Subject: [Pana] review of ipsec-06

From: Jari Arkko <[email-masked]>
Date: Wed, 01 Jun 2005 19:23:48 +0300

I have reviewed this document. Here are my comments:

Technical:

>    During EAP re-authentication, the AAA-Key changes. Whenever the AAA-
>    Key changes, a new value of Key-ID is established between the PaC and
>    PAA/EP as defined in [PANA-PROT]. If there is already an IKE SA or
>    IPsec SA established, it MUST continue to be used till it expires. A

Hmm... this would seem to dictate what the IKE implementations do
at the endpoints with their IPsec SAs. It would seem better to allow
the implementations to choose which SAs they use or if they want to
re-establish them, as it is today elsewhere.

>   The IKE PSK continues to exist
>    even after the AAA-Key from which it is derived expires.

This may be in conflict with the EAP keying framework document
which (currently) states "Nevertheless, the Session-Timeout value
represents the time after which the AAA-Key, and all keys
calculated from it, will have expired on the authenticator."

>       If source_port = PANA_PORT OR dest_port = PANA_PORT
>                PANA enabling IPsec based Access Control      
>           THEN BYPASS

I rememer that when we did RFC 3775, some reviewers were
not too happy about the above format. Perhaps take a look
at RFC2401bis if it has anything that would help you use a
format more familiar with the IPsec folks. Are you compatible
with the new 2401bis stuff, like PADs?

>              IF source = ::/128 & destination = any
>               THEN BYPASS
>    
>              IF source = fe80::/10 & destination = any
>              THEN BYPASS
>           
>              IF source = any & destination = fe80::/10
>               THEN BYPASS
>  
>               IF source_port = PANA_PORT OR dest_port = PANA_PORT
>                THEN BYPASS
>  
>              IF source = any & destination = PAC-TIA
>                  THEN USE ESP TUNNEL MODE SA:
>                     outer source = EP-ADDR
>                     outer destination = PAC-TOA 

I have several questions about this. First, I think fe80 was
link local... why are you allowing link local traffic? If I were
a network provider I would block all your traffic until you
were authenticated.

Secondly, the rules above appear to miss the "drop all
other traffic" rule, typically the last one to apply.

Thirdly, the rules you have appear to imply that
in your access network, I can communicate as much
as I want, as long as I tunnel all my traffic under the
PANA protocol number, to anyone in the internet!

(Fixing this would require adding the PAA's address
to the entries.)

Finally, I don't understand if this works or does not
work with things like RFC 3041. I'm OK with the outer
addresses being fixed, but what about the inner ones?

Editorial:

> 3.0 Pre-requisites for IPsec SA establisment 

s/establishment/establishment/

>    The character "|" denotes concatenation as defined in [RFC2409]. 

2409 does not have any more information about the notation.
In any case, 2409 probably wasn't the original reference where
concatenation was defined ;-) Suggest deleting the end of the
sentence, starting from "as defined".

>              THEN USE ESP TUNEL MODE SA: 

s/TUNEL/TUNNEL/

--Jari

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 1 Jun 2005 11:46:29 -0700

Jari,

Thanks for your comments.

> re-establish them, as it is today elsewhere.
Okay. The intent was not tie the re-creation of IPsec-SA/IKE-SA with
EAP re-authentication.

> calculated from it, will have expired on the authenticator."
Ok, i will fix it.  

> format more familiar with the IPsec folks.

Are you specifically talking about the above rule or in general ? 
The Appendix in rfc 2401bis seems to use a table format
to describe the SPD rule. Do you think that would be a better
format ? RFC 3775 is the standard for this now :-)

> Are you compatible
Nothing in the draft precludes the use of PADs etc. Perhaps, i am not
sure i understood your question..

> a network provider I would block all your traffic until you
The idea is to allow the neighbor/router discovery packets (DAD, MLD,
etc.) and not protect with IPsec. As RFC 2401bis
is almost done, i can replace this with ICMPv6 type and code values.
Would that make it better ?

> other traffic" rule, typically the last one to apply.
Yes, i always assumed that :-) I will add one at the end.

> PANA protocol number, to anyone in the internet!
You can also use the IKE port number (500 or 4500) :-)

> (Fixing this would require adding the PAA's address
Okay.

> addresses being fixed, but what about the inner ones?
Currently the inner address (Post-PANA) address is allocated
using IKEv2 or DHCP as discussed in section 4.0. The appendix
describes the issues with other mechanisms including RFC 3041.

> >              THEN USE ESP TUNEL MODE SA: 
Ok.

thanks
mohan

---

From: Jari Arkko <[email-masked]>
Date: Thu, 02 Jun 2005 09:17:22 +0300

>format ? RFC 3775 is the standard for this now :-)
In general. If you can use the table format (not sure you can),
I think reviews from IPsec folks and security ADs would be easier.
Just telling you my experience from the past...

>sure i understood your question..
What I was trying to say was that make sure you follow the 2401
terminology. If the PAD is something that you don't need, fine.

>Would that make it better ?
That would be much better.

Ok.

>You can also use the IKE port number (500 or 4500) :-)
Well... you probably can't, because the EP may accept
port 500 to itself, but not beyond.

Ok.

--Jari