Subject: [Dime] Defining a new Application for mip6-split ?

From: Julien Bournelle <[email-masked]>
Date: Thu, 18 May 2006 10:42:24 +0200

Hi all,

 we're in the process of updating/writing the document describing use of
 Diameter for the Mobile IPv6 split scenario.

 In the split scenario, the Mobile Node (MN) uses IKEv2 with the HA to
 setup IPsec SAs. This exchange is also used by the HA to authenticate
 the MN using EAP. The HA may rely on a AAA/EAP server for this. So we
 have the following scheme:

 MN <-- IKEv2-EAP --> HA <--------> AAA

 A priori Diameter EAP (RFC 4072) can be used between HA and AAA. 

 The problem is that Diameter EAP is normally used for Network Access
 authentication. 

 In our case, the AAA server must perform AAA functionality for the
 Mobile IPv6 service. The AAA server must know that it has to authorize
 the mip6 service and the accounting (ASR/ASA) is also for mip6 and not
 for network access.

 For the above reason, it seems that we should define a new Diameter
 Application. However, in the same time, the messages defined in
 Diameter EAP could be reused.

 So I'd like to hear opinions concerning this issue.

 Thanks,

 - Julien B.

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: <[email-masked]>
Date: Thu, 18 May 2006 14:45:00 +0300

Hi Julien,

There's nothing in RFC 4072 that would limit its use to, say, PPP 
or 802.1X -- it works for IKEv2 as well (which can be considered
a special kind of network access, where the "link" is a tunnel
over IP).

The details (MIP6 or 802.11 WLAN or something else) can be sent
to the AAA server using e.g. Service-Type and/or NAS-Port-Type AVPs.

Best regards,
Pasi

> -----Original Message-----
> From: ext Julien Bournelle [mailto:[email-masked]] 
> Sent: 18 May, 2006 11:42
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Dime] Defining a new Application for mip6-split ?
> 
> Hi all,
> 
>  Mobile IPv6 service. The AAA server must know that it has to 
>  authorize the mip6 service and the accounting (ASR/ASA) is also for 
>  mip6 and not for network access.
>

---

From: Julien Bournelle <[email-masked]>
Date: Thu, 18 May 2006 13:05:30 +0200

Hi Pasi,

> a special kind of network access, where the "link" is a tunnel

 I'm not saying that we can't use IKEv2 with Diameter EAP. I had just a
 doubt due to the fact that in our case, we're doing AAA for the mip6
 service and not for network access. (So I wanted to know opinion from
 the group before starting to write)

> to the AAA server using e.g. Service-Type and/or NAS-Port-Type AVPs.

 ok. I forgot the Service-Type AVP which seems to be what we need.

 thanks,

 Best regards,

 Julien

-- 
julien.bournelle at int-evry.fr