Subject: RE: PANA FAQ

From: <[email-masked]>
Date: Fri, 24 May 2002 10:54:30 -0500

>If we have consensus that PANA is not to replace L2 authentication,
>why do we still have the debate regarding PANA prior to L3
>addressing?

I don't know. But I believe people (at least some) still think that
PANA is a replacement for existing L2 mechanisms. This is totally
incorrect. Networks that use PPP or 802.1x or any other mechanism for
authenticating users and do not need any higher layer authentication
mechanism will have no need for PANA. But networks that may be willing
to provide L2 connectivity and authenticate the users at L3 will find
PANA useful. In addition if there is a need for subsequent
authentication (in any type of network) or, a need to authenticate
access to a service, PANA can be used.  

>
>The motivation for PANA when only L2 endpoints are defined seems to
>be PANA always, which seems to beg the question of co-existence with
>L2 authentication.

I think this view is not inline with the scope and charter of
PANA. There is no suggestion anywhere that PANA is always the
authentication mechanism. 

If you do not believe this is quite explicitly stated in the revised
charter, please let me know and we can add some more text to that
effect. 

>John

-Basavaraj

---

From: John Schnizlein <[email-masked]>
Date: Fri, 24 May 2002 12:19:38 -0400

I am not convinced it has to be in the charter, but we should
resolve the question of the use of PANA prior to IP address.
My opinion is that the definition of PANA over IP implies that
PANA does not operate until the host has an IP address.

We should reject complications that call for PANA relay agents,
or special-purpose IP addresses, in order to enable PANA prior
to the configuration of a host's IP address. Notice that the
complication of relay agents for DHCP was logically implied by
the purpose of DHCP to configure initial parameters such as the
IP address - no such justification exists for PANA. I see no
alternative but to follow the implication that PANA requires
valid IP addresses at both the client and server, but this
point keeps coming back.

John

At 11:54 AM 5/24/2002, [email-masked] wrote:
>>
>>The motivation for PANA when only L2 endpoints are defined 
>>seems to be PANA always, which seems to beg the question of 
>>co-existence with L2 authentication.
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 24 May 2002 14:25:40 -0400

John,

> valid IP addresses at both the client and server, but this

I would like to make sure the definition of "valid IP address".  If a
valid IP address means an IP address that is NOT to be shared by other
nodes at a time within the defined scope of the address, I tend to
agree with you (link-local address and private address are valid, but
all 0's address is invalid in this sense).

Yoshihiro Ohba