Subject: Re: [AAA-WG]: Issue 211: When should Destination-Host be present in HAR?

From: Pat Calhoun <[email-masked]>
Date: Sun, 4 Nov 2001 11:59:47 -0800

Comments below.

PatC
On Tue, Oct 30, 2001 at 10:37:16AM -0500, Bob Kopacz wrote:
> Hi Pat,
> 
> The question that prompted this issue was:
> 
> Q1: When first setting up the mobile node's session, if the AAAF has
> offered to allocate a HA in the foreign domain and the AAAH has accepted
> the AAAF's offer, does the AAAH need to send the HAR to the specific AAAF
> which forwarded the AMR, or can the HAR be receive by any old AAA server 
> in the foreign network?  The draft is unclear.
> 
> From the text and diagrams in the mobile-ip draft, it appears that the
> AAAH targets the HAR to the specific AAAF which forwarded the AMR.  All
> diagrams show the the HAR going to the AAAF which sent the AMR, and the
> text contains phrases like:    
> 
>    "... the AAAH sends the HAR message to *the* AAAF ..."
> 
> But based on our bakeoff conversations, my understanding now is that the
> HAR could be sent to any AAA server in the foreign realm, not
> necessarily the one that sent the AMR.  So this initial HAR would
> contain a Destination-Realm and not a Destination-Host.
> 
> Anyway, whichever way is correct, it would be good to clarify the draft,
> as follows (in section 1.4):
> 
> "If the HA hasn't yet been allocated by the foreign domain, the HAR sent
> by the AAAH back to the foreign realm will not necessarily be received
> by the same AAAF which sent the AMR."
> 
> or if the above is not true:
> 
> "If the HA hasn't yet been allocated by the foreign domain, the HAR sent
> by the AAAH back to the foreign realm is sent to the same AAAF which
> sent the AMR.  The AAAH must set the value of the HAR's Destination-Host
> AVP to the AAAF's DiameterIdentity.  The AAAH determines the AAAF's
> DiameterIdentity as follows: If there are two or more Route-Record AVPs
> in the AMR, the 2nd Route-Record AVP contains the AAAF's
> DiameterIdentity (the 1st Route-Record contains the FA's identity). If
> there are fewer than 2 Route-Record AVPs, then the peer which sent the
> AMR to the AAAH is the AAAF."

Well, I'm not sure where the confusion resides. Figure 7 (and associated
text) is pretty clear about where the message is forwarded.

> Also, two more questions, 
> 
> If this HAR is received and processed by an AAAF2 other than the AAAF1
> which sent the AMR:
> 
> Q2: If AAAF1 has offered to allocate an HA in the foreign network, how
> does he know that AAAF2 can make good on this offer?  AAAF2 may not have
> any HAs to talk to.

As the text states, this only occurs when the HA was already assigned in
the previous foreign agent. The drafts do not discuss a home agent to be
allocated in an arbitrary third network. It is either in the home, or the
foreign net. However, once assigned the HA is static.

> Q3: If AAAF1 has offered to allocated a HA in the foreign network, he
> sends his candiate HA in the new "Candidate-Home-Agent-Host" AVP (issue
> #223).  The AAAH's HAR then needs to convey this candidate HA to AAAF2,
> and AAAF2 must be able to route to this HA.

Huh? There appears to be confusion on how allocation works. AAAF1 would 
insert a candidate home agent in its own network. Why would AAAF2 ever be
involved here?

Look at figure 7 for more info.

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 4 Nov 2001 12:00:42 -0800

Modified the last sentence in section 1.4 to make this clearer.

Comments appreciated,

PatC
----

When the AAAH receives a AMR message, it first checks the authentication
data supplied by the mobile node, according to the MIP-Reg-Request AVP and
MIP-MN-AAA-Auth AVP, and determines whether to authorize the mobile node.
If the AMR indicates that the AAAF has offered to allocate a home agent
for the mobile node, then the AAAH must decide whether its local policy
would allow the user to have a Home Agent in the foreign network.
If so, and after checking authorization from the data in the AMR
message, the AAAH sends the HAR message to the AAAF that does not
contain the MIP-Home-Agent-Address, but includes the Destination-Host AVP
set to the value of the AMR's MIP-Candidate-Home-Agent-Host AVP.

---

From: "Bob Kopacz" <[email-masked]>
Date: Tue, 6 Nov 2001 16:12:29 -0500

Hi Pat,

> From: [email-masked] on behalf of Pat Calhoun
> Sent: Sunday, November 04, 2001 3:00 PM
> To: Bob Kopacz
> Cc: Pat Calhoun; [email-masked]
> Subject: Re: [AAA-WG]: Issue 211: When should Destination-Host be
> present in HAR?
>
> Comments below.
>
> PatC
>
> > which forwarded the AMR, or can the HAR be received by any old AAA server

I think I've been misunderstood here.  I'm not referring to Figure 7.
I'm referring to the case associated with Figure 5, where there is only
one foreign network.  Here's Figure 5:

                 Visited                           Home
                  Realm                           Realm
                +--------+ ------- AMR -------> +--------+
                |  AAAF  | <------ HAR -------- |  AAAH  |
                |        |                      |        |
           +--->| server | ------- HAA -------> | server |
           |    +--------+ <------ AMA -------- +--------+
           |         ^  |
           |         |  |
   HAR/HAA |     AMR |  | AMA
           v         |  v
   +---------+       +---------+
   |   Home  |       | Foreign |
   |  Agent  |       |  Agent  |
   +---------+       +---------+
                             ^
        +--------+           |
        | Mobile |<----------+
        | Node   |  Mobile IP
        +--------+
    Figure 5: Home Agent allocated in Visited Realm

What I was trying to say was that Figure 5, and the text associated with
Figure 5, make it appear that there is only _one_ AAAF involved, and
that the AAAF that sends the AMR is the very same AAAF that receives the
HAR and talks to the HA.  If the following diagram is the general case,
and the above is a special case, then I was asking that either a diagram
or at least some text say so (AAAF1 and AAAF2 are different AAA servers
in the same foreign realm).  I've offered some candidate text above.

                Visited
                 Realm
               +--------+
               |  AAAF2 | <------ HAR --------------+
               |        |                           |
          +--->| server | ------- HAA ----------+   |
          |    +--------+                       |   |
          |                                     |   |
          |                                     |   |
  HAR/HAA |                                     |   |
          v                                     |   |
  +---------+                                   |   |
  |   Home  |                                   |   |
  |  Agent  |                                   |   |
  +---------+                                   |   |
                                                v   |
                Visited                           Home
                 Realm                           Realm
               +--------+ ------- AMR -------> +--------+
               |  AAAF1 |                      |  AAAH  |
               |        |                      |        |
               | server |                      | server |
               +--------+ <------ AMA -------- +--------+
                    ^  |
                    |  |
                AMR |  | AMA
                    |  v
                    +---------+
                    | Foreign |
                    |  Agent  |
                    +---------+
                            ^
       +--------+           |
       | Mobile |<----------+
       | Node   |  Mobile IP
       +--------+

> Look at figure 7 for more info.

Bob K.

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 12 Nov 2001 07:34:57 -0800

Finally getting around to trying to close this baby. Comments below.

> > > AMR to the AAAH is the AAAF."

Since it is possible that a broker sits between the AAAF and the AAAH, we
cannot dictate to which AAAF the HAR will be sent. Doing so would require
the use of the Destination-NAI, but this AVP actually contains the identity
of the HA, not the AAAF.

So, the first paragraph would be more appropriate.

>            |    +--------+ <------ AMA -------- +--------+
ok, got it. However, this figure is pretty big. Can we include the text you
proposed above, and just leave figure 5 as is? Or are you asking that figure
5 be revised?

Thanks,

PatC

---

From: "Bob Kopacz" <[email-masked]>
Date: Mon, 12 Nov 2001 10:23:23 -0500

Hi Pat,

----- Original Message ----- 
From: "Pat Calhoun" <[email-masked]>
To: "Bob Kopacz" <[email-masked]>
Cc: "Pat Calhoun" <[email-masked]>; <[email-masked]>
Sent: Monday, November 12, 2001 10:34 AM
Subject: Re: [AAA-WG]: Issue 211: When should Destination-Host be present in HAR?

> So, the first paragraph would be more appropriate.
 
This is fine with me.  All I wanted was to make it clear that there
may be more than one AAAF involved.

> proposed above, and just leave figure 5 as is? Or are you asking that figure

Leaving Figure 5 as-is is ok with me.  The above picture was just my
long-winded way of trying to explain the situation.  Just the addition
of a sentence indicating there may be a 2nd AAAF is plenty good enough.