Subject: RE: Concerns about draft-ietf-pana-requirements-00

From: George Tsirtsis <[email-masked]>
Date: Thu, 7 Feb 2002 08:07:04 -0500

-----Original Message-----
From: Yoshihiro Ohba [mailto:[email-masked]]
Sent: Thursday, February 07, 2002 12:20 AM
To: Alper Yegin
Cc: James Carlson; Yoshihiro Ohba; [email-masked]
Subject: Re: Concerns about draft-ietf-pana-requirements-00

On Wed, Feb 06, 2002 at 03:36:07PM -0800, Alper Yegin wrote:

[...]

> > PPP provides an inherently point-to-point interface.  This is by
> > design.  If you have a multiaccess subnetwork (e.g., Ethernet), then
> > you're certainly not using a point-to-point model.  In particular, you
> > have arbitrary peer-to-peer relationships on that network (which, to
> > emulate with PPP, would require either a full mesh of point-to-point
> > links, or the use of a designated router) and you likely have the
> > options of broadcasting and multicasting (depending on the exact
> > technology used).
> 
> This is a very good point. We need to capture this in the req. draft.

Since 802.1X can solve that problem, I don't think that thing can
really justify the need for PANA.  

GT> Yoshi, 802.1X can NOT solve the problem. I keep saying this but it is
important. 802.1X authenticates a node to an Access Point (AP). This AP may
be far, far away and over multiple link layer hops from the nearest Access
Router. PANA authenticates a node to the first IP aware Access Router no
matte how many link layer hops are between them. The scope of the problem is
totally different and should be very clear by now.

George

---

From: James Carlson <[email-masked]>
Date: Thu, 7 Feb 2002 08:53:00 -0500 (EST)

> totally different and should be very clear by now.

Let me paraphrase to make sure I understand your point: "802.1X is
broken because the link authentication that occurs stops at the Access
Point, and this node doesn't necessarily carry the authentication via
standard protocols to a backend service that can do authentication in
the same way for all access methods."

In other words, the problem isn't precisely that the Access Router
isn't involved in the actual authentication, but rather that the
mechanism that exists doesn't integrate well with AAA or the assumed
trust model.  As long as some properly functioning and correctly
configured node serves as the boundary for the provider's network and
links into AAA in an appropriate way, why should we care whether this
node is necessarily classed as a "link layer" device or a "router?"

This seems to be an argument to either fix or replace 802.1X, and not
necessarily an argument that PANA must be an independent protocol.

-- 
James Carlson, Solaris Networking         <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677

---

From: John Schnizlein <[email-masked]>
Date: Thu, 07 Feb 2002 09:53:03 -0500

James,

Would you please take a look at draft-congdon-radius-8021x-17.txt
and tell us if this fixes the problem "that [it] doesn't integrate 
well with AAA or the assumed trust model"?

My impression is that using the Internet Standard (RADIUS) AAA back-end 
provides the sort of integration you may have found lacking.

John

At 08:53 AM 2/7/2002, James Carlson wrote:
>George Tsirtsis writes:
>> GT> Yoshi, 802.1X can NOT solve the problem. I keep saying this but it 
>> is important. 802.1X authenticates a node to an Access Point (AP). This 
>> AP may be far, far away and over multiple link layer hops from the 
>> nearest Access Router. PANA authenticates a node to the first IP aware 
>> Access Router no matte how many link layer hops are between them. The 
>> scope of the problem is totally different and should be very clear by now.
>

---

From: James Carlson <[email-masked]>
Date: Thu, 7 Feb 2002 10:15:31 -0500 (EST)

> well with AAA or the assumed trust model"?

I'm aware of the draft.  I wasn't agreeing with the point you quote at
all: I was trying to understand it by paraphrasing it.  Perhaps I
didn't make that clear enough ...

> provides the sort of integration you may have found lacking.

Yes; it certainly does, but I didn't find it lacking in the first
place.  It was the original poster's contention that 802.1X didn't
solve the same problem as PANA because 802.1X has the node
authenticate itself to the Access Point, and PANA has it authenticate
itself to the Access Router.  I was pointing out that, as long as the
AAA backend is the same and the authentication method is the same,
then there appears to be no practical authentication-related
difference from the provider's viewpoint between allowing the AP to do
the work versus the AR.

In fact, doing it at the AP is likely better in practice: if you defer
to the AR, then you have to either do the authentication twice or
allow unauthenticated traffic to pass on those links between the AP
and AR.  Neither solution is as clean.

Even if you have a common PANA mechanism, but you allow different
authentication types over it, then the provider is stuck with dealing
in different authentication realms and (based on the vagarities of
implementations) this is very likely to vary based on access method.
So, I don't think PANA actually fixes one of the problems.

---

From: Jacques Caron <[email-masked]>
Date: Thu, 07 Feb 2002 23:03:13 +0100

James,

>the same way for all access methods."

The 802.1x spec explicitly tackles the use of a back-end AAA mechanism 
(RADIUS). And most switches and APs that do implement 802.1x support RADIUS.

>necessarily an argument that PANA must be an independent protocol.

I think 802.1x is just fine. The only issue is deployment (not everybody 
uses Win XP).

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: Jacques Caron <[email-masked]>
Date: Thu, 07 Feb 2002 22:59:07 +0100

Hi George,

>totally different and should be very clear by now.

This may sound like a stupid question, but... why does the nearest access 
router need to have any authentication information? I think this might be 
were the confusion lies. I thought PANA was supposed to be a protocol to 
authenticate network access, which obviously, happens at the first L2 
device. Hence the need for authentication at that stage.

But there must be a need for authentication at the first L3 device?

Jacques.