RE: [dhcwg] status of draft-ietf-dhc-agent-subnet-selection

Not necessarily.  The giaddr is required to be the IP address of the
interface upon which the original packet was heard, but I don't recall an
actual restriction on what IP the relayed packet must be sourced from.  If
you have a multiple interface router doing the relaying, the giaddr could be
different than the source IP....

However, the DHCP server is required to send the answer back to the giaddr,
and not the source IP.

-----Original Message-----
From: Thomas Narten [mailto:narten@us.ibm.com]
Sent: Wednesday, October 09, 2002 12:40 PM
To: Ralph Droms
Cc: Ted Lemon; Bernie Volz (EUD); Kim Kinnear; dhcwg@ietf.org
Subject: Re: [dhcwg] status of draft-ietf-dhc-agent-subnet-selection 

> The message from the relay agent to the server uses the relay agent's 
> address as the source address.  The relay agent modifies and sends the
DHCP 
> message as the payload in a UDP message that appears to originate from the

> relay agent.  Section 4 of RFC1542 gives more details.  The difference 
> between DHCPv4 and DHCPv6 is in the way in which the client message is 
> processed by the relay agent (in DHCPv6, the message is encapsulated in a 
> new message generated by the relay agent).

OK. I misunderstood how this worked. Because the relay agent mucks
with the giaddr field, I had never understood that the relay agent is
in fact sourcing a packet with its own source address (which contains
the same info as the giaddr field). I guess back then, getting the
source address of a packet out of the API was deemed to hard or
something?

So yes, I agree IPsec could be used to secure the relay-agent - server
path.

Thomas
_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg