Subject: Topology Issues

From: Tschofenig Hannes <[email-masked]>
Date: Fri, 14 Mar 2003 09:45:51 +0100

Hi all, 

This short text should describe some of the topology problems which arise
when

- no toplogy knowledge is available where to create device identifiers at
eps (e.g. one particular PAA is responsible only for some eps)

- the PAA is not the first-hop router. 

In Figure 1 various PAAs are available. The PAAs are not the first IP
device. 

  PaC1a --+            +- Router1 ---------- PAA3 --
          |            |
  PaC1b --+-- EP1 -----+- Router2 -----+
                       |               |
   PaC2 ----- EP2 -----+               |
                       |               |
   PaC3 ----- EP3 -----+- Router3 -----+----- PAA2--
                       |               |
                       +- Router4 -----+------PAA1 ---

Figure 1: PANA scenario where PAA is not the first IP device

Based on the discovery mechanism PaC2 is authenticated at PAA2. In general
it might be quite difficult for PAA2 to know which path later packets will
take to install the device identifier at the correct EP. Hence if we assume
that only packet filter information is installed at the PAA2 (i.e. PAA2 acts
as a firewall). 

When PaC2 transits a packet to a certain destination address (Dst1) then the
IP packet will hit one of the routers (e.g. Router3). Depending on the
routing table the packet will be forwarded to a particular PAA (e.g. PAA1). 

When PaC2 transmits a new packet with a different destination address (Dst2)
then the IP packet suddenly hits a different PAA (e.g. PAA2) due to the
routing table entries at Router3. 

Furthermore it is possible that the incoming packet takes a different path
then the outgoing packet. Hence there is the question how the packet filter
actually looks like. Is the packet filter only filtering packets from the
PaC direction to the network direction or even from the outside to the
inside direction?

Hence I would like to raise the following questions: 

1) How should the PAA know at which EP to install the device identifier? (in
a generic case). Or: What assumptions have to be made here. 

2) What should be assumed about the location of the PAA? (again in a generic
case). 

Especially question (2) is important. There is obviously a relationship to
the discovery mechanisms. You might not want to discover a PAA where packets
never flow through (in case that the PAA acts as a firewall). 

Ciao
Hannes

---

From: [email-masked]
Date: Fri, 14 Mar 2003 12:30:54 +0100

a brief comment inline in order to avoid misunderstandings:

> that only packet filter information is installed at the PAA2 (i.e. PAA2 acts

my understanding is that the PAA installs DI-based filters in EP(s).
I dont understand this sentence: "packet filter information is installed 
at the PAA2"... please can you further explain ?

thanks,
yacine

---

From: Alper Yegin <[email-masked]>
Date: Fri, 14 Mar 2003 10:49:12 -0800

Hello,

Here is what we said in the requirements draft:

  The PAA and PaC must be exactly one IP hop away from each other.

And in the solution draft says:

   EPs location in the network topology should be appropriate for
   performing access control functionality. The closest IP-capable
   access device to the client devices is the logical choice. PAA and
   EPs on an access network should be aware of each other as this is
   necessary for access control. Generally this can be achieved by
   manual configuration. Dynamic discovery is another possibility, but
   this is clearly outside the scope of PANA.

PAA and EP are functional entities. They can be located on various
access network entities. Possible combinations are:

- PaCs are physically connected to access router (AR):
    - EP and PAA can reside on the AR.

- PaCs are physically connected to a L2 access device (e.g., access  point,
AP)
    - Both EP and PAA can reside on the AP
    - EP can reside on the AP, PAA on a separate server/router
    - EPs can reside on first hop routers, PAA on a separate server, or on
one of the routers.

These are based on the Appendix section of the requirements draft.

I don't know if these answer your questions..

The assumption is, access network, the last hop, is owned by one NAP, which
controls the PAA(s) and EP(s). Before going into more complex cases like
several PAAs owned by different NAPs and managing subsets of EPs on the same
link, we need to understand if it is realistic and needed.

alper

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Fri, 14 Mar 2003 20:13:58 +0100

hi alper,

i fully agree with you. this is also my observation that the requirement is
very useful as i tried to motivate with the topology issues text.

ciao
hannes

> -----Original Message-----
> From: Alper Yegin [mailto:[email-masked]]
> Sent: Freitag, 14. Marz 2003 19:49
> To: Tschofenig Hannes; [email-masked]'
> Subject: Re: Topology Issues
>
>
> Hello,
>

---

From: Julien Bournelle <[email-masked]>
Date: Mon, 17 Mar 2003 14:23:30 +0100

Hi,
>     - EP can reside on the AP, PAA on a separate server/router

=> in this case, we have the problem mentionned by hannes:
the EP filters unauthenticated PaC and will have to look at 
IP and transport layer to forward PANA packet.

-- 
[email-masked]

---

From: Alper Yegin <[email-masked]>
Date: Mon, 17 Mar 2003 10:47:40 -0800

> IP and transport layer to forward PANA packet.

Yes, this is what EP has to do. Depending on the authorization information
it gets from PAA it might even have to shape or police traffic, and do more
fancy stuff. But I'm not sure if this is a "problem".

alper