Subject: [Pana] Few clarifications regarding PANA Pre-auth

From: Sasikanth Bharadwaj <[email-masked]>
Date: Tue, 14 Feb 2006 11:23:59 +0530

Hi

I need a few clarifications regarding PANA preauthentication

Since the draft says it does not intend to replace the CTP based method
for mobility optimization, it would be better to add certain recommendations
as to how a PaC that supports both methods should behave and what are the
criteria based on which the PaC can decide which method to use. Is PANA
assumed to know whether movement was within an administrative domain or
across domains if that is the criteria to decide?

Another issue is related to reauthentication between PaC and its preparing
PAAs.
Is the session timeout applicable in the same way as it is with the active
PAA?
Do the preparing PAAs need to start reauthentication upon session timeout?
Some clarification regarding this is required.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 14 Feb 2006 12:19:19 -0500

Hi Sasikanth,

These are good comments.  Please see my comments below.

> across domains if that is the criteria to decide?

After handover, there is no choice to do pana-preauth because
pre-authentication must happen before handover.

Before handover, the PaC has a choice of performing or not performing
pana-preauth with a remote PAA.  I think this is your question.  A
simple rule would be to try pana-preauth first unless the PaC knows
that the remote PAA does not support pana-preauth by other means.

> Is the session timeout applicable in the same way as it is with the active

The answer is yes.  On the other hand, the session timeout for
pre-authentication SA can be different from that for active SA.

> Some clarification regarding this is required.

I think so.  Re-authentication for pre-authentication SA can also be
started from PaC side.

Yoshihiro Ohba

---

From: Sasikanth Bharadwaj <[email-masked]>
Date: Wed, 15 Feb 2006 12:21:27 +0530

Hi Yoshi

Please see my comments inline

> pre-authentication must happen before handover.

Actually, another issue got mixed up here. After handover, the PaC has to
first check whether it has a preauth SA with the PAA in the new
network/subnet. So, how does PaC come to know which PAA is incharge in the
new network?

Once it knows which PAA is incharge, inorder to decide whether mobopts can
be used here or not, PaC needs to know whether it has moved within an
administrative domain or not, because in mobopts, the pPAA and nPAA are
assumed to be within an administrative domain. The behavior is not defined
when the PaC moves to a different domain and the PAA there supports mobopts.
Either the PaC has to refrain from using mobopts or the PAA has to restrict
the PaC to perform full authentication.

Thanks and Regards

Sasikanth

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 15 Feb 2006 11:45:01 -0500

Hi Sasikanth,

> network/subnet. So, how does PaC come to know which PAA is incharge in the

If the preparing PAA advertises a list of EPs in PBR during
pre-authentication and the PaC handovers to one of those EPs, then the
PaC knows that the preparing PAA is in charge of the EP and 
sends PUR to the preparing PAA that advertised the EP to make
the preparing PAA the active PAA.

Otherwise, the PaC would need to perform PAA discovery after handover.
If the preparing PAA is found, then it should send PUR to the
preparing PAA to make the preparing PAA the active PAA.  If there is
no preparing PAA discovered, then it may try pana-mobopts with a
discovered PAA.

> the PaC to perform full authentication.

There is no need for the PaC to know whether it has moved within
administrative domain or not.  In case no preparing PAA was found, the
PaC can always try pana-mobopts by including the Session-Id assigned
by pPAA in PSA.  If the nPAA does not support pana-mobopts or does not
have a required SA with pPAA to perform pana-mobopts, it will assign a
new Session-Id and return PAR instead of PBR to fall back to a full
EAP authentication.

Regards,
Yoshihiro Ohba

---

From: Sasikanth Bharadwaj <[email-masked]>
Date: Mon, 20 Feb 2006 18:56:19 +0530

Hi Yoshi

> no preparing PAA discovered, then it may try pana-mobopts with a
So, how is PANA expected to know to which EP it is attached upon movement?
Is this information expected to be provided by some external entity?

 Thanks and Regards
 
 Sasikanth

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 20 Feb 2006 18:28:29 -0500

> Is this information expected to be provided by some external entity?

If EP is implemented on access point (e.g., 802.11i bootstrapping),
then the PaC can know the EP when it associates to the access point.
(I was assuming this case.)

In case where EP is IPsec gateway (i.e., IPsec bootstrapping), you are
right that the PaC may not be able to know whether the EP is in the
attached network or not by just attaching the network.  So I think PAA
discovery would need to be performed after handover for this case as
well.

To avoid performing PAA discovery, other optimization mechanism such
as IEEE 802.21 Information Service may be used.

Regards,
Yoshihiro Ohba