Subject: Re: Separation of PAA and Access router (multi access router scenario)

From: Prakash J <[email-masked]>
Date: Mon, 30 Sep 2002 23:21:50 -0700

[email-masked] wrote:
> 
> >
> > Maybe the question is. Does the exactly same packet
> > message need to be sent to all ARs? Because even if
> > you multicast a message, some nodes might receive it
> > later, some nodes might not receive it, etc, etc.
> >
> > So you cannot guarantee total synchronicity, right?
> 
> Yes.
> 
> >
> > I think what you can guarantee is that all ARs will
> > receive the message within a time window. We can rely
> > on retransmissions to detect a downed AR.
> 
> I think this is sufficient for PANA. Is this acceptable
> to WG members?

How will an AR that went down and came back up, or an AR
that is being introduced in the network resync  with the PAA?
In general terms, is there a provision or some other mechanism
(from other working groups) for the EP to learn the policies currently 
in effect on that access network? 

- prakash

> > Reinaldo
> -BP

---

From: <[email-masked]>
Date: Tue, 1 Oct 2002 10:00:47 -0500

> in effect on that access network? 

Maintain some state in the PAA.

> - prakash

-Basavaraj

---

From: "fan zhao" <[email-masked]>
Date: Tue, 1 Oct 2002 18:32:32 -0700

> The intent is to find a solution via an existing protocol.
> But when you have a one-to-many relationship (PAA-ARs),
> do any of these protocols allow you to send the authorization
> information to all ARs synchronously? Is it important to do
> it so (synch?) or does the PAA send authorization messages to all
> ARs in a sequential manner or maybe use the all routers multicast
> address?

Hi everybody.

I was considering to solve this problem without sending the authorization
to all ARs by PAA.
Can anybody take a look at and give the comments to  the following scheme?
Thanks.

fan zhao

----------------------------------------------------------------------------
------------------------------------

PaC------------------------------EP(AR)1------------------------------------
--Internet
   |                            |
|
   |                            |
|
   |                            |-----------EP(AR)2-------------------|
   |                            |
|
   |                            |
|
   |                            |-----------EP(AR)2-------------------|
   |
   |---------------------------------PAA

When PaC wants to access Internet, it has to do authentication with PAA
firstly.
If the authentication succeeds, PAA will generate some lease, which
regulates
how long PaC can access  the Internet before re-authentication.

Then PaC sends the packets to Internet as usual way, the packets will be
intercepted
by one of the EP(AR) depending on which AP is chosen as the default router
by PaC.

Then EP(AR) receiving such packet sends requests to PAA to check if it is
valid to let the packet
pass through or not. PAA can send the lease or denial back to EP(AR). So
after that, EP(AR)
can cache the lease locally to filter the following packets.

So if PaC dosen't do authentication with PAA at first, EP can not let the
packet go.
Also this scheme doesn't require that PAA send authorization to every AR.

---

From: <[email-masked]>
Date: Wed, 2 Oct 2002 10:37:53 -0500

The pull-approach to allowing access is one possible solution.
But every time the client changes the DR, the new AR has to 
poll the PAA. There may be an issue of delay as a result of
having to poll the PAA every time. 
So your approach works, but may not be the most optimal.

-Basavaraj