Subject: [Pana] Issue 35

From: Julien Bournelle <[email-masked]>
Date: Fri, 7 Nov 2003 15:26:47 +0100

Hi all,

On Mon, Oct 06, 2003 at 09:30:04PM -0700, Alper Yegin wrote:
> 
> >From PANA-IPsec draft:
> 
> 
> 3.0 Pre-requisites for IPsec SA establisment
>   
>    This document assumes that the following have already happened before
>    the IPSEC SA is established.
>      
>      1) PANA client (PaC) learns the IP address of the Enforcement point
>         (EP) during the PANA exchange.
> 
> Currently we don't have this feature in PANA. I think we can handle this by:
> 
> - Having an AVP for carrying the DI of EP(s). We can add a new field (or
> flag?) to current device-ID AVP to indicate whether it belongs to PAA or one
> of the EPs.

I think we can't add a Flag in AVP header, because these flags are for
general purpose. (cf. Mandatory, Vendor etc...). I prefer the idea of
adding a field.

> - This AVP MUST be included in PANA-Bind-Request when L2 or L3 ciphering
> will be enabled after PANA. There may be more than one such AVP at a time
> (for multiple access routers, for example).

If we do L2 ciphering, do you think that the ciphering will occur
between pac and ep ?

> - The address type in this AVP MUST match the ciphering type.

agree

-- 
[email-masked]

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Julien Bournelle <[email-masked]>
Date: Fri, 7 Nov 2003 15:26:47 +0100

Hi all,

agree

---

From: Alper Yegin <[email-masked]>
Date: Fri, 07 Nov 2003 16:09:08 -0800

> If we do L2 ciphering, do you think that the ciphering will occur

Yes. Whether it is L2 or L3 ciphering, it will take place between the PaC
and EP. Of course, the EP might be co-located with the PAA.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Fri, 07 Nov 2003 16:09:08 -0800

Alper