Subject: [Pana] PAA-2-EP SNMP solution

From: [email-masked]
Date: Thu, 08 Jan 2004 14:20:47 +0100

hi all,

http://www.ietf.org/internet-drafts/draft-yacine-pana-snmp-00.txt

this ID provides an SNMP solution for the PAA-2-EP interface.
please do note two remarks:

1) discussions on the PAA-2-EP protocol requirements are currently held
on the PANA ML.

2) this SNMP solution is largely based on the IPSec Configuration MIB
that has been designed in the IPSP wg. Indeed, it has recently been
decided to split this IPSec MIB into 3 modules
(see http://www.vpnc.org/ipsec-policy/mail-archive/msg00797.html).

In the present version of the draft, the IPSec MIB is referenced as a
whole, as it was before the split, when I edited this version. the next
version of the document would take these changes into account.

thanks,
yacine

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Wed, 14 Jan 2004 11:36:51 -0800

Hi Yacine,

I read the draft and I have couple comments.

   Network access enforcement can be provided by one or more
   nodes on the same IP subnet as the client (e.g., multiple routers),
   or on another subnet in the access domain (e.g., gateway to the
   Internet, depending on the network architecture).

We assume an EP is on the same IP-hop as the PaC. I'd suggest we drop the
second part of the text above. We are not going to design the solution where
the EP might be multiple hops away.

Reading the draft, I couldn't figure out how the "PANA Session ID" and "IKE
pre-shared key" are carried in SNMP. Wouldn't we need a MIB for these?
[maybe we are inhereting the IKE key one from IPsec MIB, but how about the
session ID?]

Thank you.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Wed, 14 Jan 2004 11:36:51 -0800

Hi Yacine,

Thank you.

Alper

---

From: [email-masked]
Date: Thu, 15 Jan 2004 12:14:51 +0100

hello alper,

> the EP might be multiple hops away.

agree. the next version will correct this.

> [maybe we are inhereting the IKE key one from IPsec MIB, but how about the

if I remember well (I wrote the ID in november...), it's like you said: 
the pre-shared key provisioning is done using the IPSEC MIB. and the 
session id needs to be specified in the PANA-specific extention.

anyway, there are some syncrho needed with the lattest version 
pana-ipsec-01, recntly submitted.

thanks,
yacine

---

From: [email-masked]
Date: Thu, 15 Jan 2004 12:14:51 +0100

hello alper,

thanks,
yacine