Subject: [Pana] New Intro section for framework I-D

From: Alper Yegin <[email-masked]>
Date: Wed, 14 Jul 2004 15:07:09 -0700

Hello,

Based on Erik's feedback, I have a new proposed text for the
introduction section of the PANA Framework document. Comments welcome.

   PANA is a link-layer agnostic network access authentication protocol
   that runs between a node that wants to gain access to the network and
   a server on the network side. PANA defines a new EAP [RFC3748] lower 
   layer that uses IP between the protocol end points. 

   The motivation to define such a protocol and the requirements are 
   described in [I-D.ietf-pana-requirements]. Protocol details are 
   documented in [I-D.ietf-pana-pana]. [I-D.ietf-pana-ipsec] describes
use 
   of IPsec for access control following PANA-based authentication.
IPsec 
   can be used for per-packet access control, but nevertheless it is not
the
   only way to achieve this functionality. Alternatives include reliance
on 
   physical security and link-layer ciphering. Separation of PANA server
   from the entity enforcing the access control is envisaged as an
optional
   deployment choice. SNMP [I-D.ietf-pana-snmp] is chosen as the
protocol to 
   carry associated information between the separate nodes.

   PANA design provides support for various types of deployments. Access
   networks can differ based on the availability of lower-layer
   security, placement of PANA entities, choice of client IP
   configuration and authentication methods, etc.

   PANA can be used in any access network regardless of the underlying
   security.  For example, the network might be physically secured, or
   secured by means of cryptographic mechanisms after the successful
   client-network authentication.

   The PANA client, PANA authentication agent, authentication server,
   and enforcement point are the relevant functional entities in this
   design.  PANA authentication agent and enforcement point(s) can be
   placed on various elements in the access network (e.g., access point,
   access router, dedicated host).

   IP address configuration mechanisms vary as well. Static
   configuration, DHCP, stateless address autoconfiguration are possible
   mechanisms to choose from. If the client configures an IPsec tunnel
   for enabling per-packet security, configuring IP addresses inside the
   tunnel becomes relevant, for which there are additional choices such
   as IKE.

   This I-D defines a general framework for describing how these various
   deployment choices are handled by PANA and the access network
   architectures.  Additionally, two possible deployments are described
   in detail: PANA over DSL networks and WLAN networks.	

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 15 Jul 2004 10:13:48 -0400

Hi Alper,

The suggested text looks fine.

Since the introduction section mentions that SNMP is chosen as the
protocol to carry associated information between the separate nodes, 
we might modify the following text in section 7 (PAA-EP Protocol):

"
   When a client is authenticated and authorized, PAA should notify
   EP(s) and ask for changing filtering rules to allow traffic for a
   recently authorized client.  There needs to be a protocol between PAA
   and EP(s) when these entities are not co-located.  PANA Working Group
   will not be defining a new protocol for this interaction.  Instead,
   it identifies one of the existing protocols that can fit the
   requirements.  An assessment was made in the PANA Working Group and
   SNMPv3 has been chosen as the mandatory PAA-EP protocol.
"

to: 

"
   When a PaC is authenticated and authorized, the PAA should notify
   EP(s) and ask for installing filtering rules to allow the PaC to sent
   and receive data traffic.  SNMP is used between PAA
   and EP(s) for this purpose when these entities are not co-located
   [I-D.ietf-pana-snmp].
"

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 15 Jul 2004 11:44:05 -0700

Makes sense. 

Alper

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Thursday, July 15, 2004 7:14 AM
> To: Alper Yegin
> Cc: [email-masked]
> Subject: Re: [Pana] New Intro section for framework I-D
> 
> Hi Alper,
>