Subject: RE: [dhcwg] draft-pruss-dhcp-auth-dsl-00.txt

From: "MORAND Lionel RD-CORE-ISS" <[email-masked]>
Date: Wed, 21 Mar 2007 20:00:17 +0100

I think that existing solutions relying on IP address/line identifier bindings at the NAS level are deployed because there is no available authentication mechanism in DHCP-based environment.
And the goal is actually to control access to the core network behind the NAS.
Therefore, based on the limitations of the implicit authentication based on the use of the DHCP option 82, the questions are:
- Should DHCP support such network access requirements?
- Should a CHAP-based solution in DHCP fulfil theses requirements?

I would say that the first answer is "NO" based on the draft-aboba-ip-configuration-00.

Lionel

> -----Message d'origine-----
> De : Richard Pruss [mailto:[email-masked]] 
> Envoyé : mercredi 21 mars 2007 19:19
> À : Ted Lemon
> Cc : DHC WG
> Objet : Re: [dhcwg] draft-pruss-dhcp-auth-dsl-00.txt
> 
> Ted Lemon wrote:
> > On Mar 21, 2007, at 2:45 PM, MORAND Lionel RD-CORE-ISS wrote:
> >> So at least, it seems that there is consensus that something is 
> >> missing in dhcp-based environment for network access control, that 
> >> was not (really) the case several months ago ;)
> >
> > I don't think you can say that.   Dave Thaler actually made 
> a really 
> > nice presentation this morning about his configuration 
> draft, and one 
> > of the points he reiterated, which has been a theme for the DHCP 
> > community pretty much since day one, is that you *can't* control 
> > access to the network using the DHCP protocol.
> >
> I did say this as a comment to Dave's excellent presentation 
> but let me try it on list as well.
> Some switch implementations allow administrative policy that 
> enforces that hosts use DHCP on particular ports, and any 
> host that successfully uses DHCP (as determined by the DHCP 
> server policy) is allowed on the network. Additionally these 
> switches enforce that the host use the address assigned 
> through DHCP, and not some other address.  Then additionally 
> to that some switches enforce not only the use of the 
> assigned address on a port but also enforce the binding 
> between the layer 2  and the IP address.
> 
> The effect of these features in relatively commonly deployed 
> in first hop switches is that the DHCP exchange does 
> effectively control access in the definition Dave gave for 
> access control.  Which is access too things beyond the point 
> of enforcement in this case this is layer 2 access contro and 
> access to things beyond the first hop layer 2 port.
> 
> Regards,
> Ric
> 
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dhcwg
> 
> 

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg