Subject: RE: [Dime] HA-to-AAAH/HA as a single box ?

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Fri, 13 Oct 2006 00:00:27 -0400

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: Wednesday, October 11, 2006 7:10 PM
> To: Julien Bournelle
> Cc: [email-masked]
> Subject: Re: [Dime] HA-to-AAAH/HA as a single box ?
> 
> Julien Bournelle wrote:
> > Hi all,
> >
> >    I also prefer start a new thread on this subject.
> >
> >    Gerardo raised an issue concerning the fact that
> >    the IKEv2 Responder of the HA may also act as a VPN concentrator.
> 
> IMO, this must be supported.
> 
[KC>] Not sure why you say so. We are talking about Diameter MIP6
support here. Having a VPN concentrator in the HA is an implementation
choice, albeit quite common. But within the context of MIP6, it seems
irrelevant. 

> >
> >    The issue is that the IKEv2 responder has (a priori) no way to
know
> >    if the IKEv2 Initiator wants mip6 service or VPN.
> 
> there are many ways of doing this. some deployments use
> the IDr field to indicate that you are going to use a
> certain service.
> 
[KC>] Hmmm...which deployments? As far as 3GPP2 (X.P0028-200) is
concerned, service identifier in IDr is history.

> Vijay
> 
> >
> >    If it wants mip6 service, it should use 4072 in
> >    AUTHENTICATE_ONLY mode and then use the mip6 Authorization
> >    application. If it wants VPN, I guess 4072 would be used
> >    in a different way.
> >
> >    So before trying to solve this, the question is to know wether
> >    we can assume that HA is a single box.
> >
> >    I personnally would prefer assume the IKEv2 responder is only for
> >    HA and add a note in the document about this problem.
> >
> >    Any comments ?
> >
> >     Julien
> >
> > _______________________________________________
> > DiME mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/dime
> 
> 
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Fri, 13 Oct 2006 00:06:08 -0400

Vijay/Gerardo,

I think you are complicating the Diameter based HA-HAAA interface by
introducing this orthogonal VPN concept here. IMHO, if the MN tries to
establish IPsec/IKEv2 with the HA it is assumed to initiate MIP6.
Otherwise, why would the HA contact the MSA for EAP authorization? I am
sure a VPN concentrator has no idea about MSA.

-Kuntal

> From: Gerardo Giaretta [mailto:[email-masked]]
> Sent: Thursday, October 12, 2006 3:35 AM
> To: Vijay Devarapalli
> Cc: [email-masked]
> Agree (this is obvious since I raised the issue)
> 
> > >
know
> based on this approach, the IDi (isn't the initiator's ID and not the
> reponder's?) must be chosen based on the service. This means that the
> MN needs to have different permanent long-lived identities for
> different services. This is doable but it seems it introduces an extra
> identity management effort.
> 
> Obviously another approach would be to identify the service in IKEv2
> exchange (e.g. using different CONFIG attributes for different
> services), but I'm not sure this can be acceptable for IPsec people.
> 
> Some more suggestions?
> 
> --Gerardo
> 
> > Vijay
> >
> > >

---

From: <[email-masked]>
Date: Fri, 13 Oct 2006 07:24:58 +0200

Hi Kuntal, 

See a comment below.

> From: Chowdhury, Kuntal [mailto:[email-masked]] 
> Sent: 13. lokakuuta 2006 7:00
> To: Vijay Devarapalli; Julien Bournelle
> Cc: [email-masked]
> Subject: RE: [Dime] HA-to-AAAH/HA as a single box ?
> 
> 
> 

E.g. 3GPP I-WLAN does W-APN selection in this way.

Cheers,
	Jouni