Subject: [DMM] AERO and Mobile IP comparison

From: "Templin, Fred L" <[email-masked]>
Date: Tue, 7 Oct 2014 18:08:39 +0000

Hi,

During the call today, there was interest expressed in having a discussion on the
differences between AERO and Mobile IP. In the interest of getting the discussion
going, I will just say the following for now:

- the mobility archetype for Mobile IP is that of a mobile host that wanders away from
  its home link and tells a home agent on its home link where it has moved to

- the mobility archetype for AERO is that of a mobile router that stays connected to its
  home link even if it changes between access link technologies

The latter model is supported through the abstraction of an NBMA tunnel virtual
link that spans the mobile node's home network. IMHO, it is a cleaner and more
natural architecture that makes everything else easier.

Comments? Questions?

Thanks - Fred
[email-masked]

---

From: Charlie Perkins <[email-masked]>
Date: Tue, 07 Oct 2014 11:15:45 -0700

Hello Fred,

One comment:

>    home link even if it changes between access link technologies

This implies local-only mobility, right?

If so, then I guess from your other description that "local" is
engineered to be huge.  But more to the point it puts AERO
pretty much in direct competition with PMIP -- or, perhaps
PMIP with LMAs stitched together by way of BGP.

Regards,
Charlie P.

---

From: "Templin, Fred L" <[email-masked]>
Date: Tue, 7 Oct 2014 18:39:45 +0000

Hi Charlie,

> -----Original Message-----
> From: Charlie Perkins [mailto:[email-masked]]
> Sent: Tuesday, October 07, 2014 11:16 AM
> To: Templin, Fred L; [email-masked]
> Subject: Re: [DMM] AERO and Mobile IP comparison
> 
> 
> Hello Fred,
> 
> One comment:
> 

Not just local, but global also. Take for example an AERO mobile router that is connecting
over an access link provided by some ISP other than its home network. In that case, the
node typically remains connected to its home link by setting up a VPN connection via a
security gateway connected to its home network. In that case, the AERO link is said to
be extended *through* the security gateway. So, the AERO mobile router remains
tethered to its home link via the VPN, but  it can set up route optimization with Internet
correspondents in a manner similar to MIPv6. In that case, communications with the
Internet correspondent can bypass the home network.

> engineered to be huge.

AERO has been evolving for the better part of a decade really, but in recent years it
has been specifically focused on enterprise network mobility where the enterprise
network that services my employer has been used as the reference model. In such
cases, the AERO virtual link is indeed huge.

> But more to the point it puts AERO

I have to admit that PMIP comparison was an after-thought that only went into the
AERO spec very recently. Yes, AERO can be applied in the same use cases as for
PMIP, but in the enterprise mobility case the AERO Client itself is the mobile router
and runs a small piece of application layer code to do the tunneling and control
messaging. In our enterprise, for example, mobile nodes can start out attached
to a wired LAN connection, then change over to WiFi, then change over to 4G,
etc. See my "day in the life" message from several weeks ago:

http://www.ietf.org/mail-archive/web/dmm/current/msg01464.html

In fact, I see PMIP as a very specialized solution for cellular operator networks.
There are vastly many other use cases where having the mobile node do the
tunneling on its own behalf is necessary. AERO supports either model.

Thanks - Fred

---

From: Charlie Perkins <[email-masked]>
Date: Tue, 07 Oct 2014 13:25:13 -0700

Hello Fred,

A few little follow-up questions...

On 10/7/2014 11:39 AM, Templin, Fred L wrote:
>> ...

- Is the VPN setup part of AERO?
- How does the mobile router know whether or not to do this?
- Why would the external AERO servers admit traffic from the AERO client?
     Or, is AERO completely out of the picture for external networks?
- Is the route optimization simply a matter of VPN to the correspondent 
node?
     Or, did you mean to suggest use of the MIPv6 mechanisms?

Regards,
Charlie P.

---

From: "Templin, Fred L" <[email-masked]>
Date: Tue, 7 Oct 2014 21:20:09 +0000

Hi Charlie,

> Sent: Tuesday, October 07, 2014 1:25 PM

The AERO Client requests a DHCPv6 Prefix Delegation as part of the VPN setup. The
security gateway (acting as an AERO Server) delegates the prefix and sets up a
neighbor cache entry for the Client.

> - How does the mobile router know whether or not to do this?

The AERO Client needs to know whether it is connecting to an access link provided by
the home network or by an ISP outside of the home network. One way of doing this is
to examine the connection-specific DNS suffix the Client gets when it connects to the
access link and comparing it to the home network DNS suffix.

When I think about my laptop computer user experience, I have to perform a manual
intervention to select a security gateway and set up the VPN when I am connecting via
an Internet access link. That would be OK and compatible with AERO as well, but would
be much better if it were automated. Whether it can be fully automated depends on
what kind of security credentials are necessary to establish the VPN, e.g., whether
certificates alone are sufficient or whether some kind of active badge needs to be
swiped, etc. Do you know more about this?

> - Why would the external AERO servers admit traffic from the AERO client?

The external AERO Servers are security gateways that also delegate AERO Client
Prefixes (ACPs) to Clients using DHCPv6 PD. During PD, the Server performs an
additional layer of authentication for the Client above and beyond what is done
for establishing the VPN. So, the Server has a way of knowing that the Client is
permitted to source packets from the delegated ACP.

>      Or, is AERO completely out of the picture for external networks?

External networks as in something that does not have hard perimeters with
security gateways - maybe like a university campus network? I'll have to think
more about that, but in that case there may need to be some other trust basis
besides source address verification and IPsec tunnels. Any ideas?

> - Is the route optimization simply a matter of VPN to the correspondent

VPN to the correspondent node (triggered by AERO mechanisms) is certainly
a use case that we don't want to rule out.

>      Or, did you mean to suggest use of the MIPv6 mechanisms?

For communications with correspondents that do not require IPsec protection,
the mechanism is the same as the MIPv6 Return Routability, only using IPv6
ND messaging for signaling. Otherwise, I just studied the RR procedure in
RFC6275 and pretty much borrowed what I saw there for AERO.

Thanks - Fred