Subject: RE: Comments on draft-ietf-pana-requirement-00.txt

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 11 Mar 2002 20:59:22 +0100

George, 

  > Personally I think that a clean separation between the 
  > Mobile Network behind
  > an MR and the fixed or other network the MR is connected to is very
  > beneficial. 

=> Agreed.

  > 
  > In one model (the one I prefer) the MR is authenticated on 
  > the network, in
  > which case the MR needs a PaC while the AR implements a PAA.
  > 
  >   <----Monet--->
  >  EndNode------MR(Pac)-----------AR(PAA)
  > 
  > In the same model the EndNode can authenticate itself to 
  > the MR in which
  > case the EndNode runs a Pac and the MR runs a PAA. Note 
  > that the MR plays
  > the role of the AR for the EndNode.
  > 
  >   <--------Monet-------->
  >  EndNode(Pac)------(PAA)MR-----------AR
  >                        (AR)
  > 
  > In  the above case the Monet is a different administrative 
  > domain than the
  > access network. Both of the above authentications can 
  > happen in the same
  > deployment scenario since they are independent.

=> Right. My question was about the use of the 
IP address as a DI in the case above. Or 
even associating the PaC with a single IP address. 
I agree with this model btw, I don't know 
if I gave the impression that I didn't. 
So Alper's suggestion is to solve this problem
by using the MR's MAC address. Which would 
only work if the access control was done 
at the AR. 
But I still don't understand why we need to 
associate a PaC with a single IP address
(by definition). 

  > The model Hesham suggests, however, can be implemented 
  > using the PANA mode
  > where the PAA is not in the AR. In this case the EndNode 
  > implements a Pac as
  > before while the PAA is in the AR of the access network. 
  > Note that the MR
  > implements no MR function in this case, or it may also 
  > implement a PaC if it
  > needs to also be authenticated on the network. 
  > 
  >   <----Monet------->
  >  EndNode(Pac)------MR-----------(PAA)AR
  >                   (AR)
  > 

=> I've had a pretty eventful weekend :) did I
suggest that? I like the first model more. I'm
pretty sure I would have suggested the first model ;)

Hesham

---

From: George Tsirtsis <[email-masked]>
Date: Mon, 11 Mar 2002 15:17:55 -0500

I think I misunderstood what you said :) but in any case both models can in
principle be satisfied by PANA. BTW, IMO the DI is ANY identifier, including
an IP address and prefix length if this is what is required for a given
scenario.

George

-----Original Message-----
From: Hesham Soliman (ERA) [mailto:[email-masked]]
Sent: Monday, March 11, 2002 7:59 PM
To: 'George Tsirtsis'; 'Alper E. YEGIN'; [email-masked]
Subject: RE: Comments on draft-ietf-pana-requirement-00.txt

George, 

=> Agreed.

Hesham