Subject: [Pana] [Pana]: Pana and IEEE802.11i

From: Goeman Stefan <[email-masked]>
Date: Mon, 15 Mar 2004 11:24:52 +0100

Hello,

I am reading "draft-ohba-pana-framework-00.txt". It is unclear to me how
PANA would work with IEEE802.11. That is using PANA for authentication and
then using the shared key between STA and AP to derive the L2 keys. 

Section 10.2.2 mentions two methods, i.e. separate PAA and AP (section
10.2.2.1) and Co-located PAA and AP (section 10.2.2.2). 

1. It is unclear to me how IP traffic is allowed before you are
authenticated. I suppose that, before authentication, everything will go
through the uncontrolled port. Section 5.9.1 of IEEE802.11i (page 13)
mentions that protocols (IP-based protocols?) may need to bypass the
authorization function and make use of the uncontrolled port. Then, how do
you manage which IP-based protocols are allowed to go through the
uncontrolled port? I don't find this in IEEE802.11i.

2. Section 10.2.2.1 describes the case where the PAA and the AP are
separate. This case uses two VLAN (an unauthenticated VLAN and an
authenticated VLAN), possible in one physical AP. I am not an LAN expert,
but these two Virtual APs, do they have different MAC addresses
(L2-addresses), on the "link" towards the PaC? It is also mentioned that the
PaC runs PANA authentication on the unauthenticated VLAN to obtain the MAC
address of the authenticated VLAN (So, here I suppose that there are indeed
two MAC addresses). How does the PaC obtains this MAC address. Would this be
an EP-Device-ID AVP, containing the MAC-address of the authenticated VLAN,
included in the PANA-Binding-Request message? 

3. You don't know the difference between the separate EP-PAA case and the
co-located EP/PAA case until you receive this PANA-Binding-Request message,
which indicates how the PaC should run the 4-way handshake protocol. It
seems to me that section 10.2.2.1 suggests that this 4-way handshake
protocol is run between the PaC and the authenticated VLAN; or, the 4-way
handshake protocol is run over the controlled port. Is this so?  

Greetings, 
Stefan.

Stefan Goeman 
SIEMENS ICM/ICN 
[email-masked]  <mailto:[email-masked]> 
Mobile Solutions 
and Enabling Services
http://www.ic.siemens.be <http://www.ic.siemens.be/eng/default_rd.shtm>

Customer driven solution providers

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 12 Mar 2004 18:10:51 -0800

Hi Stefan,

> uncontrolled port? I don't find this in IEEE802.11i.

How specific IP packets go through the uncontrolled port depends on AP
implementation and it is not described in IEEE 802.11i, BTW, in the
case of separate PAA and AP, all IP traffic before PANA authentication
goes through unauthenticated VLAN (virtual) AP which does not have
controlled/uncontrolled port distinction, so the above issue does not
apply to the separate PAA and AP case.

> (L2-addresses), on the "link" towards the PaC? 

There are several types of virtual APs, but sectioin 10.2.2.1 assumes
that different APs have different ESSIDs (and MAC addresses are
different).

> It is also mentioned that the

Yes.

> handshake protocol is run over the controlled port. Is this so?  

In section 10.2.2.1, 4-way handshake is performed between the station
(PaC) and authenticated VLAN AP.  Also, in IEEE 802.11i, IEEE 802.1X
messages including the ones used for 4-way handshake are processed at
the IEEE 802.1X uncontrolled port of the AP.

Yoshihiro Ohba

> Customer driven solution providers 	

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 12 Mar 2004 18:10:51 -0800

Hi Stefan,

Yes.

Yoshihiro Ohba