Subject: RE: [AAA-WG]: AAA for IPv6

From: [email-masked]
Date: Tue, 21 Aug 2001 16:52:52 +0300

Thomas,

The WG chairs may correct me if I misunderstood, but at the last AAA WG
meeting it was evident that even work clearly on the current charter, like
Mobile IPv6 Application (extension), do not get taken up by the WG. At least
not before the current work is finished, and maybe the WG is re-chartered
etc. So it seems hopeless to even think about work on areas outside, or
bordering the current charter.

I think the URP WG should be chartered ASAP and AAAv6 taken there as a
possible solution. Where can I find the current proposal for the URP
charter?

With regards,

	Jarno

> -----Original Message-----
> From: ext Thomas Eklund [mailto:[email-masked]]
> Sent: 21. elokuuta 2001 15:23
> To: 'George Tsirtsis'; 'Bernard Aboba'; Charlie Perkins
> Cc: [email-masked]; [email-masked]; 
> [email-masked];
> [email-masked]
> Subject: RE: [AAA-WG]: AAA for IPv6
> 
> 
> Dear George,
> What you are suggesting is already done in the draft.
>  
> It proposes two mechanism to do access control for IPv6 
> where, one way of
> doing it is a stateful approach is based on ND and the other 
> is to do it in
> the stateful approach with DHCPv6.
> 
> Instead of people bouncing back and forth I belive that the 
> correct WG now
> is the AAA WG.
> 
> -- thomas
> 
> >-----Original Message-----
> >From: George Tsirtsis [mailto:[email-masked]]
> >Sent: den 21 augusti 2001 14:07
> >To: 'Bernard Aboba'; Charlie Perkins
> >Cc: [email-masked]; [email-masked]; 
> >[email-masked];
> >[email-masked]
> >Subject: RE: [AAA-WG]: AAA for IPv6
> >
> >
> >It seams to me that the subject of "AAA for IPv6" has at least two
> >components that may potentially belong to different WGs. One is the
> >communication between the end node and the access router and 
> >the other is
> >the communication between the AAA client in the Access Router 
> >and the rest
> >of the AAA infrastructure. 
> >
> >The latter is all about IPv6 support in the AAA protocol 
> >(Radius, diameter,
> >cops)...and thus belongs to the AAA/COPS WGs...
> >
> >The former is about challenging the end node and transporting the
> >identification and authentication parameters over the access 
> >link. This is
> >not part of the AAA protocol (e.g.: typically Radius does not 
> >run over the
> >access link). What is needed is a "carrier" mechanism for the 
> >parameters
> >that need to be fed to the AAA protocol. PPPv6 for example 
> >provides such a
> >carrier. MIPv4 also provides such a carrier to IPv4 nodes that 
> >use Mobile IP
> >but, MIPv6, due to the lack of FAs, does not provide such an obvious
> >carrier...hence Charlie's work. Now, there are a couple of 
> >things that can
> >be done IMO.
> >
> >1. Use Neighbor Discovery (ND) as a carrier for the AAA 
> >parameters. e.g.:
> >extend Neighbor Advertisements and Router Advertisements to carry
> >challenge/response messages....this to me is the job of IPv6 
> >WG and could be
> >the start of a much bigger fish called authenticated ND or
> >
> >2. Create a new carrier, independent from ND and with the 
> >specific task of
> >carrying the appropriate challenge/response parameters...this 
> >to me belongs
> >to URP WG.
> >
> >...my two drachma
> >
> >Regards
> >George
> >-----Original Message-----
> >From: Bernard Aboba [mailto:[email-masked]]
> >Sent: Tuesday, August 21, 2001 8:06 AM
> >To: Charlie Perkins
> >Cc: [email-masked]; [email-masked]; 
> >[email-masked];
> >[email-masked]
> >Subject: Re: [AAA-WG]: AAA for IPv6
> >
> >
> >The AAA WG only considers work items resulting from a consensus draft
> >within a subject area WG. Until the IPNG or URP WG progresses 
> >a draft on
> >the subject, we cannot consider a work item relating to AAA 
> for IPV6. 
> >
> >--------------------------------------------------------------------
> >IETF IPng Working Group Mailing List
> >IPng Home Page:                      http://playground.sun.com/ipng
> >FTP archive:                      ftp://playground.sun.com/pub/ipng
> >Direct all administrative requests to [email-masked]
> >--------------------------------------------------------------------
> >
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
>

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 21 Aug 2001 10:48:59 -0700 (PDT)

> bordering the current charter.

The AAA WG requires that subject area WGs come to consensus before
considering a work item. That ensures that the AAA WG is working
cooperatively with other WGs. So if you want to look at MIPv6/AAA, the
first thing to do is to finish MIPv6. If you want to look at URP/AAA, then
you first need to come to consensus on URP. If you want to work on AAAv6,
you've got to get consensus within IPNG WG that this approach makes sense. 
Same with SIP/AAA -- the SIP community needs to come to consensus first. 

This approach has worked well so far with MIPv4, NASREQ and ROAMOPS. Those
WGs investigated their problem spaces, wrote and discussed requirements
documents, and came to consensus. At that point, AAA WG picked up and
responded to their requirements. 

Having an architectural framework and problem statement agreed to
beforehand makes the AAA work straightforward and easy to deal
with. Where the relevant communities are willing and able to do the
required work to think through the architectural issues, and develop a
framework that is the solution to a real problem, I suspect that the 
AAA issues will sort themselves out naturally, and AAA WG
will not be a bottleneck. 

> possible solution. Where can I find the current proposal for the URP

Just as the AAA WG is not the appropriate place to do the work of subject
area WGs, it is not appropriate for subject area WGs to design AAA
protocols. We have separate WGs so that subject matter experts can
congregate and focus on their area of expertise. So it would be best for
URP to be handled in URP WG,  AAA in AAA WG, and IPv6 in IPNG WG.