Subject: RE: Location of authentication agent

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Fri, 12 Apr 2002 15:06:02 +0200

> > The Authentication Agent can reside on any node in the 
  > network that can
  > > send/receive IP datagrams (i.e., has an IP stack). The 
  > Authentication
  > > Agent and the Enforcement Point can be co-located (as is 
  > the case with
  > > PPP and EAPOW), or be on separate nodes. PANA will 
  > identify a transport
  > > (e.g., AAA, SNMP, COPS, etc.) to carry access control information
  > > (such as filters) from the Authentication Agent to the 
  > Enforcement point
  > > when these two entities are separated.
  > > There are pros and cons associated with having the authentication
  > > agent beyond the first hop [NAS/AP/Rtr/etc.]. This is an 
  > issue that
  > > needs to be delved into by the WG.
  > 
  > PANA provides the flexibility that the Authentication Agent and the
  > Enforcement Point can be co-located or separate. Co-location is the
  > model that is already used with the existing link-layer 
  > authentication
  > protocols.
  > Separation looks like a good feature, yet it requires using another
  > transport between two.
  > 
  > In order to better understand the value of separation, we 
  > need to look at
  > some
  > usage scenarios. Can people think of such scenarios?

=> More than the ones in the scenarios draft?
Namely: Load sharing, limited free access and 
payment after a certain point..etc

Hesham

---

From: John Vollbrecht <[email-masked]>
Date: Fri, 12 Apr 2002 11:40:09 -0400

> payment after a certain point..etc

I would be interested in understanding the model for each of these.  I
don't understand why separation of agent and enforcement point is needed
for load sharing, for example.  Could you draw the diagrams and explain
what the role of each element is?
  
For example - are you thinking of something like this?

   client  ------- edge device/ enforcement point --------- Pana Agent
-------- Pana Server

Thanks --

John

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Fri, 12 Apr 2002 14:10:18 -0700

> payment after a certain point..etc

We should look closer at these scenarios.

For example, in limited free access and payment after a certain
point scenario, where would you put the authentication agent? It'd
be good to take a look at the model and required interactions among
protocol entities.

While this scenario can be supported by separation of authentication agent
from the enforcement point, does it really need that? Or can we achive the 
same when two are co-located? What component of this scenario requires
the separation? 

Can you please provide more details... 

alper

---

From: subir Das <[email-masked]>
Date: Fri, 12 Apr 2002 17:23:30 -0400

John,

>    client  ------- edge device/ enforcement point --------- Pana Agent

 I would prefer following for limited free access: 

                                     PANA Agent -----------------PANA
Server
                                           |
Client  ------ edge device -------- enforcement point 

Thanks,

Subir

---

From: Reinaldo Penno <[email-masked]>
Date: Fri, 12 Apr 2002 23:24:47 -0700 (PDT)

Limited free access or "walled garden scenarios".

Walled garden (or isles of content) where you actually
pay for premium content that reside on a specific
subnet/network. A separate PAA controls these types of
accesses through several PEPs. 

Now, even if the PAA was co-located with one PEP, it
would be remote to the other that controls access to
the other island of content.

regards,

Reinaldo

> Client  ------ edge device -------- enforcement

__________________________________________________
Do You Yahoo!?
Yahoo! Tax Center - online filing with TurboTax
http://taxes.yahoo.com/