Subject: [Pana] Comments on simple PAA discovery

From: <[email-masked]>
Date: Thu, 13 Mar 2008 19:53:35 +0100

Here are some comments.
 
Section 1 "Introduction"
Indicate that a DHCP-based mechanism exists and that new method could be used as alternative.
 
A more global comment:
 
This draft proposes an explicit PANA-based PAA mechanism discovery, as a way for the PAA to discover the PaC source IP address to send back unicats PANA messages.
But could we not consider that in a PANA-based environment, any unauthorized IP host trying to send traffic in the access network will be blocked by the EP/PAA? At this stage, the souce IP address of the sender is known and this could trigger a PAA-initiated PANA authentication procedure...
What is not clear in the draft is the added-value to have an explicit PANA-based method compared to an implicit one (when not relying on DHCP-based solution)
 
BR,
 
Lionel

 <http://www.francetelecom.com/sirius/logos_mail/orange_logo.gif> 

Lionel Morand
Orange Labs

Core Network/Network Architecture Centre

Architecture and Mobility for Multi-access Networks
Senior Architect
tél.    +33145296257
mob. +33607758936
[email-masked]

 <http://www.francetelecom.com/sirius/logos_mail/ampersand.gif> 

_______________________________________________
Pana mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pana

---

From: Victor Fajardo <[email-masked]>
Date: Thu, 13 Mar 2008 15:25:48 -0400

Hi Lionel,

> Indicate that a DHCP-based mechanism exists and that new method could be used as alternative.

Ok.

> But could we not consider that in a PANA-based environment, any unauthorized IP host trying to send traffic in the access network will be blocked by the EP/PAA? At this stage, the souce IP address…

Yes this is true. In this case, full PAA discovery may not be needed.

> What is not clear in the draft is the added-value to have an explicit PANA-based method compared to an implicit one (when not relying on DHCP-based solution)

Yes that needs to be clarified in the draft. Currently, with the 
PANA-based environment only, the use case would be when the PAA does not 
initiates an auth when it discovers a PaC.

regards,
victor