Subject: RE: [AAA-WG]: Possible to do handover with HA in foreign network and multiple AAAH in realm?

From: Thomas Panagiotis-PTHOMAS1 <[email-masked]>
Date: Mon, 8 Oct 2001 10:00:54 -0500

> Is this problem even solvable? If the HA were in a home network you
> could potentially use configured knowledge to map from ip to uri. If not
> the only reasonable response seems to be to reject the authentication
> due to lack of information.

or forward the AMR to an AAAH in your domain that may know something.
Multiple AAAHs in home domain must somehow be able to share information.
Protocol itself will not do much without proper configuration.

-Panos

-----Original Message-----
From: Fredrik Johansson [mailto:[email-masked]]
Sent: Monday, October 08, 2001 7:41 AM
To: AAA Listan
Subject: [AAA-WG]: Possible to do handover with HA in foreign network
and multiple AAAH in realm?

The scenario is as follows:

The mobile node authenticates with AAAH1 via FA1 and is allocated a home
agent in the foreign network. The MN then moves to FA2 and passes it the
HA-address. FA2 sends an AMR that is handled by AAAH2 serving the same
realm as AAAH1. Neither FA2 nor AAAH2 has any knowledge of the existing
session beyond that of the MIP-Mobile-Home-Agent avp.

Note that this is the ip address of the interface that the home agent
uses to tunnel Mobile Ip traffic. There is no reason to expect this to
be the same interface used for diameter traffic, in fact this is even
unlikely. Since the mobile node has no knowledge of anything but Mobile
Ip it cannot be expected to pass the diameter uri of the HA.

Is this problem even solvable? If the HA were in a home network you
could potentially use configured knowledge to map from ip to uri. If not
the only reasonable response seems to be to reject the authentication
due to lack of information.

j

---

From: "Fredrik Johansson" <[email-masked]>
Date: Thu, 11 Oct 2001 18:00:22 +0200

>Protocol itself will not do much without proper configuration.

Well, we designed the protocol to handle multiple AAAh and so a request
could come in on any of them. If no session exist on the AAAh it would
then create a session towards the HA and the HA should sort out wether
it's a new registration or a contunuation of a old session. This was
decided so no session state should be shared between multiple AAAh servers.
And probably work fine as long as the HA is in the home network because
you MAY expect the AAAh to be configured with the HA URI.

However, with HA's  allocated in a foreign network it means that every AAAh
needs to be able to map between HA IP address and the HA URI for every
possible HA in every possible foreign network that its clients can be
visiting.

The HA address is available in the registration request and sent in the
Home Agent Address AVP in the AMR. However the URI of an HA in a foreign
network is not known in any other AAAh server than the one that received
the first request for registration. And we agreed previously that session
state shouln't have to be shared between multiple AAAh.

/Fredrik