Subject: [Pana] [issue33] Clarifying section 4.7

From: [email-masked]
Date: Thu, 2 Oct 2003 13:42:02 +0300

Dan Forsberg <[email-masked]> added the comment:

Change (from 4.1.7):

    o When a Device-Id AVP is included, the AVP is valid if the device 
    identifier type contained in the AVP matches the expected one (this 
    check is for PAA only) and the device identifier value contained in 
    the AVP matches the value extracted from the lower-layer 
    encapsulation header corresponding to the device identifier type 
    contained in the AVP. 

To (from Yoshihiro Ohba):

   o When a Device-Id AVP is included, the AVP is valid if the device
     identifier type contained in the AVP is supported (this check is
     for both PaC and PAA) and is the requested one (this check is
     for PAA only) and the device identifier value contained in
     the AVP matches the value extracted from the lower-layer 
     encapsulation header corresponding to the device identifier type 
     contained in the AVP.  Note that a Device-Id AVP carries the
     PaC's device identifier in messages from PaC to PAA and PAA's
     device identifier in messages from PAA to PaC.

Updated section 4.7 (s/should/SHOULD/):

4.7 Device ID Choice
    
   A PaC SHOULD configure an IP address before PANA if it can. It might
   either have a pre-configured IP address, or have to obtain one via
   dynamic methods such as DHCP or stateless address autoconfiguration.
   Dynamic methods may or may not succeed depending on the local
   security policy.  In networks where clients have to be authorized
   before they are allowed to obtain an IP address, EPs will detect the
   associated activity and PANA protocol will be engaged before the 
   clients can configure a valid IP address.
   
   Either an IP address or a link-layer address SHOULD be used as device
   ID at any time. It is assumed that PAA knows the security mechanisms
   being provided or required on the access network (e.g., based on 
   physical security, link-layer ciphers enabled before or after PANA, or  
   IPsec). When IPsec-based mechanism [PANA-IPSEC] is the choice of 
   access control, PAA SHOULD provide its IP address as device ID, and  
   expect the PaC to provide its IP address in return.  In all other 
   cases, link-layer addresses can be provided from both sides.
    
   When IPsec-based access control is used but the PaC is using an
   unspecified IP address in the authentication phase, the device ID
   reported by the PaC MUST be either 0.0.0.0 or 0::0. This device ID 
   MUST be recorded as a temporary one by the PAA until the PaC obtains a 
   valid one and informs the PAA. Eventually PaC MUST obtain an IP 
   address, possibly by relying on the newly-created PANA session 
   [PANA-DHCP], in order to gain full access to the network. PaC MUST 
   update the device identifier registered on the PAA from unspecified to 
   the valid IP address by initiating a 
   PANA-Reauth-Request/PANA-Reauth-Answer exchange in which the IP 
   address of the PaC is contained in the Device-Id AVP.

________________________________________________
PANA Issues <[email-masked]>
http://danforsberg.info:8080/pana-issues/issue33
________________________________________________

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana