Subject: Re: [Dime] Re: [Mip6] Diameter Mobile IPv6 Bootstrapping: Authorizing Route Optimization

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 4 Sep 2007 12:55:28 -0700 (PDT)

I like Jouni's idea of making RO authorization part of the subscriber profile. I think such a thing fits better into the (AAA) managed network model. Defining an AVP probably is not necessary.

Regards,

Behcet

----- Original Message ----
From: Hannes Tschofenig <[email-masked]>
To: Basavaraj Patil <[email-masked]>
Cc: Mobile IPv6 Mailing List <[email-masked]>; [email-masked]
Sent: Tuesday, September 4, 2007 2:34:20 PM
Subject: [Dime] Re: [Mip6] Diameter Mobile IPv6 Bootstrapping: Authorizing Route Optimization

Hi Raj,

you raise a good point. There is no doubt that a network operator can 
prevent all end hosts from using the RO procedure.

The main question therefore is whether the RO procedure has to enabled / 
disabled on a per user basis.

Ciao
Hannes

Basavaraj Patil wrote:
> Hi Ahmad,
>
> I am skeptical about the need for an MN being authorized to use an inherent
> feature of MIP6. It makes no sense for an MN to be authorized depending on
> the network that it is attached to whether it is able to use RO with CNs.
>
> -Raj
>
>
> On 9/4/07 8:57 AM, "ext Ahmad Muhanna" <[email-masked]> wrote:
>
>   
>> Hi Alex,
>>
>> Just some background:
>>
>> The proposed Diameter MIPv6 Application is used to enable MIPv6 service
>> authorization + dynamic security association allocation. As per the
>> current application, the user is authorized for MIPv6 service without a
>> clear indication if the user is allowed to use Route Optimization or
>> not. Allowing the operator this flexibility makes a lot of sense. Let us
>> remember in order for the MN to establish a RO, it needs to have at
>> least HoTI and HoT signals transmitted via the HA which can act as the
>> authorization enforcement point.
>>
>> Of course, we are talking about a network which is controlled by AAA
>> infrastructure since the proposed application is for Diameter MIPv6.
>>
>> Also, please see comments inline.
>>
>> Regards,
>> Ahmad
>>  
>>
>>     
>>> Subject: Re: [Mip6] Diameter Mobile IPv6 Bootstrapping:
>>> Authorizing Route Optimization
>>>
>>> Hannes Tschofenig wrote:
>>>       
>>>> Hi all, during his review of "Diameter Mobile IPv6: HA<->AAA" Ahmad
>>>> made the following comment:
>>>>         
>>>> We discussed before that AUTHORIZATION for ROUTE OPTIMIZATION is
>>>> needed. I did not see it included here?! As we discussed last time,
>>>> operators do care about having control over the willingness
>>>>         
>>> of the MN 
>>>       
>>>> to have route optimization. If that the case, then there
>>>>         
>>> should be a 
>>>       
>>>> process to enable that kind of authorization. No? <<<
>>>>
>>>> Does the group think that we need to provide any backend
>>>> infrastructure support to enable this type of functionality?
>>>>         
>>> Which group(s)?
>>>
>>> I think RO is designed to work across the entire Internet,
>>> not limited to a AAA-controlled domain.
>>>
>>>  From tests, the benefits of running RO on the MN are
>>> apparent only when the distance MN-CN is much shorter than
>>> both MN-HA and CN-HA, in terms of IP hops.
>>>
>>> In a closed system, that equation is not valid, ie, MN is
>>> close to both CN and to its HA, and the benefits of running
>>> RO are minimal, one doesn't gain much at all.
>>>
>>> So, in first place I don't see why would a MN want to run RO
>>> at all while in a AAA-controlled (closed) domain.  It may
>>> very well be that MN is not interested at all to run RO to a
>>> CN outside the AAA-controlled domain, because it wouldn't
>>> gain much.  Then, even if MN would want to do that, I don't
>>> see why asking the local AAA to be authorized to perform RO.
>>>       
>> [Ahmad]
>> Are you assuming that the HA is always in the visited network? Also,
>> V-AAA does not communicate with H-AAA?
>> I just want to understand what you meant here.
>> Thanks.
>>
>>     
>>> Finally, are you talking about AAA backend authorizing the MN
>>> or the CN to do RO?
>>>       
>> [Ahmad]
>> AAA infrastructure only can control the MN to have RO or not and hence
>> authorization is for the MN not the CN.
>>     
>>> Alex
>>>
>>> ______________________________________________________________________
>>> This email has been scanned by the MessageLabs Email Security System.
>>> For more information please visit
>>> http://www.messagelabs.com/email
>>> ______________________________________________________________________
>>>
>>> _______________________________________________
>>> Mip6 mailing list
>>> [email-masked]
>>> https://www1.ietf.org/mailman/listinfo/mip6
>>>
>>>       
>> _______________________________________________
>> Mip6 mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/mip6
>>     

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: <[email-masked]>
Date: Wed, 5 Sep 2007 08:31:47 +0200

Hmm.. lets clarify what my "yes" was supposed to mean. An operator
needs to have a way to indicate to a HA per subscriber basis whether
a RO procedure is enabled / disabled (in the HA). This information
can be conveyed e.g. in the current dime-split draft using the
MIP6-Feature-Vector AVP. IMO this is more a policy decision than an
authorization.

Cheers,
	Jouni

________________________________

	From: Behcet Sarikaya [mailto:[email-masked]] 
	Sent: Tuesday, September 04, 2007 10:55 PM
	To: Hannes Tschofenig
	Cc: Mobile IPv6 Mailing List; [email-masked]
	Subject: Re: [Dime] Re: [Mip6] Diameter Mobile IPv6
Bootstrapping: AuthorizingRoute Optimization

	I like Jouni's idea of making RO authorization part of the
subscriber profile. I think such a thing fits better into the (AAA)
managed network model. Defining an AVP probably is not necessary.
	
	Regards,
	
	Behcet

	----- Original Message ----
	From: Hannes Tschofenig <[email-masked]>
	To: Basavaraj Patil <[email-masked]>
	Cc: Mobile IPv6 Mailing List <[email-masked]>; [email-masked]
	Sent: Tuesday, September 4, 2007 2:34:20 PM
	Subject: [Dime] Re: [Mip6] Diameter Mobile IPv6 Bootstrapping:

	Hi Raj,
	
	you raise a good point. There is no doubt that a network
operator can 
	prevent all end hosts from using the RO procedure.
	
	The main question therefore is whether the RO procedure has to
enabled / 
	disabled on a per user basis.
	
	Ciao
	Hannes