Subject: [Pana] pana-ipsec-02 comments...

From: Alper Yegin <[email-masked]>
Date: Mon, 23 Feb 2004 20:27:24 -0800

Comments on PANA-IPsec draft.

   This document assumes that the following have already happened before

   the IKE exchange starts.  
   ...
   4) PaC configures a routable or global address as discussed in  
      section 4 of this document.  
   
Well, that's not strictly accurate when we consider IP address
configuration during IKEv2.

   After a successful authentication, the client configures a routable  
   or global address using [DHCP][DHCPV6] before running [IKE][IKEv2] or

   running address auto-configuration methods available within [IKE] or

   [IKEv2] by using a configuration payload or running DHCP over a  
   special IPsec tunnel mode SA [RFC3456] or auto-configures an address

   using stateless auto-configuration [IPv6-ND] before running [IKE] or

   [IKEv2] if IPv6 is being used.
  
This text is a bit hard to follow... 

- IPv6 address autoconf, DHCP, and DHCPv6 can (and normally would)
happen even before PANA.
- RFC3456 and IKEv2 configurations would happen after PANA.

   In IPv4, all packets are tunneled  
   using IPsec tunnel mode SA with the inner and outer source address  
   same as the routable address.

Is that the case even when the global IP address is configured via
IKEv2?

   If the network chooses IPsec to secure the link between PaC and EP,  
   PAA should communicate the IKE pre-shared key, the link-local address

   of the PaC (in IPv6 only), routable address of the PaC and the PANA  
   session ID to EP before the IKE exchange begins.

I don't think the routable address of PaC is delivered to EP... The
draft has a discussion on that in section 6.0 anyways.

   In the case of address configuration  
   using [RFC3456] or [IKE] [IKEV2] or [DHCP] [DHCPV6], EP can learn the

   address allocated to the client and hence setup the SPD before the  
   IKE exchange starts.

The case for DHCP is different than the rfc3456 and IKE ones. In the
latter, the IP address configuration is part of the protocol executions,
hence EP can know the allocated address. In DHCP case, I guess the
assumption is that DHCP server/relay is co-located with the EP, hence EP
can learn the address indirectly. If that's the case, some explanation
in the I-D would be useful. 

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana