1. PANA in DSL networks draft-morand-pana-panaoverdsl-01.txt
Lionel Morand France Telecom
Alper Yegin Samsung
Yoshihiro Ohba Toshiba
John Kaippallimalil Huawei
IETF-71, Philadelphia

2. Draft History IETF 66: IETF 67: IETF 67 and IETF 71: IETF 71:
PANA use case for DSL removed from PANA Framework
IETF 67:
First presentation of the "PANA over DSL" draft (v00)
IETF 67 and IETF 71:
Draft frozen during finalization of PANA protocol
DSL Liaison on access authentication requirements
IETF 71:
Update version of the "PANA over DSL" draft (v01)
Based on final version of the PANA base protocol and comments received and outputs of DSLF liaison discussions

3. Context Evolution of DSL architecture in two steps:
Moving from ATM-based aggregation to Gigabit Ethernet
Moving from PPP-based environment to IP-based model
"IP Sessions" model ongoing work in DSL Forum
Basically, an IP session represents the subscriber IP traffic associated with an IP address
Need for a subscriber access authentication mechanism
DSL Forum working around DHCP evolution for supporting EAP
DSL Liaison discussion during IETF70 in the Internet Area meeting session
PANA should also be considered a natural candidate
Fulfill DSL Forum security requirements provided in the Liaison

4. Summary
Provides guidelines for PANA deployment over DSL access networks
Focus on DSL networks migrating from:
a traditional PPP access model
Where PPP is used to carry authentication parameters (PAP/CHAP or EAP methods)
to a pure IP-based access environment
No built-in explicit per-subscriber access authentication
Use of DHCP option 82 for implicit line-based authentication
PANA provides such a mechanism in this environment

5. From v00 to v01 Alignment with PANA final specification
Clarification on the possible PAA-EP interface
Removal of reference to SNMP or ANCP
Description of DHCP snooping/triggering mechanism
Reorganization of the draft
New section on the use of the MAC address as authorized device ID
Added section on specific implementation example
With the use of Link-local IPv4 address
More details in message flow descriptions

6. PAA/EP Location ISP DSLAM BRAS ISP DSLAM BRAS PAA/EP DSL Modem/RG
API or
DHCP Snooping EP
PAA
BRAS
ISP
DSL Modem/RG
DSLAM

7. PaC Location ISP DSLAM Bridge BRAS ISP DSLAM NAT/Router BRAS ISP DSLAM
PAA/EP
BRAS
ISP
DSL Modem/RG
DSLAM
PaC
Bridge
1/ Bridged Mode in IPv4/IPv6
PAA/EP
BRAS
PaC
ISP
DSL Modem/RG
DSLAM
NAT/Router
2a/ Routed Mode in IPv4
PaC
PAA/EP
BRAS
PaC
ISP
DSL Modem/RG
DSLAM
PaC
Router
2b/ Routed Mode in IPv6

8. Use of PRPA/POPA Mainly useful in IPv4 context
to prevent waste of scarce IP resources
In IPv4 context, PRPA may be:
Link-local IP address
Private IP address
Temporary allocated IP address
with short-lease and/or limited use
After a successful authentication, POPA is configured using DHCP

9. RADIUS/Diameter Authentication 6. IP Session/data traffic
Generic Message Flows
DSL Model/RG
or host
(PaC)
DSLAM
(EP)
BRAS
(PAA)
AAA Server
1. PRPA Configuration
2. PAA Discovery
3. PANA Authentication
RADIUS/Diameter Authentication
4. POPA Configuration*
5. EP filter setup
6. IP Session/data traffic
*Only needed if the IP address needs to be reallocated

10. Specific example Deployment scenario in which:
DSL Network configuration with:
PaC in the DSL modem/RG
BRAS hosting PAA, DHCP Server/Relay, and AAA client
DSLAM acting as EP
Link-local IPv4 address as PRPA
DHCP-based PAA discovery
EAP-MD5 Authentication method
POPA configured using DHCPv4
EP is triggered by DHCPACK whose 'yiaddr' field is filled

11. Specific Message flows
DSL Model/RG
or host
(PaC)
DSLAM
(EP)
BRAS
(PAA)
EP Filter allowing only DHCP and PANA
AAA Server
No IP Address Allocation
1. Link local PRPA Configuration
2. DHCP Inform *(req PAA option)
3. DHCP Ack (PAA option)
4. PANA client initiation
Authentication
5. PANA Auth Req (EAP-MD5 Challenge)
6. PANA Auth Ans (EAP-MD5 resp)
7. RADIUS Access Req (EAP)
8. RADIUS Access Accept (EAP)
9. PANA Auth Req (EAP Success)
10. PANA Auth Ans (Ack)
11. DHCP Discover
12. DHCP Offer
IP Address Allocation
13. DHCP Request (with IP address in 'yiaddr')
14. DHCP Ack
15. IP Session/data traffic
EP Filter update based on DHCP snooping

12. Next Step Provide more details on:
The use of link-local
Mechanism to avoid/resolve possible address conflict/collision
PANA impacts on DSL network:
Host, DSL Modem, DSLAM, BRAS, DHCP server
DSLAM acting as EP
And the use of DHCP as EP triggering mechanism
binding management
Tight/loose coupling between DHCP/PANA/AAA
Investigate/clarify the case of hosts behind a NAT/Router in IPv4
Does PANA support NAT traversal?
Consider Unspecified IP address?
As an alternative to link-local IP address as PRPA

13. Thank You