Subject: RE: [Int-area] Re: [dhcwg] Discussion of subscriber authentication

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 09 Apr 2007 14:29:34 -0500

Hi Hesham,
  Have you read draft-pruss? If you look at Figure 1, it is not replacing 
AAA servers with DHCP servers, DHCP server acts like NAS. 
I agree that DHCP has been overloaded.

Regards,

Behcet
> The authentication in RFC 3118 (for DHCPv4) and RFC 3315 
 > (for DHCPv6)  
 > is message authentication, not subscriber authentication.
 > 
 > Message authentication is all about ensuring that the contents are  
 > not fake, assuming that there is enough shared trust between client  
 > and server host computers.  The shared trust also serves to control  
 > authorization to exchange DHCP messages.
 > 
 > Subscriber authentication is about the user of network access, and  
 > the user is often the person who has credentials rather than the  
 > host, although storing user credentials on the host happens.
 > 
 > The point of section 2.5 of draft-aboba-ip-config-00.txt is that  
 > these are different:
 > 
 >    2.5.  Configuration is Not Access Control
 > 
 >     Network access authentication is a distinct problem from Internet
 >     host configuration.
 > 

=> I couldn't agree more. I don't see the need for replacing AAA servers
with DHCP servers or overloading DHCP for this purpose. 

Hesham

_______________________________________________
Int-area mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/int-area

---

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 13 Apr 2007 10:08:12 -0700 (PDT)

OK, I see.

Isn't it true that you need additional enforcement if Layer 3 access authentication fails? Even for some Layer 2 cases where you can not tear down the link?

Behcet

----- Original Message ----
From: Alan DeKok <[email-masked]>
To: Behcet Sarikaya <[email-masked]>
Cc: [email-masked]
Sent: Friday, April 13, 2007 11:17:49 AM
Subject: Re: [Int-area] Discussion of subscriber authentication

Behcet Sarikaya wrote:
>  If someone avoids DHCP, and therefore
> avoids this DHCP "authentication", their ability to access the network
> is unrestricted.
> [behcet]
> Disagree. Without an IP address access to the Internet is restricted.

  DHCP is *advisory*.  The clients that do DHCP could just as well
configure a static IP, and get network access.

> [behcet] Authentication failed, no IP address, what more can you do?

  Sniff the local net.  Find an unused IP.  Configure it.

  Configuring static IP's is impossible only if the switch filters
traffic.  i.e. It blocks all network traffic except for DHCP, until the
DHCP IP has been allocated.  Once the IP has been allocated, it only
permits traffic that uses that source IP.

  This is not, as yet, a common configuration for a switch.

  Alan DeKok.