Re: [Pana] and network selection

[Yoshihiro Ohba <[e-mail]>]

I totally agree with Jari.

Regarding whether it is possible to for the user to select one ISP
(say, "isp1") but submit a NAI that is from a roaming partnert of that
ISP (say, "[e-mail]"), I think section 5.11 of the current PANA
specification needs to be revised to support this case.  Here is my
suggested changes:

[1] Change section 5.11 from:

"
5.11  Network Selection

   In a discovery and handshake phase, a PANA-Start-Request message sent
   from the PAA MAY contain zero or one NAP-Information AVP and zero or
   more ISP-Information AVPs to advertise the information on the NAP
   and/or ISPs.  The PaC MAY indicate its choice of ISP by including an
   ISP-Information AVP in the PANA-Start-Answer message.  When a AAA
   backend is used, the identity of the destination AAA server or realm
   MUST be determined based on the explicitly chosen ISP.  When the
   ISP-Information AVP is not present, the access network MAY rely on
   the client identifier carried in the EAP authentication method to
   make this determination.  The PaC can choose an ISP and contain an
   ISP-Information AVP for the chosen ISP in a PANA-Start-Answer message
   even when there is no ISP-Information AVP contained in the
   PANA-Start-Request message.
"

To:

"
5.11  Network Selection

   In a discovery and handshake phase, a PANA-Start-Request message sent
   from the PAA MAY contain zero or one NAP-Information AVP and zero or
   more ISP-Information AVPs to advertise the information on the NAP
   and/or ISPs.  The PaC MAY indicate its choice of ISP by including an
   ISP-Information AVP in the PANA-Start-Answer message.  The PaC can
   choose an ISP and contain an ISP-Information AVP for the chosen ISP
   in a PANA-Start-Answer message even when there is no
   ISP-Information AVP contained in the PANA-Start-Request message.
   When an ISP-Information AVP is not present in the PANA-Start-Answer
   message, a default ISP is automatically chosen by the PAA.

   When a AAA backend is used, the identity of the destination AAA
   server or realm MAY be determined based on the the client
   identifier carried in the EAP authentication method. If the
   client is a subscriber of another ISP (i.e., the home ISP of the
   client) that has a roaming relationship with the chosen ISP, it can
   specify the realm of the home ISP in the realm part of the client
   identifier.  In the roaming case, the PAA MAY carry 
   ISP-Information AVPs only for ISPs that are directly connected to the
   access network it resides, not for all possible home ISPs.

   In addition to performing network selection by using PANA for
   choosing an ISP, another level of network selection may be
   performed by using EAP for choosing AAA intermediaries
   [I-D.adrangi-eap-network-discovery].  The latter network selection
   occurs over EAP in PANA authentication phase after completion of
   the former network selection in PANA discovery and handshake phase,
   possibly in the scope of the chosen ISP.
"

[2] Add the following reference:

[I-D.adrangi-eap-network-discovery]

  F. Adrangi, et. al, "Identity selection hints for Extensible
  Authentication Protocol (EAP)", adrangi-eap-network-discovery-05
  (work in progress), October 2004.

Regards,

Yoshihiro Ohba


On Fri, Nov 05, 2004 at 02:53:16PM +0200, Jari Arkko wrote:
> 
> Hi Avi and Yoshihiro,
> 
> It may help to think about PANA as a layer 2 function
> for the purposes of this discussion. Layer 2 systems
> typically have means for at least rudimentary network
> selection. For instance, in 802.11 we have the SSID
> which enables a client to pick the right type of a
> network, and several such networks might in fact be
> co-located in the same equipment. In general, we
> expect link layer support for network discovery to
> be improved in the future, because without that
> other solutions will be inefficient (such as running
> EAP towards everyone to find out who we want to
> connect to).
> 
> The PANA link layer has slightly different mechanisms
> than in 802.11. One big difference is that in PANA, you have
> a possibility of authenticating twice, both to the access network
> and a home operator. So the first observation is that there's
> more things to "discover" in PANA than in 802.11 networks.
> 
> The second observation is that by their nature, link
> layers may not have a lot of information on what
> happens in the AAA beyond the first proxy hop.
> The third observation is that roaming is important;
> I would not like to see a link layer that prevents
> roaming beyond what the link layer negotiated for
> the "ISP" or "SSID" or whatever at the beginning.
> 
> What does this mean for the discussion at hand?
> I would classify PANA's network discovery mechanisms
> as an enhanced link layer discovery mechanism, and
> I like to have such mechanisms. However, we should
> also ensure that it is still possible for the user
> to select one ISP (say, "isp1") BUT submit a NAI
> that is from a roaming partnert of that ISP (say,
> "[e-mail]". If this is possible in PANA then
> we are fine. If not, we need further discussion.
> 
> --Jari
> 
> Avi Lior wrote:
> >Hi Yoshihiro,
> >
> >
> >>Network selection based on EAP occurs always after completion 
> >>of network selection in PANA in its discovery and handshake 
> >>phase (this is guaranteed because section 5.12.1 of 
> >>pana-pana-06 explcitly prohibits piggybacking EAP-Request in 
> >>PANA-Start-Request messsage). This means that network 
> >>selection based on EAP is only performed under the chosen ISP.
> >
> >
> >I am a bit confused here.  So let me ask you a few questions:
> >
> >What is the purpose of ISP-Information?
> >How does the PAA know what ISP-Information to provide to the PaC?
> >If the PAA has a relationship with hunderds of ISPs does it send all the
> >ISPs?
> >How does the PaC select which ISP?
> >
> >Note: the visited network may not have a direct relationship with the home
> >network 
> >So it will send a list of intermediaries to the PaC.  The PaC may not be
> >able to select the intermediaries because it wouldn't necessarily know the
> >routing.  It knows its home network for sure but it may not know other
> >relationships.
> >
> >When we do EAP based authentication in AAA we use the User-Name the NAI to
> >determine how to route the AAA requests to the Home Network.  How is this
> >invisioned to work when PANA and AAA work together.
> >
> >When we do the authentication part, the AAA will use the NAI that was
> >provided by the device to route the authentication requests.  This may be
> >totally different then the ISP selected during the discovery phase.
> >
> >So what is the purpose of doing ISP selection in the discovery phase? 
> >
> >
> >
> >>-----Original Message-----
> >>From: Yoshihiro Ohba [mailto:[e-mail]] 
> >>Sent: Tuesday, November 02, 2004 9:32 PM
> >>To: Avi Lior
> >>Cc: 'Alper Yegin'; [e-mail]
> >>Subject: Re: [Pana] and network selection
> >>
> >>
> >>Hi Avi,
> >>
> >>I think network selection in PANA (that is ISP selection) and 
> >>the network selection based on EAP (that is intermediary network
> >>selection) does not conflict each other for the following reason:
> >>
> >>Network selection based on EAP occurs always after completion 
> >>of network selection in PANA in its discovery and handshake 
> >>phase (this is guaranteed because section 5.12.1 of 
> >>pana-pana-06 explcitly prohibits piggybacking EAP-Request in 
> >>PANA-Start-Request messsage). This means that network 
> >>selection based on EAP is only performed under the chosen ISP.
> >>
> >>I agree that we should clarify somethign like this in the 
> >>PANA specification draft.
> >>
> >>Regards,
> >>
> >>Yoshihiro Ohba
> >>
> >>
> >>On Wed, Nov 03, 2004 at 03:22:46PM -0500, Avi Lior wrote:
> >>
> >>>Issues with Network Selection.
> >>>
> >>>PANA provides its own network selection and EAP also provides a 
> >>>network discover mechanism 
> >>>(draft-adrangi-eap-network-discovery-05.txt)
> >>>
> >>>These may conflict with each other.  Furthermore, the PAA 
> >>
> >>may not know 
> >>
> >>>that the EAP payload contains network discovery material.
> >>>
> >>>What happens if both are used?  Is it something that PANA 
> >>
> >>needs to be 
> >>
> >>>concerned about? Do we need to say something about this in PANA?
> >>>
> >>>
> >>>
> >>>
> >>>_______________________________________________
> >>>Pana mailing list
> >>>[e-mail]
> >>>https://www1.ietf.org/mailman/listinfo/pana
> >>
> >
> >_______________________________________________
> >Pana mailing list
> >[e-mail]
> >https://www1.ietf.org/mailman/listinfo/pana
> >
> >
> 

_______________________________________________
Pana mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/pana