Subject: [Nea] Comments on NEA requirements document

From: Christopher Misra <[email-masked]>
Date: Mon, 10 Jul 2006 16:43:11 -0400

Given the current needs and usage of NEA-like models as characterized by
the work of the SALSA-NetAuth working group, we would propose the follow
changes or amendments, details inline below. These comments reflect the
consensus of the NetAuth working group as of 6 July 2006.

Christopher Misra
Chair, Internet2 Salsa-NetAuth working group
=
Addition to Section 4 (Common Requirements Across Architecture):
Add a requirement to section 4 that is a rephrasing of point 1 from
Section 7 (operational considerations):

1. Some network devices (e.g. printers, legacy systems) will not
   have support for NEA agents present < ... >

Added as section 4.8

8. Some network devices (e.g. printers, legacy systems) will not have
support for NEA agents and others, though able to run an NEA agent,
might experience periods of time when the client is unable to respond
using the NEA protocols. Because of this, the NEA protocols MUST be
capable of detecting that some network devices are incapable of
responding to NEA protocols and thus will not be able to report its
security posture. The NEA architecture SHOULD allow for this event to be
detected and reported to other components. The other components MAY be
able to evaluate risk via other mechanisms (e.g. using scanning
techniques) and report back a suggested action.

Clarification of Section 5.3

 5.3.Posture Transport (PT) Protocol Requirements

    The PT is the transport protocol between the Network Access
    Requestor (NAR) in the NEA Client and the Network Access Authority
    (NAA) within the NEA Server present on the network owner?s
    infrastructure.  PT is responsible for providing a protected
    transport (frequently using a tunnel) for the PB protocol.

<additional text>
    This section will also define the use of EAP as the Posture
Transport. While EAP is explicitly defined it is not the only supported
method of transport.  An implementation could add additional transport
options in addition to EAP and still be compliant.
</additional text>

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea