Subject: RE: RE: EAP over ICMP

From: George Tsirtsis <[email-masked]>
Date: Wed, 16 Jan 2002 13:45:57 -0500

James,

PANA MUST NOT assume any specific AAA mechanism. System integrators should
be able to interface PANA to Radius, Diameter, local file or whatever else
they want.

Makes sense?
George
-----Original Message-----
From: James Kempf [mailto:[email-masked]]
Sent: Wednesday, January 16, 2002 1:26 PM
To: Patil Basavaraj (NET/Dallas); [email-masked]
Subject: Re: RE: EAP over ICMP

Hi Raj,

> PANA is a protocol that carries authentication information for network
> access. It is a protocol between the end-host and a function called
> PAA in the access network.
>
> PANA does not really require AAA (at least in the RADIUS sense). The
> PAA MAY interwork (backend) with RADIUS or any other AAA entity, but
> that is not the scope of this WG.
>
> So one thing to note is that PANA is NOT "between the host and the AAA
> server".
>
>      |    |
>   |           |
>      |          |
>        [Host]<----------->|    -----     |
>   |    |PAA|      |
>   |    -----    |
>   | Access Network |
>   |    |
> >

OK. Suppose I want to use Radius or Diameter for "network access."
What is to prevent me from doing that?

I'm just trying to draw some boundaries around what this WG is about.
I thought I had a clear idea of what PANA was supposed to do,
namely replace link specific mechanisms like EAP over PPP and
802.1x for last hop AAA between the host and the network,
where "network" could mean an AAA server or a router,
one of the things we need to decide yet. But
all this talk about firewalls and running PANA to arbitrary points
in the network sounds to me like people are thinking of
coming up with an alternate mechanism to the AAA WG's
architecture.

            a wondering jak

---

From: "James Kempf" <[email-masked]>
Date: Wed, 16 Jan 2002 10:50:46 -0800

> be able to interface PANA to Radius, Diameter, local file or whatever
else

I just want to make sure the WG isn't coming up with an alternate
network AAA
architecture to that done by the AAA WG. They spent a lot of work and
many years on it, and I think it is pretty good.

If somebody wants to run PANA to a local file, that is their business.
But
for AAA within the network, and in particular between different
administrative
domains, I believe PANA must endorse the AAA architecture.

            jak

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 16 Jan 2002 11:56:00 -0800

Hi Jim,

> domains, I believe PANA must endorse the AAA architecture.

What do you mean by "endorse"?

Basically PANA must not assume any specific AAA backend, it must
not even assume there's a AAA infrastructure at the backend. The payload
of PANA might be different (maybe?), but not the carrier (PANA, that is).

alper

---

From: "James Kempf" <[email-masked]>
Date: Wed, 16 Jan 2002 12:42:39 -0800

Hi Alper,

> What do you mean by "endorse"?

By "endorse" I mean "use it when it is there."

        jak