Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: George Tsirtsis <[email-masked]>
Date: Mon, 12 Feb 2001 09:03:22 -0500

Let me also agree to Pat's point which is not limited to cdma2000 but makes
sense as a generic separation between L2 and L2 AAA functions. 

L2 AAA only gives access to the specific L2 resources and as I said before
this has nothing to do with AAA in the IP layer. This is emphasized when the
Link Layer is not one hop but a whole network/infrastructure as in a lot of
2G/3G scenarios.
L3 AAA has to be employed separately to provide access to L2 (Internet)
resources that the Link Layer, very often, is not even aware of.
On top of that we also have Application Layer AAA that is also independent
from L3 AAA...e.g.: access to specific sites/servers etc.

I think there is temptation to integrate some of L2/L3 AAA and indeed in
some circumstances it might even be possible....but I still think the above
is not the general case. To return to my favorite example of always-on...per
port L2 authentication could be static and subscription based. L3 AAA on top
of it could supply customer/user profiles as well as accounting and
authorization to specific services.

Regards
George

-----Original Message-----
From: Patrice Calhoun [mailto:[email-masked]]
Sent: Monday, February 12, 2001 8:32 AM
To: Erik Nordmark
Cc: Subir Das; DHCPv4 discussion list; [email-masked];
[email-masked]
Subject: Re: Comments on draft-ietf-dhc-aaa-ra-00.txt

> The mobile IP L3 authentication is made to the home agent, right?
> If mobile IP runs on an infrastructure which already has L2 AAA
> functionality, all that mobile IP needs to provide is the home agent
> authenticating the mobile to avoid some imposter redirecting traffic.
> But the access control and accounting could all be done at L2.
> 
The issue with the above is that in the cdma2000 world, AAA will be used to
auth* the link connection. However, the AAA server that "owns" the device is
different from the AAA server that is "owns" the Home Agent. In a corporate
outsourcing model, the L2 AAA is owned by the carrier, while the L3 AAA is
owned by the corporate customer.

One provides access to the spectrum, the other access to the network (be it
a
corporate or general Internet access).

PatC

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 12 Feb 2001 18:25:06 +0100 (CET)

> authorization to specific services.

This sounds a lot different that "provide what PPP authentication and access
control does for PPP links for any link layer".

While I can sort of understand that granting L2 connectivity is different
than granting L3 connectivity (even though PPP doesn't make such a distinction)
I think the issue of AAA for applications was sent off to IRTF/AAARCH to do
some research. So I don't see how the last part relates to the BoF proposal.

  Erik