Subject: RE: PANA FAQ

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 1 Jul 2002 18:37:32 +0200

Sorry, late reply.

  > On Wed, Jun 05, 2002 at 11:09:55AM -0700, Alper E. YEGIN wrote:
  > > Yoshihiro,
  > > 
  > > Even configuring a link-local address would require host to
  > > send IP packets on the link. An unauthenticated host would need
  > > to send neighbor solicitations and neighbor advertisements
  > > for duplicate address detection. Is this not a concern?
  > 
  > Hmm, I don't understand why that becomes a concern.  We can discuss
  > based on an analogy to L2 authentication.
  > 
  > For example, when we consider 802.1X over 802.11, some management
  > frames (Beacon, Probe request/response, etc.) are allowed to be
  > exchanged between a station and an access point even before the
  > station is authenticated.  Bringing this ananogy to one step higher
  > layer, i.e., PANA over IP, it seems to be natural for an
  > unauthenticated host would exchange some IP layler 
  > management messages
  > (i.e., neighbor discovery messages) with access router(s).
  > 
  > > 
  > > Note that using unspecified IP address doesn't require
  > > sending and receiving IP packets prior to PANA exchange.
  > 
  > I currently fail to see what the exact problem is when neighbor
  > discovery message exchange occurs prior to PANA exchange and how
  > unspecified IP address can solve that problem.
  > 

=> Agree with Yoshi here. You cannot stop a node on an ethernet
link from sending any ND messages. So there is no point in saying 
that it should not be done before authentication, if a rule can't be 
enforced then there is no point in mandating it.

Hesham

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Mon, 1 Jul 2002 10:51:15 -0700

> enforced then there is no point in mandating it.

Enforcement points could be configured to let only PANA
packets go by until the client is authenticated. That would prevent
any other type of packets, including ND signaling.

Also, the proposal was *not* to "force IP address configuration
to happen only after PANA", but to "allow IP address configuration to 
happen before or after PANA". Just for clarification...

alper

> Hesham

**********************Confidentiality Note**********************
Privileged/Confidential Information may be contained in this e-mail and any
attachment to it and may be covered by existing non-disclosure or
confidentiality agreements.
If you are not the addressee (or authorized to receive for the addressee),
you may not use, copy or disclose to anyone any information contained in
this e-mail.  If you have received this e-mail in error, please notify the
sender immediately by reply e-mail and delete it from your system.
Thank you very much.
*************************************************************