Subject: FW: [issue5] Updating the Device Identifier

From: <[email-masked]>
Date: Mon, 11 Aug 2003 18:41:35 +0300

Dan Forsberg <[email-masked]> added the comment:

Alper Yegin: 

As presented at IETF 57, the only valid case identified that
requires a DI change is this:

- A PaC performs PANA, configures an IP address via DHCP,
binds the IP address to PANA session, performs IKE for
IPsec-based access control.

Needless to say, one wouldn't do this if physical security
or L2 ciphering capability is available in the network. A L2
address can be used as DI, we won't need to use IKE or
IPsec. This above is a very particular case where
IPsec-based access control is used and the clients are not
allocated IP address before they are authenticated.
Unauthenticated hosts are allowed two types of traffic: PANA
and DHCP. DHCP is secured by some means (pending DHCP
WG's solution).

Proposed solution was to handle this case by allowing PaC to
send its new DI (i.e., the IP address obtained from DHCP)
via PANA-reauth message. The new DI overwrite the previous
one (0::0, or 0.0.0.0 in this case).

Unless there is any objection, let's move forward with this
solution.

_______________________________________________
PANA Issues <[email-masked]>
http://danforsberg.info:8080/pana-issues/issue5
_______________________________________________