Re: [dhcwg] status of draft-ietf-dhc-agent-subnet-selection

[Mark Stapp <[e-mail]>]

I had thought that the progressing relay-agent-authentication draft was the 
response to Thomas's issue. That seemed to me to be targetted at the 
specific problem of relay<->server communication, and to require relatively 
light-weight implementation and configuration changes while providing an 
appropriate level of security. That path still seems to me to offer the 
best cost/benefit/deployment balance. Will it be more difficult to deploy 
and configure an ipsec solution in heterogeneous or complex networks? Will 
any additional configuration work required provide any additional security? 
Will relays need separate SAs to all the dhcp failover server pairs? Will 
all the kinds of v4 devices that act as relays and servers be able to 
implement ipsec? I'm concerned that choosing ipsec may lead to reduced 
adoption of relay-agent security.

-- Mark

At 02:58 PM 10/9/2002 -0400, Ralph Droms wrote:
>The message from the relay agent to the server uses the relay agent's 
>address as the source address.  The relay agent modifies and sends the 
>DHCP message as the payload in a UDP message that appears to originate 
>from the relay agent.  Section 4 of RFC1542 gives more details.  The 
>difference between DHCPv4 and DHCPv6 is in the way in which the client 
>message is processed by the relay agent (in DHCPv6, the message is 
>encapsulated in a new message generated by the relay agent).
>
>Yes, IPsec cannot be used from the client to the server.  The proposal for 
>the use of IPsec under consideration here is to protect the message as it 
>travels between the relay agent and the server.  The primary purpose is to 
>protect any relay agent options, addressing an issue raised by the 
>original relay option spec (RFC3046), which assumes no security is needed 
>between the relay agent and the server.
>
>- Ralph
>
>At 02:35 PM 10/9/2002 -0400, Thomas Narten wrote:
>> > If I squint my eyes and stand back far enough, I don't see that the DHCPv4
>> > case is different.
>>
>>Conceptually similar, details are different.
>>
>> > While the relay agent is relaying a message on behalf
>> > of the client, it really is relaying that message in an independent UDP
>> > message, in which the source address belongs to the relay agent.
>>
>>Isn't the source address of the packet that of the client (and not the
>>relay agent)? This makes a huge differences with regards to IPsec.
>>
>>Even worse, the client has no IP address yet, so the relayed packet
>>has no source address...
>>
>>This can't be made to work trivially with stock IPsec. You'd need
>>extensions I'd suspect, defeating much of the purpose of trying to use
>>IPsec.
>>
>>Note that the above also factored into why DHC needed something
>>specific to DHC rather than trying to somehow use IPsec.
>>
>>Thomas
>
>_______________________________________________
>dhcwg mailing list
>[e-mail]
>https://www1.ietf.org/mailman/listinfo/dhcwg

_______________________________________________
dhcwg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/dhcwg