Subject: [Pana] PAA-2-EP protocol requirements

From: [email-masked]
Date: Mon, 24 Nov 2003 14:21:10 +0100

At IETF58 Minneapolis, several comments were made asking for the
PAA-2-EP protocol to support additional characteristics (accounting, 
heartbeat, etc.). these features were discussed earlier in the PAA-2-EP 
design process, but it was finaly decided that they are NOT REQUIRED.

in order to move forward on this charter item (protocol choice,
extensions, etc.) and based on the reactions at the last IETF meeting, I
think the working group should clarify the PANA needs here and reach
consensus on the PAA-2-EP protocol requirements.

so far the official requirements for this interface, as stated in the
lattest PANA requirements doc, are the following:

1) EP Configuration information:
The PAA-2-EP protocol must carry DI-based filters and keying material.

2) One-to-many PAA-EP relation:
This means that there might be multiple EPs per PAA.

3) Secure Communication:
The PAA-EP protocol must provide for message authentication,
confidentiality, and integrity.

4) New PaC Notification:
The PAA-2-EP protocol may allow the EP to notify a new PaC to the PAA.

below are some other PAA-2-EP functionnalities (open list). should we 
consider them as also required ? not required at all ? supported 
elsewhere ? any alternative ?

a) Inactive peer detection:
The protocol used between PAA and EP should be able to detect inactive
peer within an appropriate time period. This can be achieved by having
both the EP and remote PAA constantly verify their connection to each
other via keep-alive messages: a heartbeat in fact.

b) Stateful approach:
The protocol must allow to maintain some states in the PAA in order for
an EP that went down and came back up, or an EP that is being introduced
in the network to (re-)synchronize with the PAA.
In general terms, the PAA-EP protocol needs to support the stateful
model between the PAA and the EP(s) and some other mechanism for the EP
to learn the policies currently in effect on that access network.

c) Accounting/Feedback from the EPs:
The PAA must have an efficient way to to get the accounting information
of PaC from EP since the PAA may be a client of the AAA backend
infrastructure.

d) ????

thanks,
Yacine El Mghazli

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 25 Nov 2003 12:16:36 -0800

> other via keep-alive messages: a heartbeat in fact.

I'm not sure how much "explicit support" we need for this from the PAA2EP
protocol. There can always be ad-hoc solutions to this. For example, running
some request-reply messages between the PAA and EP can be used as a
keep-alive. I can imagine an implementation resorting to such techniques
when the protocol does not have a dedicated facility....

> in the network to (re-)synchronize with the PAA.

We can assume PAA always has the associated state. It'd have a list of
authorized PaCs and their attributes... I don't think this is something for
PAA2EP protocol to worry about...

> of PaC from EP since the PAA may be a client of the AAA backend

Getting statistics from the EP makes sense. For example, in the case of
SNMP, if we get the counters from the EP this is good enough. The AAA client
sitting on the PAA can turn these into accoutning records.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Tue, 25 Nov 2003 12:16:36 -0800

Alper

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 26 Nov 2003 16:53:14 +0100

Hi all,

> This means that there might be multiple EPs per PAA.

If we want to use IPsec between PaC and EP, the EP must be a router. AS
the PAA must be located exactly one IP hop away from the PaC, there must
be no EP between PaC and PAA. So it means that EP, PaC and PAA are
on the same IP subnet (Am I wrong ?). So, I wonder if it a valid scenario to have
multiple EPs per PAA if we use IPsec.

Any ideas ?

-- 
[email-masked]

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 26 Nov 2003 16:53:14 +0100

Hi all,

Any ideas ?

---

From: [email-masked]
Date: Thu, 27 Nov 2003 16:59:16 +0100

hi all,

please see below:

 > when the protocol does not have a dedicated facility....

ok. my feeling is you think it's not a requirement at all :-)

 > PAA2EP protocol to worry about...

I agree, for sure the PAA maintains each PaC state, but the question
here is rather about the PAA-EP communication:
* does the PAA should maintain each EP state ?
the reason for such a feature can be the one cited above (for an EP 
crashing and coming back up, etc.)

anyway, these questions bring up some PANA framework issues related to 
the EP-PAA relation when we have multiple PAAs in the access network:
* can a given EP relate to multiple PAAs ?
* does a given PAA configure all the EPs with the same rules ?
* or only the one which treat the traffic coming from the PaC ?
* inter-PAAs communication ?
etc...

comments on these "issues" are warmly welcome !

 > sitting on the PAA can turn these into accoutning records.

should the PAA poll the EPs to get these counters when needed (the SNMP 
way...) or the EPs are supposed to send them periodically ?

anyway, this should be somehow a requirement.

 > Alper

thanks,
yacine

---

From: [email-masked]
Date: Thu, 27 Nov 2003 16:59:16 +0100

hi all,

please see below:

thanks,
yacine

---

From: [email-masked]
Date: Thu, 27 Nov 2003 17:16:46 +0100

hello Julien,

Julien Bournelle a écrit:
 > Hi all,
 >
 >
 >> 2) One-to-many PAA-EP relation: This means that there might be
 >> multiple EPs per PAA.
 >
 >
 > If we want to use IPsec between PaC and EP, the EP must be a router.
 > AS the PAA must be located exactly one IP hop away from the PaC,
 > there must be no EP between PaC and PAA. So it means that EP, PaC and
 > PAA are on the same IP subnet (Am I wrong ?). So, I wonder if it a
 > valid scenario to have

this requirement says that a given PAA can relate to n EPs.
in your case n=1.

did I misunderstand your statement ?

Yacine

---

From: [email-masked]
Date: Thu, 27 Nov 2003 17:16:46 +0100

hello Julien,

Yacine

---

From: Julien Bournelle <[email-masked]>
Date: Thu, 27 Nov 2003 17:37:28 +0100

hello yacine,

> did I misunderstand your statement ?

I guess so.
I just wonder if people consider to have multiple EPs (with 1 PAA) on the same IP
subnet as a relevant scenario.

---

From: Julien Bournelle <[email-masked]>
Date: Thu, 27 Nov 2003 17:37:28 +0100

hello yacine,

I guess so.