Subject: RE: PANA FAQ

From: <[email-masked]>
Date: Thu, 27 Jun 2002 16:25:48 -0500

Hello,

>Hi,
>
>Quick comments...
>
>At 20:35 27/06/2002, [email-masked] wrote:
>>  or may be used as a
>>mechanism for periodic reauthentication of an existing connection that
>>was originally authenticated using an L2 mechanism.
>
>I believe all L2 authentication mechanisms indicated above (802.1X, PPP) 
>allow for periodic re-authentication. Actually, I'm currently connected via 
>an 802.1X-authenticated WLAN, and my AP is re-authenticating me every 5 
>minutes (a full 4 round-trip EAP SRP authentication each time to my RADIUS 
>server 500 km away -- I should really implement the SRP fast re-auth part) 
>because my RADIUS server told it to.

Guess that was a poor example of PANA applicability.

>
>>If a network is unwilling to provide
>>access (or L2 connectivity) without authenticating at L2, PANA would
>>be useless anyway. However if such networks do exist (I cannot give an
>>example of such at this time :( ) and the operator is willing to
>>provide L2 connectivity without authentication and will only provide
>>L3 connectivity if authentication is succesful, then there is no
>>reason to limit the scope of PANA in such networks.
>
>Providing L3 addresses and L3 connectivity are two different things. You 
>can provide the former without the latter. 

And what would be the benefit of not providing even limited L3
connectivity? 

>But I doubt anyone would give L2 
>connectivity if they don't want to give L3 connectivity and they can use L2 
>authentication. For what purposes?

I agree. Current operators force users to authenticate at L2. But is
there any real benefit in the case of WLAN operators in authenticating
at L2 as opposed to authenticating at L3?
And if operators are worried about assigning IP addresses to hosts
before it is authenticated then hopefully IPv6 solves that problem.

If operators are worried about hosts attaching to APs at L2 and not
authenticating, I guess you could have mechanisms to drop
non-authenticated (performed at L3) L2 connections based on some
timers. 

And again to reiterate one of the reasons of why L3 based
authentication is useful:
If you have multi-interface devices (Ethernet, .11, GPRS, 1X), you
could use a common mechanism for authenticating the user instead of
having to do .1x when attached to WLAN and PPPoE when connected over
Ethernet and PPP when connected to GPRS or 1X.

>Jacques.

-Basavaraj