Subject: [Pana] PAA-2-EP protocol requirements

From: [email-masked]
Date: Mon, 24 Nov 2003 14:21:10 +0100

At IETF58 Minneapolis, several comments were made asking for the
PAA-2-EP protocol to support additional characteristics (accounting, 
heartbeat, etc.). these features were discussed earlier in the PAA-2-EP 
design process, but it was finaly decided that they are NOT REQUIRED.

in order to move forward on this charter item (protocol choice,
extensions, etc.) and based on the reactions at the last IETF meeting, I
think the working group should clarify the PANA needs here and reach
consensus on the PAA-2-EP protocol requirements.

so far the official requirements for this interface, as stated in the
lattest PANA requirements doc, are the following:

1) EP Configuration information:
The PAA-2-EP protocol must carry DI-based filters and keying material.

2) One-to-many PAA-EP relation:
This means that there might be multiple EPs per PAA.

3) Secure Communication:
The PAA-EP protocol must provide for message authentication,
confidentiality, and integrity.

4) New PaC Notification:
The PAA-2-EP protocol may allow the EP to notify a new PaC to the PAA.

below are some other PAA-2-EP functionnalities (open list). should we 
consider them as also required ? not required at all ? supported 
elsewhere ? any alternative ?

a) Inactive peer detection:
The protocol used between PAA and EP should be able to detect inactive
peer within an appropriate time period. This can be achieved by having
both the EP and remote PAA constantly verify their connection to each
other via keep-alive messages: a heartbeat in fact.

b) Stateful approach:
The protocol must allow to maintain some states in the PAA in order for
an EP that went down and came back up, or an EP that is being introduced
in the network to (re-)synchronize with the PAA.
In general terms, the PAA-EP protocol needs to support the stateful
model between the PAA and the EP(s) and some other mechanism for the EP
to learn the policies currently in effect on that access network.

c) Accounting/Feedback from the EPs:
The PAA must have an efficient way to to get the accounting information
of PaC from EP since the PAA may be a client of the AAA backend
infrastructure.

d) ????

thanks,
Yacine El Mghazli

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Alper Yegin" <[email-masked]>
Date: Sun, 30 Nov 2003 14:38:41 -0800

(sorry for the late and batched responses due to my travels)

> > I'm not sure how much "explicit support" we need for this from the 
>PAA2EP
> > protocol. There can always be ad-hoc solutions to this. For example, 
>running
> > some request-reply messages between the PAA and EP can be used as a
> > keep-alive. I can imagine an implementation resorting to such techniques
> > when the protocol does not have a dedicated facility....
>
>ok. my feeling is you think it's not a requirement at all :-)

I don't think it is a hard requirement on the PAA2EP protocol.
It may be a requirement of the architecture which can be satisfied
by other means...

> > We can assume PAA always has the associated state. It'd have a list of
> > authorized PaCs and their attributes... I don't think this is something 
>for
> > PAA2EP protocol to worry about...
>
>I agree, for sure the PAA maintains each PaC state, but the question
>here is rather about the PAA-EP communication:
>* does the PAA should maintain each EP state ?

No. All PAA needs to do is to maintain state per PaC, and be able to
associate a PaC with one or more EPs. So, if an EP goes down, PAA can
identify the associated PaC state and bring the EP up-to-date.

>the reason for such a feature can be the one cited above (for an EP 
>crashing and coming back up, etc.)
>
>
>
>anyway, these questions bring up some PANA framework issues related to the 
>EP-PAA relation when we have multiple PAAs in the access network:
>* can a given EP relate to multiple PAAs ?

I think we had discussed that there may be multiple PAAs on a link,
but the PaC will run PANA with one of them. So, I guess yes, an EP
might be associated with more than one PAA.

>* does a given PAA configure all the EPs with the same rules ?

The provisioning info pushed to EPs for a given PaC would be the
same.

>* or only the one which treat the traffic coming from the PaC ?

Well, PAA decides which EPs should receive the information. And this
depends on the topology. For a multi-access link with multiple access
routers as EPs, each router will be provisioned with the PaC-specific
info.

On the other hand, if a switch is the EP, as a L2 access device there is
only one connected to PaC and that single device is the EP. It will be
provisioned with the PaC-specific info.

>* inter-PAAs communication ?

Why do we need this for?

Alper

>etc...
>
>comments on these "issues" are warmly welcome !
>
>
>
> > Getting statistics from the EP makes sense. For example, in the case of
> > SNMP, if we get the counters from the EP this is good enough. The AAA 
>client
> > sitting on the PAA can turn these into accoutning records.
>
>should the PAA poll the EPs to get these counters when needed (the SNMP 
>way...) or the EPs are supposed to send them periodically ?
>
>anyway, this should be somehow a requirement.
>
>
> > Alper
> >
>
>thanks,
>yacine
>
> >>d) ????
> >>
> >>
> >>thanks,
> >>Yacine El Mghazli
> >>
> >>
> >>
> >>
> >>
> >>

_________________________________________________________________
Set yourself up for fun at home!  Get tips on home entertainment equipment, 
video game reviews, and more here.   
http://special.msn.com/home/homeent.armx

---

From: "Alper Yegin" <[email-masked]>
Date: Sun, 30 Nov 2003 14:38:41 -0800

Why do we need this for?

Alper

---

From: "Alper Yegin" <[email-masked]>
Date: Sun, 30 Nov 2003 14:41:30 -0800

>If we want to use IPsec between PaC and EP, the EP must be a router. AS
>the PAA must be located exactly one IP hop away from the PaC, there must
>be no EP between PaC and PAA. So it means that EP, PaC and PAA are
>on the same IP subnet (Am I wrong ?). So, I wonder if it a valid scenario 
>to have
>multiple EPs per PAA if we use IPsec.

If the access routers are used as EP and there are more than one....
PAA may be co-located with one of the access routers, or may be hosted
on a dedicated server on the same multi-access link shared by the access
routers and PaCs.

Alper

_________________________________________________________________
Is there a gadget-lover on your gift list?  MSN Shopping has lined up some 
good bets!  http://shopping.msn.com

---

From: "Alper Yegin" <[email-masked]>
Date: Sun, 30 Nov 2003 14:41:30 -0800

Alper