Subject: PANA FAQ

From: "Alper E. YEGIN" <[email-masked]>
Date: Thu, 18 Apr 2002 14:10:51 -0700

Hello,

Along with the minimum scope write-up sent earlier, 
we also prepared this FAQ to answer commonly asked
questions... Please see if this already answers the questions
you might have.

- WG Chairs

PANA FAQ
=========

Q1: What is PANA?
A:  PANA is 
    - a layer two agnostic network layer messaging protocol for
      authenticating IP hosts for network access
    - a transport protocol for authentication payload (EAP)
      between a client (IP based) and a server (agent) in the access
      network. 

Q2: Does PANA aim to replace link layer authentication?
A:  No. PANA will complement and/or coexist with link layer
    authentication mechanisms to enable network layer authentication.

Q3: Do we still need PANA if the link-layer supports authentication?
A:  It is a common practice to use higher-layer authentication on top
    of link-layer authentication. For example in 3GPP and 3GPP2, PPP is
    used for authentication after link-layer authentication succeeds.
    Or, http-redirect method is used as a higher-layer user
    authentication in some other network access architectures. Hence
    even if link-layer authentication exists, PANA is needed in
    certain scenarios.

Q4: Access control should always be an L2 function. Does PANA violate
    the layering principles?
A:  No. While most networks today require authentication at L2, it is
    not based on any layered architecture principles. Hence performing
    authentication at L3 for network access does not violate
    architectural principles.

Q5: Is PANA specifically targeted for mobile/wireless networks?
A:  No. PANA is applicable for any type of network that requires the
    host that is attaching to it for access to authenticate itself
    before being granted access.

Q6: Does PANA deal with mobility?
A:  No. However mobile IP based networks may use PANA for network
    access authentication.

Q7: Does PANA introduce new security vulnerabilities as a result of
    being an L3 solution?
A:  Requirements for dealing with security issues are part of the
    charter.

Q8: Does PANA do access control?
A:  No. PANA enables access control indirectly.

Q9: Does PANA require a AAA protocol/infrastructure in the access
    network?
A:  PANA may interact with backend AAA infrastructures such as RADIUS
    or Diameter. But it is not a requirement.

Q10: What is the PaC and the PAA?
A:   PaC : PANA Client
     PAA : PANA Authentication Agent
     The PaC and PAA are the client and server elements of the
     protocol.

Q11: Where is the PAA located in the access network?
A:   The PAA should be on an IP capable network element on the same
     subnet as the PaC. Hence it can be on the NAS or WLAN AP or first hop 
     router.

Q12: Is PAA always co-located with the enforcement point?
     It doesn't have to be. When they are separated, there needs to be
     another transport between two for client provisioning. This 
     transport is outside the scope of PANA.
 
Q13: How does the PaC know the address of the PAA?
A:   Possibilities include:
     - A discovery mechanism
     - Multicast or anycast

Q14: Does PANA assign the client/host an IP address?
A:   No. PANA does not perform any address assignment functions.

Q15: What type of authorization does PANA provide?
A:   It provides only a binary authorization to indicate whether the PaC
     can access the network or not. It doesn't deal with finer granularity
     authorization, such as negotiating QoS parameters.

Q16: Is PANA applicable to IPv6 only?
A:   No. PANA is IP version agnostic in addition to being L2 agnostic.

Q17: What is the role of EAP in PANA?
A:   EAP is the authentication protocol for which PANA is the
     transport.

Q18: Is PANA a client-server or peer-peer protocol?
A:   PANA is a client-server protocol.

Q19: Does the PAA know (or need to know) when the PaC has disconnected
     from the network?
A:   In some networks it may be required to know when the client has
     disconnected. This may be accomplished via mechanisms such as
     heartbeat etc.

Q20: Does PANA provide per-packet authentication and encryption?

A:   No, this is outside the scope of PANA. Though, PANA carries EAP
     and certain EAP methods generates session keys for this purpose.
     Therefore PANA is an enabler for per-packet protection. The keys
     generated can be used with link-layer protection, or network
     layer protection (IPsec). Generation and distribution of these
     keys is outside the scope of PANA.

Q21: Does the PaC have to configure an IP address before using PANA?

A:   No. Since both PaC and the PAA are on the same IP subnet, PaC can
     use unspecified IP address and still go through PANA. IP address
     allocation and configuration can happen before or after PANA
     authentication.

V: 0.3