Subject: RE: [Dime] ASA == MSA: Is it the same Server?

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Wed, 23 Aug 2006 10:18:08 -0400

Gerardo,

What you describe is a possibility i.e. the AAA server that hands out
the HA info to the MN (via the NAS) is different from the one that is
doing EAP auth for IKE_Auth at the HA for mobility access.

The point we are trying to clarify here is, the AAA server (ASA) that
hands out HA address to the MN (via the NAS), does it have to know
whether it is authorizing the MN for MIP6 service? This will need the
NAS to include a hint to the AAA server via App-ID or NAS-port to
indicate that the MN intends to start a MIP6 service. The question is
how does the NAS know whether the MN wants to start MIP6? At the time of
access auth at the NAS there is no such indication from the MN. So, the
more fundamental question is, regardless of which way we go i.e. APP-ID
or NAS-port, how the NAS know that the MN is going to start a MIP6
session?

-Kuntal

> -----Original Message-----
> From: Gerardo Giaretta [mailto:[email-masked]]
> Sent: Tuesday, August 22, 2006 2:22 AM
> To: Hannes Tschofenig
> Cc: Chowdhury, Kuntal; [email-masked]
> Subject: Re: [Dime] ASA == MSA: Is it the same Server?
> 
> Hi Kuntal and Hannes,
> 
> > > [KC>] In case of split scenario, I see the use case where the AAA
> > > transaction for network access at the NAS is going to a different
AAA
> > > server than the same at the HA, since ASA != MSA in split.
> >
> > In this case the identities are different though. You cannot use the
> > same identity to hit two different domains.
> > Hence, there is no problem as such.
> >
> >   In case of
> > > integrated scenario, it is essential that the AAA transactions
from
> the
> > > NAS and from the HA get routed to the same AAA server (ASA ==
MSA). So
> > > we need to keep this in mind.
> >
> > Here is the question whether they are indeed the same server. Some
folks
> > they argue that it is not the same one
> >
> 
> Some background: the integrated scenario was defined during the
> bootstrapping DT discussion because some proposed solutions were
> applicable only in the case the entity that authenticates the user for
> network access is the same entity that authenticate the user for
> mobility service. In my view, the initial assumption was that the same
> AAA server authenticates the user for both services, since during the
> authentication for network access some MIP6 related information are
> sent to the NAS.
> 
> However, in a AAA stateless architecture, it would be possible to have
> also different AAA servers; I guess in this case the solution for
> integrated scenario would still work: the first AAA server (that
> authenticates the user for network access) sends the MIP6-related
> information to the NAS, and the second AAA server (that authenticates
> the user for mobility service) just terminates the EAP exchange
> carried on IKEv2 between MN and HA.
> 
> Therefore, I think the servers may be different, but the AAA
> infrastructure/business entity is the same. Am I missing something?
> 
> > >>From the AAA message routing point of view, I thought the @realm
part
> of
> > > the username (NAI) was sufficient to route AAA messages to
different
> AAA
> > > systems.
> >
> > IMHO, for the ASA != MSA scenario it is.
> >
> 
> agree for the split scenario.
> 
> --Gerardo
> 
> > Ciao
> > Hannes
> >
> > _______________________________________________
> > DiME mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/dime
> >

"This email message and any attachments are confidential information of Starent Networks, Corp. The information transmitted may not be used to create or change any contractual obligations of Starent Networks, Corp.  Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this e-mail and its attachments by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify the sender immediately -- by replying to this message or by sending an email to [email-masked] -- and destroy all copies of this message and any attachments without reading or disclosing their contents. Thank you."

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 23 Aug 2006 16:27:32 +0200

Hi kuntal,

On Wed, Aug 23, 2006 at 10:18:08AM -0400, Chowdhury, Kuntal wrote:
> whether it is authorizing the MN for MIP6 service? 

 this is not the point I try to clarify :)
 For what you describe, I don't think that the ASA has to authorize the
 mip6 service at this point of time. It just provide the HA info.

 The MSA authorize the mip6 service when the MN uses IKEv2 with the HA.

 Maybe I miss something.

 regards,

 Julien

> This will need the

-- 
julien.bournelle at int-evry.fr