Subject: Re: REQMTS 4: definition of remote access

From: Scott Kelly <[email-masked]>
Date: Wed, 01 Nov 2000 11:32:55 -0800

Hi Jan,

Sorry for the delayed response. Comments interspersed...

Jan Vilhuber wrote:
> 
> Two thoughts:
> 
> a) the only difference I can think of quickly between what you define as
> 'remote access' and 'extranet' is the fact that one gets an ip-address, and
> the other gets an ip-address and a subnet. Is that right?

Well, that's not clear at this point: it's possible to connect in an
extranet situation without having an address assignment occur. On the
other hand, based on the definition I tried to formulate, if both get
addresses assigned, the subnet is immaterial, because both meet the
suggested criteria (local address assigned).

<much trimmed...>

> b) why not ask the AAA WG for their definition of 'remote access'? I would
> quite frankly say that we need to complement or extend any general IETF
> definition of 'remote access' to ipsec, no matter how broad the IETF
> definition of 'remote access' is. In other words 'for our purposes' MUST be
> the same as the IETF purpose in general. We can't dumb it down, so to speak.
> I'm kind of going on the assumption that the AAA WG (or maybe the PPP WG?) is
> the 'authority' on what remote-access is, not us. So we should bow to
> whatever definition they have, and work with it.

Two comments: first, my aim *is* to construct a definition which extends
the general definition, which is why I first referred to ppp et al.
Second, I think we must limit the scope of what we intend to address. I
think the definition Skip offered encompasses all of ipsec except for
intranet, and this scope is too large for this working group. That's why
I'm trying to find a more precise definition. I don't think what I've
suggested clashes with pppext, l2tpext, or aaa, but I agree that we
should ensure that such a clash does not occur.

Scott

---

From: "Moshe Litvin" <[email-masked]>
Date: Thu, 2 Nov 2000 13:01:12 +0200

Scott,

I strongly disagree with the definition of remote access = local address
assignment.

If you have a software installed on a laptop, that is able to establish an
IPsec tunnel with the corporate gateway but the client keeps his ISP
assigned address. Isn't this also remote access?

On the other hand if you have a GW to GW tunnel, where one of the GW decide
to NAT the incoming traffic to locally assigned address (in order the help
with routing issues). Would you call this remote access?

When looking for what is common in many remote access scenarios I see:

- "Remote module" is coming from an unexpected IP address (as opposed to GW
which have a fixed address).

- The "remote module" usually have a human operator on-line, and the
authentication process identify the human (with or without separate
authentication for the machine), and the access policy can/will also depend
on the human.

Moshe

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Scott Kelly
> Sent: Tuesday, October 31, 2000 4:03 AM
> To: ipsra list
> Subject: REQMTS 4: definition of remote access
>
>
> This is the fourth in a series of posts aimed at resolving some issues
> prior to publication of a revision of the requirements draft.
>
> I think, based upon recent discussion on this list, that we
> need to more
> clearly define what we mean by remote access. While a definition might
> seem obvious at first glance (I sure thought it was), it turns out not
> to be quite so straightforward. Skip suggested that any host which is
> not physically connected to the network and must use some other method
> of obtaining access to the network qualifies as a remote
> access host. My
> difficulty with this definition is that it includes almost every
> topology in which we might use ipsec, other than intranet. I think the
> implied scope is far larger than what some of us would expect for this
> working group.
>
> An alternative is to try to construct an operational
> definition based on
> what we've defined as remote access in the past. Not too long ago,
> remote access meant dialing into a modem at the corporate
> site. Not long
> after that, it came to include dialing into an ISP and tunneling the
> connection across the internet using pptp, l2tp or something
> like that.
> Now, we're attempting to extend the definition a bit by
> including ipsec
> in the cadre of tunneling mechanisms.
>
> I think it may be that one common thread in all the scenarios
> described
> is that the remote system is given an address from the local network.
> That is, although the system is remote in space, once access
> is granted,
> it appears to be on the same physical lan as the other hosts.
>
> If we use this as a filter, remote access would include
> access using any
> arbitrary connection technology, so long as the connection
> was tunneled,
> and the user was assigned a local lan address somehow. This
> squares well
> with the scenarios we've defined so far, but it excludes the
> 2 scenarios
> I was thinking about deleting, i.e.
>
>  o extranet users using their corporate desktop systems to
>    access the remote company network of a business partner
>
>  o extranet users using a business partner's system (on that
>    partner's network) to access their home corporate network
>
> unless the connections are tunnelled, and a home lan address
> is assigned
> from the accessed network.
>
> Does anyone have a better idea of how to define remote access (for our
> purposes)?
>
> Scott
>