Subject: RE: RE: EAP over ICMP

From: George Tsirtsis <[email-masked]>
Date: Wed, 16 Jan 2002 09:44:05 -0500

-----Original Message-----
From: Erik Nordmark [mailto:[email-masked]]
Sent: Wednesday, January 16, 2002 5:31 AM
To: Paal Engelstad
Cc: George Tsirtsis; [email-masked]
Subject: RE: RE: EAP over ICMP

> A configurable firewall will probably be a favorite target of DoS attacks.
> As a countermeasure it would be easy to configure the FW so that all
> configuration messages (e.g. of a MIDCOM protocol) must be received on the
> interface behind (inside) the firewall. Messages received from the outside
> would simply be discarded. 
> 
> If the PAA, on the other hand, is located outside the firewall, the FW may
> have to process a lot of bogus configuration messages (e.g. performing
> packet authenticating) before discarding them. 

I don;t understand what the "outside" is in this case.
The AR+PAA+FW are sitting between a bunch of visiting client devices
(which might be potentially hostile) and the Internet (which might might
contain some hostile nodes).
Thus there are two "outsides" as far as I can tell.

GT> I agree with this. Furthermore, PAA should be thought of as a *function*
rather than as a *box*. So the PAA can be implemented in the AR, in the
site's FW or somewhere in between. The result of a PANA session is likely to
be some configuration that will allow access to what was just authenticated.
This "configuration" is likely to be installed in the AR or in the FW. The
details of how this is done are out of scope of this discussion and the
reasons are:
- There are many ways of doing this (AAA protocols, FW configuration with
SNMP or other management software etc etc)
- Whatever way you choose it can always be independent of the PANA transport
protocol which is both good and important! i.e.: PANA should do one thing
and do it well!!

George

> Placing PAA behind the FW will naturally require that PAA is designed to
be
> sufficently secure since it requires a hole in the FW to allow reachablity
> from un-authenticated hosts. However, accommodating this security is in
the
> hands of PANA WG. We will not depend on work from other WGs.
> 
> Paal

---

From: "James Kempf" <[email-masked]>
Date: Wed, 16 Jan 2002 09:16:45 -0800

George,

> details of how this is done are out of scope of this discussion and
the

Now I am really confused. I thought this was all the responsiblity of
AAA.
I thought PANA was supposed to only be between the host and the
AAA server. Do we really need two ways of doing AAA??

            jak

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 16 Jan 2002 23:50:09 +0100 (CET)

> AAA server. Do we really need two ways of doing AAA??

I *think* I know what George is talking about so let me try to
explain what I think.

Case 1: PAA colocated with the AR. The AR implements access control
enforcement.

The AAA protocol might return some filter attributes in addition the PAA 
function might want to specify some filtering (e.g. IP addresses or IP address
prefixes). This results in some filter rules being added to the AR.

Case 2: PAA separate from the AR. The AR implements access control enforcement.
 Just like above AAA plus potential PAA filter rules are merged by the PAA.
But those need to be downloaded to the AR for enforcement.
So some protocol (out of scope for PANA - could be SNMP or whatever) needs
to be used for this "download".

Makes sense?

  Erik

---

From: "James Kempf" <[email-masked]>
Date: Wed, 16 Jan 2002 15:10:16 -0800

> to be used for this "download".

OK, now I understand. Thanx.

            jak