Subject: Re: [Pana] IP address configuration

From: [email-masked]
Date: Mon, 24 Nov 2003 17:02:50 -0800

I'm trying to figure out how we can:
   - just maintain one DI for the PaC, and that is used as the local
   end-point
   of the IPsec tunnel (when IPsec-based access control is used)

OK.

   - any other IP address can be configured inside this tunnel. Router
   discovery, ND, and DHCP can be run inside the tunnel. These IP addresses
   should not be used as PANA DI.

I agree tht these addresses should not be uesd as PANA DI when IPsec when
IPsec-based access control is used.  But it is possible to configure any
these addresses
outside of IKE or IKEv2 and then register it as the IPsec tunnel inner
address
within IKE or IKEv2 signaling (by using the address as IKE Phase 2 SA or
IKEv2 CHILD_SA
identification, with still using link-local address as PANA DI (thus
the inner address can be transparent to PAA). So I don't understand why
configuring
every inner address through IKE or IKEv2 is preferred. What is preferred is
allowing
flexibility in inner IP address acquisition procedures (which can be
performed
inside or outside of IKE or IKEv2).

   I think supporting DHCP-based or autoconf based address configuration is
   required. Additional methods, like IKE-based address config, is nice to
   have. This is so that the impact of PANA on the access network
   architecture
   is minimal. It sounds like both IP-in-IP transport mode SA and tunnel
   mode SA with
   wildcard phase 2 identities support these...

It seems that we are thining about the same goal in a slightly different
way. I think
what is required for PANA is to be able to become transparent to any inner
address configuration
methods.  If both IP-in-IP transport mode SA and tunnel mode SA
negotiations support
DHCP and autoconf inside IKE/IKEv2, that is fine (but I think using tunnel
mode SA is enough).
On the other hand, if particular type of IPsec SA negotiation can support
only limited type of configuration method inside IKE/IKEv2, that is also
fine, because that is an IKE/IKEv2 design
and/or implementation issue, and not a PANA issue.

Yoshihiro Ohba

   Alper

   > With regard to the inner address assignment through IKE or IKEv2,
   > just use the method(s) available for tunnel mode SA.
   >
   > I don't think we have to support IP-in-IP transport mode SA just
   because a
   > particular address configuration
   > method may not be supported by tunnel mode SA.
   >
   > Yoshihiro Ohba
   >

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 25 Nov 2003 11:55:48 -0800

> the inner address can be transparent to PAA).

If you are saying that we can let PaC configure inner addresses in any way
they like (statically, via DHCP, via autoconf), and let PaC "register" them
through IKE/IKEv2 in a transparent way to PANA, then that's fine. Only the
outer address will have significance for the PANA "network access
authorization." The inner addresses would have significance for "IP address
authorization" which PANA does not care.

Does IKE/IKEv2 allow updating the inner addresses at any time?

> So I don't understand why
> configuring
> every inner address through IKE or IKEv2 is preferred.

No, I didn't mean that. I said configuring post-PANA addresses inside the
IPsec tunnel is preferred.

> What is preferred is

What do you mean by "inside IKE/IKEv2"? Do you mean inside the IPsec tunnel?

> and/or implementation issue, and not a PANA issue.

We need to make sure the networks are still capable of configuring IP
addresses for their clients the same way they have been doing before
(whether it is done statically, via DHCP, or via autoconf). If we don't,
then that'd be a limitation of this design.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Tue, 25 Nov 2003 11:55:48 -0800

Alper