Subject: RE: [Pana] PANA over IP-in-IP tunnels

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 16 Aug 2004 08:33:13 +0200

hi mohan, 

> > 
> > Can we run PANA over IP-in-IP tunnels as is, or do we need some 
> > additional considerations for that? Consider the tunnel is 
> established 
> > prior to running PANA. PANA does not have anything to do with the 
> > management of the tunnel, but simply takes it as a "link".
> > 
> Though it is technically a single hop, it allows the PAA to 
> be anywhere on the internet. This means the attacker gets to 
> consume all of the network resources (compared to just a few 
> devices if PAA is located on the edge) that is between the 
> PaC and the PAA.

i don't understand your last sentence. what is your concern? 

 I don't remember all of the discussions on 
> what prevented from PAA being more than one hop away  i.e 
> what are the dis-advantages of performing network access 
> authentication in the core ? Sure, hop count not being 
> decremented in the tunnel still prevents a few threats. 
the one hop away thing was mostly related to the packet filter installation,
routing asymmetry and topology knowledge. 

ciao
hannes

> 
> -mohan
> 
>  
> > Alper
> >  
> > 
> > 
> > 
> > 
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana