Subject: RE: multiples PAAs

From: <[email-masked]>
Date: Wed, 12 Mar 2003 12:32:02 -0600

I agree with what you are saying here. I guess we did not consider
the deployment model where different PAAs are responsible for different
EPs. Do you foresee such deployments?

-Basavaraj

> 
> Hi all,
> 
> "Discovery and Initial Handshake Phase" text in the protocol draft:
>     There can be multiple PAAs on the link.  The result does 
> not depend
>     on which PAA PaC chooses. By default PaC chooses the PAA that sent
>     the first response.
> 
> IMHO, there is a need to clarify here. Let's assume that we have 
> multiple PAAs separated from EPs:
> 
>              PaC1a --+            +- PAA1
>                      |            |
>              PaC1b --+-- EP1 -----+- router -----+
>                                   |              |
>               PaC2 ----- EP2 --- -+              |
>                                   |              |
>               PaC2 ----- EP3 -----+- router -----+----- (AAA)
>                                   |
>                                   +- PAA2
> 
> I mean if:
> - PAA1 provisions EP1
> - PAA2 provisions EP2 and EP3
> then it should be this way:
> - PAA1 authenticates Pac1a and PaC1b
> - PAA2 authenticates PaC2 and PaC3
> 
> it should be stated that the PAA which authenticates the PaC 
> should be 
> the same as the one which provisions the corresponding EP(s).
> 
> thanks,
> yacine
> 
>

---

From: [email-masked]
Date: Thu, 13 Mar 2003 14:50:37 +0100

> EPs. Do you foresee such deployments?

IMHO, it's the best way for a stateful approach. I mean a given EP 
controled by a single dedicated PAA and a given PAA controls a "pool" of 
EPs.

do note that this does not prevent from synchronising PAAs for mobility 
purposes or whatever...

thank you,
yacine

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 13 Mar 2003 11:04:40 -0500

Hi Yacine,

> controled by a single dedicated PAA and a given PAA controls a "pool" of 

The assumption in this model would be that a PaC may need to
communicate with multiple PAAs if packets from the PaC diverge among
multiple EPs controlled by different PAAs.  IMHO, this is not a good
model since it might create more traffic on PaC, which might not be
desired if PaC is a wireless device.

I believe a good model is an assymetric model in which every EP is
controlled by every PAA, and PaC chooses just one PAA and obtains the
same authentication and authorization result whichever PAA is chosen.
This might imply that when PANA_discover message is generated at an
EP, the EP may need to send the PANA_discover message to each PAA, but
this should not be a problem because (i) the link between EP and PAA
is typically a wired link and the increased bandwidth for this might
not be a major concern and (ii) each PAA does not create any state by
receiving a PANA_discover message.

Yoshihiro Ohba

---

From: [email-masked]
Date: Thu, 13 Mar 2003 18:37:50 +0100

Yoshihiro,

Yoshihiro Ohba wrote:

> multiple EPs controlled by different PAAs. 

IMHO, your assumption is not true:
if needed, the chosen PAA may inform the other PAAs that a PaC has been 
successfully authentified and uses a given DI. Then each PAA provisions 
its EPs accordingly. it's transparent for the PaC.

> IMHO, this is not a good

are you saying that the for each PaC authentified, each PAA will install 
filters in all the EPs ?

> receiving a PANA_discover message.

you bring up another point:

Discovery phase in the pana draft:
    PaC may also choose to start sending packets before getting
    authenticated.  In that case, the network should detect this and
    send an unsolicited PANA_start message to PaC.  EP is the node that
    can detect such activity.  If EP and PAA are co-located, then an
    internal mechanism (e.g. API) between the EP module and the PAA
    module on the same host can prompt PAA to start PANA.  In case they
    are separate, there needs to [be] an explicit message to prompt PAA. 

    Upon detecting the need to authenticate a client, EP can send a
    PAC_discovery message to the PAA on behalf of the PaC.  This
    message carries a device identifier of the PaC in a Device-Id AVP.

why not stating this point as a requirement for the PAA-EP protocol 
instead ? (I thought it was the case... 'event notification' is in the 
list !)

actually, in my view, EPs are attached to one single PAA. After the 
discovery phase, the chosen PAA provisions its EPs and informs other 
PAAs (like explained above).
if the EP detects activity before the PaC is authentified, then it sends 
an explicit message to prompt its PAA (via the PAA-EP protocol).

do note that I voluntary left appart the initial problem of the choice 
of the PAA, which is IMHO distinct from the problem discussed here.

thank you,
yacine

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 13 Mar 2003 14:01:22 -0500

Hi Yacine,

> its EPs accordingly. it's transparent for the PaC.

In that case, PAA-to-PAA communication is assumed.  But the WG does 
not assume it as far as I know.

> >same authentication and authorization result whichever PAA is chosen.

Correction to my comment: assymetic -> symmetric

> are you saying that the for each PaC authentified, each PAA will install 

No.  What I'm thinking is that for each PaC authentified, one PAA
chosen by the PaC will install filters in all the EPs (in this sense 
the model is not completely symmetric.

> instead ? (I thought it was the case... 'event notification' is in the 

Good point.  Event notification (as an authentication trigger) from EP
to PAA was once discussed on the mailing list, but it is not described
in the requirements draft.  I think it might be better to make it an
explicit requirement.

> PAAs (like explained above).

I prefer the current model in which PAA-to-PAA protocol is not assumed.

> an explicit message to prompt its PAA (via the PAA-EP protocol).

Yes.

> of the PAA, which is IMHO distinct from the problem discussed here.

OK.

Yoshihiro Ohba

---

From: [email-masked]
Date: Fri, 14 Mar 2003 12:52:48 +0100

Hi Yoshihiro,

 > What I'm thinking is that for each PaC authentified, one PAA

Is the WG considers this as realistic ?

thanks,
yacine

---

From: Alper Yegin <[email-masked]>
Date: Fri, 14 Mar 2003 10:57:39 -0800

> Is the WG considers this as realistic ?

Hi Yacine, which part are you asking this about?
The possibility of having multiple EPs, or a PAA knowing about them?

I think the former is a possibility when PaC connects to an access network
via L2 access device, but the enforcement points are first hop routers just
behind the access device. Ideally one should put the EP on the L2 access
device, but this might not be possible and EPs on the routers can offer an
alternative.

Second one is possible too, imo, at least by static configuration.

alper

---

From: [email-masked]
Date: Tue, 25 Mar 2003 14:38:21 +0100

Hi Alper,

sorry for the late reply, please see below:

Alper Yegin wrote:
 > The possibility of having multiple EPs,

no problem with that.

 > or a PAA knowing about them?

each PAA knowing about ALL them... In such a case, do you have already 
an idea of the number of EPs in the access network that will be 
configured each time a PaC is authentified by a PAA  ?

 > I think the former is a possibility when PaC connects to an access
 > network via L2 access device, but the enforcement points are first hop
 > routers just behind the access device. Ideally one should put the EP
 > on the L2 access device, but this might not be possible and EPs on the
 > routers can offer an alternative.

could you elaborate on this, I dont really understand what makes a 
difference from the PAA perspective (whether the EP is co-located with 
the AR or not) ?

thanks,
yacine

---

From: Alper Yegin <[email-masked]>
Date: Tue, 25 Mar 2003 11:57:59 -0800

Hi Yacine,

> configured each time a PaC is authentified by a PAA  ?

The number of EPs on an IP link is a deployment parameter, I have no idea.
EPs and PAA are on the same link. I think it is reasonable to assume that
PAA is pre-configured with the EP information, and vice versa.

> difference from the PAA perspective (whether the EP is co-located with

If there is a L2 access device between the PaC and the AR, that means most
probably IPsec should be used for access control. Hence PAA should use the
appropriate flag in the data-protection-AVP [please see the pana-00 draft].
These are all pre-configured though, no need to dynamically detect the
"environment".

alper

---

From: [email-masked]
Date: Wed, 26 Mar 2003 14:25:20 +0100

let's try to clarify:

what are the motivations (if any) for having more than a single PAA in 
the access network WHEN SEPARATED from EPs (and/or ARs) ?

thanks,
yacine

---

From: Alper Yegin <[email-masked]>
Date: Wed, 26 Mar 2003 17:52:57 -0800

We had a discussion on that: whether we should allow multiple PAAs or not.
We could simply say there cannot be more than one, but we wanted to keep the
protocol flexible for now unless this causes problems. A deployment might
choose to have more than one for reasons like redundancy. Of course
redundancy is not as simple as putting a second server, but that's a start.
There are more details that needs to be worked out to have full redundancy,
but clearly they are not for the PANA WG to solve.

I hope this answers your question.

alper