Subject: Re: [Pana] comments on draft-ietf-pana-ipsec-00.txt

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 21 Nov 2003 15:34:49 -0800

> Hello all ...
>
>  I have a question about process you comment at the end of the e-mail...
> should not stept 2) be changed by 3) step? I mean after PANA
> authentication , we would establish a IPSec SA between PaC and EP and
> then to get a global address.
>

The selector that triggers setting up the SA is the inner address i.e
global/routeable
address that is acquired by DHCP/ND. Let us say, you have 2 clients with
GLOB_ADDR1, GLOB_ADDR2 respectively. On the EP, packets whose destination
 address matches either one of the above will send the packets
encrypted/authenticated to the
client. This means EP has to know the client address before negotiating the
SA.
Similarly PaC has to know which address the SA is being bound to. Thus, you
have to acquire an address before setting up the SA.

-mohan

> Thanks.
>
> Mohan Parthasarathy escribió:
>
> >
> >
> >>Alper Yegin wrote:
> >>
> >>
> >>
> >>>>This makes sense in the general way, but we need more details. Also,
> >>>>it might be that there are difficult issues in this. For instance,
> >>>>if network access is based on RA/ND, then we have quite a bit of
> >>>>functionality and freedom. But I'm not sure we have that much if
> >>>>we, say, just assign an address through IKEv2. Or maybe I just
> >>>>don't know where that functionality exists. Anyway, I'd rather
> >>>>have the basic IPv6 functionality available somehow, but I'm not
> >>>>sure if you can actually run it through a tunnel.
> >>>>
> >>>>
> >>>You mean configuring DHCP-based or autoconfigured IPv6 addresses inside
> >>>
> >>>
> >an
> >
> >
> >>>IPv6 tunnel might have issues? Any specific issues in your mind?
> >>>
> >>>
> >>It could be that I just don't know enough about the subject (please
> >>educate me), but has the use of ND over a tunnel been defined
> >>somewhere?
> >>
> >>
> >
> >There is only one on-link prefix i.e the link-local prefix. All other
> >prefixes
> >are considered off-link i.e you have to send it to the default router.
> Thus,
> >the only node you ever do ND is for the default router's link-local
address
> >and the SPD bypasses IPsec for such packets. So, i don't understand where
> >the
> >ND over tunnel issue comes up. Could you clarify ?
> >
> >
> >
> >>And what if you run things over an IPsec tunnel, do
> >>you have to use the IKEv2 facilities only for address assignment,
> >>or can you also do DHCP and ND?
> >>
> >>
> >>
> >The steps are
> >
> >1) PANA authentication is performed. Also EP/PaC learn each other address
> at
> >the
> >    end of the authentication.
> >2) PaC gets a "global" address - DHCP/ND. Need to update the EP about
> >     the address for it to be able to setup SPD. At the end of this step,
> >SPD has
> >     been setup on both PaC and EP.
> >3)  Setup IKE/IPsec SAs.
> >
> >After this, ND/RD is bypassed explicitly by the SPD. Any more DHCP
packets
> >may run
> >over the IPsec tunnel mode SA.
> >
> >These steps were not mentioned in the draft and  i can clarify them. Does
> it
> >answer
> >your question ?
> >
> >-mohan
> >
> >
> >
> >>--Jari
> >>
> >>
> >>_______________________________________________
> >>Pana mailing list
> >>[email-masked]
> >>https://www1.ietf.org/mailman/listinfo/pana
> >>
> >>
> >
> >
> >_______________________________________________
> >Pana mailing list
> >[email-masked]
> >https://www1.ietf.org/mailman/listinfo/pana
> >
> >
> >
> >
>
> -- 
> ------------------------------------------------------
> Rafael Marin Lopez
> Faculty of Computer Science-University of Murcia
> 30071 Murcia - Spain
> Telf: +34968367645 e-mail: [email-masked]
> ------------------------------------------------------ 
>
>
>
>
>
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 21 Nov 2003 15:34:49 -0800

-mohan

address
packets