Subject: RE: [Pana] IP address configuration

From: Soliman Hesham <[email-masked]>
Date: Tue, 25 Nov 2003 21:05:16 -0500

Alper, 

I might be missing something here, but I'm a bit 
confused by a couple of things below.

 > I'm trying to figure out how we can:
 > - just maintain one DI for the PaC, and that is used as the 
 > local end-point
 > of the IPsec tunnel (when IPsec-based access control is used)

 > - any other IP address can be configured inside this tunnel. Router
 > discovery, ND, and DHCP can be run inside the tunnel. These 
 > IP addresses
 > should not be used as PANA DI.
 > 
 > I think supporting DHCP-based or autoconf based address 
 > configuration is
 > required. Additional methods, like IKE-based address config, 
 > is nice to
 > have. 

=> When you talk about the IPsec tunnel are you always
referring to the use of IPsec for access control? I mean
you're never referring to a tunnel to a remote VPN in a 
corporate many hops away, right?

If the above is correct I don't know how stateless address
autoconfig is expected to work through that tunnel and why 
it needs to?? A node could use one address only, same in 
the outer and inner src fields. What am I missing? 

Hesham

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Wed, 26 Nov 2003 09:52:08 -0800

> corporate many hops away, right?

Yes, I'm not talking about a VPN tunnel to some corporate network.

> autoconfig is expected to work through that tunnel

This is what I'm trying to understand too. What are the issues there?

> and why 
> it needs to?? 

Running router discovery and neighbor discovery (for DAD) inside the IPsec
tunnel would provide additional security to the network. This ensures, for
example, PaC does not receive unauthorized router advertisements.

> A node could use one address only, same in

It could. But in the case of IPv6, using the link-local address as the outer
address, and the global address as the inner address makes sense to me.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Wed, 26 Nov 2003 09:52:08 -0800

Alper

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 26 Nov 2003 11:52:58 -0800

> This is what I'm trying to understand too. What are the issues there?
It has been defined before e.g. ISATAP. But i  can see a few problems
here.

1) How do you  send unsolicited RAs to so many PaCs ? Normally
it is sent to all-nodes multicast address that reaches all PaCs. Now, you
have to send multiple of them each with different protection for each
of the PaC. Solicited RAs work. So, this would be a limitation.

2) The secure channel is between PaC and the AR. Two nodes cannot
     communicate with each other in a secure fashion. But this may not be
    a big limitation as the only on-link prefix is the link-local prefix
which is
    any way not used for normal communication.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 26 Nov 2003 11:52:58 -0800

-mohan