Subject: Re: RE: EAP over ICMP

From: Paal Engelstad <[email-masked]>
Date: Thu, 17 Jan 2002 1:55:13 +0100

George,

This mail was clarifying. I wonder if I can bring the conclusion a tiny step forward without stepping out a cliff:

What if we say that the access control function on the AR in terms of address filtering equals a functional firewall. 

Is that a conceptual model that could be agreed upon? 

In that case we would have a model simply consisting of authenticating PAAs and policing firewalls - no matter co-located or not - and no matter located on AR or not. 

Paal

> 
> Fra: "James Kempf" <[email-masked]>
> Dato: 2002/01/17 Thu AM 12:10:16 CET
> Til: "Erik Nordmark" <[email-masked]>
> CC: "George Tsirtsis" <[email-masked]>, 
>    "'Erik Nordmark'" <[email-masked]>, 
>    <[email-masked]>
> Tema: Re: RE: EAP over ICMP
> 
> > I *think* I know what George is talking about so let me try to
> > explain what I think.
> >
> > Case 1: PAA colocated with the AR. The AR implements access control
> > enforcement.
> >
> > The AAA protocol might return some filter attributes in addition the
> PAA
> > function might want to specify some filtering (e.g. IP addresses or IP
> address
> > prefixes). This results in some filter rules being added to the AR.
> >
> > Case 2: PAA separate from the AR. The AR implements access control
> enforcement.
> >  Just like above AAA plus potential PAA filter rules are merged by the
> PAA.
> > But those need to be downloaded to the AR for enforcement.
> > So some protocol (out of scope for PANA - could be SNMP or whatever)
> needs
> > to be used for this "download".
> >
> > Makes sense?
> 
> OK, now I understand. Thanx.
> 
>             jak
> 
> 
>

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 17 Jan 2002 10:04:52 +0100 (CET)

> What if we say that the access control function on the AR in terms of
> address filtering equals a functional firewall. 

I don't think the term "firewall" is well defined and it is definitely
evolving over time.
Used to be that stateless packet filters were firewalls.
Then came stateful. Then inspecting email attachments for viruses.
Is URL filtering for kids accessing the 'net considered to be a firewall
function today?

I *think* the Radius/Diameter attributes for carrying filters is of the
simplest kind - be able to specify IP addresses, protocols, and port numbers
and nothing more. (but I haven't checked the specs)

Is it such "5-tuple filtering" that you think we should agree upon?

  Erik