Subject: [Pana] IP address configuration

From: Alper Yegin <[email-masked]>
Date: Tue, 18 Nov 2003 17:17:57 -0800

Here is an attempt to describe how IP addresses are configured in various
PANA scenarios..

- Physically secured links:

The device ID can be set to the MAC address of the PaC. Hence the IP address
of the PaC has no significance for the PANA session or the access control
mechnanism. 

If we don't allow unspecified IP addresses in the PANA design, than a
pre-PANA IP address should be configured via address autoconfig or DHCP
before running PANA. If the IP address assignment relies on the identity of
the PaC, a post-PANA address will be configured after PANA authentication. A
statically configured IP address on the PaC can be used as both pre-PANA and
post-PANA address.

If pre-PANA address is not the globally routable (ultimate) IP address, then
the PaC should be prompted to obtain a new (post-PANA) IP address upon
successful PANA authentication. PANA-Bind-Request message can carry the
relevant indication. [If pre-PANA address is the same as post-PANA address,
then we are done.]

If IPv6 is used, the pre-PANA address would be a link-local address. The
post-PANA address might be configured via DHCP or address autoconfiguration.
Both pre-PANA address and post-PANA address can be retained by the PaC at
the same time.

If IPv4 is used, the pre-PANA address should be released before configuring
the post-PANA address. Post-PANA address would be obtained from DHCP in that
case.

- L2-ciphered before PANA:

Same as physically secured links.

- L2-ciphered after PANA:

Same as physically secured links.

- IPsec-based access control after PANA:

This time IP addresses are used as the device ID and they have significance
for the access control and PANA session.

Pre-PANA addresses are configured the same way as before (via DHCP or
stateless address autoconfiguration). IPv6 link-locals used for IPv6, and
IPv4 link-local or DHCP for IPv4.

A pre-PANA address is bound to the PaC as the device ID. It will be used as
the local end-point of the IPsec tunnel to the EP.

If PaC needs to configure a post-PANA address, this should be indicated by
the PANA-Bind-Request message. PaC should attempt this configuration inside
the tunnel. For IPv4, this can be via DHCP. For IPv6, stateless address
autoconfiguration or DHCP can be used.

Both pre-PANA and post-PANA addresses are used by the PaC at the same time,
though post-PANA addresses only appear inside the tunnel. A post-PANA
address has no significance for the PANA session or access control.

If pre-PANA and post-PANA addresses are the same, they will be used both
inside and outside the tunnel (any issues with IPsec processing?). This can
be the case when the client has a static IP address, or the DHCP address
assignment does not depend on the client identity.

Comments?

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Ashutosh Dutta <[email-masked]>
Date: Tue, 18 Nov 2003 21:42:40 -0500

> statically configured IP address on the PaC can be used as both pre-PANA and

If  a  Pac  is  configured  to   use  DHCP  as  a  means  for  address
configuration,  then Pre-PANA  and post-PANA  address would  always be
same, PaC  will be talking to the  same DHCP server in  the subnet for
address configuration.  Things may be different if  one configures Pac
to  have a  static  address as  Pre-PANA  and then  uses  DHCP as  the
post-Pana. But then  how do you toggle between static  and DHCP in the
network configuration file.  Things do not work that  well if you have
have BOOTPROTO set to both static and DHCP.

> relevant indication. [If pre-PANA address is the same as post-PANA address,

Who is going to provide this globally routable IP address, I assume
Pac is behind a NAT here, and the pre-PANA address it has obtained is
from a DHCP server within the NAT.

> Both pre-PANA address and post-PANA address can be retained by the PaC at

What is the compexity of having both addresses active at the same time
on the same interface of Pac.

> autoconfiguration or DHCP can be used.

How well DHCP messages work over an IPSEC tunnel, in the above case?

Thanks
Ashutosh

---

From: Ashutosh Dutta <[email-masked]>
Date: Tue, 18 Nov 2003 21:42:40 -0500

Thanks
Ashutosh

---

From: Alper Yegin <[email-masked]>
Date: Tue, 18 Nov 2003 20:40:50 -0800

On 11/18/03 6:42 PM, "Ashutosh Dutta" <[email-masked]> wrote:

> address configuration.

Not necessarily. Pre-PANA address might be allocated from the address pool
of the NAP, whereas post-PANA address might be allocated from the ISP's
pool. 

> Things may be different if  one configures Pac

If a PaC is already configured with a static IP address, it does not have to
configure another one via DHCP after PANA. The same IP address can be used
before and after PANA.

> from a DHCP server within the NAT.

I shouldn't have said "globally routable". Yes, you are right, it can also
be a RFC1918 address. I meant to refer to the address that will be used for
data communication after the client is authorized to access the network.

> on the same interface of Pac.

It's part of the base IPv6 design to have a link-local and global IPv6
address at the same time.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Tue, 18 Nov 2003 20:40:50 -0800

Alper

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 20 Nov 2003 18:11:18 -0800

Alper,

> If PaC needs to configure a post-PANA address, this should be indicated by

I am not sure i understood the "need" part. The PaC most likely would
configure
a routeable address. And why does the network operator control this ?

> autoconfiguration or DHCP can be used.
As i clarified in my other email, you don't setup the IPsec selectors until
you have
acquired the "routeable" (inner) address. And these addresses are used as
selectors
in the SPD.

> address has no significance for the PANA session or access control.
For tunnel mode SA, the outer addresses are not significant for access
control.
The inner addresses are used for access control. SPD selectors are inner
addresses.

> inside and outside the tunnel (any issues with IPsec processing?). This
can

Some implementations have problem with this when the packets are destined to
the tunnel end point address itself. Here, these will be PANA messages
which will anway be bypassed (mentioned in the draft) i.e no IPsec for PANA
messages flowing between PaC and PAA/EP.

> assignment does not depend on the client identity.
mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 20 Nov 2003 18:11:18 -0800

Alper,

mohan

---

From: Alper Yegin <[email-masked]>
Date: Fri, 21 Nov 2003 17:18:48 -0800

> a routeable address. And why does the network operator control this ?

Actually pre-PANA and post-PANA addresses do not necessarily mean
link-local/non-routable and globally routable addresses. Pre-PANA address is
configured prior to PANA and used during the authentication. Post-PANA
address is configured after the PaC is authorized.

In case the PaC is statically configured, or the IP address assignment does
not depend on the PaC identity and the network is willing to assign the
ultimate IP address to the client before authentication, then pre- and
post-PANA addresses can be the same.

In an access network, the ultimate IP address assignment might rely on the
identity of the PaC (e.g., DSL networks). In that case, the NAP might assign
a pre-PANA address first. Later, the PaC needs to configure post-PANA
address that belongs to the ISP network.

> The inner addresses are used for access control. SPD selectors are inner

Apparently I was still thinking in terms of IP-IP transport mode (the older
version of the draft).

Even in tunnel mode, I'd think we can use ID_IPV6_ADDR_RANGE for PaC's phase
2 identity, so that the inner IP addresses can be anything. And run address
autoconfiguration or DHCP inside the tunnel.

> the tunnel end point address itself.

Does this have anyting to do with the specification, or the intended use of
it? Or, is this simple a shortcoming or a bug in some implementations?

> Here, these will be PANA messages

Alper

---

From: Alper Yegin <[email-masked]>
Date: Fri, 21 Nov 2003 17:18:48 -0800

Alper

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 21 Nov 2003 17:38:06 -0800

> Apparently I was still thinking in terms of IP-IP transport mode (the
older
Yes. The older version of the draft used just the link-local address as
selectors.
So, it is possible to do IPsec as soon as you are done with PANA.

> autoconfiguration or DHCP inside the tunnel.
I am not sure whether the EP would accept the range. EP may just accept only
one address as it lets any authenticated nodes spoof each other very easily.
I have only seen ranges used by VPN gateways and not sure whether any
host uses it or not. Again, if we can fix this in other ways e.g. using
IP-IP transport mode, we should do that.

> it? Or, is this simple a shortcoming or a bug in some implementations?
It is just an implementation artefact. I send packets to "DEST", route
lookup
returns a tunnel interface, which in turn encapsulated with outer header
"DEST" , re-enters IP and loops again. This comes as a side effect of
implementing IPsec tunnel mode SA as an "interface". This is not
a real issue here as we can always bypass IPsec for messages sent
to EP.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 21 Nov 2003 17:38:06 -0800

-mohan