Subject: RE: [AAA-WG]: General question on MIP and AAA interaction

From: Thomas Panagiotis-PTHOMAS1 <[email-masked]>
Date: Thu, 4 Oct 2001 14:47:48 -0500

Thanks Fredrik. I'll need a little more help though... :)

So what you are saying is that the MN should have two
"registration lifetime" timers running. One with AAAH
(aaa-lifetime) and one with HA (mip-lifetime). They
start off with the same value at the same time but then
they diverge (both in value and expiration times).

I understand why aaa-lifetime makes sense to be greater
than mip-lifetime, but why multiple? Even if aaa-lifetime
is a multiple of mip-lifetime, you still can not guarantee
that aaa-lifetime will expire at the same time that
mip-lifetime does. The reason is because mip-lifetime is
refreshed not only upon its expiration but also upon handoff
times, which are stochastic. So after a while these two timers
will run independent of each other. The MN would have to
re-register:
(1) upon aaa-lifetime expiration (with AAAH)
(2) upon mip-lifetime expiration (with HA)
(3) upon handoff, (with HA)

Is that what you have in mind?

Thanks again!

-Panos

-----Original Message-----
From: Fredrik Johansson [mailto:[email-masked]]
Sent: Thursday, October 04, 2001 2:48 AM
To: Thomas Panagiotis-PTHOMAS1; [email-masked]
Subject: RE: [AAA-WG]: General question on MIP and AAA interaction

>
>Hi,
>
>As noted in many places, mobility agents (FA,HA) do not have to
>interact with the AAA infrastructure every time a mobile is
>sending a Registration Request. To my understanding, this implies
>that whenever a AAA infrastructure is available and used, the HA
>does NOT have the authority to extend the registration lifetime.
>In other words,
>(i)  either the MN ignores the lifetime field in Registration
>     Replies coming directly from the HA, or

No, it will not ignore the lifetime field in the Reg Reply

>(ii) Registration Replies sent directly to the MN MUST have the
>     lifetime field set to:
>      (Authorization-Lifetime in last received HAR) minus
>      (Time elapsed since last HAR was received) minus
>      (some delays)

The Lifetime field in the registration reply should be set so that 
the Authorization-Lifetime is a multiple of the lifetime in the 
reg-reply. This way the mobile node will be able to do periodic 
tunnel updates without involving AAA. AAA is only involved when 
the Authorization-Lifetime expires.

Hope this clarifies

/Fredrik

>
>Is that how it's supposed to work or am I way off on this? :)
>
>Thanks,
>
>-Panos

---

From: "Fredrik Johansson" <[email-masked]>
Date: Fri, 5 Oct 2001 10:16:15 +0200

>they diverge (both in value and expiration times).

yes, there will be one timer to keep track of the tunnel lifetime
and one to handle registration keys.

>Is that what you have in mind?

Yes, you're right, the mn has to re-register at, tunnel expiration,
key expiration and upon handoff to another FA

I guess that the key lifetime being a multiple of the tunnel 
lifetime just makes sence if you always give out new keys to all 
nodes upon handoff. In that case both timers will expire at the same
time. So making it a recomendation might be the best we can do,
that will help for MNs connected to the same FA for longer periods
of time.

/Fredrik