Subject: RE: PANA and IP address configuration

From: <[email-masked]>
Date: Fri, 6 Dec 2002 17:40:09 -0600

>> So, one proposal might choose to require an IP address be
>> configured on the PaC before PANA, and therefore possibly open to
>> address depletion attacks. Another proposal might work without 
>> IP address, but may have some protocol complexity (in addition to 
>> implementation complexity). Both proposals should be acceptible for 
>> consideration. 
>
>For IPv4, in my view, the protocol should not require an IP address 
>assignment on the PaC. Such requirement would limit the useability of the 
>protocol when facing the question "should the PaC device be assigned an IP 
>address at all". If it already has an IP address, it's is too late.

Can you clarify what you mean by "its too late"?
One of the scenarios that we have talked about is the ability to have
a limited scope address assigned to the PaC for authentication and the
succesful completion of the procedure would result in either a
different address or change in scope for that address. 

But operators who consider IP addresses as a valuable resource and do
not want to assign them up front (pre-authentication) would prefer to
have the PANA messaging occur without any IP address at the PaC.

However, most of today's WLAN hotspot networks assign you an IP
address anyway irrespective of whether you authenticate or use the
network. 

-Basavaraj

>
>The question can also be rephrased as "from which IP subnet should I 
>assign the IP address" considering situations with filtering, CoS, rate-
>limiting or other actions in the network partly or in whole based on IP 
>subnet.
>
>-- 
>Fredrik Nyman
>PacketFront Sweden AB
>http://www.packetfront.com/
>
>

---

From: [email-masked]
Date: Sat, 07 Dec 2002 01:38:54 +0100 (CET)

> Can you clarify what you mean by "its too late"?

I am considering situations where the authentication process itself might 
affect which IP address to assign to the PaC. For instance, consider a 
situation with multiple devices on a shared media. Device A that authenticates 
to be of a certain type or affiliation might not be eligible for an IP address 
from the same subnet as Device B. 

Considering a xDSL or Ethernet based network (radio access might apply even 
more), Device A might be a setop-box to receive IP multicast while Device B is 
a desktop PC. They are both two PaCs using a shared connection to the PAA.

In order to preserve address space, device As communication needs might be 
satisfied with private address space while device B requires a public IP 
address. Today the address assignment would in many implementations be based on 
the MAC address of the device, which I don't think is the best solution.

Private address space is only one example. There are other situations when 
addresses from different prefixes of public IP address space should be assigned 
because packet filtering, policy routing, diffserv or whatever at some point in 
the network is based on that.

If the PaC already has negotiated for an address, authentication will not be 
part of the input to the address selection. Unless PANA can trigger a 
renegotiation for address once the authentication is done, PANA may not be 
useful in the scenarios I just described, which I would consider typical in an 
xDSL or Ethernet based "broadband" network.

> different address or change in scope for that address. 

I am new to the list, so I might have missed some important discussion, 
although I try to catch up from the archive.

> have the PANA messaging occur without any IP address at the PaC.

If PANA can trigger a renegotiation when dynamic assignment is used, operators 
could use private address space for the initial assignment until PANA has 
completed. Link local IPv4 might also be a solution for the brief 
authentication period.