Subject: RE: Concerns about draft-ietf-pana-requirements-00

From: George Tsirtsis <[email-masked]>
Date: Thu, 7 Feb 2002 09:01:11 -0500

-----Original Message-----
From: James Carlson [mailto:[email-masked]]
Sent: Thursday, February 07, 2002 1:53 PM
To: George Tsirtsis
Cc: [email-masked]
Subject: RE: Concerns about draft-ietf-pana-requirements-00

George Tsirtsis writes:
> GT> Yoshi, 802.1X can NOT solve the problem. I keep saying this but it is
> important. 802.1X authenticates a node to an Access Point (AP). This AP
may
> be far, far away and over multiple link layer hops from the nearest Access
> Router. PANA authenticates a node to the first IP aware Access Router no
> matte how many link layer hops are between them. The scope of the problem
is
> totally different and should be very clear by now.

Let me paraphrase to make sure I understand your point: "802.1X is
broken because the link authentication that occurs stops at the Access
Point, and this node doesn't necessarily carry the authentication via
standard protocols to a backend service that can do authentication in
the same way for all access methods."

GT> I did not say 802.1X is broken. I said that its objective is different
i.e.: allow your *802 frames* to pass through an Access Point. In all
scenarios that AP is not collocated with the Access Router, 802.1X is not
solving the problem of PANA which is: to allow your *IP Packets* to go
through an Access Router. Never mind all the link layers outside the 802
family.

In other words, the problem isn't precisely that the Access Router
isn't involved in the actual authentication, but rather that the
mechanism that exists doesn't integrate well with AAA or the assumed
trust model.  As long as some properly functioning and correctly
configured node serves as the boundary for the provider's network and
links into AAA in an appropriate way, why should we care whether this
node is necessarily classed as a "link layer" device or a "router?"

This seems to be an argument to either fix or replace 802.1X, and not
necessarily an argument that PANA must be an independent protocol.

GT> And of course in my opinion the problem is that the access router is not
involved in the authentication. the other problem also is that PAA in the AR
is only one side of the PANA story. The other side is PAA beyond the AR
(hotel case) in which case 802.1X has no chance.

Regards
George

-- 
James Carlson, Solaris Networking         <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677

---

From: James Carlson <[email-masked]>
Date: Thu, 7 Feb 2002 10:00:24 -0500 (EST)

> through an Access Router. Never mind all the link layers outside the 802

I think we're saying the same thing by different means.  If that AP
integrated properly into the AAA structure, it would do exactly as you
request: block network access until authentication to a common backend
service is complete.  If you can't get 802 frames to go through the
AP, then you certainly cannot get them to go through any routers
behind that AP.

So the real issues are that the AP isn't integrating into AAA, and
(secondarily) doesn't include the sort of finer-grained (per network
layer protocol) authorization that might be desired.  (Of course, not
much other than IP really matters, so allowing any packets is
essentially equivalent to allowing IP packets.)

Why do you insist on the involvement of a router?  As long as the
access boundary (regardless of where that line is drawn) makes the
*same* AAA decision as would be made by this 'access router,' what
does that matter?

> involved in the authentication.

Why?

> the other problem also is that PAA in the AR

Agreed.  As I said before, the clear reason for PANA is for link
layers that don't have authentication; plain old Ethernet being the
most obvious example of that.

As I said, all of this is perhaps an argument against 802.1X.  It's
not an argument for non-link-layer-associated PANA.