Subject: RE: [Pana] [issue19] Result-Code AVP values?

From: [email-masked]
Date: Mon, 6 Oct 2003 15:24:51 +0300

Ok. So do you want to say that realm based routing is outside 
the scope of PANA and in error case NAS must inform PaC in some 
other means than PANA protocol? I don't mind taking this error 
case away. Anyway, I'm curious of how 802.1X does handle this 
case?

- Dan

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 02 October, 2003 20:31
> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> Subject: Re: [Pana] [issue19] Result-Code AVP values?
> 
> 
> >>>        PANA_REALM_NOT_SERVED                   3003
> >>>           Error code from PAA to PaC.  The network 
> doesn't recognize
> >>>           the realm.
> >> 
> >> We don't have a place where PaC sends the realm information.
> >> So, I can't see
> >> where such an error would be returned to the PaC.
> > 
> > The EAP-Response/Identity contains the realm if it is required. Or
> > should we create a NAI AVP, that contains only the realm? Realm is
> > needed to route the packet to the right AAA backend. If PAA
> > functionality doesn't check the realm, NAS or for example the local
> > AAA proxy will do it. But in the case of unknown realm the client
> > should be notified.
> 
> I should have said "We don't have a place where PaC sends the realm
> information in PANA." You are right that EAP client ID can 
> have this, but
> than it is the responsibility of EAP or EAP method to deal 
> with this. This
> error case should not leak into PANA.
> 
> Alper
> 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 06 Oct 2003 09:34:20 -0700

> other means than PANA protocol?

Yes, I'm thinking that this should be happening transparent to PANA.

> I don't mind taking this error

I think this is also an EAP question. What would be the EAP behavior when
the NAS cannot recognize the EAP client identifier?

From your other message:
> Just one more comment. The usage scenarios document chapter 3
> (problem statement) says that the authentication agent (PAA)
> chooses the backend authentication server based on the identity,
> for example NAI..

If we were to expand "the authentication agent" from that text, actually it
should be the "NAS" (draft-ietf-aaa-eap) implementation which needs to deal
with AAA routing, not "PAA."

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 06 Oct 2003 09:34:20 -0700

Alper