Subject: Re: [Pana] IP address configuration

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 1 Dec 2003 12:30:13 -0800

> 
> I took people off from cc and to fields.
> 
> A more general comment here. I tried to catch up with 
> about 50 emails on the pana mailing list and found that 
> the scenarios we are talking about with PANA+IPSec and IP
> address configuration etc. are becoming a bit complex.
> 
> I'm not up-to-date with all the documents, but it seems 
> that we have too many moving parts and architectural
> decisions that do not all affect plain PANA.
> 
I almost agree with this. But we are at a point to see what IP addresses
are used by PANA protocol itself as PANA runs over IP. Next
comes the question of  how the client acquires these IP addresses - before
or after PANA ? Then we agreed to document some access control
mechanism to prevent the service theft mentioned in the THREATS draft.
Perhaps we should stop here. At least the discussion should have two
separate threads. One is about address configuration and the access
control mechanism associated with it. Second one (might be out of
scope as mentioned by others) about using PANA to do much
more like securing RD/ND etc. 

So, large part of the discussion might still be in scope i think.

-mohan

> Br,
> - Dan
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of ext
> > Mohan Parthasarathy
> > Sent: 26 November, 2003 21:53
> > To: Alper Yegin; Soliman Hesham; [email-masked]
> > Cc: Bernard Aboba; Jari Arkko; James Kempf; [email-masked]
> > Subject: Re: [Pana] IP address configuration
> > 
> > 
> > 
> > > >> I'm trying to figure out how we can:
> > > >> - just maintain one DI for the PaC, and that is used as the
> > > >> local end-point
> > > >> of the IPsec tunnel (when IPsec-based access control is used)
> > > >
> > > >> - any other IP address can be configured inside this 
> > tunnel. Router
> > > >> discovery, ND, and DHCP can be run inside the tunnel. These
> > > >> IP addresses
> > > >> should not be used as PANA DI.
> > > >>
> > > >> I think supporting DHCP-based or autoconf based address
> > > >> configuration is
> > > >> required. Additional methods, like IKE-based address config,
> > > >> is nice to
> > > >> have.
> > > >
> > > > => When you talk about the IPsec tunnel are you always
> > > > referring to the use of IPsec for access control? I mean
> > > > you're never referring to a tunnel to a remote VPN in a
> > > > corporate many hops away, right?
> > >
> > > Yes, I'm not talking about a VPN tunnel to some corporate network.
> > >
> > > >
> > > > If the above is correct I don't know how stateless address
> > > > autoconfig is expected to work through that tunnel
> > >
> > > This is what I'm trying to understand too. What are the 
> > issues there?
> > >
> > It has been defined before e.g. ISATAP. But i  can see a few problems
> > here.
> > 
> > 1) How do you  send unsolicited RAs to so many PaCs ? Normally
> > it is sent to all-nodes multicast address that reaches all 
> > PaCs. Now, you
> > have to send multiple of them each with different protection for each
> > of the PaC. Solicited RAs work. So, this would be a limitation.
> > 
> > 2) The secure channel is between PaC and the AR. Two nodes cannot
> >      communicate with each other in a secure fashion. But 
> > this may not be
> >     a big limitation as the only on-link prefix is the 
> > link-local prefix
> > which is
> >     any way not used for normal communication.
> > 
> > -mohan
> > 
> > > > and why
> > > > it needs to??
> > >
> > > Running router discovery and neighbor discovery (for DAD) 
> > inside the IPsec
> > > tunnel would provide additional security to the network. 
> > This ensures, for
> > > example, PaC does not receive unauthorized router advertisements.
> > >
> > > > A node could use one address only, same in
> > > > the outer and inner src fields. What am I missing?
> > >
> > > It could. But in the case of IPv6, using the link-local 
> > address as the
> > outer
> > > address, and the global address as the inner address makes 
> > sense to me.
> > >
> > > Alper
> > >
> > > >
> > > >
> > > > Hesham
> > > >
> > >
> > >
> > > _______________________________________________
> > > Pana mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/pana
> > 
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> > 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 1 Dec 2003 12:30:13 -0800

-mohan