Subject: RE: PANA FAQ

From: <[email-masked]>
Date: Wed, 22 May 2002 15:05:34 -0500

>At 01:49 PM 5/22/2002, Thomas Narten wrote:
>
>>> people ... don't want to hand out IP addresses until they [know]
>>> the client is authorized. Also IP address provided might depend on 
>>> the identity of the client. This is a very useful and needed feature.
>>
>>I'm not sure I agree with (or fully understand the need for) this. I'd
>>like to hear more from the list.
>
>I thought the consensus was that PANA was not supposed to be 
>involved in assigning IP addresses.
>

Completely agree. That is is the consensus and the scope of PANA does
not have anything to do with address assignment.

>If someone wants authentication before an IP address is assigned, 
>it seems clear that they want layer-2 authentication.

I do not totally agree with this. You could have authentication at L2
and subsequently authentication of some userID or NAI at a higher
layer. So just because you perform authentication before a node has an
IP address does not directly imply that the network only relies or
wants L2 authentication. For example, you could have an IP address
associated with your device and the network may request you to do an L2
authentication or reauthentication (whatever the case). 

>
>Assigning IP addresses based on authenticating the identity of 
>the user of the host is precisely the function that motivated 
>draft-ietf-dhc-agentopt-radius-00.txt. 
>This specification enables the layer-2 authenticator to forward the 
>user's identity, and any other AAA attributes necessary, to the
>DHCP server for its use in address assignment.
>
>There is no need to make this function a feature of PANA.

Assigning IP addresses is outside the scope of PANA.

>John

-Basavaraj