Subject: Re: [AAA-WG]: Re: AAAH must be stateful

From: Joe Lau <[email-masked]>
Date: Fri, 5 Oct 2001 12:03:38 -0700 (PDT)

> > Are there any reasons a server MUST maintain state?
> > 
> What about this one (as stated on draft 8, alpha)?
>  > 
>  >    During the creation of the HAR, the AAAH MUST use a different session
>  >    identifier than the one used in the AMR/AMA (see figure 2). Of
>  >    course, the AAAH MUST use the _same_ session identifier for _all_ HARs
>  >    initiated on behalf of a given mobile node's session. 

I was disappointed to the lack of response/discussion to this important issue.

Can we all have a discussion on this important issue?

	1) The reasons for the above MUST requirement on the AAAH
	2) Whether AAAH must be stateful to meet the above requirement

In addition, it will be very helpful to the AAA server implementors if
we can add a section to the Diameter Mobile IP draft describing when the
AAA server must be stateful and when not. 

Thanks!

Joe Lau

---

From: Mark Eklund <[email-masked]>
Date: Fri, 5 Oct 2001 17:03:52 -0400

> 	1) The reasons for the above MUST requirement on the AAAH

I can't think of a reason for this to be a MUST.  Is there ever a
situation where the HA will not be able to determine if this is a
continuation of a connection or a new connection?  If so, that would
be a reason for the MUST.  I would think the MIP-Mobile-Node-Address
would be a good indicator.  If the HA has a connection established
with the MIP-Mobile-Node-Address, then it is a continuation.

I think the MUST should be at least a SHOULD for one reason.  It will
reduce the number of STRs sent.  Every time the session-id changes
for the connection, a STR will have to be sent for the previous
session-id.  If the session-id doesn't change because of re-auth.

 > 	2) Whether AAAH must be stateful to meet the above requirement

I can think of three reasons that you would get communications for the
same connection.

1. Mobile IP Handoffs
2. Re-authorization
3. Key lifetime expiration and update.

Mobile IP Handoffs always causes generation of a new HAR session ID so
it doesn't count in the session state discussion.

If your server always gives an infinite lifetime for the authorization
and keys, then 2 and 3 shouldn't happen.  Because of this, the AAAH
should not have to keep session state.

Even if there are either re-authorizations, or key lifetime expiration
updates, I think the session id can be preserved without the AAAH
having to keep state.  This can be done with the Class AVP (section
8.20) of the base draft.  You simply send the Home agent session in a
Class AVP in your AMA.  All subsequent AMR re-auths will have to include
it and the stateless AAAH can extract the session-id and use it when
communicating with the HA.

-mark

---

From: "Mark Jones" <[email-masked]>
Date: Fri, 5 Oct 2001 19:02:18 -0400

Joe,

> 	1) The reasons for the above MUST requirement on the AAAH

I too am confused why this requirement is a MUST. The text seems to suggest
that it is because the HA is tracking a single session regardless of how
many handoffs occur. However, the HA can always determine whether a HAR
relates to a new or continued session so I fail to see why the AAAH MUST
remember the session id it added to the original HAR.

I do have a question on the STR generation though: Assuming the AAAH
included Auth-Session-State=NO_STATE_MAINTAINED in the HAR and a handoff
results in the AMR being sent to a different AAAH than that which originally
authorized the session, does this imply that the HA is not required to send
an STR to the original AAAH?

> 	2) Whether AAAH must be stateful to meet the above requirement

If the requirement in (1) remains a MUST, I believe the AAAH MUST also be
stateful. I don't think the Class attribute would help here unless it was
somehow being passed down to the MN which echoed it back in subsequent MIP
messages for the same session (regardless of FA).

Regards,
       Mark