Subject: Re: RE: PANA FAQ

From: Paal Engelstad <[email-masked]>
Date: Fri, 24 May 2002 21:30:00 +0200

> At 11:39 AM 5/24/2002 -0400, John Schnizlein wrote:
> >If we have consensus that PANA is not to replace L2 authentication,
> >why do we still have the debate regarding PANA prior to L3 addressing?
> 
> 
> You took the words right out of my mouth :-)

I would prefer to see this pinned down in the charter once and for all, that PANA is for post-IP-address authentication. 

(Another way to see it, is that we focus on this first, and postpone possible complicating hacks for pre-IP-address PANA authentication till after we have developped a successfull post-IP-address PANA protocol. If ever...)

Paal

> 
> 
> >The motivation for PANA when only L2 endpoints are defined seems to
> >be PANA always, which seems to beg the question of co-existence with
> >L2 authentication.
> >
> >John
> >
> >At 11:23 AM 5/24/2002, [email-masked] wrote:
> >
> > >Glen Zorn [[email-masked]] wrote:
> > >
> > >>The idea of running EAP (or something) over IP to accomplish this isn't
> > >>totally lame, but the idea of replacing all (or any) of the existing L2
> > >>authentication methods w/PANA certainly is.  IMHO, this WG would 
> > accomplish
> > >>much more, much more quickly if it stopped confusing the two things (as
> > >>evidenced here), abandoned the latter and concentrated on the former.
> > >
> > >Glen,
> > >
> > >PANA is an alternative mechanism (to PPP, 802.1x etc.) for network
> > >authentication. It is not the intent to replace any and all existing
> > >L2 schemes. We have mentioned this in the FAQ that was sent to the
> > >list (on 4/18):
> > >"
> > >Q2: Does PANA aim to replace link layer authentication?
> > >A:  No. PANA will complement and/or coexist with link layer
> > >    authentication mechanisms to enable network layer authentication.
> > >"
> > >
> > >There is no confusion as to what we want to do. I think the new
> > >charter that we have proposed (on 5/21) explicitly states the focus of
> > >the WG. So I believe we can now get down to the business of defining a
> > >solution for PANA.
> > >
> > >-Basavaraj
> 
>

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Fri, 24 May 2002 15:58:58 -0700

> I would prefer to see this pinned down in the charter once and for all,
that PANA is for post-IP-address authentication.
>
> (Another way to see it, is that we focus on this first, and postpone
possible complicating hacks for pre-IP-address PANA authentication till
after we have developped a successfull post-IP-address PANA protocol. If
ever...)

I don't think this detail belongs to the charter. Requirements
draft is the right place to pin this issue down, and we have
already been doing this discussion in the context of requirements.

alper