Subject: RE: Issue4: (new) Device identifier (types)

From: <[email-masked]>
Date: Wed, 13 Aug 2003 17:01:45 +0300

One of the questions in IETF57 PANA wg meeting was that should PAA 
take care of authorizing IP addresses. I think it should, because 
it informs the EPs about the filtering rules.

If I've understood correctly IPSec tunnel is used between PaC and 
EP/PAA with link local addresses. Then the inner IP address in the 
IPSec tunnel should be PANA DI. In this case it could be a subnet 
prefix, right?

If PANA uses MAC as the DI (and even with IPSec tunnel), PAA/EP can't 
control the IP addresses the PaC is using (inner IP address in the 
IPSec tunnel). Anyway, I firmly believe that access networks wount 
pass packets with ANY source IP address to the network (refusal to 
route). So I don't think that any IP address can be used inside the 
IPSec tunnel.

- Dan

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 08 August, 2003 00:42
> To: [email-masked]
> Subject: Issue4: (new) Device identifier (types)
> 
> 
> 
> http://www.danforsberg.info:8080/pana-issues/issue4
> 
> The issue text refers to multi-homed hosts and device ID 
> changes. These are
> covered under separate issues (#16 and #5).
> 
> So, issue #4 should only be talking about new DI types. And the one
> mentioned in the text is "subnet prefix." Unless anyone has 
> another proposed
> device ID type, let's discuss that.
> 
> I'm trying to understand the utility of setting the DI as a 
> subnet prefix.
> If this is proposed to enable mobile routers to connect to an access
> network, we can easily achive that by using either a mac 
> address DI along
> with L2 ciphering, or a single IP address DI along with 
> IPsec. In the latter
> case, any IP address can be used inside the IPsec tunnel. 
> Aside from not
> needing it, I'm also not sure how we can use this DI as an 
> IPsec end point.
> 
> Unless anybody objects, I recommend we reject this issue.
> 
> Comments please.
> 
> Alper
>  
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 11 Aug 2003 09:28:19 -0700

> IPSec tunnel should be PANA DI. In this case it could be a subnet 

The inner IP address in the IPsec tunnel is not necessarily be a PANA
DI, since the outer IP address (i.e., a link local IP address) can be
used as a PANA DI.  Authorization for the inner IP address can be done
in IKE negotiation by which an appropriate per-packet filtering rule
for the inner IP address is set to IPsec SPD.  IKE also supports
negotiatin of subnet-prefix parameters for inner packets.

> route). So I don't think that any IP address can be used inside the 

I think the required functionality of per-packet filtering for inner
packets is already covered by the combination of:

- Support of DI update (from MAC address to IP address).

- Use of link-local address as a DI when bootstrapping IKE.

- Use of IKE for establishing an tunnel mode IPsec SA between PaC and EP.
  (as a result, an SPD entry for inner packet filtering will be created.)

- Use of IPsec tunnel (whether inner packet filtering is done
  based on the created SPD entry).

Yoshihiro Ohba