Re: [dhcwg] lease query question

[Kim Kinnear <[e-mail]>]

Thomas,

This approach to access control was developed by joint work with
the folks building our access concentrators and several of us in
the DHCP implementation group.  They found that the functionality
delivered to actual users was of sufficient value to those users
to be worth the cost of engineering this particular solution.
We supported them in moving the implementation forward.

The solution was not based on the charter of the DHC working
group either then or now -- it was based on a rather pragmatic
approach to meeting the needs of users, which it has seemed to
do.  In my view at least, it fits within spirit of the DHC WG
activities, and was a logical extension of the those activities.

It isn't a comprehensive approach to any sort of security (nor
was it designed to be such) -- it is a supporting piece of
technology to one limited form of access control.

We decided to bring this work to IETF to see if anyone felt it
was worthwhile to standardize it, and at the time the sense of
the working group was that standardization was appropriate.  We
did this knowing full well that we would have to re-implement our
support after the standardization process was complete, but felt
that something this valuable should be standardized and available
to all.

I think it is time to ask that question again of the DHC WG -- is
there any value to standardizing the leasequery capability?

I will do so in a separate email, and we'll see just where this
work stands with the other members of the working group.

Kim


At 10:34 AM 2/26/2003, Thomas Narten wrote:
>> Would replacing the current problem statement with this one
>> suggested by Ralph be sufficient to meet (enough of) your
>> concerns to allow the draft to proceed?
>
>Not really.
>
>What we had originally (I had thought) was is a relatively simple
>problem, with a relatively simple solution, and one that didn't really
>change DHC in any serious way. The solution seem to have taken on
>feature creap, where the problem got expanded, and the solution got
>expanded. Sure, given any solution, one can go back and rewrite the
>problem statement to make it match the solution. While that is
>certainly necessary to make the document accurate, I have to wonder
>whether the problem statement actually makes sense or is well defined.
>
>> >        Router-type devices which want to enforce some level of access
>> >        control over which IP addresses are allowed on their links
>> >        need to maintain information concerning IP<->MAC/client-id
>> >        mappings.  One way in which these devices can obtain
>> >        information about IP<->MAC/client-id bindings is through "DHCP
>> >        gleaning", in which the device extracts useful information
>> >        from DHCP messages exchanged between hosts and DHCP
>> >        servers.
>
>So far, simple.
>
>> >        However, these devices don't typically have stable storage
>> >        sufficient to keep this information over reloads.  There may
>> >        be additional information that is useful to the device that
>> >        cannot be obtained through DHCP gleaning.  The leasequery
>> >        request message described in this document allows a device to
>> >        obtain information about IP<->MAC/client-id bindings from a
>> >        DHCP server.  This information may include currently active
>> >        bindings, bindings involving previously assigned addresses for
>> >        which the lease on the address has expired and static bindings
>> >        for devices that are otherwise configured and not using DHCP
>> >        for address assignment.
>
>Note, that above is pretty vague and doesn't say what information the
>access device needs. It's hard to look at the problem statement and
>say "yes, I understand the boundaries of the problem" and then "and
>the solution seems like a good match for the problem".
>
>Popping up a level, how is it even appropriate for the DHC WG to be
>doing work on "access control in router type devices"? One can argue
>that work of this broad a scope is well out-of-scope for this WG
>(e.g., look at the recently approved charter). I'm far from clear that
>work of this scope should be done in DHC or that the problem is well
>enough understood to conclude that DHC lease query is the right
>solution or that any DHC-based solution is the right one.  What about
>routers wanting to do access control that don't use DHC, for instance?
>
>And note, I'm not raising these issue just to be a PITA. These are
>questions that I expect that the IESG would ask if I brought the
>document forward. Thus, I need to have reasonable responses to those
>questions. Otherwise, I can predict the likely outcome.
>
>Thomas
>_______________________________________________
>dhcwg mailing list
>[e-mail]
>https://www1.ietf.org/mailman/listinfo/dhcwg 

_______________________________________________
dhcwg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/dhcwg