Subject: RE: Location of authentication agent

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 15 Apr 2002 17:24:22 +0200

James, 

This separate protocol is already available
everywhere. Is there any router that 
doesn't implenment SNMP for example? 
I don't understand the complication.

Hesham

  > -----Original Message-----
  > From: James Kempf [mailto:[email-masked]]
  > Sent: Saturday, April 13, 2002 2:38 AM
  > To: Alper E. YEGIN; [email-masked]
  > Subject: Re: Location of authentication agent
  > 
  > 
  > I question the value of separation, since it will require a separate
  > protocol to transmit the enforcement decisions between the 
  > enforcement
  > point and the authentication agent. I have, as yet, not seen a
  > compelling need for complicating the traditional NAS architecture in
  > this manner.
  > 
  > 
  >             jak
  > 
  > ----- Original Message -----
  > From: "Alper E. YEGIN" <[email-masked]>
  > To: <[email-masked]>
  > Sent: Thursday, April 11, 2002 6:12 PM
  > Subject: Location of authentication agent
  > 
  > 
  > >
  > > > The Authentication Agent can reside on any node in the 
  > network that
  > can
  > > > send/receive IP datagrams (i.e., has an IP stack). The
  > Authentication
  > > > Agent and the Enforcement Point can be co-located (as 
  > is the case
  > with
  > > > PPP and EAPOW), or be on separate nodes. PANA will identify a
  > transport
  > > > (e.g., AAA, SNMP, COPS, etc.) to carry access control 
  > information
  > > > (such as filters) from the Authentication Agent to the 
  > Enforcement
  > point
  > > > when these two entities are separated.
  > > > There are pros and cons associated with having the 
  > authentication
  > > > agent beyond the first hop [NAS/AP/Rtr/etc.]. This is 
  > an issue that
  > > > needs to be delved into by the WG.
  > >
  > > PANA provides the flexibility that the Authentication 
  > Agent and the
  > > Enforcement Point can be co-located or separate. 
  > Co-location is the
  > > model that is already used with the existing link-layer 
  > authentication
  > > protocols.
  > > Separation looks like a good feature, yet it requires 
  > using another
  > > transport between two.
  > >
  > > In order to better understand the value of separation, we 
  > need to look
  > at
  > > some
  > > usage scenarios. Can people think of such scenarios?
  > >
  > > Comments please..
  > >
  > > alper
  > >
  > >
  > >
  > >
  > >
  > >
  > >
  > >
  > >
  > >
  >

---

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Apr 2002 08:51:05 -0700

> I don't understand the complication.

I still don't see any compelling need for complicating the architecture.
Why have two entities when one is sufficient? What is the application
that won't work with a traditional NAS-style architecture?

            jak