Subject: [Pana] Issue16: Multihoming support

From: [email-masked]
Date: Wed, 3 Dec 2003 17:52:21 -0800

The issue is related to PaC that has multiple interfaces on the same IP
link.

In the IETF58 meeting, a resolution was proposed for multihomed host to use
separate PANA session for each interface.  Here is the proposed text for
the PANA draft:

In Section 2, Change:

"  PANA Session:
      PANA session is defined as the exchange of messages between the
      PANA Client (PaC) and the PANA Authentication Agent (PAA) to
      authenticate a user (PaC) for network access. If the
      authentication is unsuccessful, the session is terminated. The
      session is considered as active until there is a disconnect
      indication by the PaC or the PAA terminates it."

To:

"  PANA Session:
      PANA session is defined as the exchange of messages between the PANA
      Client (PaC) and the PANA Authentication Agent (PAA) to authenticate
      a user (PaC) for network access. If the authentication is
      unsuccessful, the session is terminated. The session is considered as
      active until there is a disconnect indication by the PaC or the PAA
      terminates it. A distinct PANA session is associated with a pair of
      device identifiers of PaC and PAA. For example, if the PaC has two
      interfaces connected to the same IP link with different IP addresses
      and IP address is used as a device identifer, a distinct PANA session
      will be created per interface if both interfaces addresses need to be
      authorized for network access."

Issue16 can be found at:
http://www.danforsberg.info:8080/pana-issues/issue16

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Dec 2003 15:39:00 -0800

>     authorized for network access."

I think the last part is not clear enough. What we really mean is each
*physical* interface needs to use separate PANA sessions to access the
network. Logical interfaces with different IP addresses might still be bound
to the same physical interface and hence not require separate PANA
instances.

I think the second half starting from "A distinct PANA session..." can be
replaced by:

    A distinct PANA session needs to be associated with each physical
    interface of a PaC. A PaC can maintain multiple PANA sessions at the
    same time, one for each interface that is authorized to access the
    network. 

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Dec 2003 15:39:00 -0800

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 08 Dec 2003 16:38:12 -0800

> to the same physical interface and hence not require separate PANA

I think it depends on the routing context where PANA is performed.
When PANA runs over the routing context of the physical interface
only, I agree that separate PANA sessions are not needed for the
logical interfaces.  But when PANA runs over the routing context of
logical interface (additional PANA may or may not be running over the
routing context of the physical interface), I think separate PANA
sessions might be needed.

>     same time, one for each interface that is authorized to access the

Does a PaC need to maintain multiple PANA sessions in this case even
when those physical interfaces share the same device identifier?

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 08 Dec 2003 16:38:12 -0800

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Dec 2003 18:53:03 -0800

> sessions might be needed.

Agreed. 

> when those physical interfaces share the same device identifier?

Like two interfaces (that are connected to separate links) sharing the same
MAC address or IP address? Regardless, PaC should have two separate PANA
sessions. 

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Dec 2003 18:53:03 -0800

Agreed. 

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 08 Dec 2003 19:24:35 -0800

> MAC address or IP address? Regardless, PaC should have two separate PANA

When two physical interfaces with sharing the same MAC address or IP
address are connected to the same IP link and the shared address is
used as the device identifier, should the PaC have two separate PANA
sessions?  I think it can share a PANA session in this particular
case.  I mean that the other layer's addresses that are not used as
device identifier may be different among the interfaces but the PAA
and EP does not care the difference since they are not used for access
control.  That is another reason for why I mentioned "pair of device
identifiers of PaC and PAA" in the proposed text.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 08 Dec 2003 19:24:35 -0800

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 09 Dec 2003 10:50:48 -0800

> sessions?  

This is a scenario where you need some magic to make the link-layer and IP
work just to send/receive regular data packets. If these two interfaces will
appear as one to the link-layer or network-layer, than I think it should
appear as one to the PANA protocol as well. [details depend on your magic..]

But I don't think we need to get into these non-standard variations in the
PANA protocol specification... [a sanity check to make sure we are not
breaking them is useful though...]

> I think it can share a PANA session in this particular

Alper

---

From: Alper Yegin <[email-masked]>
Date: Tue, 09 Dec 2003 10:50:48 -0800

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 09 Dec 2003 11:28:35 -0800

> appear as one to the PANA protocol as well. [details depend on your magic..]

Right.

> breaking them is useful though...]

Of cource introducing non-standard variation was not my intention. I
just thought that defining a PANA session based on a pair of device
identifiers is sufficient since it covers all standard variations
regardless of which layer's device identifier is used and how the
device identifers are assigned to (physical or logical) interfaces.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 09 Dec 2003 11:28:35 -0800

Right.

Yoshihiro Ohba