Subject: RE: Location of authentication agent

From: George Tsirtsis <[email-masked]>
Date: Mon, 15 Apr 2002 15:10:58 -0400

James,

I suggest you do that. Personally I do not care much about the split
scenarios but that is not a reason for those to not exist. To put it another
way, I do not see a reason to force collocation. Architecturally and
conceptually the PANA Server and the Enforcement point ARE separate entities
and artificially forcing them to co-exist does not give us anything.

If they do co-exist then things are simple and we have the core protocol for
PANA that deals with that. If they do not co-exist then a third protocol is
also needed. SNMP is prime candidate for that as has been indicated before.
PANA WG could choose to either say this is out of scope and PANA WG will not
provide the details of this protocol (so vendors can develop their own
solutions) or some people interested in interoperability (now or later)
could write something up to show how SNMP could be used for that purpose.

So, again, I do not understand what is the benefit of forcing colocation.

George

-----Original Message-----
From: James Kempf [mailto:[email-masked]]
Sent: Monday, April 15, 2002 12:04 PM
To: Hesham Soliman (ERA); Alper E. YEGIN; [email-masked]
Subject: Re: Location of authentication agent

> What is the 
>   > application
>   > that won't work with a traditional NAS-style architecture?
> 
> => Have a look at the scenarios draft. 
> You could question whether the scenarios are important
> enough, but there is no question that the scenarios 
> exist and have been discussed when BURP started. 
> 

I've looked at the scenarios draft, and I don't find the arguments
compelling. I will attempt to find the time to compose an email with
a detailed description of why.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Apr 2002 12:36:59 -0700

> So, again, I do not understand what is the benefit of forcing
colocation.

One word, George:

        S-I-M-P-L-I-C-I-T-Y

            jak

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 15 Apr 2002 16:53:50 -0400

I don't understand how it can be simple in the case of, for example,
load sharing described in draft-ietf-ipv6-host-load-sharing-00.txt.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Apr 2002 13:05:45 -0700

Yoshi,

By using the same method described in previous email to propogate the
AAA info from the router hosting the NAS to another, i.e. SNMP. Secured,
of course. This was brought up at Minneapolis.

            jak

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: "George Tsirtsis" <[email-masked]>; "Hesham Soliman (ERA)"
<[email-masked]>; "Alper E. YEGIN"
<[email-masked]>; <[email-masked]>
Sent: Monday, April 15, 2002 1:53 PM
Subject: Re: Location of authentication agent

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 15 Apr 2002 17:47:50 -0400

> of course. This was brought up at Minneapolis.

I think that requires N^2 security associations for N access routers
sharing the load.  If separation between PANA Agent and enforcement
point is allowed, the number of security associations is reduced to N
(PAA to each access router).

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Apr 2002 14:16:49 -0700

> (PAA to each access router).

The routers have to have those security associations anyway, to handle
cryptographic security on their LSAs. Injecting the PANA agent requires
N more than would otherwise be necessary.

        jak

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 15 Apr 2002 18:36:16 -0400

The number of LSAs is not a problem at all since LSAs are dynamically
established.  The SAs between routers are static ones and that would
increase management complexity, I think.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Apr 2002 14:58:41 -0700

> increase management complexity, I think.

LSA means "Link State Advertisement". It is the reachability information
that is exchanged between routers. If a network operator is concerned
about security, they will enable cryptographic security on their router
traffic. If they are offering public access service and require PANA,
then it makes a certain amount of sense that they do.

Regarding the SAs being static, what's the problem? The routers can use
Kerberos, IKE locally, or AAA to obtain keys, so the key distribution is
taken care of. Of course, the network operator must enable that, but the
same steps are needed for a separate PAA if you want to use Kerberos,
IKE locally, or AAA for PAA key distribution.

            jak

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Mon, 15 Apr 2002 15:19:50 -0700

IETF 53 presentation slides can be found at:

http://www.toshiba.com/tari/ietf53-pana.html

Thanks to Yoshihiro Ohba for posting these on the web.

alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 16 Apr 2002 07:35:23 -0400

> IKE locally, or AAA for PAA key distribution.

OK, static SA will not be the problem.  Do you assume using the same
SA for securing Link State Advertisement and securing SNMP?  If you
don't necessarily assume that, I don't still understand why
co-location is simpler than separation.  Moreover, it seems to me that
allowing SNMP 'set' operation mutually among access routers is
difficult to manage.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Apr 2002 09:33:32 -0700

Whatever is used currently between a NAS and other routers on the link
would work for a PAA as a NAS.

            jak

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: "Yoshihiro Ohba" <[email-masked]>; "George Tsirtsis"
<[email-masked]>; "Hesham Soliman (ERA)"
<[email-masked]>; "Alper E. YEGIN"
<[email-masked]>; <[email-masked]>
Sent: Tuesday, April 16, 2002 4:35 AM
Subject: Re: Location of authentication agent

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 16 Apr 2002 14:23:56 -0400

Jim,

Your model is also based on separation of Authentication Agent (AA)
and Enforcement Point (EP) in that an access router which acts as an
AA distributes access control rules to other access routers (including
itself) which are EPs.  So you seem to basically agree on the
separated model.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Apr 2002 11:06:54 -0700

Yoshi,

You are confusing the functional architecture and the network
architecture. I agree that the AA and EP are two separate functional
entities. I believe that they need to be grouped into the default router
network entity, not that they can be arbitrarily assigned to a network
entity somewhere in the access network.

These are two very different network architectures.

            jak

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: "Yoshihiro Ohba" <[email-masked]>; "George Tsirtsis"
Sent: Tuesday, April 16, 2002 11:23 AM

> > > > Regarding the SAs being static, what's the problem? The routers
can
> > use
> > > > taken care of. Of course, the network operator must enable that,
but
> > the

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 16 Apr 2002 16:22:27 -0400

I don't think I'm confused.  Let me explain more accurately.  Your
model is also based on the separated model in that it requires
external communication between the AA functional entity of an access
router network entity and the EP functional entities of other access
router network entities.  Only the communication between the AA and EP
functional entities of the same access router network entity can occur
internally.  Hence, it seems to me that your co-located model is
essentially no different from the separated model.  

Yet another case is that AA is in the same subnet as the PaC but is
not co-located with any ARs on the same subnet.  This case is similar
to your model in that all EP and AA are placed at the edge.  I still
don't see a need for coupling AA and EP in access routers in load
sharing scenario.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Apr 2002 13:33:14 -0700

OK, but today the NAS model works fine with multiple access routers. Why
does this need to be changed?

            jak

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: "Yoshihiro Ohba" <[email-masked]>; "George Tsirtsis"
Sent: Tuesday, April 16, 2002 1:22 PM

> > > > Whatever is used currently between a NAS and other routers on
the
> > link
> > > > > > > established.  The SAs between routers are static ones and
that
> > > > would
> > > > > > about security, they will enable cryptographic security on
their
> > > > router
> > > > > > traffic. If they are offering public access service and
require
> > > > PANA,
> > > > > OK, static SA will not be the problem.  Do you assume using
the
> > same
> > > > > SA for securing Link State Advertisement and securing SNMP?
If
> > you
> > > > > co-location is simpler than separation.  Moreover, it seems to
me
> > that

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 16 Apr 2002 18:11:49 -0400

> does this need to be changed?

Today's NAS model is based on PPP where a (PPP) client is always 
associated with a single AR even there are multiple ARs and thus 
no external communication occurs among access routers to carry 
access control information (thus co-locating AA and EP does make 
much sense).

The scenario we are considering is already different from today's NAS
model in that a client is to be assiciated with mulitple ARs at the
same time and thus external communication inevitable between AA and EP
(even in your model as I explained in the previous mail) to carry
access control information.  In this case, considering separation
between AA and EP from the viewpoint of both functional architecture
and network architecture makes much sense to me.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Apr 2002 15:27:18 -0700

Sorry, I still don't see much point in separating the functional
entities just for the point of separation.
Having the EP and AA on a single default router, even if EP information
needs to get sent to other routers, isolates the decision and
enforcement point at the edge, where it belongs. More complication can
be introduced via a distributed AAA infrastructure, if needed.

For a strong security argument about why enforcement and decision at the
edge are a good idea, see my previous email about DoS attackes.

        jak

> > > > entities. I believe that they need to be grouped into the
default
> > > > > and Enforcement Point (EP) in that an access router which acts
as
> > an
> > > > > > > > > The number of LSAs is not a problem at all since LSAs
are
> > > > > > dynamically
> > > > > > > > LSA means "Link State Advertisement". It is the
reachability
> > > > > > information
> > > > > > > > that is exchanged between routers. If a network operator
is
> > > > > > concerned
> > > > > > > > taken care of. Of course, the network operator must
enable
> > that,
> > > > but
> > > > > > the
> > > > > > > > same steps are needed for a separate PAA if you want to
use
> > > > > > Kerberos,

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 17 Apr 2002 11:01:50 -0400

> edge are a good idea, see my previous email about DoS attackes.

When we consider putting both EP and AA at the edge, we still have 
design choices.

The first one is your model, which is:

    AR1[AA+EP]
    AR2[AA+EP]
    AR3[AA+EP]

In this model each AR needs to support PANA, EAP and 
secure SNMP with firewall MIB 

The other one is the model that I mentioed "Yet another case" 
in my previous mail, which is:

    AA(at the edge subnet)
    AR1[EP]
    AR2[EP]
    AR3[EP]

I think the security threat is the same for both models 
in that all AAs and EPs are in the edge subnet.

The latter model makes the cost of the ARs lower than your model,
since ARs does not have to support EAP and PANA at all.  
Those ARs just need to support secure SNMP with firewall MIB.

So separating AA and EP makes sense when we consider implementation
cost even if AA and EP are located at the edge.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 17 Apr 2002 11:20:50 -0400

> edge are a good idea, see my previous email about DoS attackes.

BTW, I still don't understand what is the security threat that is said
to occur when putting AA behind ARs.  I think if the firewall
parameters for the ARs are set in such a way that they only pass
through PANA messages by default, the level of security is equivalent
to the co-located model.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Thu, 18 Apr 2002 08:27:12 -0700

Right, but the attacker can still continue to pump PANA packets at the
PAA.

            jak

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: "Yoshihiro Ohba" <[email-masked]>; "George Tsirtsis"
Sent: Wednesday, April 17, 2002 8:20 AM