Subject: RE: [Pana] and network selection

From: Avi Lior <[email-masked]>
Date: Mon, 8 Nov 2004 15:08:47 -0500

Assuming AAA is working then:

  +---+     +---+     +----+   +----+             +----+
  |PaC|-----|PAA|-----|VAAA|---|BAAA|-------- o o |HAAA|
  +---+     +---+     +----+   +----+             +----+
  |<----VISITED NETWORK--->|   |<--ISP1 -->|      |<--Home isp2.com-->|

Given that the PaC selects isp1.
The VAAA (acting as EAP Authenticator) is using eap network selection and
will present the PAC with a list of possible NAIs. (Keeping it simple for
now)
The PaC selects one. The VAAA connects to the HAAA routing according to the
PaC selection.

So really I don't see what is the purpose of ISP selection in PANA.

However, if during PANA discovery the PaC selects isp1.com and then the
Authentication phase happens with the BAAA of isp1.com.  That is, isp1.com
becomes the EAP Authenticator. Then that is entirely a different story.
Since now the isp1.com will present the PaC with a list of networks to
select.

So PANA ISP Selection is the process of selecting the EAP Authenticaror for
ISP authentication.

Likewise PANA NAP Selection is the process of selection the EAP
Authenticator for Network Authentiction.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Jari Arkko <[email-masked]>
Date: Mon, 08 Nov 2004 22:19:42 +0200

> Assuming AAA is working then:

Well, generally speaking, link layers might be more efficient
than EAP in making this selection happen. With EAP, you need
to actually start the authentication process and send unicast
packets. Or at least that's the way its in 802.11, presumably
you could do it other ways too.

However, this general rule does not appear to apply to PANA
given that its discovery phase is not multicast to the client.
If it were multicast to the clients, then clients could, without
sending any messages, determine whether a suitable attachment
point exists. So the ISP discovery in PANA suffers largely
from the same limitations as EAP-based discovery.

--Jari

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Nov 2004 13:40:33 -0800

> from the same limitations as EAP-based discovery.

PANA allows ISP discovery as early as PANA-Start-Request. Depending on
the deployment this message may be sent unsolicited, but it is unicast.
 
I agree that the enabling discovery as early as possible (at the lowest
possible layer) is more optimal. When that's not possible (e.g., lack of
supporting technology) you need to keep popping up layers to accomplish
that. If using PANA, then you are done. If not, then you can fall back
to EAP-based discovery.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Nov 2004 13:40:33 -0800

Hi Avi,

> The PaC selects one. The VAAA connects to the HAAA routing according
to
> the

                              +----- BAAA(ISP1)
                              | 
PaC ------- PAA/NAS ---VAAA --+----- BAAA(ISP2)
                              |
                              +----- BAAA(ISP3)

The ISP discovery and selection allows the PaC to:
- learn that ISP1, ISP2, and ISP3 are available
- convey that it chose ISP1

PaC may or may not have a subscription with ISP1. (when not, there
better be a business relation between the ISP1 and the PaC's service
provider).

> Since now the isp1.com will present the PaC with a list of networks to

In the current scheme the AAA traffic still goes through BAAA(ISP1), but
the EAP authenticator (NAS) does not change or anyting.

> So PANA ISP Selection is the process of selecting the EAP
Authenticaror
> for

No.

> Authenticator for Network Authentiction.

No. NAS stays the same. As far as the AAA is concerned, the AAA routing
is impacted.

Alper

---

From: Jari Arkko <[email-masked]>
Date: Mon, 08 Nov 2004 23:55:43 +0200

> that. If using PANA, then you are done. If not, then you can fall back

Yes. Two things remain, however:

(1) Does someone have an answer as to how all this can be
     accomplished in the current AAA protocols while
     still allowing the local access provider to have
     a proxy AND roaming? I'm not quite sure how the
     destination realm value is set in the case of
     Diameter EAP, for instance.

(2) We need to consider this in light of Avi's question,
     which was what additional value the PANA ISP selection
     provides over things that already exist in EAP. I
     personally do not believe you absolutely need to
     have additional value, but of course it would be
     useful if you could demonstrate, for instance, that
     your "L2" network selection scheme is better than
     what exists in 802.1X.

     Speaking of multicast packets, how does a PANA client
     know that it needs to initiate a PANA exchange? What
     if you added a new PANA multicast message that told
     the client about this and carries the ISP/ASP info
     within it?

--Jari