Subject: RE: [Pana] on PANA's requirement to use the unspecified address

From: Soliman Hesham <[email-masked]>
Date: Sat, 8 Nov 2003 21:42:27 -0500

> > Thus, what I'd really like to understand is why the following isn't
 > > the standard pana model:
 > > 
 > > - device gets an address using standard mechanisms (either 
 > DHC, IPv4
 > > LL, or IPv6 LL). Since the PAA is required to be on the 
 > same IP link
 > > as the PAC, LL addressing works just fine.
 > > 
 > > - Use the address obtained in the previous step to run 
 > PANA. Because
 > > its a proper address, IP-based protocols just work.
 > > 
 > > - Once PANA has completed, obtain a proper/better address, 
 > if that is
 > > what is needed. (And there are lots of ways of doing this, but that
 > > comes later).
 > 
 > Aside from the security issue, this approach has additional 
 > burden on the
 > deployment.
 > 
 > For the first step, either the PaC should be using an IPv4 link-local
 > implemantation, or the access network must be maintaining a 
 > DHCP pool of
 > temporary PANA addresses. The latter might mean having to 
 > add a DHCP server
 > on that network, which otherwise could be using a DHCP relay only.

=> Why not just provide a normal address (not LL and not 
a temp "special" DHC address for PANA)? The address could be 
provided with a short lease time if DoS is the issue. 
Do people know of current deployments that use HTTP
redirect and do not provide an IP address at the beginning?
We can have the same model in PANA. What happens if you
connect to the WLAN today, get an address and then never
login the HTTP redirect? This is certainly possible. 

 > 
 > For the third step, PANA should signal whether the current 
 > IP address can be
 > kept, and whether the PaC can (or has to) to obtain a new IP 
 > address. 

=> I wouldn't worry about that, I'd just provide the proper
address from the beginning. 

Hesham

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 10 Nov 2003 09:35:13 -0800

> address from the beginning.

This doesn't help the networks where the address assignment depends on the
client's identity. In such networks, final address assignment must take
place after the client authentication.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 10 Nov 2003 09:35:13 -0800

Alper

---

From: Jari Arkko <[email-masked]>
Date: Mon, 10 Nov 2003 17:57:04 +0200

First, I'd like to echo Thomas' concern on the use of the unspecified
address. I think it is likely that either PANA or EAP within PANA has
a similar DoS issue as we are trying to avoid here.

> place after the client authentication.

Yes, I agree that this can be a requirement in some cases. But in a way,
it highlights another issue: what are the addresses that are used on the
wire. Are they first some local addresses, and then *switch* to addresses
from an ISP? If yes, I'd like to understand if both addresses are still
considered to be "on-link" and whether you can use either one at any
time? Or do we need to know that in state X of PANA the addresses are
local and in state Y they are from the ISP? What if the ISP and the
local addresses overlap?

Or perhaps the intention is that there's *encapsulation* so that the
local addresses always appear on the PANA packets or on the outer
headers of payload packets, and the ISP addresses can appear only
in the inner headers?

--Jari

---

From: Jari Arkko <[email-masked]>
Date: Mon, 10 Nov 2003 17:57:04 +0200

--Jari

---

From: Alper Yegin <[email-masked]>
Date: Mon, 10 Nov 2003 10:50:12 -0800

> a similar DoS issue as we are trying to avoid here.

As I was saying earlier, we should look at the specifics of the DoS attacks.
Are you thinking of any particular DoS attack in PANA or EAP?

> from an ISP? 

This switch is necessary if we require PaC to have an IP address prior to
using PANA, and we are not using IPsec-based access control (i.e., no tunnel
between PaC and EP). [if IPsec-based access control is used, then the "local
address" becomes the local end-point of the tunnel, and the ISP-based
address should be configured inside the tunnel]

> If yes, I'd like to understand if both addresses are still

Local address should be used for PANA exchanges and tunneling data packets
to EP when IPsec-based access control is used.

If IPsec-based access control is not used, the local addresses are not
needed. In case of IPv4, they can cause trouble.  The host should not have
more than one IPv4 address. In IPv6, the host can deal with this if the
local address is a IPv6 link-local address.

> headers of payload packets, and the ISP addresses can appear only

Yes. When the local addresses are maintained on the PaC, this should be
their use.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 10 Nov 2003 10:50:12 -0800

Alper