Subject: RE: [Dime] Defining a new Application for mip6-split ?

From: "Avi Lior" <[email-masked]>
Date: Sat, 20 May 2006 10:25:27 -0400

Hi see inline please.... 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] 
> Sent: Friday, May 19, 2006 3:01 PM
> To: Avi Lior; [email-masked]
> Cc: [email-masked]
> Subject: RE: [Dime] Defining a new Application for mip6-split ?
> 
> Hi Avi, 
> 
> Some questions inline.
> 
> /Jouni
> 
> 
> > Jari,
> > 
> > 
> > See inline... 
> > 
> > > Avi,
> > > 
> > > > If I have two EAP based application in my network, one that is 
> > > > handling pure EAP application, the other is extended to
> > > handle the new
> > > > behavior then I need a way to route the (same) command 
> correctly.
> > > >
> > > Ah, but that is a new requirement. If you believe that 
> you need to 
> > > route EAP authentication from a 802.11 AP differently than from 
> > > IKEv2/MIPv6, then you need one of these:
> > > 
> > > - Use different user/domain names for the users of
> > >   the different services.
> > 
> > This is unacceptable.
> 
> Just for my clarification why would this (e.g. different
> realms) be unacceptable?

If the service is offered by a different realm then sure. But if it is
not then you ought not create different realms problems.

If it is indeed a different user-identity, then okay use a different
user identity. But if it is not then you ought not create different
users to solve this problem.

So an example of when this is unacceptable is Network Access
Authentication and Mobile IP authentication.  We must not create
different user identities for each service.  

In general, operators want to reduce the numbers of entities they have
to manage.  Having a different identity for each service is the WRONG
way to solve these problems.  We want to consolidate.

> 
> > > - Point to different servers from the AP and SGW (but
> > >   this works less well if you have proxies and roaming).
> > 
> > Good, cause this is unaccpetable.
> >  
> > > - New application ID.
> > 
> > I thought that that was what an application ID is for. No?
> > 
> > > - Some weird form of Diameter and RADIUS source routing
> > >   based on what type of node sent the message.
> > 
> > Good again.  This is unacceptable.
> > 
> > > However, it is far from clear to me why you would really need to 
> > > route the authentication differently *for the same user*.
> > 
> > We want to use common user credentials.  That is a big plus.
> >  
> > > Many authentication mechanisms can also have state, which would 
> > > imply that at the end they need to end up in the same 
> device anyhow. 
> > > Can you expand on why you need to handle the same users 
> in different 
> > > authentication servers?
> > 
> > See above.
> > 
> > Can you please explain why we are not using Diamter 
> Application Id the 
> > way they ought to be used?
> > 
> > > --Jari
> 
> 

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Jari Arkko <[email-masked]>
Date: Sun, 21 May 2006 13:06:29 +0300

>way to solve these problems.  We want to consolidate.
Indeed. But wouldn't consolidation also apply to deployment
of multiple authentication servers for the same credentials
albeit different service (SIP, 802.11, VPN, ...)? I would assume
that there are business and technical reasons to keep the
number of servers down...

--Jari

---

From: Anders Kristensen <[email-masked]>
Date: Mon, 22 May 2006 11:14:40 -0400

> number of servers down...

Isn't it just a matter of having the same set of servers advertise an 
additional application ID?

Anders