Re: [dhcwg] DHCP interconnected to RADIUS for AAA

The latest version of PANA requirements draft says:
(it missed the submission deadline, but it is available on 
 http://www.toshiba.com/tari/pana/draft-ietf-pana-requirements-05.txt)

4.2. IP Address Assignment

   Providing address assignment functionality is outside the scope
   of PANA. PANA protocol design MAY require the PaC to configure
   an IP address before using this protocol. Allocating an IP address
   to unauthenticated PaCs may enable security vulnerabilities, such as
   IP address depletion attacks on the access network [SECTHREAT]. This
   threat may not be an issue for IPv6 because of the large address
   space, but it can effect IPv4 deployments. Such a threat can be
   mitigated by allowing the protocol to run without an IP address on
   the PaC (e.g., using unspecified source address), but this choice 
   might limit the re-use of existing security mechanisms, and impose
   additional implementation complexity. This trade off should be taken
   into consideration in designing PANA.

Yoshihiro Ohba

On Thu, Mar 13, 2003 at 01:35:50PM -0500, Ralph Droms wrote:
> I don't understand how PANA can be used first - the requirements doc says:
> 
>    PANA does not perform any address assignment functions
>    but MUST only be invoked after the client has a usable
>    IP address (e.g., a link-local address in IPv6 or a
>    DHCP-learned address in IPv4)
> 
> - Ralph
> 
> At 09:45 PM 3/11/2003 +0100, Erik Nordmark wrote:
> >> Is there work currently in progress on such an alternative? (triggering a
> >> PANA transaction upon a DHCP message from the client or something 
> >similar).
> >> Would this be an appropriate forum to start a discussion?
> >
> >The simplest thing would be to have them operate independently
> >e.g. PANA authentication first then DHC address assignment etc.
> >That doesn't allow you to assign different addresses for different classes
> >of authenticated devices though.
> >
> >  Erik
> >
> >_______________________________________________
> >dhcwg mailing list
> >dhcwg@ietf.org
> >https://www1.ietf.org/mailman/listinfo/dhcwg
> 
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www1.ietf.org/mailman/listinfo/dhcwg
> 
_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg