Subject: RE: Solutions ...

From: George Tsirtsis <[email-masked]>
Date: Mon, 14 Jan 2002 18:09:38 -0500

All,

Erik will correct me if I wrong but I do not think he talked about
"de-authentication" but about "sensing that a node disconnected from the
network".

I think network "sensing" of any type should be outside the scope of the
PANA WG. In fact this is a much needed work that the IETF needs to take up
at some point...and something tells me that it will happen soon and comes
under the general area of "link layer triggers". And yes I know you can
devise "liveness" protocols to do that at the IP layer but I really think
PANA should not go there.

De-authentication, is also kind of interesting but I think not very useful.
What I mean is that the networks will have to cope with end nodes suddenly
disconnected in wired and even more in wireless networks; no way to go
around that. Still, if people think that de-authentication is useful as an
optional feature then fine, but again I do not see it as work for PANA but
rather for the authentication mechanisms that will be carried over
PANA...Again trying to follow the idea that PANA is an *authentication
transport mechanism* rather than an *authentication protocol* by itself.

Regards
George

-----Original Message-----
From: Reinaldo Penno [mailto:[email-masked]]
Sent: Monday, January 14, 2002 8:46 PM
To: John Angelmo; Alper Yegin
Cc: Erik Nordmark; [email-masked]
Subject: Re: Solutions ...

I think Erik had a good point.

We should think about the deauthentication also,
otherwise we will end up with different solutions from
different companies (as pointed out) and/or a "new"
protocol to sync state between PPP/DHCP/Radius and
PANA to know when a user has disconnected.

regards,

-Reinaldo

--- John Angelmo <[email-masked]> wrote:
> 
> 
> Alper Yegin wrote:
> > 
> > Hi Erik,
> > 
> > > Oh - and for those that can't stay away from
> thinking about solutions
> > > even though it is a bit too early:
> > > As far as I understand the solutions that are
> being discussed
> > > they don't talk about a way to detect when the
> client has been
> > disconnected,
> > 
> > I understand that for a network access
> architecture, we definitely need a
> > way
> > to detect client has disconnected. So that the
> network can cancel the access
> > granted to the disconnected client (for security,
> resource management
> > reasons..).
> > 
> > But, doesn't this go beyond "carrying
> authentication" that PANA is about?
> > I'm under the impression that client sending a
> message like "authenticate me
> > for
> > network access" is in the scope, but "stop the
> network access for me" is not
> > so (?)
> > 
> > Or, maybe we can see it like this:
> > 
> > - the initial PANA exchange can also be seen as
> both "authenticate me"
> >   and "provide me network access".
> > - another message can say "authenticate me and
> terminate my network
> >   access".
> > 
> > Is what you are suggesting this second type of
> message?
> > 
> > > dealing with multiple access routers on the
> link, etc.
> > > (Of course, I could be wrong.)
> > 
> > Regards,
> > 
> > alper
> 
> If PANA handles both authentication and
> "deauthentication" we are
> handeling one solution/protocol but if PANA only
> handles authentication
> then we might end up with one solution from
> Microsoft one from Cisco one
> for linux and so on and then we have to invent the
> wheel again with
> "PANA 2.0"
> 
> I'm just a newbie here so I don't have the
> experience that you all got.
> 
> Regards,
> 
> John
> 

__________________________________________________
Do You Yahoo!?
Send FREE video emails in Yahoo! Mail!
http://promo.yahoo.com/videomail/

---

From: "James Kempf" <[email-masked]>
Date: Mon, 14 Jan 2002 15:19:45 -0800

George,

I interpreted Erik's remarks to mean the same thing as periodic
reauthentication. Thus, if a MN fails a periodic
reauthentication, it is deauthenticated.

I agree that sensing the disappearence of a MN requires link layer
interaction, and would be better put under link
layer triggers.

            jak

----- Original Message -----
From: "George Tsirtsis" <[email-masked]>
To: "'Reinaldo Penno'" <[email-masked]>
Cc: "Erik Nordmark" <[email-masked]>;
<[email-masked]>
Sent: Monday, January 14, 2002 3:09 PM
Subject: RE: Solutions ...

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 14 Jan 2002 19:37:54 -0500

> reauthentication, it is deauthenticated.

That is one type of de-authentication.  We can call it implicit
logoff.

There would be another type of de-authentication, i.e., explicit
logoff.  802.1X supports explicit logoff at L2.  I think that explicit
logoff at L3 is also useful as we cannot assume all L2 has 
explicit logoff, and PANA should support it as much as possible.

>             jak

Yoshihiro Ohba

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 15 Jan 2002 19:49:42 +0100 (CET)

> "de-authentication" but about "sensing that a node disconnected from the

I'm not a "sensing" kind of guy :-)
so I suspect I actually used a term like "detecting".

> PANA should not go there.

You mean that TCP should have never been define to have a FIN flag? :-)

  Erik