Subject: RE: [issue21] Conformancy with RFC2284bis anddraft-ietf-aaa-eap-02

From: <[email-masked]>
Date: Mon, 25 Aug 2003 10:33:16 +0300

Alper,

You didn't address the issue itself. Do you want to say that in order to use PANA with backend AAA and EAP Server, PAA must be used together with a NAS? This would mean that NAS takes care of EAP retransmission timer, but PANA actually does the transmission.

Do you see some problems if PANA provides reliable transport for EAP messages?

- Dan

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 23 August, 2003 20:22
> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> Subject: Re: [issue21] Conformancy with RFC2284bis
> anddraft-ietf-aaa-eap-02
> 
> 
> Dan,
> 
> From RFC2284bis: 
> 
> "In EAP, the authenticator retransmits Requests that have not 
> yet received
> Responses, so that EAP does not assume that lower layers are 
> reliable."
> 
> "The authenticator is responsible for retransmitting requests 
> as described
> in Section 4.1."
> 
> "The EAP layer receives and transmits EAP packets via the lower layer,
> implements duplicate detection and retransmission, and 
> delivers and receives
> EAP messages to and from EAP methods."
> 
> So, PANA, as an EAP lower-layer, does not have to provide 
> retransmissions
> for reliable EAP delivery.
> 
> Alper
> 
> 
> > Alper,
> > 
> > This becomes a problem if the EAP server is in the AAA 
> infrastructure
> > and the EAP server really doesn't do retransmissions itself 
> (like these
> > documents describe). There is no case where EAP server does 
> retransmission
> > when in the backend AAA infrastructure, because AAA 
> protocol is reliable
> > and the NAS takes care of the reliability too. Now PANA can 
> do the same,
> > which makes the system simpler (no need to decide if 
> retransmission is
> > needed or not for this PANA packet).
> > 
> > The documents have evolved since we last time discussed 
> about this issue.
> > 
> > Br,
> > - Dan
> > 
> >> -----Original Message-----
> >> From: ext Alper Yegin [mailto:[email-masked]]
> >> Sent: 22 August, 2003 04:51
> >> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> >> Subject: Re: [issue21] Conformancy with RFC2284bis
> >> anddraft-ietf-aaa-eap-02
> >> 
> >> 
> >> 
> >>> New submission from Dan Forsberg <[email-masked]>:
> >>> 
> >>> In draft-ietf-aaa-eap-02.txt section 2.5 retransmission for
> >> EAP packets
> >>> is explained. Here NAS is doing the retransmissions (or
> >> vice versa). PANA
> >>> MUST be conformant with this draft and also RFC2284bis.
> >> This means that
> >>> PAA is doing retransmissions for PANA-Auth-Request message also.
> >> 
> >> That draft talks about the responsibilities of the NAS 
> (network access
> >> server). NAS would implement a collection of protocols, such
> >> as PANA (in the
> >> form of a PAA module), Diameter (in the form of a Diameter client),
> >> draft-ietf-aaa-eap as the glue, etc.  I think what you see in
> >> draft-ietf-aaa-eap-02.txt is what the glue should be doing:
> >> retransmitting
> >> EAP packets when needed.
> >> 
> >> Imo, as the lower-layer of EAP, PANA does not have to deal
> >> with this. It
> >> just transmits EAP packets when it is given one.
> >> 
> >> Alper
> >> 
> >> 
> >> 
> >>> In case 
> >>> of PANA-Reauth-Request the sender retransmits (PaC or PAA).
> >> PANA MUST
> >>> also honor Multi-Round-Time-Out AVP.
> >>> 
> >>> ----
> >>>> From draft-ietf-aaa-eap-02.txt:
> >>> 
> >>>  2.5 Retransmission
> >>> 
> >>>  As noted in [RFC2284bis], if an EAP packet is lost in
> >> transit between
> >>>  the authenticating peer and the NAS (or vice versa), the NAS will
> >>>  retransmit.
> >>> 
> >>>  It may be necessary to adjust retransmission strategies and
> >>>  authentication timeouts in certain cases.  For example,
> >> when a token
> >>>  card is used, additional time may be required to allow 
> the user to
> >>>  find the card and enter the token.  Since the NAS will
> >> typically not
> >>>  have knowledge of the required parameters, these need to
> >> be provided
> >>>  by the Diameter server.
> >>> 
> >>>  If a Multi-Round-Time-Out AVP [BASE] is present in an
> >>>  Diameter-EAP-Answer message that also contains an 
> EAP-Payload AVP,
> >>>  that value is used to set the EAP retransmission timer 
> for that EAP
> >>>  Request, and that Request alone.
> >>> 
> >>> ________________________________________________
> >>> PANA Issues <[email-masked]>
> >>> http://danforsberg.info:8080/pana-issues/issue21
> >>> ________________________________________________
> >>> 
> >>> 
> >>> 
> >> 
> >> 
> > 
> > 
> 
>

---

From: Alper Yegin <[email-masked]>
Date: Mon, 25 Aug 2003 01:04:52 -0700

Dan,

> Alper,
> 
> You didn't address the issue itself. Do you want to say that in order to use
> PANA with backend AAA and EAP Server, PAA must be used together with a NAS?
> This would mean that NAS takes care of EAP retransmission timer, but PANA
> actually does the transmission.

Generally, people would call the node that implements PAA a network access
server (NAS). NAS is a functional entity in an access network (it might
reside on AP  with IEEE 802.11, BRAS with DSL, PDSN with CDMA2000 networks).
It would implement PANA, Diameter, and draft-ietf-aaa-eap, and a bunch of
other stuff. This collection takes care of the EAP retransmissions, without
PANA having to deal with it.

> Do you see some problems if PANA provides reliable transport for EAP messages?

Yes, unjustified complexity for a functionality that is not PANA's
responsibility and that is already taken care of by something else.

Alper