Subject: [Pana] Issue 30

From: Alper Yegin <[email-masked]>
Date: Wed, 01 Oct 2003 19:30:37 -0700

http://danforsberg.info:8080/pana-issues/issue30

See below for the proposed text for section 4.9. Comments welcome.

4.9 Mobility Handling
 
   If PaC wants to resume an ongoing PANA session after connecting to
   another link in the same access network, it MAY send the unexpired
   PANA session identifier in its PANA-Start-Answer message. In the
   absence of a Session-Id AVP in this message, PAA MUST assume this is a
   fresh session and assign a new session identifier in the first
   PANA-Auth-Request message.
    
   If PAA receives a session identifier in the PANA-Start-Answer message,
   and it is configured to enable fast re-authentication, it SHOULD
   retrieve the PANA SA from the previous PAA of the PaC. The mechanism
   required to determine the previous PAA of the PaC by relying on the PANA
   session identifier is outside the scope of PANA protocol. A possible
   solution is to embed the PAA identifier in the PANA session identifier.
   Furthermore, the mechanism required to retrieve the PANA SA from the
   previous PAA is outside the scope of this protocol. Seamoby Context
   Transfer Protocol [CTP] might be useful for this purpose.
    
   If the PAA is not configured to enable fast re-authentication, or
   can not retrieve the PANA SA, or the PANA SA has expired, the PAA
   MUST send the PANA-Auth-Request message with a new session identifier and
   let the PANA exchange take its usual course. Otherwise, PAA MUST
   continue the PANA session with a PANA-Reauth exchange (rather than
   PANA-Auth exchange which, in most of the times, means full EAP
   authentication). Device ID AVPs MUST be included in this exchange to
   bind the new DIs to the PANA SA.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Julien Bournelle <[email-masked]>
Date: Thu, 2 Oct 2003 12:58:39 +0200

Hi all,

>    solution is to embed the PAA identifier in the PANA session identifier.

I just want to note that if we use this mechanism we need a way to
to change the session-id. Actually at the second handover the third PAA
won't be able to retrieve the second PAA's identity.

-- 
[email-masked]

---

From: Julien Bournelle <[email-masked]>
Date: Thu, 2 Oct 2003 12:58:39 +0200

Hi all,

---

From: Alper Yegin <[email-masked]>
Date: Thu, 02 Oct 2003 11:28:05 -0700

Hi Julien,

> won't be able to retrieve the second PAA's identity.

Good point. How about if we immediately assign a new session-id on the new
link. Please see below for another revision on the text:

4.9 Mobility Handling
 
   When a PaC wants to resume an ongoing PANA session after connecting to
   another link in the same access network, it MAY send the unexpired
   PANA session identifier in its PANA-Start-Answer message. In the
   absence of a Session-Id AVP in this message, PAA MUST assume this is a
   fresh session and continue its normal execution.
    
   If PAA receives a session identifier in the PANA-Start-Answer message,
   and it is configured to enable fast re-authentication, it SHOULD
   retrieve the PANA session attributes from the previous PAA of the PaC.
   The mechanism required to determine the previous PAA of the PaC by
   relying on the PANA session identifier is outside the scope of PANA
   protocol. A possible solution is to embed the PAA identifier in the PANA
   session identifier. Furthermore, the mechanism required to retrieve the
   session attributes from the previous PAA is outside the scope of this
   protocol. Seamoby Context Transfer Protocol [CTP] might be useful for
   this purpose.
    
   When the PAA is not configured to enable fast re-authentication, or
   can not retrieve the PANA session attributes, or the PANA session has
   already expired (i.e., session lifetime is zero), the PAA MUST send the
   PANA-Auth-Request message with the new session identifier and let the
   PANA exchange take its usual course. This action will engage EAP
   authentication and create a fresh PANA session from scratch.

   In case the new PAA retrieves the on-going PANA session attributes from
   the previous PAA, the PANA session continues with a PANA-Reauth exchange.
   The MAC AVP contained in the PANA-Reauth messages MUST be generated and
   verified by using the retrieved PANA SA attributes. This exchange MUST
   also include Session-Id AVP that contains the newly assigned session
   identifier, and Device-Id AVP. A new PANA session is created upon
   successful completion of this exchange. This session inherits only the
   session lifetime, protection capability, and MSK attributes from the
   previous session. Other attributes are generated based on the PANA
   exchanges on the new link. While MSK stays the same, a new PANA_MAC_Key
   is computed using the new parameters. Subsequent MAC-AVPs are processed
   using this new PANA SA.

---

From: Alper Yegin <[email-masked]>
Date: Thu, 02 Oct 2003 11:28:05 -0700

Hi Julien,

4.9 Mobility Handling

---

From: Julien Bournelle <[email-masked]>
Date: Tue, 7 Oct 2003 15:00:28 +0200

hi alper,

> link. Please see below for another revision on the text:

it seems ok, 

thanks,

---

From: Julien Bournelle <[email-masked]>
Date: Tue, 7 Oct 2003 15:00:28 +0200

hi alper,

it seems ok, 

thanks,