Subject: RE: [Pana] RE: EAP-based reauth clarification [Re: Mobility Handling in PANA]

From: Giaretta Gerardo <[email-masked]>
Date: Thu, 15 Jul 2004 16:37:03 +0200

Hi Yoshi,

thanks for your reply. See my comments below..

> Hi Gerardo,
> 
> On Thu, Jul 15, 2004 at 11:07:19AM +0200, Giaretta Gerardo wrote:
> > > 
> > > - What happens if the EAP re-authentication with a single EAP run 
> > > (for NAP authentication for example) fails?  Should the PANA 
> > > session be deleted, or remain because authorization for ISP part 
> > > still exists? In the latter case, are the subsequent 
> > > EAP-reauthentications always performed with a single EAP run for 
> > > ISP authentication?  And also in the latter case is the 
> > > PANA_MAC_KEY needs to be updated after the single EAP run failure 
> > > in the EAP re-authentication?  If so, how?
> > > 
> > 
> > I think this is the main issue. Maybe if one
> re-authentication fails,
> > the PANA session should be deleted. This case should be
> treated as the
> > bootstrap case when double authentication is performed and
> ISP or NAP
> > authentication fails.
> 
> If you delete the PANA session just because the
> re-authentication for NAP fails, this would be a problem for 
> the other (ISP) authorization state.  
> 

Are you referring to the fact that the ISP state in the PAA would be
deleted?

Maybe I miss your point or the scenario you are referring to. Should the
PAA mantain the ISP authorization state even if the NAP
(re)authentication fails?
Can you please describe a scenario in which even if the NAP
authentication fails, the ISP authorization state in the PAA must be
kept?			

> > 
> > Agree.
> > Note that this implies that if the PaC performs only 
> re-authentication
> > procedures, it will never know if a new ISP is available. 
> Do you think
> > this is an issue?
> 
> I don't think that is an issue because it is a rare case.
> 

ok.

--Gerardo

> Yoshihiro Ohba

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 15 Jul 2004 10:57:43 -0400

> Are you referring to the fact that the ISP state in the PAA would be

Yes.

> authentication fails, the ISP authorization state in the PAA must be

If you fail NAP authentication, you may lose access to some
application servers within the NAP network for instance.  But if you
keep the ISP state, you can still access to the ISP network.

Yoshihiro Ohba