Subject: [Pana] comments draft-ohba-pana-statemachine-00

From: Alper Yegin <[email-masked]>
Date: Thu, 22 Jul 2004 18:16:51 -0700

Hello,

I read draft-ohba-pana-statemachine-00, and it looks good. 

It'd be useful to have some state machine diagrams on the web, and
provide links to them in the I-D. That'd help readers follow what is
going on.

Some messages in the I-D are not matching the latest pana-pana spec.
Like PAUR and PAUA are PUR and PUA. Also device ID update does not
exist.

On page 21:

   Rx:PBR &&                alt_reject();              WAIT_EAP_RESULT
   1ST_EAP==Success &&
   PBR.RESULT_CODE==
   PANA_SUCCESS &&
   !PBR.exist_avp
   ("EAP-Payload"); 

I couldn't understand what scenario this is for...

Page 35:

   EAP_FAILURE &&           1ST_EAP=Failure            WAIT_PFEA
   1ST_EAP==Unset &&        PBR.insert_avp
                            ^^^^^^^^^^^^^^
 I think this should be PFER.insert_avp

   SEPARATE==Set &&         ("EAP-Payload");
   ABORT_ON_1ST_EAP_FAILURE if (key_available())
   ==Unset                    PFER.insert_avp("MAC");
                            PFER.S_flag=1;
                            if (NAP_AUTH)
                              PFER.N_flag=1;
                            Tx:PFER();
                            RtxTimerStart();

In 8.2:

	may come in the form of an SNMP conversations between PANA and
EP as

This should read "between PAA and EP".

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 22 Jul 2004 22:23:46 -0400

Hi Alper,

> I read draft-ohba-pana-statemachine-00, and it looks good. 

Thank you very much for reading this draft.

> provide links to them in the I-D. That'd help readers follow what is

I agree.  Rafa is now working on creating diagrams and hopefully they
will be available on the web soon.

> Like PAUR and PAUA are PUR and PUA. Also device ID update does not

Right.  We will fix them.

> I couldn't understand what scenario this is for...

This case can happen in the following situation:

- NAP and ISP separate authentications are performed, and the first
EAP authentication succeeds.  (i.e., 1ST_EAP==Success)

- For the second EAP authentication, the PAA runs with EAP Full
Authenticator.  The second EAP authentication fails due to timeout
(i.e., the EAP Full Authenticator state machine enters TIMEOUT_FAILURE
or TIMEOUT_FAILURE2 sink state).  This does not generate an EAP
Failure message. (i.e., !PBR.exist_avp("EAP-Payload");).

- Assume that the PAA's policy is to allow network access for the PaC
unless both of two EAP authentications fail, the PAA returns a PBR
with a result code that indicates success (i.e.,
PBR.RESULT_CODE==PANA_SUCCESS).

>    1ST_EAP==Unset &&        PBR.insert_avp

Right.  We will fix this.

> This should read "between PAA and EP".

We will fix this also.

Thanks again,

Yoshihiro Ohba