Subject: [Pana] pana-fwk technical issue 2/4

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 16 Dec 2004 16:52:35 -0500

In section 10.2.1: "Note that for all of the cases described in this
section, PBR and PBA exchange in PANA should occur after installing
the authorization parameter to AR, so that IKE can be performed
immediately after PANA is successfully completed."

Issue: How can PAA install filtering rules for PaC to EP before
receiving PBA with Device-Id AVP?

Discussion: The device-id of the PaC can be obtained from MAC/IP
headers However, when the PBR/PBA exchange fails, the authorization
parameters installed in EP must be immediately revoked.

Proposed resolution: rewrite the mentioned paragraph in section 10.2.1 to:

"
Note that for all of the cases described in this section, a PBR
(PANA-Bind-Request) and PBA (PANA-Bind-Answer) exchange in PANA
[I-D.ietf-pana-pana] should occur after installing the authorization
parameter to the AR, so that IKE can be performed immediately after
PANA is successfully completed.  The PAA can obtain the required
device identifer (i.e., the IPsec-TOA in this case) to be installed on
the AR from the IP header of a PANA message sent by the PaC before
sending the PBR.  However, when the PBR/PBA exchange fails, the
authorization parameters already installed on the AR must be
immediately revoked to avoid unauthorized access.  
"

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana