Subject: RE: [Dime] HA-to-AAAH support/When ? HoA allocation considerations

From: <[email-masked]>
Date: Tue, 3 Oct 2006 13:24:59 +0200

Hi Julien,

Just a quick comment or few inline.. 

> -----Original Message-----
> From: Julien Bournelle [mailto:[email-masked]] 
> Sent: 3. lokakuuta 2006 13:53
> To: [email-masked]
> Subject: [Dime] HA-to-AAAH support/When ? HoA allocation 
> considerations
> 
> Hi all,
> 
>  as promised, some considerations concerning triggering the 
> mip6-authz  process.
> 
>  As noted by gerardo, the IKEv2 responder may act both as a 
> HA and as a  VPN concentrator. In this case, it knows that it 
> will be used as a HA  while receiving a BU. So, we may think 
> that the mip6-authz could be  used at this point of time.
> 
>  However, we also have to consider the Home-Address (HoA) 
> allocation. As you  may know the MN may auto-assign its HoA 
> or requests one. (cf.
>  draft-ietf-mip6-bootstrapping-split-02.txt)
> 
>  If it wants to auto-assign its HoA, it has 2 possibilities:
> 
>   1/ It autoassignes its HoA and includes it in the CFG_REQUEST
>   (INTERNAL_IP6_ADDRESS)i in the first IKE_AUTH message. 
>   If the HA is ok, it replies with the CFG_REPLY
>   with the same address.
> 
>    2/ The MN asks for the Home Prefix (CFG_REQUEST with
>    MIP6_HOME_PREFIX). The HA sends the Home prefix in the CFG_REPLY.
>    Then
>    the MN uses a CREATE_CHILD_SA.
> 
>  This raises some questions:
> 
>  1/ Do we consider that it is the HA which decides if the MN 
> is  authorized to configure its HoA  (policy configuration at 
> the HA) ? or do we  consider that it is a per-MN policy and 
> thus that the HA should request  that to the MSA ?

Imho both.. depends on operator's deployment.

>  If we consider that the MSA should decide this, as the HoA 
> is sent  after the MN being authenticated by EAP. This 
> implies that the  mip6-authz app should be used before this 
> last IKEv2 message.
> 
>  If the MN requests a HoA to the HA, we also have the following
>  question:
> 
>  1/ do we allow the AAA server to allocate this address ? or 
> do we need  an AVP to carry the HoA from the AAA to the HA ?

I'm not entirely sure what the above is supposed to mean.. but
imho again depending on the operator's deployment either HA or
AAA should be able to allocate the HoA.

Cheers,
	Jouni

>  
>  regards,
> 
>  Julien
>    
> 
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime
> 

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 4 Oct 2006 13:33:48 +0200

Hi jouni,

On Tue, Oct 03, 2006 at 01:24:59PM +0200, [email-masked] wrote:

<snip>

> Imho both.. depends on operator's deployment.

 if we want both. This implies that the mip6-authz process occurs during
 the EAP authentication process (probably when the HA receives the
 result of the EAP authentication from the AAAH).

 I'm also in favor of that but then we have the issue raised by gerardo
 concerning the fact that the IKEv2 responder may play 2 roles (VPN
 concentrator and HA). How do the IKEv2-R know that the MN wants to use
 mip6 ?

> AAA should be able to allocate the HoA.

 I also agree with you. It also implies that the mip6-Authz App should
 be used during EAP authentication process.

 Julien

-- 
julien.bournelle at int-evry.fr

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Wed, 4 Oct 2006 14:23:01 +0200

Hi Julien and Jouni,

>  result of the EAP authentication from the AAAH).

This is needed only for autoconfiguration. But autoconfiguration has
been introduced in mip6-split for rfc3041 addresses and CGAs. Do we
want the AAA to decide if theMN can use CGA? I'm not sure this is the
case.

I think what is important from an operator perspective is that the
address may be allocated by either AAA or HA. However, to get this, we
do not need to start mip6-authz during EAP exchange, since it is a
generic IKEv2 address assignment issue and not a MIP specific one.

--Gerardo

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 4 Oct 2006 16:26:47 +0200

> want the AAA to decide if theMN can use CGA? I'm not sure this is the

 LEt's call AAA-MIP6 the AAA server contacted by the HA for the
 authorization process.

 I'm not saying that the AAA should decide if the MN can use CGA. I'm
 just asking if we want that the AAA-MIP6 be able to authorize if the MN
 can auto-assign its address.

> generic IKEv2 address assignment issue and not a MIP specific one.

 If the HoA is allocated by the AAA-MIP6, the HA must get this address
 before sending the last IKEv2 message:

   HDR, SK {AUTH, [CP(CFG_REPLY,] SAr2, TSi, TSr }

 but you're right that the mip6-authz can be used right after the
 reception of the EAP-Success (but not after this last message and thus
 not after reception of the BU).

 If we want the AAA-MIP6 to authorize the MN to auto-assign its address,
 it is the same conclusion. It must be contacted before this last IKEv2
 message.

 Julien