Subject: [Pana] NEW: [issue62] PAA discovery triggered by data traffic

From: [email-masked]
Date: Tue, 10 Feb 2004 09:08:51 +0200

RGFuIEZvcnNiZXJnIDxkYW4uZm9yc2JlcmdAbm9raWEuY29tPiBhZGRlZCB0aGUgY29tbWVudDoNCg0KNC4yIERpc2NvdmVyeSBhbmQgSW5pdGlhbCBIYW5kc2hha2UgUGhhc2UNCg0KDQogICAuLi4NCg0KICAgUGFDIG1heSBhbHNvIGNob29zZSB0byBzdGFydCBzZW5kaW5nIHBhY2tldHMgYmVmb3JlIGdldHRpbmcNCiAgIGF1dGhlbnRpY2F0ZWQuIEluIHRoYXQgY2FzZSwgdGhlIG5ldHdvcmsgc2hvdWxkIGRldGVjdCB0aGlzIGFuZCBzZW5kDQogICBhbiB1bnNvbGljaXRlZCBQQU5BLVN0YXJ0LVJlcXVlc3QgbWVzc2FnZSB0byBQYUMuIEVQIGlzIHRoZSBub2RlIHRoYXQNCg0KSmFyaTogKFRlY2huaWNhbCkgS2V5d29yZHMgbm90IGluIHVwcGVyIGNhc2UuIEFyZSB0aGVzZSBmdW5jdGlvbnMNCiAgICAgIHJlcXVpcmVkIG9yIG5vdD8NCg0KICAgY2FuIGRldGVjdCBzdWNoIGFjdGl2aXR5LiBJZiBFUCBhbmQgUEFBIGFyZSBjby1sb2NhdGVkLCB0aGVuIGFuDQogICBpbnRlcm5hbCBtZWNoYW5pc20gKGUuZy4gQVBJKSBiZXR3ZWVuIHRoZSBFUCBtb2R1bGUgYW5kIHRoZSBQQUENCiAgIG1vZHVsZSBvbiB0aGUgc2FtZSBob3N0IGNhbiBwcm9tcHQgUEFBIHRvIHN0YXJ0IFBBTkEuIEluIGNhc2UgdGhleQ0KICAgYXJlIHNlcGFyYXRlLCB0aGVyZSBuZWVkcyB0byBiZSBhbiBleHBsaWNpdCBtZXNzYWdlIHRvIHByb21wdCBQQUEuDQogICBVcG9uIGRldGVjdGluZyB0aGUgbmVlZCB0byBhdXRoZW50aWNhdGUgYSBjbGllbnQsIEVQIGNhbiBzZW5kIGENCiAgIFBBTkEtUEFBLURpc2NvdmVyIG1lc3NhZ2UgdG8gdGhlIFBBQSBvbiBiZWhhbGYgb2YgdGhlIFBhQy4gVGhpcw0KICAgbWVzc2FnZSBjYXJyaWVzIGEgZGV2aWNlIGlkZW50aWZpZXIgb2YgdGhlIFBhQyBpbiBhIERldmljZS1JRCBBVlAuIFNvDQogICB0aGF0LCB0aGUgUEFBIGNhbiBzZW5kIHRoZSB1bnNvbGljaXRlZCBQQU5BLVN0YXJ0LVJlcXVlc3QgbWVzc2FnZQ0KICAgZGlyZWN0bHkgdG8gdGhlIFBhQy4gIElmIHRoZSBsaW5rIGJldHdlZW4gdGhlIEVQIGFuZCBQQUEgaXMgbm90DQogICBzZWN1cmUsIHRoZSBQQU5BLVBBQS1EaXNjb3ZlciBtZXNzYWdlIHNlbnQgZnJvbSB0aGUgRVAgdG8gdGhlIFBBQQ0KICAgTVVTVCBiZSBwcm90ZWN0ZWQgYnkgdXNpbmcsIGUuZy4sIElQc2VjLg0KDQpKQVJJOiAoVGVjaG5pY2FsKSBUaGlzIGlzIGEgYml0IHdlYWsuIEluIGFueSBjYXNlLCB0aGUgaW50cm9kdWN0aW9uDQogICAgICBwcm9taXNlZCB0byBub3QgdGFsayBhYm91dCB0aGUgRVAtUEFBIHByb3RvY29sLiBOb3cgeW91IGFyZSB0YWxraW5nDQogICAgICBhYm91dCBpdCEgSXQgbWlnaHQgYmUgYmV0dGVyIGZvciB0aGlzIGRvY3VtZW50IHRvIHNlZSB0aGUNCiAgICAgIEVQLVBBQSBhcyBhIHNpbmdsZSBlbnRpdHkuDQoNCjQuMTAgRXZlbnQgTm90aWZpY2F0aW9uDQoNCiAgIFVwb24gZGV0ZWN0aW5nIHRoZSBuZWVkIHRvIGF1dGhlbnRpY2F0ZSBhIGNsaWVudCwgRVAgY2FuIHNlbmQgYQ0KICAgdHJpZ2dlciBtZXNzYWdlIHRvIHRoZSBQQUEgb24gYmVoYWxmIG9mIHRoZSBQYUMuIFRoaXMgY2FuIGJlIG9uZSBvZg0KICAgdGhlIG1lc3NhZ2VzIHByb3ZpZGVkIGJ5IHRoZSBQQUEtdG8tRVAgcHJvdG9jb2wsIG9yLCBpbiB0aGUgYWJzZW5jZQ0KICAgb2Ygc3VjaCBhIGZhY2lsaXR5LCBQQU5BLVBBQV9EaXNjb3ZlciBjYW4gYmUgdXNlZCBhcyB3ZWxsLiBUaGlzDQogICBtZXNzYWdlIE1VU1QgY2FycnkgdGhlIGRldmljZSBpZGVudGlmaWVyIG9mIHRoZSBQYUMuIFNvIHRoYXQsIHRoZSBQQUENCiAgIGNhbiBzZW5kIHRoZSB1bnNvbGljaXRlZCBQQU5BLVN0YXJ0LVJlcXVlc3QgbWVzc2FnZSBkaXJlY3RseSB0byB0aGUNCiAgIFBhQy4gIElmIHRoZSBsaW5rIGJldHdlZW4gdGhlIEVQIGFuZCBQQUEgaXMgbm90IHBoeXNpY2FsbHkgc2VjdXJlZCwNCiAgIHRoaXMgbWVzc2FnZSBzZW50IGZyb20gRVAgdG8gUEFBIE1VU1QgYmUgY3J5cHRvZ3JhcGhpY2FsbHkgcHJvdGVjdGVkDQogICAoZS5nLiwgYnkgdXNpbmcgSVBzZWMpLg0KDQpKQVJJOiAoVGVjaG5pY2FsKSBBcyBjb21tZW50ZWQgcHJldmlvdXNseSwgcGVyaGFwcyBpdCB3b3VsZCBiZSBiZXR0ZXINCiAgICAgIGlmIHRoZSBBUC1QQUEgY29uc2lkZXJhdGlvbnMgd2VyZSBrZXB0IG91dCBvZiB0aGlzIGRvY3VtZW50LiBUaHVzDQogICAgICB0aGUgYWJvdmUgdHJpZ2dlciBtZXNzYWdpbmcgY291bGQgcGVyaGFwcyBiZSBvbWl0dGVkIGhlcmU/IFNlY3Rpb24NCiAgICAgIDQuMTEsIGhvd2V2ZXIsIGlzIG5lY2Vzc2FyeS4NCg0KTm90ZSBieSBBbHBlcjogV2UgY2FuIGNvbnNpZGVyIGRlcHJlY2F0aW5nIHRoZSBQQU5BLWJhc2VkIEVQLVBBQSBtZXNzYWdpbmcNCnNpbmNlIHRoZSBtYW5kYXRvcnkgRVAtdG8tUEFBIHByb3RvY29sLCBTTk1QLCBhbHJlYWR5IHN1cHBvcnRzIHNpZ25hbGxpbmcgdG8NCnRoYXQgZWZmZWN0Lg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClBBTkEgSXNzdWVzIDxwYW5hX2lzc3Vlc0BkYW5mb3JzYmVyZy5pbmZvPg0KPGh0dHA6Ly9kYW5mb3JzYmVyZy5pbmZvOjgwODAvcGFuYS1pc3N1ZXMvaXNzdWU2Mj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo=_______________________________________________Pana mailing [email-masked]://www1.ietf.org/mailman/listinfo/pana

---

From: [email-masked]
Date: Tue, 10 Feb 2004 10:23:08 +0100

hello,

please see a couple of comments below:

> Dan Forsberg <[email-masked]> added the comment:
> 
> 4.2 Discovery and Initial Handshake Phase
> 
> 
>    ...
> 
>    PaC may also choose to start sending packets before getting
>    authenticated. In that case, the network should detect this and send
>    an unsolicited PANA-Start-Request message to PaC. EP is the node that
> 
> Jari: (Technical) Keywords not in upper case. Are these functions
>       required or not?
> 
>    can detect such activity. If EP and PAA are co-located, then an
>    internal mechanism (e.g. API) between the EP module and the PAA
>    module on the same host can prompt PAA to start PANA. In case they
>    are separate, there needs to be an explicit message to prompt PAA.
>    Upon detecting the need to authenticate a client, EP can send a
>    PANA-PAA-Discover message to the PAA on behalf of the PaC. This
>    message carries a device identifier of the PaC in a Device-ID AVP. So
>    that, the PAA can send the unsolicited PANA-Start-Request message
>    directly to the PaC.  If the link between the EP and PAA is not
>    secure, the PANA-PAA-Discover message sent from the EP to the PAA
>    MUST be protected by using, e.g., IPsec.
> 
> JARI: (Technical) This is a bit weak. In any case, the introduction
>       promised to not talk about the EP-PAA protocol. Now you are talking
>       about it! It might be better for this document to see the
>       EP-PAA as a single entity.
> 

1) agree. moreover both paragraph quoted above say the same thing. I 
would suggest to replace this part of 4.2, dealing with the case where 
EP and PAA are separated:

    Upon detecting the need to authenticate a client, EP can send a
    PANA-PAA-Discover message to the PAA on behalf of the PaC. This
    message carries a device identifier of the PaC in a Device-ID AVP. So
    that, the PAA can send the unsolicited PANA-Start-Request message
    directly to the PaC.  If the link between the EP and PAA is not
    secure, the PANA-PAA-Discover message sent from the EP to the PAA
    MUST be protected by using, e.g., IPsec.

by a nice "see section 4.10 for further details on this case"

> 4.10 Event Notification
> 
>    Upon detecting the need to authenticate a client, EP can send a
>    trigger message to the PAA on behalf of the PaC. This can be one of
>    the messages provided by the PAA-to-EP protocol, or, in the absence
>    of such a facility, PANA-PAA_Discover can be used as well. This
>    message MUST carry the device identifier of the PaC. So that, the PAA
>    can send the unsolicited PANA-Start-Request message directly to the
>    PaC.  If the link between the EP and PAA is not physically secured,
>    this message sent from EP to PAA MUST be cryptographically protected
>    (e.g., by using IPsec).
> 
> JARI: (Technical) As commented previously, perhaps it would be better
>       if the AP-PAA considerations were kept out of this document. Thus
>       the above trigger messaging could perhaps be omitted here? Section
>       4.11, however, is necessary.
> 
> Note by Alper: We can consider deprecating the PANA-based EP-PAA messaging
> since the mandatory EP-to-PAA protocol, SNMP, already supports signalling to
> that effect.

2) agree. if we finally go this way, we might group 4.10 and 4.11 under 
a single "Support for Separate EP" section, as suggested by Jari.

thanks,
yacine

> __________________________________________________
> PANA Issues <[email-masked]>
> <http://danforsberg.info:8080/pana-issues/issue62>
> __________________________________________________
> =?ڙ???x%??Ojv?z??m????0?'?~???f??f??X??)ߣ?Zna==

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: [email-masked]
Date: Tue, 10 Feb 2004 10:23:08 +0100

hello,

thanks,
yacine