Subject: Re: Location of authentication agent

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 23 Apr 2002 07:36:54 -0700

> > 1- PAA is on the same subnet as PaC, and
> > 2- we assume PAA is co-located with EP.
> >
> > [1] makes the discovery real easy. It can be as
> > simple as picking a link-scoped multicast address,
> > for example.
>
> An interesting question here is whether this can be
> applied to IP-in-IP tunnels as a link layer.

It should be applicable.

>
> Is that is the case then such tunneling might be a way to
> handle cases when, through some out-of-band "discovery" mechanism, the PaC
> desires to authenticate to an entity not on the physical link.
>
> An example of this might be to pre-authenticate to a (potential) future
> access router when L2 is capable of indicating the IP address of the
future
> AR to the PaC.

Yes. In this scenario, the PaC can go through a full PANA
exchange while still attached to the current access point. This would
establish authenticity of the client at the new access point (and establish
session keys depending on the EAP method).

As soon as the PaC attaches to the new access point, it can go through a
partial PANA exchange, or partial 802.1x exchange (just identity exchanged
to lookup the keys, no backend verification needed).

alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 23 Apr 2002 14:58:17 -0400

Interesting.

That means, by allowing PANA messaging over IP-in-IP tunnel over
multiple IP hops, local re-authentication at an event of interface
switching would be still possible without mandating the use of other
protocols such as context transfer and AAA.

Is my understanding correct?

Yoshihiro Ohba

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 23 Apr 2002 15:09:36 -0700

Yoshihiro,

Based on the discussion, this seems like one way to use
PANA. But of course it relies on an out-of-band PAA discovery.

This shouldn't create any new requirement on the protocol.

alper

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "Alper E. YEGIN" <[email-masked]>
Cc: "Erik Nordmark" <[email-masked]>; "Hesham Soliman (ERA)"
<[email-masked]>; <[email-masked]>
Sent: Tuesday, April 23, 2002 11:58 AM
Subject: Re: Location of authentication agent

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 23 Apr 2002 18:44:36 -0400

Alper,

> PANA. But of course it relies on an out-of-band PAA discovery.

What does the out-of-band PAA discovery mean in this case?

> This shouldn't create any new requirement on the protocol.

Agreed.  I'd just like to know whether the interface switching
scenario is still worth being described in the usage scenario draft or
not.

Yoshihiro Ohba

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 23 Apr 2002 16:00:44 -0700

> What does the out-of-band PAA discovery mean in this case?

Normally, PAA is assumed to be on the same link as PaC and
PANA will define a PAA discovery method.

But since in this particular usage, PAA is not on the same link
as the PaC, this discovery method won't work. Instead some
other mechanism/protocol should provide the identity of
new PAA.

An example is that PaC knows its geographic location
(via GPS) and has a table with AP/PAA locations. Now it can do
a simple lookup and discover the upcoming PAA(s).
[disclaimer: this is just an illustration of out-of-band PAA
discovery and absolutely outside the scope of PANA :) ]

alper

> > > > > handle cases when, through some out-of-band "discovery" mechanism,
the
> > PaC

---

From: "James Kempf" <[email-masked]>
Date: Wed, 24 Apr 2002 00:19:45 -0700

Why would you want to do this?

            jak

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "Alper E. YEGIN" <[email-masked]>
Cc: "Erik Nordmark" <[email-masked]>; "Hesham Soliman (ERA)"

> > > handle cases when, through some out-of-band "discovery" mechanism,
the PaC