Subject: [Pana] pana-ipsec-02 comments...

From: Alper Yegin <[email-masked]>
Date: Mon, 23 Feb 2004 20:27:24 -0800

Comments on PANA-IPsec draft.

   This document assumes that the following have already happened before

   the IKE exchange starts.  
   ...
   4) PaC configures a routable or global address as discussed in  
      section 4 of this document.  
   
Well, that's not strictly accurate when we consider IP address
configuration during IKEv2.

   After a successful authentication, the client configures a routable  
   or global address using [DHCP][DHCPV6] before running [IKE][IKEv2] or

   running address auto-configuration methods available within [IKE] or

   [IKEv2] by using a configuration payload or running DHCP over a  
   special IPsec tunnel mode SA [RFC3456] or auto-configures an address

   using stateless auto-configuration [IPv6-ND] before running [IKE] or

   [IKEv2] if IPv6 is being used.
  
This text is a bit hard to follow... 

- IPv6 address autoconf, DHCP, and DHCPv6 can (and normally would)
happen even before PANA.
- RFC3456 and IKEv2 configurations would happen after PANA.

   In IPv4, all packets are tunneled  
   using IPsec tunnel mode SA with the inner and outer source address  
   same as the routable address.

Is that the case even when the global IP address is configured via
IKEv2?

   If the network chooses IPsec to secure the link between PaC and EP,  
   PAA should communicate the IKE pre-shared key, the link-local address

   of the PaC (in IPv6 only), routable address of the PaC and the PANA  
   session ID to EP before the IKE exchange begins.

I don't think the routable address of PaC is delivered to EP... The
draft has a discussion on that in section 6.0 anyways.

   In the case of address configuration  
   using [RFC3456] or [IKE] [IKEV2] or [DHCP] [DHCPV6], EP can learn the

   address allocated to the client and hence setup the SPD before the  
   IKE exchange starts.

The case for DHCP is different than the rfc3456 and IKE ones. In the
latter, the IP address configuration is part of the protocol executions,
hence EP can know the allocated address. In DHCP case, I guess the
assumption is that DHCP server/relay is co-located with the EP, hence EP
can learn the address indirectly. If that's the case, some explanation
in the I-D would be useful. 

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 24 Feb 2004 10:55:59 -0800

> configuration during IKEv2.
Perhaps it can be reomved from that section.

> - RFC3456 and IKEv2 configurations would happen after PANA.
Will open an issue on this one.

> Is that the case even when the global IP address is configured via
If we have to assume that the pre-PANA address will be unconfigured,
then we have no choice. 

> draft has a discussion on that in section 6.0 anyways.
In the cases where the address is known a priori, it is communicated so that
the SPD entries can be setup. It also needs to send the Key-ID along with
session ID and need to specify how both are communicated in the ID payload.
Will open an issue on this one also..

> in the I-D would be useful. 
But we are already assuming EP and AR are co-located. Then how bad
this assumption would be ?

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 24 Feb 2004 10:55:59 -0800

-mohan

---

From: Alper Yegin <[email-masked]>
Date: Tue, 24 Feb 2004 15:25:05 -0800

> In the cases where the address is known a priori, it is communicated
so
> that
> the SPD entries can be setup. 

Which case is that? It is not when the routable address is configured
via:
- IKEv2,
- rfc3456,
- stateless autoconf, or
- dhcpv6

Maybe when PaC uses static IP or DHCPv4... This is when PRPA is a
globally routable address, and PAA learns this address prior to talking
to EP.

> It also needs to send the Key-ID along with

I wasn't thinking in terms of validity of this assumption. Just
suggesting that we document it in the I-D.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Tue, 24 Feb 2004 15:25:05 -0800

so

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 24 Feb 2004 18:04:44 -0800

Hi Mohan,

I have some comments (please see below).

> the SPD entries can be setup. 

Since the address is not always known a priori, carrying the routable
address only when the address is known a priori is not much useful.
Also, delivering the routable address from PAA to EP is not consistent
with the design policy of staying away from inner address
authorization.

> this assumption would be ?

DHCP server/relay may be separated from EP and AR.  In addition, I
think that the DHCP case and auto-configuration case are the same in
that EP may not be able to setup the SPD entries before IKE exchange
starts.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 24 Feb 2004 18:04:44 -0800

Hi Mohan,

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 25 Feb 2004 11:06:30 -0800

> Which case is that? It is not when the routable address is configured
Agreed.  

> globally routable address, and PAA learns this address prior to talking
Yes. 

> suggesting that we document it in the I-D.
Ok.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 25 Feb 2004 11:06:30 -0800

Agreed.  

Yes. 

Ok.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 25 Feb 2004 11:10:41 -0800

> with the design policy of staying away from inner address
Okay, i will remove it in the next version.

> DHCP server/relay may be separated from EP and AR.  In addition, I

How is this possible ? Either DHCP server or the relay has to be on the first
IP hop and if it is not AR or EP, where can it be ?

> that EP may not be able to setup the SPD entries before IKE exchange
Agreed.  But EP can verify whether the given client can use a given address
or not in the case of DHCP as it  can learn which address was given to
the PaC assuming EP (and AR is co-located) is in the path of DHCP messages.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 25 Feb 2004 11:10:41 -0800

-mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 24 Feb 2004 23:31:18 -0800

> IP hop and if it is not AR or EP, where can it be ?

DHCP server or relay can be put just anywhere on the first IP hop.  EP
is placed on the data traffic path to the Internet.  On the other
hand, it does not matter whether DHCP signaling path is on the same
path as the data traffic as long as the server can assign an IP
address.  Figures in Section 10.2 draft-ohba-pana-framework-00.txt do
not assume that DHCP server or relay is always co-located with EP(AR).

> the PaC assuming EP (and AR is co-located) is in the path of DHCP messages.

I don't think the assumption is generic enough.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 24 Feb 2004 23:31:18 -0800

Yoshihiro Ohba