Subject: [Pana] Issue 210 (AD-review, pana-fwk, section 10.1, editorial)

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 21 Nov 2005 21:14:34 -0500

Let me tackle on major editorial comments on section 10.1:

http://danforsberg.info:8080/pana-issues/issue210

The terms NAS and CPE will be replaced with BRAS and DSL Modem/RG
(Routing Gateway), according to the terms used in DSL Forum TR-59.

The following is the new text (BTW, I'll fix alignment of Figure
labels so that they are centered):

"
10.1.  DSL Access Network

   In a DSL access network, PANA is seen applicable in the following
   scenarios.

   A typical DSL access consists of a BRAS at the DSL access provider
   and DSL Modem/RG (Routing Gateway) in the CPN (Customer Premises
   Network).  The DSL Modem/RG supports multiple modes of operation and
   PANA is applicable in each of these modes.

   In the current DSL deployment, a DSLAM (DSL Access Multiplexor) which
   is placed between the DSL Modem/RG and the BRAS is a transparent
   device from PANA perspective.  In a future DSL model, the PAA may
   reside in the DSLAM which may directly connect ISP routers through
   VLANs.

         Host--+                                     +-- ISP1
               |                  DSL link           |
               +-- DSL Modem/RG --- DSLAM --- BRAS --+-- ISP2
               |                                     |
         Host--+                                     +-- ISP3

       <-------- CPN --------> <------ NAP ------> <-- ISP -->

   Figure 7: DSL Model

   The devices at the customer premises have been shown as "hosts" in
   the above network.

   DSL networks are protected by physical means.  Eavesdropping and
   spoofing attacks are prevented by keeping the unintended users
   physically away from the network media.  Therefore, generally
   cryptographic protection of data traffic is not common.
   Nevertheless, if enhanced security is deemed necessary for any
   reason, IPsec-based access control can be enabled on DSL networks as
   well by using the method described in [I-D.ietf-pana-ipsec].

10.1.1.  Bridging Mode

   In the bridging mode, the DSL Modem/RG acts as a simple link-layer
   bridge.  The hosts in the CPN will function as clients to obtain
   addresses from the BRAS by using DHCP or PPPoE.

   If PPPoE is used, authentication is typically performed using CHAP or
   MS-CHAP.

   PANA will be applicable when the hosts use DHCP to obtain an IP
   address.  DHCP does not support authentication of the devices on
   either side of the DSL access line.  In the simplest method of
   address assignment, the BRAS will allocate the IP address to a host
   with a lease time reasonably sufficient to complete a full PANA based
   authentication which will be triggered immediately after the address
   assignment.  The hosts will perform the PaC function and the BRAS
   will perform the PAA, EP and AR functions.

         Host--+
         (PaC) |
               +-- DSL Modem/RG --- DSLAM --- BRAS ----- ISP
               |     (Bridge)             (PAA,EP,AR)
         Host--+
         (PaC)

   Figure 8: Bridge Mode

   The DSL service provider's trunk network should not be accessible to
   any host that has not successfully completed the PANA authentication
   phase.

10.1.2.  Router Mode

   In this mode, the DSL Modem/RG acts as a router for the CPN.  The DSL
   Modem/RG itself may obtain the IP address using DHCP or be configured
   with a static IP address.  Once the DSL Modem/RG is authenticated
   using PANA and is provided access to the service provider's network,
   the BRAS should begin exchanging routing updates with the DSL
   Modem/RG.  All devices at the customer premises will then have access
   to the service provider's network.

         Host--+
               |
               +-- DSL Modem/RG --- DSLAM --- BRAS ----- ISP
               |   (Router, PaC)          (PAA,EP,AR)
         Host--+

   Figure 9: Router Mode

   It is possible that both ends of the DSL link are configured with
   static IP addresses.  PANA-based mutual authentication of PaC and PAA
   is desirable before data traffic is exchanged between the CPN and the
   service provider network.  The DSL Modem/RG may also use NAPT
   (Network Address Port Tranlation).

10.1.3.  PANA and Dynamic ISP Selection

   In some installations, a BRAS is shared by multiple service
   providers.  Each service provider configures the BRAS with a certain
   IP address space.

   The devices at the customer premises network indicate their choice of
   service provider and the BRAS chooses the IP address from the
   appropriate service provider's pool.  In many cases, the address is
   assigned not by the BRAS but by the AAA server that is managed fully
   by the service provider.

   This simplifies the management of the DSL access network as it is not
   always necessary to configure each DSL access line with the service
   provider's identity.  The service provider is chosen dynamically by
   the DSL Modem/RG.  This is typically known as "dynamic Internet
   Service Provider selection".  The AAA function is usually overloaded
   to perform dynamic ISP selection.

   If the DSL Modem/RG uses a PPP based protocol (PPP or PPPoE), the ISP
   is chosen by mapping the username field of a CHAP response to a
   provider.

   If the DSL Modem/RG uses DHCP, the 'client-id' field of the DHCP-
   discover or DHCP-request packet is mapped to the provider.
"

Does this look good?

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Prakash Jayaraman <[email-masked]>
Date: Mon, 21 Nov 2005 18:23:08 -0800

New text looks good.

- prakash