Subject: RE: Location of authentication agent

From: George Tsirtsis <[email-masked]>
Date: Mon, 15 Apr 2002 18:06:57 -0400

James,

It is typical for access routers to have SAs with backhaul servers e.g.: AAA
servers, management stations and maybe now PANA servers. It is NOT common to
have SAs between ALL the access routers in the domain...for obvious scaling
issues.

George

-----Original Message-----
From: James Kempf [mailto:[email-masked]]
Sent: Monday, April 15, 2002 5:52 PM
To: George Tsirtsis
Cc: [email-masked]
Subject: Re: Location of authentication agent

> Why access routers HAVE to have SAs between them?????
>

They don't necessarily but if the network operator is concerned about
security and is using cryptographic security for exchange of LSAs, then
they will. Injecting a PANA agent means that the network operator is
concerned about security. Why would a network operator enable security
on traffic with a PANA agent and not between access routers?

            jak

---

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Apr 2002 15:35:48 -0700

> have SAs between ALL the access routers in the domain...for obvious
scaling

IGP protocols have security features. What you are saying is that ISPs
don't turn these features on today, because they view the management as
burdensome. After the first report of a successful attack on the routing
infrastructure because an ISP's IGP is not being secured, you can be
sure that ISPs will quickly change their practice regardless of how
burdensome it is.

I don't believe we should predicate a major change in network access
infrastructure on a current, somewhat questionable routing security
practice. If the problem is the difficulty of managing cryptographic
security on the routing infrastructure, then that problem should be
solved. Adding a separate PAA as a workaround for a routing security
management problem seems like a bad idea to me.

But, of course, there may be other reasons why adding a separate PAA is
a good idea, though I still haven't seen any.

            jak