Subject: [Pana] pana-pana Issue240: PaC Updating its IP address

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Dec 2005 12:22:18 -0500

>5.8  PaC Updating its IP Address
>
>   A PaC's IP address can change in certain situations.  For example,
>   the PANA framework [I-D.ietf-pana-framework] describes a case in
>   which a PaC replaces a pre-PANA address (PRPA) with a post-PANA
>   address (POPA).  In order to establish reachability, the PAA needs
to
>   be notified about the change of PaC address.
>
>   After the PaC has changed its address, it MUST send a PANA-Update-
>   Request message to the PAA.  The PAA MUST update the PANA session
>   with the new PaC address (source IP address) and return a PANA-
>   Update-Answer message.  If there is an established PANA SA, both
>   PANA-Update-Request and PANA-Update-Answer messages MUST be
protected
>   with a MAC AVP.
Does this imply a potential "device ID" change as well? Or, just the IP 
address for which PANA operates over.

I'm sure there are all sorts of NAT implications with carrying the IP 
address in a message like this.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Jari Arkko <[email-masked]>
Date: Wed, 28 Dec 2005 15:08:25 +0200

>address in a message like this.
Yes.

To me the current text in Section 5.8 appears somewhat
underspecified. The PRPA->POPA case is probably well
understood, but I'm concerned about the phrase "in
certain situations". What situations? Does the described
procedure include telling the EP about the changed
address? What if IPsec is used as the security protocol
and you only tell the EP about your new address via
NAT-T or MOBIKE, is that allowed or should you also
inform PAA? And how would you know your public
address changed if you were behind a NAT?

--Jari

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 28 Dec 2005 14:00:38 -0500

> >address in a message like this.

The updated IP address is not carried inside PANA message.  It is
carried in the Source Address field of the IP header for the PANA
message.

> certain situations". What situations? 

One case is PRPA->POPA as already described in the text.  Another case
is when the PaC moves to another subnet under the same PAA's realm,
and we can explicitly describe this case.

> Does the described

If an IP address is used as the device identifier and the device
identifier changes due to the IP address update, then PAA will need to
tell the EP about the change via a PaC-EP protocol.  In addition, when
pana-ipsec is used, the PaC will need to tell the EP about the change
via MOBIKE.  I think it is good to have these explanations in the
specification.

Regarding your last question, I don't think PANA supports the specific
IP address update case in NAT environment.  I am not sure whether PANA
needs to deal with all possible NAT scenarios including this one.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Dec 2005 10:00:42 -0500

> >address in a message like this.

In my previous email, I stated that the updated IP address is not
carried inside PANA message.  This is true.  On the other hand, there
is a case in which an IP address is carried inside PANA message, that
is when IP address is used as PaC's device identifier and IPsec
ciphering is bootstrapped from PANA.  In this case, a
PANA-Bind-Request sent from the PAA will contain EP's IP address in
Device-Id AVPs and the corresponding PANA-Bind-Answer sent from the
PaC will contain PaC's IP address in a Device-Id AVP.  So, I think NAT
implications exist in the PANA-Bind exchange, and this may affect the
IP address update procedure.

So, to deal with Mark's comment, Device-Id AVP should not be included
in the PANA-Bind-Answer when IP address is used as PaC's device
identifier.  (Instead, the device identifier should be extracted from
the Source Address field of IP header of the PANA-Bind-Answer in this
case.)

"
The PANA-Bind-Answer message MUST contain the PaC's device identifier
in a Device-Id AVP when it is already presented with that of EP(s) in
the request with using the same type of device identifier as contained
in the request.  If the PANA-Bind-Answer message sent from the PaC
does not contain a Device-Id AVP with the same device identifier type
contained in the request, the PAA sends a PANA-Error-Request message
with a PANA_MISSING_AVP result code, and wait for a PANA-Error-Answer
message to terminate the session.
"

to:

"
The PANA-Bind-Answer message MUST contain the PaC's device identifier
in a Device-Id AVP when it is already presented with that of EP(s) in
the request with using the same type of device identifier as contained
in the request and the type of device identifier is other than 1 (IP
version 4) or 2 (IP version 6).  If the PANA-Bind-Answer message sent
from the PaC does not contain a Device-Id AVP with the same device
identifier type contained in the request and the requested device
identifier type is other than 1 or 2, the PAA sends a
PANA-Error-Request message with a PANA_MISSING_AVP result code, and
wait for a PANA-Error-Answer message to terminate the session.
"

Also, to deal with Jari's comment, I suggest revising Section 5.8 
as follows:

"

   A PaC's IP address can change in certain situations.  For example,
   the PANA framework [I-D.ietf-pana-framework] describes a case in
   which a PaC replaces a pre-PANA address (PRPA) with a post-PANA
   address (POPA).  In another situation a PaC may change its IP
   address when it moves from one IP link to another within the same
   PAA's realm.  In order to establish reachability, the PAA needs to
   be notified about the change of PaC address.

   PANA-Update-Request and PANA-Update-Answer messages MUST be protected
   with a MAC AVP.

   If an IP address is used as the device identifier and the device
   identifier changes due to the IP address update, the PAA needs to
   inform the EP(s) of the change.  In addition, if there is an IPsec
   SA between the PaC and an EP, the PaC needs to inform the EP of the
   change using MOBIKE [I-D.ietf-mobike-protocol].
"

Regards,
Yoshihiro Ohba

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 30 Dec 2005 14:56:54 +0200

When we discussed the NAT traversal during IETF 62, we had decided to handle
this case:

PaC --- EP --- NAT --- PAA

(See slide 8 in
http://www3.ietf.org/proceedings/05mar/slides/pana-1/sld1.htm)

And that required practically no special handling in the base specification.

If we stick to that scenario, then I think the "IP address as the DI of the
PaC" has a significance with respect to the EP as they are both on the same
side of the NAT. So, I think we shall keep the DI transmission as is.

[Yes, the PAA can still extract the IP address DI from the IP headers, but I
don't think this is worth special casing...]

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Yoshihiro Ohba
> Sent: Thursday, December 29, 2005 5:01 PM
> To: Jari Arkko
> Cc: Yoshihiro Ohba; [email-masked]
> Subject: Re: [Pana] pana-pana Issue240: PaC Updating its IP address
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 30 Dec 2005 09:07:33 -0500

I understand that IP address DI in PBA is needed in the case of NAT
between EP and PAA so that PAA can identify the PaC by the DI,
otherwise PAA would only see NAT's public address which may be shared
among multiple PaCs.

On the other hand, we did not discuss much how this behavior can
impact subsequent IP address update procedure when PRPA is replaced
with POPA.  Since PANA-Update-Request does not carry DI, PAA cannot
know the new DI(=POPA) since DI is not carried inside the PUR.  So the
address update should not happen in this particular NAT case.

Yoshihiro Ohba

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 30 Dec 2005 18:56:51 +0200

We had considered PaC's "client IP address" changing, not the "DI" changing.

What is the scenario that leads to this situation? I'm guessing it is the
"PaC moving to another IP subnet within the realm of the current PAA." If
so, can we simply(?) handle this by carrying Device-ID in PUR/PUA? Upon such
a handover, PUR carries the new DI of the PaC, PUA carries the DIs of the
EPs in the new subnet.

Alper

> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Friday, December 30, 2005 4:08 PM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; 'Jari Arkko'; [email-masked]

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 30 Dec 2005 12:18:31 -0500

On Fri, Dec 30, 2005 at 06:56:51PM +0200, Alper Yegin wrote:
> "PaC moving to another IP subnet within the realm of the current PAA." 

I originally thought about PRPA->POPA case, but yes, the above
scenario could be more likely.

> If

"PUR carries the new DI of the PaC" looks good.  But why does PUA need
to carry the DIs of the EPs, while the entire list of EPs for all
subnets of the PAA's realm can be carried in PANA-Bind-Request?

Yoshihiro Ohba