Subject: RE: PANA FAQ

From: <[email-masked]>
Date: Thu, 23 May 2002 15:11:26 -0500

>I did not mean to suggest that the layer-2 authentication that 
>someone might want to require before an IP address is assigned
>would preclude any other authentication desired after the host
>has an IP address and is (therefore) capable of higher-layer
>communication. After the IP address is configured, a host can
>use any layer-3 protocol for authentication or anything else.
>
>I hope you agree that requiring authentication before an IP
>address implies that authentication will not be at layer-3. 

I tend to agree. But the thinking has been that the host could possibly ICMP
with IP address 0 to carry EAP payload. So it is possible that we
could do authentication without the host having been assigned
an address. 

-Basavaraj

>
>John
>
>At 04:05 PM 5/22/2002, [email-masked] wrote:
>
>>>If someone wants authentication before an IP address is assigned, 
>>>it seems clear that they want layer-2 authentication.
>>
>>I do not totally agree with this. You could have authentication at L2
>>and subsequently authentication of some userID or NAI at a higher
>>layer. So just because you perform authentication before a node has an
>>IP address does not directly imply that the network only relies or
>>wants L2 authentication. For example, you could have an IP address
>>associated with your device and the network may request you to do an L2
>>authentication or reauthentication (whatever the case). 
>

---

From: Thomas Narten <[email-masked]>
Date: Fri, 24 May 2002 06:49:03 -0400

> could do authentication without the host having been assigned

I think this misses a basic point. If a server has to support multiple
concurrent operations with clients -- with each client using the all
0's address -- the server needs some other way to distinguish
connections than IP addresses/port numbers. This would likely be
something based on the link-layer addresses used. But now, we no
longer have vanilla IP. We have IP plus the link-layer address. Note
this is an issue for all higher-layer "connection-oriented" protocols
(EAP would be one, in the sense that a connection consists of a
sequence of related packets belonging to a single EAP transaction). So
it does create complexity and would seem to lose a number of the
advantages of the pure L3 solution (which I thought was supposed to be
L2-agnostic).

Thomas

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Fri, 24 May 2002 14:19:29 -0700

Thomas,

> advantages of the pure L3 solution (which I thought was supposed to be

As I mentioned earlier, what is needed for this to work is same as
what we are already doing for Mobile IPv4 in foreign-agent located
care-of address case. Do we call Mobile IPv4 "not L2-agnostic"?

I acknowledge what it takes to make this work. But I don't agree
this makes the solution L2-dependent.

Other than having to cache the mac address of the incoming packet,
and by-pass ARP/ND, what else is needed? What are the pure L3
advantages we are losing?

I think being able to assign an IP address after PANA is important.
And this is better than assigning a temporary IP address to PaC and
forcing the PaC to change it after PANA, imo.

alper