Subject: RE: PANA FAQ

From: <[email-masked]>
Date: Wed, 5 Jun 2002 16:42:56 -0500

Thomas,

>
>One issue I have with not allowing *any* IP access prior to the PANA
>exchange is that this comes awfully close to saying you want PANA to
>provide access control, which by the nature of it being L3, PANA
>cannot provide. 

The effect of a PANA exchange between the PaC and the PAA may very
well be access control. How access control is accomplished is outside
the scope of this WG. So I would not say that PANA is an access
control protocol at all, but rather it emay enable access control via
other means which are unspecified.

>If that is really what one wants, it's hard to ignore
>the argument that L2 authentication/access control is better able to do
>this than L3. On many wireless technologies, for example, a client
>could connect to the network spoof an authorized address, launch DOS
>attacks, consume bandwidth resources on the first-hop link, etc.

Attacks on wireless networks such as DoS cannot be prevented by having
L2 authentication/access control mechanisms. Since the actual access
control mechanism that is applied is unspecified (outside the scope of
PANA) it is upto the network operator to utilize other ways to prevent
a node spoofing valid addresses.

>Thomas

-Basavaraj