Subject: [Pana] RADIUS Access-Reject and NAP/ISP authz

From: Alper Yegin <[email-masked]>
Date: Fri, 18 Mar 2005 13:37:05 -0800

Issue as discovered in draft-lior-pana-radius-00.txt:

When NAP/ISP separate auth is being carried out, even if one of the
auths has failed, PANA session may still "succeed" (based on local
policy decision). In that case, sending a RADIUS Accounting Start to the
AAA server that had Rejected the client would confuse that server.

I think the above issue is valid based on the current PANA
specification.

IMO, what we failed to explicitly capture in the base specification is,
for PANA session to succeed, minimally the ISP authentication must
succeed. After all, it is the "ISP" that provides the "IP access
service." The NAP authentication is in the picture just to let PaC
access differentiated (e.g., gold, silver, bronze) "L1/L2" services if
it has a separate account with the NAP. Otherwise, a NAP account by
itself is not sufficient get Internet connectivity.

And, a AAA server that hasn't authorized the requested service must not
receive an accounting start message. If ISP auth has succeeded, PaC's IP
access is authorized, and ISP's AAA server gets notified. If ISP auth
failed, all bets are off. If ISP auth succeeded, and NAP failed, IP
access is granted but PaC does not get any differentiated service from
the NAP (L1/L2); only ISP's AAA server receives the accounting start
message. 

Makes sense?

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Rafa Marin Lopez <[email-masked]>
Date: Tue, 22 Mar 2005 13:40:26 +0100

Hi Alper a short question...

>itself is not sufficient get Internet connectivity.
You are assuming here that even when you are not authenticated by 
AAA-NAP you are always authorized at least to use L1/L2 services right?

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: [email-masked]
------------------------------------------------------

---

From: Alper Yegin <[email-masked]>
Date: Thu, 24 Mar 2005 17:42:01 -0800

> AAA-NAP you are always authorized at least to use L1/L2 services
right?

Typically an ISP-only auth/authz is sufficient to access L1/L2/L3 access
service. This is the currently deployed widely-available model.

Alper