Subject: [Pana] Issue 202-206 (AD-review pana-fwk, sections 7.1)

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 31 Oct 2005 12:29:20 -0500

http://danforsberg.info:8080/pana-issues/issue202
http://danforsberg.info:8080/pana-issues/issue203
http://danforsberg.info:8080/pana-issues/issue204
http://danforsberg.info:8080/pana-issues/issue205
http://danforsberg.info:8080/pana-issues/issue206

Summary
-------

According to AD's comments, it is better to condense sections 7.1.1,
7.1.2, 7.1.2.1 and 7.1.2.2 into section 7.1, with removing unclear
scenarios such as serial/parallel relationship between PAA and EP, as
well as too detailed scenarios such as pre-installation of filters to
EPs to reduce handoff latency.

Also, the current description on the benefit of having a single PAA
controlling multiple EPs in terms of manageability is unclear, as AD
commented the authentication server may be viewed as the single
manageable point.  I think the real benefit of of having a single PAA
controlling multiple EPs is the ability to eliminate EAP messaging all
the way to the authentication server while the PaC is roaming among
multiple EPs in the access network without inter-PAA commnunications.

Proposed Changes
----------------

[1] Remove Figures 3 and 4.  Renumber Figure 5 to Figure 3.

[2] Remove Sections 7.1.1, 7.1.2, 7.1.2.1 and 7.1.2.2.

[3] Rewrite Section 7.1 as follows:

"
7.1  PAA and EP Locations

   EPs' location in the network topology should be appropriate for
   performing access control functionality.  When the access control is
   performed at link-layer, an IP-capable access device on the same link
   as the client devices is the logical choice.  When IPsec-based or
   non-cryptographic access control mechanisms are used, the EPs'
   location can range from the first-hop router to other routers within
   the access network.  The first-hop router may be preferred in order
   to limit the access of unauthorized IP traffic.

   PAA and EPs should be aware of each other as this is necessary for
   access control.  Generally this can be achieved by manual
   configuration.  Dynamic discovery is another possibility, but this is
   left to implementations and outside the scope of this document.

   Since PANA allows the separation of EP and PAA, there are several
   models depending on the number of EPs and PAAs and their locations.

   In the simplest model, the PAA and EP are co-located on the same
   device.  In this model, the PAA-EP communication is implemented
   locally by using an API.  When there are multiple such co-located
   devices in the same IP subnet, only the PAA co-locating with the EP
   that is closest to the PaC among all EPs in the same subnet needs
   to be discovered by the PaC in order to perform per-packet access
   control appropriately.  To achieve this, each PAA/EP device on an
   link-layer switch or access point MUST NOT forward multicast PANA
   discovery message sent by PaCs attached to it to other devices.
   This model is suitable for an access network with a small number of
   EPs.

   In the other model, the PAA and EP are separated into multiple
   devices and they communicate using a PAA-EP protocol such as SNMP.
   A typical scenario is that a single PAA controls multiple EPs
   (Figure 3).  While this model is complex compared to the first
   model, it is particularly useful in an access network with a large
   number of EPs because it eliminates EAP messaging when the PaC
   switches from one EP to another in the same access network without
   inter-PAA communications.  In a more complex scenario, the
   single PAA may be replaced with multiple PAAs to avoid a single
   point of failure.
"

Regards,
Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana