Subject: RE: Topology Issues

From: Tschofenig Hannes <[email-masked]>
Date: Fri, 14 Mar 2003 12:55:53 +0100

hi all, 

the device identifier consists of different attributes. 
some of them are link layer specific (e.g. mac address) whereas others are
simply ip addresses. since the ep is a link layer device only (in many
cases) ip address based packet filters can only be installed at a router. if
the paa is the first hop router then it seems to be reasonable to install
the filters there. (usually people protect their network by installing
packet filters at the edge).

ciao
hannes

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]
> Sent: Friday, March 14, 2003 12:31 PM
> To: Tschofenig Hannes
> Cc: [email-masked]'
> Subject: Re: Topology Issues
> 
> 
> a brief comment inline in order to avoid misunderstandings:
> 
> Tschofenig Hannes wrote:
> 
> > Hi all, 
> > 
> > This short text should describe some of the topology 
> problems which arise
> > when
> > 
> > - no toplogy knowledge is available where to create device 
> identifiers at
> > eps (e.g. one particular PAA is responsible only for some eps)
> > 
> > - the PAA is not the first-hop router. 
> > 
> > In Figure 1 various PAAs are available. The PAAs are not 
> the first IP
> > device. 
> > 
> >   PaC1a --+            +- Router1 ---------- PAA3 --
> >           |            |
> >   PaC1b --+-- EP1 -----+- Router2 -----+
> >                        |               |
> >    PaC2 ----- EP2 -----+               |
> >                        |               |
> >    PaC3 ----- EP3 -----+- Router3 -----+----- PAA2--
> >                        |               |
> >                        +- Router4 -----+------PAA1 ---
> > 
> > Figure 1: PANA scenario where PAA is not the first IP device
> > 
> > Based on the discovery mechanism PaC2 is authenticated at 
> PAA2. In general
> > it might be quite difficult for PAA2 to know which path 
> later packets will
> > take to install the device identifier at the correct EP. 
> Hence if we assume
> > that only packet filter information is installed at the 
> PAA2 (i.e. PAA2 acts
> > as a firewall). 
> 
> 
> my understanding is that the PAA installs DI-based filters in EP(s).
> I dont understand this sentence: "packet filter information 
> is installed 
> at the PAA2"... please can you further explain ?
> 
> thanks,
> yacine
> 
> 
> > 
> > When PaC2 transits a packet to a certain destination 
> address (Dst1) then the
> > IP packet will hit one of the routers (e.g. Router3). 
> Depending on the
> > routing table the packet will be forwarded to a particular 
> PAA (e.g. PAA1). 
> > 
> > When PaC2 transmits a new packet with a different 
> destination address (Dst2)
> > then the IP packet suddenly hits a different PAA (e.g. 
> PAA2) due to the
> > routing table entries at Router3. 
> > 
> > Furthermore it is possible that the incoming packet takes a 
> different path
> > then the outgoing packet. Hence there is the question how 
> the packet filter
> > actually looks like. Is the packet filter only filtering 
> packets from the
> > PaC direction to the network direction or even from the 
> outside to the
> > inside direction?
> > 
> > Hence I would like to raise the following questions: 
> > 
> > 1) How should the PAA know at which EP to install the 
> device identifier? (in
> > a generic case). Or: What assumptions have to be made here. 
> > 
> > 2) What should be assumed about the location of the PAA? 
> (again in a generic
> > case). 
> > 
> > Especially question (2) is important. There is obviously a 
> relationship to
> > the discovery mechanisms. You might not want to discover a 
> PAA where packets
> > never flow through (in case that the PAA acts as a firewall). 
> > 
> > Ciao
> > Hannes
> > 
> > 
> > 
> 
>

---

From: Julien Bournelle <[email-masked]>
Date: Fri, 14 Mar 2003 16:03:03 +0100

> hi all, 

hi,

> packet filters at the edge).

ok, but finally in the latter case, if you put filter
rules on the PAA, it means that the EP and the PAA are
co-located.
Do I miss something ?

-- 
[email-masked]

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Fri, 14 Mar 2003 19:49:27 +0100

hi julien,

-snip-
> rules on the PAA, it means that the EP and the PAA are

you are right.

> Do I miss something ?

no.

i would like to add another question:

let us look at the pana configuration example again:

the ep cannot filter (i.e. block) packets (or better frames) of
unauthenticated pacs. it needs to allow (at least) pana packets to go
through. however, you don't want to have a link layer device to look at ip
and at transport layer protocols to determine whether to forward this pana
packet or not. i personally think that it is much better to co-locate the
paa and the ep and to provide paa functionality at the edge (i.e. at the
first-hop router).

what do you think?

ciao
hannes