Subject: Re: [Pana] Issue 210 (AD-review, pana-fwk, section 10.1, editorial)

From: Mark Townsley <[email-masked]>
Date: Tue, 20 Dec 2005 12:09:01 +0100

Yoshihiro Ohba wrote:

>Let me tackle on major editorial comments on section 10.1:
>
>http://danforsberg.info:8080/pana-issues/issue210
>
>The terms NAS and CPE will be replaced with BRAS and DSL Modem/RG
>(Routing Gateway), according to the terms used in DSL Forum TR-59.
>  
>
Please provide a reference to the DSL Forum document. Normative, if you
are not going to provide definitions of the terms used here. Expanding
Broadband Remote Access Server on its first usage wouldn't hurt either.

- Mark

>The following is the new text (BTW, I'll fix alignment of Figure
>labels so that they are centered):
>
>"
>10.1.  DSL Access Network
>
>   In a DSL access network, PANA is seen applicable in the following
>   scenarios.
>
>   A typical DSL access consists of a BRAS at the DSL access provider
>   and DSL Modem/RG (Routing Gateway) in the CPN (Customer Premises
>   Network).  The DSL Modem/RG supports multiple modes of operation and
>   PANA is applicable in each of these modes.
>
>   In the current DSL deployment, a DSLAM (DSL Access Multiplexor) which
>   is placed between the DSL Modem/RG and the BRAS is a transparent
>   device from PANA perspective.  In a future DSL model, the PAA may
>   reside in the DSLAM which may directly connect ISP routers through
>   VLANs.
>
>         Host--+                                     +-- ISP1
>               |                  DSL link           |
>               +-- DSL Modem/RG --- DSLAM --- BRAS --+-- ISP2
>               |                                     |
>         Host--+                                     +-- ISP3
>
>       <-------- CPN --------> <------ NAP ------> <-- ISP -->
>
>   Figure 7: DSL Model
>
>   The devices at the customer premises have been shown as "hosts" in
>   the above network.
>
>   DSL networks are protected by physical means.  Eavesdropping and
>   spoofing attacks are prevented by keeping the unintended users
>   physically away from the network media.  Therefore, generally
>   cryptographic protection of data traffic is not common.
>   Nevertheless, if enhanced security is deemed necessary for any
>   reason, IPsec-based access control can be enabled on DSL networks as
>   well by using the method described in [I-D.ietf-pana-ipsec].
>
>
>10.1.1.  Bridging Mode
>
>   In the bridging mode, the DSL Modem/RG acts as a simple link-layer
>   bridge.  The hosts in the CPN will function as clients to obtain
>   addresses from the BRAS by using DHCP or PPPoE.
>
>   If PPPoE is used, authentication is typically performed using CHAP or
>   MS-CHAP.
>
>   PANA will be applicable when the hosts use DHCP to obtain an IP
>   address.  DHCP does not support authentication of the devices on
>   either side of the DSL access line.  In the simplest method of
>   address assignment, the BRAS will allocate the IP address to a host
>   with a lease time reasonably sufficient to complete a full PANA based
>   authentication which will be triggered immediately after the address
>   assignment.  The hosts will perform the PaC function and the BRAS
>   will perform the PAA, EP and AR functions.
>
>         Host--+
>         (PaC) |
>               +-- DSL Modem/RG --- DSLAM --- BRAS ----- ISP
>               |     (Bridge)             (PAA,EP,AR)
>         Host--+
>         (PaC)
>
>   Figure 8: Bridge Mode
>
>   The DSL service provider's trunk network should not be accessible to
>   any host that has not successfully completed the PANA authentication
>   phase.
>
>10.1.2.  Router Mode
>
>   In this mode, the DSL Modem/RG acts as a router for the CPN.  The DSL
>   Modem/RG itself may obtain the IP address using DHCP or be configured
>   with a static IP address.  Once the DSL Modem/RG is authenticated
>   using PANA and is provided access to the service provider's network,
>   the BRAS should begin exchanging routing updates with the DSL
>   Modem/RG.  All devices at the customer premises will then have access
>   to the service provider's network.
>
>         Host--+
>               |
>               +-- DSL Modem/RG --- DSLAM --- BRAS ----- ISP
>               |   (Router, PaC)          (PAA,EP,AR)
>         Host--+
>
>   Figure 9: Router Mode
>
>   It is possible that both ends of the DSL link are configured with
>   static IP addresses.  PANA-based mutual authentication of PaC and PAA
>   is desirable before data traffic is exchanged between the CPN and the
>   service provider network.  The DSL Modem/RG may also use NAPT
>   (Network Address Port Tranlation).
>
>
>10.1.3.  PANA and Dynamic ISP Selection
>
>   In some installations, a BRAS is shared by multiple service
>   providers.  Each service provider configures the BRAS with a certain
>   IP address space.
>
>   The devices at the customer premises network indicate their choice of
>   service provider and the BRAS chooses the IP address from the
>   appropriate service provider's pool.  In many cases, the address is
>   assigned not by the BRAS but by the AAA server that is managed fully
>   by the service provider.
>
>   This simplifies the management of the DSL access network as it is not
>   always necessary to configure each DSL access line with the service
>   provider's identity.  The service provider is chosen dynamically by
>   the DSL Modem/RG.  This is typically known as "dynamic Internet
>   Service Provider selection".  The AAA function is usually overloaded
>   to perform dynamic ISP selection.
>
>   If the DSL Modem/RG uses a PPP based protocol (PPP or PPPoE), the ISP
>   is chosen by mapping the username field of a CHAP response to a
>   provider.
>
>   If the DSL Modem/RG uses DHCP, the 'client-id' field of the DHCP-
>   discover or DHCP-request packet is mapped to the provider.
>"
>
>Does this look good?
>
>Yoshihiro Ohba
>
>_______________________________________________
>Pana mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/pana
>
>  
>

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 19 Dec 2005 13:19:52 -0500

> Broadband Remote Access Server on its first usage wouldn't hurt either.

Done.  

For the same reason I have also added a reference to 3GPP2 document
P.S0001-B_v2.0 in Section 3 where 3GPP2-specific term "PDSN" is used
(but this should be informative, because unlike DSL, no detail is
discussed on 3GPP2 in pana-framework.

Thanks,
Yoshihiro Ohba