Subject: RE: session-id

From: <[email-masked]>
Date: Tue, 22 Apr 2003 11:46:59 +0300

> -----Original Message-----
> From: ext Yoshihiro Ohba [mailto:[email-masked]]
> Sent: 19 April, 2003 01:31
> To: Alper Yegin
> Cc: Yoshihiro Ohba; [email-masked]
> Subject: Re: session-id
> 
> 
> On Fri, Apr 18, 2003 at 04:55:18PM -0700, Alper Yegin wrote:
> > > Per Alper's suggestion, I try to open up a new thread for 
> session-id.
> > 
> > Thank you Yoshi.
> > 
> > > 
> > > In pana-00 draft, a PANA session is identified by using device
> > > identifier, which is either an IP address or a MAC 
> address.  I have
> > > the following scenario which might be difficult to support in the
> > > current draft:
> > > 
> > >  A PaC starts PANA with using unspecified IP address.  
> After the PaC
> > >  is succesfully authenticated, it configures an IP 
> address via DHCP.
> > >  Before the PaC obtains an IP address, the MAC address is used as
> > >  the device identifier.  Suppose that the network forces 
> all PaCs to
> > >  use L3 ciphers, the PaC needs to perform IKE in order to 
> establish
> > >  an IPsec tunnel between the PaC and EP after the PaC 
> obtains an IP
> > >  address.
> > 
> > I presume the assumption is that dhcp is secured. 
> Otherwise, the client
> > could be given an IP address prior to PANA and there 
> wouldn't be such a
> > problem. The only reason DHCP comes after PANA is that DHCP 
> is secured using
> > PANA SA, is that right?
> 
> I think so.
> 
> > 
> > If this network is using IPsec for access control, then the 
> other assumption
> > seems like this: Clients are allowed to perform DHCP in 
> addition to PANA
> > before they are authorized to access the network.
> 
> Yes, that would be the other assumption.

Just one small clarification for this scenario: PANA is used for authorization and if it is succesfull, then DHCP is the next step. So, clients are not allowed to perform DHCP if PANA fails.

- Dan