Subject: [Pana] [Issue28] PANA state machines

From: [email-masked]
Date: Tue, 28 Oct 2003 15:46:23 +0200

Hi,

I've updated PANA state machines (PaC v0.4, PAA v0.3). 
See the change logs and state machines:
http://danforsberg.info:8080/pana-issues/issue28

I hope I have incorporated all the comments received, but 
there certainly are more issues to discuss. 

PANA State machines will be discussed during the IETF 
meeting. Please give comments and any feedback prior the
meeting so that we can have a constructive discussion also
during the meeting.

There is also this question of how we will incorporate 
these lollipop state machines into the draft.

Br,
- Dan

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Wed, 29 Oct 2003 15:58:37 -0800

On the PaC state machine:

- The discovery type where PaC receives an unsolicited PANA-start-request is
missing.
- EAP-based reauthentication initiated by PAA is missing.
- According to the latest PANA spec, when the PaC initiates the EAP-based
reauthentication, the PANA-Start-Request/Answer is skipped. This is not
reflected on the state machine.

On the PAA state machine:

- The message "Tx: Reauth Success" for WAIT_REAUTH_ANS to OPEN transition is
not defined by the PANA spec.
- The discovery type where PAA sends an unsolicited PANA-start-request is
missing.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Wed, 29 Oct 2003 15:58:37 -0800

Alper

---

From: nagi reddy jonnala <[email-masked]>
Date: Thu, 30 Oct 2003 11:22:01 +0100

All,

1) I understand the use of PANA to access the network. Do we
intend to use this mechanism in the application layers too? For
example, consider a case of  a website wants to authenticate
its users. Remember, we can access the network(internet)
but this website needs more authentication. and a webpage in
the website needs further authentication.

Do we plan to use PANA in this hierarchical model?

2) Section 4.1 - PANA with physical layer security mentions the below:

" In DSL networks, there are a number of deployment models with respect
   to client configuration and client authentication.  In DSL networks
   where PPP or PPPoE is used for both configuration and authentication,
   PANA may not be required.  On the other hand, there are some DSL
   networks that use some configuration method other than PPP or PPPoE,
   i.e., DHCP or static configuration.  Such networks use either an ad-
   hoc network access authentication method such as http-redirect with
   web-based login or no authentication method at all."

I believe 802.1x authentication mechanism is used in these DSL networks
assuming that user devices are connected by IPoE.

I didn't get the point here - why http-direct with web-based login method
is used?

-Nagi.

---

From: nagi reddy jonnala <[email-masked]>
Date: Thu, 30 Oct 2003 11:22:01 +0100

All,

-Nagi.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 30 Oct 2003 08:14:07 -0800

Thanks Nagi for your comments.  Please see my comments inline.

> Do we plan to use PANA in this hierarchical model?

I think web-based authentication works fine for this case, and I
don't think PANA is needed beyond network access authentication.

> assuming that user devices are connected by IPoE.

IEEE 802.1X is designed to work over a IEEE 802 LAN segment where
there is no bridge between Authenticator and Supplicant.  IEEE 802.1X
could be used in Ethernet-based DSL but only when the 802.1X
Authenticator is located on the first hop Ethernet bridge, which means
IEEE 802.1X has topology constraint.

> I didn't get the point here - why http-direct with web-based login method

http-redirect with web-based login is just an example of ad-hoc
authentication method in this case where PPP or PPPoE is not used 
for configurating or authenticating a client.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 30 Oct 2003 08:14:07 -0800

Yoshihiro Ohba