Subject: RE: Comments on draft-ietf-pana-requirement-00.txt

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Sat, 9 Mar 2002 02:37:00 +0100

Hi, 

I have two comments on the draft:

   PANA Client (PaC) 
    
         The entity wishing to obtain network access from a PANA  
         authentication agent within a network. A PANA client is 
         associated with a network device and a set of credentials to  
         prove its identity within the scope of PANA.  

=> Shouldn't we allow the PaC to be associated
with more than one device? For example if a MR
is trying to get access to a network, a reasonable
model would be to allow the MR to run PANA
on behalf of the network behind it. In this 
case a PaC is authenticating more than one
device. This is also an issue with allowing 
the DI to be an IP address, there is a number
of issues here apart from the monet case, like 
privacy.

  4.1.4. Identifiers 

   PANA SHOULD allow various types of identifiers to be used for the 
   PaC (e.g., NAI, IP address, FQDN, etc.) 
   PANA SHOULD allow various types of identifiers to be used as the DI 
   (IP address, link-layer address, port number of a switch, etc.)  

=> We have to mandate the support of at least one identifier 
for interoperability. 
Also an editorial comment, it's probably better to
separate DI from PaC identifier.

Hesham

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Sun, 10 Mar 2002 20:11:20 -0800

Hesham,

> with more than one device? For example if a MR

MR stands for Mobile Routers as defined by
MONET (mobile networks) work. 
(for those not familiar with this acronym)...

> of issues here apart from the monet case, like 

In the MR case, the DI can be a MAC address
and the packets forwarded by the MR on behalf
of the clients behind it shouldn't be a problem.

(you don't really want your MR to be aware of all
IP addresses of the clients in its mobile network and
do PANA for them)

If the ingress filtering of the access network is an issue,
probably MR has to reverse tunnel packets to a home
network, in which case the access network will only
see the IP address of the MR as the source of traffic.

Also, what is the privacy issue with the IP address as the DI?

> => We have to mandate the support of at least one identifier 

So, the requirements should say that the "PANA MUST mandate
at least one identifier", right? Just checking to make sure you are
not saying the requirements draft must set that one type.

> separate DI from PaC identifier.

Thanks Hesham.

alper