUS, Web and
telnet) and are only capable of handling L2
operations at wire speed. 

The CPE typically functions as a bridge which
typically will not have L3 filtering capabilities,
and to maintain a small CAM size, access control
is done at the port level rather than host level. 
For this kind of device, doing L3 access control
could drive up the cost, particularly if L3
filtering were required to operate at wire speed. 

The backends, being more expensive,
typically have more hardware and smarts 
(e.g. DWDM interfaces, BGP, etc.) So adding
L3 access control probably wouldn't be as big
an issue on the backend.

802.1X was optimized for this environment, since 
it can be implemented on a purely L2 device,
provides only authentication and doesn't require 
any encapsulation or L3 filtering that might 
sap performance. Thus, it can perform 
at speeds of 10+ Gbps. 

Similarly, use of 802.1X for 802.11 seems reasonable
since 802.11 access points are relatively low priced
devices (even enterprise access points only fetch
$700 - $1000) with modest processing capabilities.