Subject: RE: [Pana] on PANA's requirement to use the unspecified address

From: Soliman Hesham <[email-masked]>
Date: Mon, 10 Nov 2003 11:30:20 -0500

> > => I wouldn't worry about that, I'd just provide the proper
 > > address from the beginning.
 > 
 > This doesn't help the networks where the address assignment 
 > depends on the
 > client's identity. In such networks, final address 
 > assignment must take
 > place after the client authentication.

=> Or: The IP address is assigned before authentication
and is communicated during the authentication. This could
then be used to open up the filters for that address/MAC
combination. The only argument against that is of course
the fear of DoS (address depletion). But as I said earlier
operators just don't seem to care about this, at least 
in the small deployments that I used. Perhaps others 
have different experiences? 

Hesham

PS: FWIW my cable modem  operator does exactly that, address
assignment first, then login. I've also seen it wherever
they have HTTP redirect used for authentication.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 10 Nov 2003 13:56:40 -0800

> and is communicated during the authentication.

You mean one IP address is assigned prior to auth, and another one after
auth? If so, this causes the additional complexity as I outlined earlier.
[remember, I was trying to make the point that the IP address that is
assigned prior to PANA might not be the final IP address Pac will use to
access the Internet]

> This could

As I understand, the operators would like to authenticate the client before
allocating any resources, when possible. In the case of captive portal this
is not possible, because you need to have an IP address to access a web
page. 

> they have HTTP redirect used for authentication.

They don't have any other option, when they need to carry HTTP packets over
TCP.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 10 Nov 2003 13:56:40 -0800

Alper

---

From: "Prakash Jayaraman" <[email-masked]>
Date: Mon, 10 Nov 2003 14:51:11 -0600

> have different experiences?

This email is in response to Hesham's suggestion about assigning IP
address before authentication phase:

A typical NAS deployed in a large network usually serves multiple
"Internet Service Providers" and "Application Service Providers". Every
ISP owns a collection of IP address pools. Each collection is usually
referred to as a "domain".  A number of ISP's may use a single address
space and hence a single routing context. Some NAS's support multiple
routing contexts in the same physical device to allow the use of
overlapping address spaces by multiple ISPs. (See the last paragraph
about Application Service Providers).

So, it is important for the NAS device to find out which ISP to allocate
the IP address from. For PPP users, this is done by looking at the FQDN
and associating the domain-part of it to an ISP.

DHCP based access does not have this concept. It is primarily for
host-configuration in a single routing context. All the hosts on a given
interface must use a single ISP (and hence a single routing context), if
they use DHCP.  Cable modem operators own the NAS device as well as
function as the only ISP. However, there are also wholesale models in
which the NAS device is owned by one entity and the Internet Service is
provided by multiple ISP's sharing the same NAS.

If there is a single NAS and a single ISP, address-depletion-based DoS
attack is equivalent to having a wrong-password.  If there are multiple
ISPs, the problem is more fundamental than that - NAS does not know
which address to choose. In addition, this choice has to be dynamic
(i.e. not statically configured) depending on the user's identity.

Extending the host-configuration a bit beyond IP address assignment, the
host should be configured depending on the user. A person usually
connects to a domain creating a login-session. The domain has IP address
pools, DNS servers, WINS servers, DHCP servers, email-server,
access-control-lists, firewall rules etc. etc. and these parameters are
specific to domains. NAS needs a way of figuring out the services to be
offered to a user and it uses FQDN today. To offer the services
successfully, host-configuration must be done after NAS performs a AAA
procedure.

- prakash

---

From: "Prakash Jayaraman" <[email-masked]>
Date: Mon, 10 Nov 2003 14:51:11 -0600

- prakash

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 10 Nov 2003 17:55:30 -0800

> have different experiences? 
I did not have enough battery power to test this. But at the airport,
i got an address as soon as i connected to the network.  It was
a globally routable address. I could just use it for ping and any
web access was redirected. It is easy to exhaust this and perhaps
the airport operator does not care about this because not many
people use it to access the internet ?

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 10 Nov 2003 17:55:30 -0800

-mohan