Subject: RE: RE: draft-ietf-pana-usage-scenarios-00.txt

From: George Tsirtsis <[email-masked]>
Date: Thu, 7 Feb 2002 08:17:07 -0500

Who says that the DI is *access dependent*? It MAY be, true, but it does not
have to be. We currently only say that the DI MAY be carried in PANA so it
is not mandatory for a solution to do it. We also say that the DI is a kind
of handle that access control can use to authorize some traffic. The DI
could be as simple as an IP address or a link layer port number if such
thing is used in a given scenario but it could potentially be other things
as has been discussed.

The important think is that PANA should work the same and authorize the two
end points...as a result of the authentication something is authorized and
that something needs to be associated with a DI so that the network can
police the authorization.

PANA then only offers a hook, that we call DI, so that authorization and
policing can be performed following PANA.

makes sense?

George
-----Original Message-----
From: Hesham Soliman (ERA) [mailto:[email-masked]]
Sent: Thursday, February 07, 2002 1:01 PM
To: 'Paal Engelstad'; Hesham Soliman (ERA); 'Yoshihiro Ohba'; Hesham
Soliman (ERA)
Cc: 'Erik Nordmark'; Alper Yegin; George Tsirtsis;
[email-masked]
Subject: RE: RE: draft-ietf-pana-usage-scenarios-00.txt

  > > => I understand, but I think we have different views 
  > > of what a use case is. This is an example to show 
  > > the need for access independant authentication. 
  > > Nothing to do with mobility management. Just 
  > > like interface switching has nothing to do
  > > with solving the entire multihoming problem. 
  > 
  > I think we have discussed this in length and reached a 
  > common understanding (check the archive) that the 
  > authentication cannot be entirely access independent: The 
  > initial authentication (i.e not re-authentiction) will 
  > probably incorporate the "Device Identifier", which is 
  > access dependent.
  > 

=> I'm extremely confused. You will include the 
'Device identifier, which IS access dependant' ?
why would you want to do that ?
I might have missed a thread (obviously something
drastic was said in it) but this makes no sense
at all to me. If that was the case then I understand
why people are questioning the need for this protocol.
We should call it, 'replacement of PPP over Ethernet
protocol' !

Hesham