Subject: RE: Separation of PAA and Access router (multi access router scenario)

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 24 Sep 2002 09:37:52 -0700

Basavaraj,

Does separating the AR (which could be more than one) and PAA
mean there is only one PAA on the link ? Or there can be still
more than one PAA and PaC discovers just one of them authenticates
with one of them. 

Some questions below..

> 
> At IETF54 we had some discussion on the issue of how PANA 
> works in the scenario where there are multiple access routers 
> on the same link.
> 
> The charter specifies the colocation of the PAA with the 
> access router. This was done primarily to simply the protocol. The PaC
> (client) does not have to discover or figure out the address 
> of the PAA if it is colocated with the AR. Also the 
> authorization received from the the AAA backend to allow 
> access to the PaC can be directly applied to the AR. 
> 
> The primary issue at the IETF meeting was whether every 
> access router would have a PAA. Of course this is the 
> simplest approach. 
> 
> But does this imply that the PaC performs authentication with 
> every PAA? Or the PaC performs authentication with only one 
> of the PAAs and the authorization to access is then 
> distributed to all other PAAs on the link? 
> 
Could you clarify on why the authorization needs to be distributed
to all the PAAs ? Is it because the PaC may choose a different
PAA for disconnect notification ?

> I am of the opinion that it is simpler to have the *option* 
> of keeping the PAA separated from the access router.  In such 
> a case the PAA would be able to communicate with the multiple 
> access routers (EP) to authorize access for a PaC. 
> The implication here is that there needs to be a protocol 
> defined that would allow the PAA and the ARs (EP) to 
> communicate. The definition of this messaging would be a part 
> of the PANA WG scope as well.
> 
I assume that this includes the PAA -> PAAA for distributing
the authorization also as you mentioned above.

> So we would like to modify the charter to allow the option of 
> having the PAA separated from the AR. 
> If you have comments on making such a change, please send 
> them to the WG list.
>
> -Chairs
> 
mohan

---

From: <[email-masked]>
Date: Wed, 25 Sep 2002 03:43:12 -0500

>more than one PAA and PaC discovers just one of them authenticates 
 
There could be more than one PAA. As you mention one of the downsides
of not having the PAA on the AR is that the PaC now has to discover
it.
But the idea is that the PaC needs to be aware of only one PAA and it
is sufficient to authenticate with just one of them.
 
>PAA for disconnect notification ? 
 
That and:
1. Because the client may change the default router in which case the
   AR that does not have the authorization would block the packets
   to/from the client
 
>the authorization also as you mentioned above. 
 
Not sure what you mean here.

---

From: <[email-masked]>
Date: Thu, 26 Sep 2002 05:53:19 -0500

>If there are multiple access routers and mulitple PAAs, PaC initially 
>discovers the PAA. Depending on the discovery PaC might see one or 
>more of the PAA and may choose one among them for authentication. 
>Once it is done with authentication, PAA sends the access control 
>information to all the access routers (EP). In the future, if it 
>needs to reauthenticate, it might choose a different PAA. In that 
>case, the auth may be faster if the new PAA has the relevant information. 
>One example could be the handoff case. Is distributing such information 
>outside the scope of PANA ? 

The scenario that you describe above basically requires some sort of
context transfer between the PAAs. I consider this to be outside the
scope of the PANA WG. I guess it is possible that we could use some CT
mechanism in which case the PaC sending authentication requests to
another PAA would not necessarily have delay consequences. Maybe this
is a requirement for the CT protocol that is done in Seamoby WG.

>-mohan 

-Basavaraj

---

From: <[email-masked]>
Date: Mon, 30 Sep 2002 15:16:11 -0500

> 
> Maybe the question is. Does the exactly same packet
> message need to be sent to all ARs? Because even if
> you multicast a message, some nodes might receive it
> later, some nodes might not receive it, etc, etc. 
> 
> So you cannot guarantee total synchronicity, right? 

Yes. 

>
> I think what you can guarantee is that all ARs will
> receive the message within a time window. We can rely
> on retransmissions to detect a downed AR. 

I think this is sufficient for PANA. Is this acceptable
to WG members?

> regards,
> Reinaldo

-BP