Re: [dhcwg] Discussion of dhc WG rechartering for DHCP authentication

[Richard Pruss <ric at cisco.com>]

Alper Yegin wrote, around 2/11/07 10:50 PM:
> How is setting up a different filter on the devices that already know how to
> setup filters considered a "considerable re-work"? I'd appreciate if you can
> tell us how this is anything more than simply setting up a filter rule.
>   
The devices currently install these filters based on DHCP snooping.  In
our proposal current architecture use of the DHCP ack will still trigger
drive the source address verification on the first network hop, exactly
as they do today.

With PANA, these devices which are the whole of the transmission edge
would all need to get a new PANA snooping enabled code base, with all
the filtering use cases around that.  New ideas like authenticated and
unauthenticated IP addresses and policy for those need to be hooked to
new filters that operate on IP streams. A snooping version of PANA or
some sort of PANA grafting to a policy distribution mechanisms.

That more new stuff than I care to count can charitably called
"considerable re-work", more it should be pretty obvious from ethernet 
security is not the application for PANA.  This application is deeply 
entwined with layer 2, PANA is clearly aimed at IP authentication and is 
not a layer 2 or in the DHCP Auth case layer 2.5 application.

I wonder why you keep driving this square peg into a round hole.  The
first entry of the PANA FAQ is that PANA is layer 2 agnostic and you
seem determined to undo that.
http://www.toshiba.com/tari/pana/pana-faq.txt

- Ric




_______________________________________________
dhcwg mailing list
dhcwg at ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg