Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: George Tsirtsis <[email-masked]>
Date: Tue, 6 Feb 2001 05:55:38 -0500

Bernard,

So it seams we are in agreement with respect to the cost of IP over PPP over
X which is also my main reason for looking for an alternative....the
question is as follows:

- Is per port access control enough? If not, how do we do per host/user
access control in the absence of PPP?
- Is the 802.X applicable enough to cover all cases? If not, what do we do
about non-802 links, in the absence of PPP?
- If the answer to the above questions is 'No' then what are the L3/L4
alternatives? Do we need to extend and existing protocol or do we need to
built a new one?

Is this a fair summary of what this BOF is all about?

Thanks
George

-----Original Message-----
From: Bernard Aboba [mailto:[email-masked]]
Sent: Tuesday, February 06, 2001 12:57 AM
To: [email-masked]; DHCPv4 discussion list
Cc: [email-masked]
Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

>I am just trying to understand if you think there is
>nothing missing in this space or just that what is missing 
>is marginal and thus not worth bothering about.

Overall, I think that the major determinant of whether
there is "something missing" will be cost. As I'll 
describe, there are situations in which layer 3 access
control can be implemented at relatively low incremental
cost, and there are circumstances where this might be
too expensive. 

It's hard to make an overall judgement --
since it's a pretty big problem space. For example, there
might be demand for access control in ATM, Frame Relay,
Wireless WAN. There's quite a bit of high priced equipment
in these areas, so layer 3 access control might be fine. 
I'm just not familiar with that part of the world however, 
so perhaps someone else can comment. 

There might also be cases in which layer 3-4 access
control might exhibit better efficiency (e.g. 
authentication requiring certificate chain exchanges). 
Again, I haven't had much hands-on experience with
deployments of such technology so I can't say how
bad existing solutions perform. 

I will say that I've been attending the IEEE 802 
Ethernet Last Mile WG, and find their arguments 
for Ethernet over xDSL compelling. Basically, they 
believe they can dramatically cut the cost of 
xDSL equipment by moving to an Ethernet link layer, 
cutting out ATM and PPP. 

In this kind of scenario the CPE and Backend
are both Ethernet switches. The CPEs typically
have minimal L3 functionality (maybe just
SNMP & syslog support, perhaps RADIUS, Web and
telnet) and are only capable of handling L2
operations at wire speed. 

The CPE typically functions as a bridge which
typically will not have L3 filtering capabilities,
and to maintain a small CAM size, access control
is done at the port level rather than host level. 
For this kind of device, doing L3 access control
could drive up the cost, particularly if L3
filtering were required to operate at wire speed. 

The backends, being more expensive,
typically have more hardware and smarts 
(e.g. DWDM interfaces, BGP, etc.) So adding
L3 access control probably wouldn't be as big
an issue on the backend.

802.1X was optimized for this environment, since 
it can be implemented on a purely L2 device,
provides only authentication and doesn't require 
any encapsulation or L3 filtering that might 
sap performance. Thus, it can perform 
at speeds of 10+ Gbps. 

Similarly, use of 802.1X for 802.11 seems reasonable
since 802.11 access points are relatively low priced
devices (even enterprise access points only fetch
$700 - $1000) with modest processing capabilities.

---

From: "Bernard D. Aboba" <[email-masked]>
Date: Tue, 6 Feb 2001 05:02:02 -0800 (GMT-0800)

> Is this a fair summary of what this BOF is all about?

Yes, I think those are a reasonable set of questions to explore.

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 7 Feb 2001 18:05:32 +0100 (CET)

> Is this a fair summary of what this BOF is all about?

Yes, if there will be a BoF (which isn't clear yet) the most important thing
is to answer the above level of questions.

  Erik