Subject: RE: RE: EAP over ICMP

From: "Patil Basavaraj (NET/Dallas)" <[email-masked]>
Date: Wed, 16 Jan 2002 11:34:35 -0600

James Kempf [[email-masked]] wrote:
>
>Now I am really confused. I thought this was all the responsiblity of
>AAA.
>I thought PANA was supposed to only be between the host and the
>AAA server. Do we really need two ways of doing AAA??

PANA is a protocol that carries authentication information for network
access. It is a protocol between the end-host and a function called
PAA in the access network.

PANA does not really require AAA (at least in the RADIUS sense). The
PAA MAY interwork (backend) with RADIUS or any other AAA entity, but
that is not the scope of this WG.

So one thing to note is that PANA is NOT "between the host and the AAA
server".  

   			  |		   |
			  |	       	   |
   			  |   	    	   |
       [Host]<----------->|    -----  	   |
			  |    |PAA|   	   |
			  |    -----	   |
			  | Access Network |
			  |		   |
>            jak

-Basavaraj

---

From: "James Kempf" <[email-masked]>
Date: Wed, 16 Jan 2002 10:25:40 -0800

Hi Raj,

>        [Host]<----------->|    -----     |

OK. Suppose I want to use Radius or Diameter for "network access."
What is to prevent me from doing that?

I'm just trying to draw some boundaries around what this WG is about.
I thought I had a clear idea of what PANA was supposed to do,
namely replace link specific mechanisms like EAP over PPP and
802.1x for last hop AAA between the host and the network,
where "network" could mean an AAA server or a router,
one of the things we need to decide yet. But
all this talk about firewalls and running PANA to arbitrary points
in the network sounds to me like people are thinking of
coming up with an alternate mechanism to the AAA WG's
architecture.

            a wondering jak