Subject: RE: RE : [Pana] on PANA's requirement to use the unspecified addr ess

From: Soliman Hesham <[email-masked]>
Date: Mon, 10 Nov 2003 23:08:34 -0500

Hi Lionel, 

I wasn't referring to the mobile world. I was saying that
today some operators allow you to get an IP address
first then authenticate. So it seems like _those_ operators
don't worry about the address depletion DoS. I'm wondering
if that problem (that DoS) is not an artificial problem.

I don't know if we can realistically satisfy both: Upper
layer authentication and address allocation after authentication. 

Hesham

 > >  > > => I wouldn't worry about that, I'd just provide the 
 > > proper  > > address from the beginning.  > 
 > >  > This doesn't help the networks where the address assignment 
 > >  > depends on the
 > >  > client's identity. In such networks, final address 
 > >  > assignment must take
 > >  > place after the client authentication.
 > > 
 > > => Or: The IP address is assigned before authentication
 > > and is communicated during the authentication. This could
 > > then be used to open up the filters for that address/MAC 
 > > combination. The only argument against that is of course the 
 > > fear of DoS (address depletion). But as I said earlier 
 > > operators just don't seem to care about this, at least 
 > > in the small deployments that I used. Perhaps others 
 > > have different experiences? 
 > > 
 > > Hesham
 > > 
 > > PS: FWIW my cable modem  operator does exactly that, address 
 > > assignment first, then login. I've also seen it wherever they 
 > > have HTTP redirect used for authentication.
 > 
 > In the case of DSL networks, many scenarios require to 
 > authenticate the
 > user before the IP address assignment. This is to configure the
 > broadband access servers according to services subscribed by 
 > the user.
 > This configuration is performed by the network access 
 > provider. When PPP
 > is used, the configuration is based on information retrieved from the
 > physical layer (ATM link). In the broadband server, there is 
 > actually a
 > direct binding between the user, the ATM link and the PPP connection.
 > 
 > When your are considering a small/personal/residential LAN 
 > connected to
 > the Internet through a DSL access network, DHCP will be used. In that
 > case, the binding user/access link is broken at the broadband access
 > server level. A solution is then needed to authenticate the user. If
 > HTTP redirect may be used when the user just wants to access to the
 > Internet in early deployments (few requirements in terms of access
 > configuration), this solution is not acceptable when you are thinking
 > about the deployment of advanced service architectures on a 
 > large scale.
 > 
 > By the way, when the DHCP server is located behind the 
 > brodband access
 > server (belonging to the service provider) and you want to 
 > control any
 > flow being sent over the access operator's IP backbone, you need to
 > authenticate the user before any IP address allocation. If 
 > you refer to
 > the mobile world, a user must be authenticated before 
 > requesting an IP
 > address (using DHCP) through the GRX backbone (GRX is the private IP
 > backbone interconnecting the mobile operator networks). This user
 > authentication is also used to configure the access server 
 > according to
 > subscribed services.
 > 
 > So, from my point of view, there is indeed a need for supporting user
 > authentication before any IP address allocation.
 > 
 > Best regards,
 > 
 > Lionel
 > 
 > _______________________________________________
 > Pana mailing list
 > [email-masked]
 > https://www1.ietf.org/mailman/listinfo/pana
 > 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Soliman Hesham <[email-masked]>
Date: Mon, 10 Nov 2003 23:08:34 -0500

Hi Lionel, 

Hesham