Subject: Re: [MOBILE-IP] MIPv6 node location detection

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Sat, 14 Oct 2000 00:48:35 +1100

Sorry forgot to cc IPng

> -----Original Message-----
> From: Hesham Soliman (EPA) [SMTP:[email-masked]]
> Sent: Saturday, 14 October 2000 12:42
> To:   [email-masked]
> Subject:      Re: [MOBILE-IP] MIPv6 node location detection
>
> > What is the difference between two advertisement below ?
> >       - Renumbered home link router advertisement
> >       - Router advertisement in a foreign link
> >
> > My question is why the mobile node don't just add the new address
> > in MN's address list. How do the MN decide whether it start MIPv6
> > process or autoconfiguration process for renumbered home link address.
> > What if the all home addresses in the list have expired before the MN
> > get FA's router advertisement, can the MN still use the expired address
> > record
> > in it's system ?
> >
>         => I think you're certainly asking the right question but
>         perhaps to the wrong mailing list :)
>         If I understand you correctly, you're saying that while the
>         MN is at Home, if a new advertisement is received with a new
>         prefix, how does it know that this is not another foreign subnet.
>         Well based on my rusty knowledge  of ND and stateless address
>         configuration, it doesnt know. But I don't think that this is
> strictly
>         a MIP issue. While you're at home MIP does not do anything
>         for  you. So that's why I'll cc IPng on this to see if someone can
>         give you a better answer, or maybe I missed something here.
>         BTW FA's do not exist in MIPv6.
>
>
>
>
>
> > I also can't find RFC or draft which define exactly address list in a
> > MIPv6 MN. A IPv6 node have a address list and  every prefix has
> lifetime.
> > Please give me some advice on it.
> >
> >
> >

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Sat, 14 Oct 2000 14:54:06 +1100

Hi Fred
> I am not the most knowledgeable on the subject, and my betters may correct
> me. But I would think this has to be answered in the exchange with the
> Home
> Agent.
>
> First, the Mobile Node has a number of limitations on its knowledge. It
> doesn't know its own prefix beyond what it received in a router
> advertisement, for example - if the router advertisement has changed
> prefix, that may well mean that the device has changed subnet within its
> home domain and should just use that address, or as you suggest, it may
> mean that somebody is renumbering the network. Since it doesn't know the
> site prefix, it cannot distinguish between the home domain (which is
> larger
> than the prefix for a particular subnet) and a foreign domain.
>
> It also has a responsibility. It must keep the Home Agent apprised both of
> its own current address and its current care-of address. So if its address
> changes, or if a new address is added to its list on some interface, it is
> going to have to advise the Home Agent of that.
>
> It is from the Home Agent's response that it will determine what's
> happening. If the Home Agent expresses the opinion that it needs to use
> the
> COA, it probably does, and if the Home Agent thinks its address is just
> fine...
>
> Now, I haven't read the latest specifications to tell you how the Home
> Agent expresses that. But I think it is in that context that the
> information is going to have to be derived and communicated.
>
        => Well according to my memory there is no such expression
        from the HA. Of course if the MN receives the new router
        advertisement from the HA (router on the link), then it will
        know that the default router is still the same and that there is
        no need to move. But that is not a fault proof solution because
        the link-local address may be duplicated between links.

        Another way of looking at it is that the "new" Ruter advertisement
        should inform hosts that this subnet is "being renumbered".
        I think this is a clean option. I don't think this should be a MIP
        issue. MIPv6 solves the problem when the MN is away from
        home, which is when MIPv6 is espected to solve it.
        I would suggest that this is a ND-MIP interaction issue.

        Hesham

> At 10:37 AM 10/12/00 +0900, SungJin Lee wrote:
> >I got confisued while i was reading MIPv6 standards and
> >have a couple of question with cases like following. The
> >It is assumed that the MIPv6 node use stateless autoconfiguration.
> >Let me know if I lost some in MIPv6 and IPv6 RFC.
> >
> >Q.1    A MIPv6 node moved to foreign link. The MIPv6 node restarts
> >        the system there and receives  router advertisements with
> >        foreign network prefix.
> >
> >        How do the MIPv6 node detect if it is located in foreign link?
> >        isn't it could be normal autoconfiguration as in the home llink?
> >
> >Q.2    A MIPv6 node located in it's home link. The node got an IP address
> >        with stateless autoconfiguration. At a time the router changed
> the
> > home link
> >        prefix and multicast the router advertisement with new prefix.
> >        After the home link prefix ifetime expired or before the life
> time
> >        expired, it received router advertisement with new prefix.
> >
> >        Why doesn't the IPv6 node think it's located in foreign link when
> it
> >        received? isn't it possible the IPv6 node to think it's moved to
> a
> > foreign
> >        link and start MIPv6 process?

---

From: Fred Baker <[email-masked]>
Date: Tue, 17 Oct 2000 06:51:14 -0700

At 05:28 PM 10/15/00 -0700, Brian Zill wrote:
>I think there's a better solution.  Have mobile nodes attempt to treat every
>home agent they encounter as their home agent.  A mobile node should only be
>able to successfully do so if the home agent actually is its home agent.

There is something to be said for that, apart from policy. I suspect there
is actually a mutual authorization thing going on - I may be willing to be
your home agent, but you may prefer another, and you may be willing for me
to be your home agent, but I think you don't pay your bills. Reality is
that we both have to be willing. We can't determine that unless we ask the
question.

So if we moderate the statement to "have mobile nodes attempt to treat
every home agent that they accept by policy as their home agent", then the
intersection will be determined by the home agent.

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Tue, 17 Oct 2000 14:33:35 +1100

> > > > Another way of looking at it is that the "new"
> > > > Ruter advertisement should inform hosts that
> > > > this subnet is "being renumbered".  I think
> > > > this is a clean option. I don't think this
> > > > should be a MIP issue. MIPv6 solves the problem
> > > > when the MN is away from home, which is when
> > > > MIPv6 is espected to solve it. I would suggest
> > > > that this is a ND-MIP interaction issue.
> >
> > I don't think this is a general enough solution.  In the common case, an
> > administrator would renumber by adding the new prefix and marking the
> old
> > prefix to time-out.  A mobile node that returns home during the time-out
> > delta could probably surmise that a renumbering was going on without
> needing
> > an extra bit in the router advertisement.  Yes, the extra bit could
> serve to
> > aid those mobile nodes that don't come home until after the old prefix
> has
> > expired, but how long does the router continue to advertise the "being
> > renumbered" bit?  At some point the administrator has to claim that the
> > "being renumbered" state has finished, confusing any mobile nodes that
> don't
> > return home until after that.  And if some administrators never get
> around
> > to turning the bit off, you'll have some networks in a state of
> perpetual
> > renumberment.
> >
> I agree here - if you're going to keep your network in a "being
> renumbered" state, why not just continue to advertise the old prefix as
> on-link, but with 0 valid lifetime.  This would make it clear to any node
> returning to the home network that something has changed.  Also, given
> just a renumbered bit set in the RA, how does a MN tell its renumbered
> home network from a renumbered foreign network?
>
        =>

> > Note that there has to be some sort of security authorization between
> the
> > mobile node and the home agent or bad people visiting your link could
> steal
> > one of your addresses (such authorization is required for the mobile
> node to
> > securely update the home agent as to what its care-of-address is, so the
> > authorization capability must exist).  In other words, if you pass
> security,
> > you're at home (or one of your homes, at any rate).  Now the MIPv6 draft
> is
> > a little weak regarding how this authorization should be done, but I
> think
> > that's a problem for the mobile ip working group.
> >
> > --Brian
> >
> This has me a bit confused - I thought the role of IPsec was just to
> verify that the Binding Update's source could be authenticated as the true
> owner of the home address, and that allowing the node to make a home
> registration was based on 1. whether the HA considers the home address
> on-link and 2. additional policy.
>
> In a nutshell, I think some MN and HA could have security associations
> satisfying all of the requirements for mobility, but this does not mean
> that the HA is providing services for the MN's home network.
>
>
> -------------------------------------------------------------------
> John Leser                      UNH InterOperability Lab
> IP/Routing Consortium Engineer  Morse Hall, 39 College Rd, Room 332
> Tel: (603) 862-0090 (8-5 EST)   Durham, NH 03824-3525
> Fax: (603) 862-1761             Web: www.iol.unh.edu
> -------------------------------------------------------------------

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Tue, 17 Oct 2000 14:37:10 +1100

Sorry about the last mail, a bit eager on the
send button :)

> home network from a renumbered foreign network?
        => That's fine with me too. As long as there is some
        indication that the network has been renumbered and
        as long as it is done outside MIPv6 ;)
        I don't think it's a MIPv6 problem if it is done while
        you're at home.

> that the HA is providing services for the MN's home network.
        => The security required for MIPv6 signalling is
        already there in the draft.

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Tue, 17 Oct 2000 20:36:16 +1100

> I came up with the answer to your question. It takes some work, but it's
> there. Review draft-ietf-mobileip-ipv6-12.txt
>
> One the router advertisements (sections 4.1, 5.6, 5.7, etc), the routers
> tell you whether they are willing to be a home agent and/or a foreign
> agent. If no neighboring system is willing to be your home agent but there
>
> is a foreign agent, you are roaming. If there is someone willing to be a
> home agent but you cannot authenticate with him, your previous home agent
> remains your home agent, and you are roaming. If someone advertises that
> he
> will be your home agent and you can authenticate with him, you are at
> home.
>
        => I'm not sure if I understand what you mean by the foreign agent.
        Perhaps you have another entity in mind ? Because the current MIPv6
        draft does not have foreign agents.

> The one thing that bothered me as I read this was an implicit assumption,
> perhaps on my part and perhaps on the author's part, that the device has
> to
> somehow come in contact with its home agent as a neighboring device once
> in
> a while. I can think of a number of scenarios in which this may not be
> true
> - imagine a case where you have a telephone mailed to you on the road
> because the old one broke. You certainly want to be able to tell the new
> phone the old phone's information and have it stick. Or imagine a device
> which is permanently roaming - it never actually is at home. You would
> want
> to configure a home agent address somehow. I trust that in these cases the
>
> protocol is not required.
>
        => You never need to configure a Home Agent address. The
        current draft specifies a Dynamic Home Agent Discovery mechanism.
        All you need to configure is a Home Address.
        I believe MIPv6 can support the scenario you mentioned provided
        the MN knows its Home Address. Which is a reasonable assumption
        IMO.

---

From: Haseeb Akhtar <[email-masked]>
Date: Tue, 17 Oct 2000 07:38:59 -0500

Fred,

I would agree with you on the objective and portions of the solution. At
least, the part about having an Anycast address for HA discovery. This would
specially be useful for the IPv6 model where there is no FA.

Haseeb

> From: Fred Baker [SMTP:[email-masked]]
> Sent: Tuesday, October 17, 2000 7:01 PM
> I got this privately, and Michael is willing to take this discussion
> public.
>
> At 08:59 AM 10/16/00 -0700, Michael Thomas wrote:
> >My general feeling is that for most wireless devices there is no reason
> >why the mobile would _ever_ be directly attached to its home subnet
> >router. The reason is pretty straightforward: I want my HA to be a fast
> >router on housed on a fast network. I definitely do _not_ want it housed
> >on my true home network because then I'd have to deal with triangular
> >routing through krufty and slow cable/dsl, not to mention not wanting to
> >book qos through a last mile technology. The casual security problem will
> >still be as much a problem in wireless as it is today. Namely, it will be
> >the exception, not the rule.
>
> There are a couple of points to consider here. One is that I tend to think
> a lot of the discussion in Mobile IP is oriented around radio networks,
> and
> it's not in the least obvious to me that radio networks are the only use
> of
> it. I'm looking at it for quite another use that could use radios as the
> last mile, but requires no radios at all, and runs on a pretty large
> scale.
> So there is a trap we could fall into here that is somewhat worrisome.
>
> Another is largely as Michael says - we want the Home Agent to be
> somewhere
> with enough capacity for huge numbers of things to use it. The "optimized"
> routing helps MIP scale quite a bit, which is an important commercial
> step.
> Making the home agents be in routers off in crufty corners of our
> corporate
> attics (the non-radio case) defeats a lot of that. In such cases, we will
> want something more central.
>
> I looked through the Hierarchical Mobility draft, and it seems to have the
> right mix of things - although I have to say it is more a marketing
> statement about the technology ("it is wonderful and Ericcson is applying
> for a patent") than a statement about how to do it beyond the need for
> another bit; we need quite a bit on the routing aspects of the technology.
> But I think there is a simpler approach that scales more nicely.
>
> In DHCP, there is an assumption that there is a DHCP listener on every
> LAN.
> That isn't even close to reality, so in routers there is often a feature
> called a DHCP Helper; it receives the DHCP message and forwards it to an
> appropriate DHCP server. I submit that having a Home Agent Helper - a
> process which picks up messages sent to the home agent anycast address and
> tunnels them to somewhere more central - gives you the right mix of
> scaling
> properties and the ability to site home agents appropriately.
>
> Similarly, if a mobile access helper anycast address existed, the local
> router could either be that system, or could tunnel messages to it. If
> could advise the mobile device of its presence and willingness to act as a
> care-of address; the mobile node would give this mobile access point a
> more
> local care-of address, and said MAP would forward messages directed to it
> to that more local COA. The only concern I have with putting the COA
> directly on the mobile device is the need for someone to forward them
> during handoffs, and this would allow for that. It seems like this
> "helper"
> model is not dissimilar to the Hierarchical Mobility model, but simpler.
>
> I can write up a draft if someone is interested to explore that.

---

From: Fred Baker <[email-masked]>
Date: Wed, 18 Oct 2000 07:16:12 -0700

At 08:36 PM 10/17/00 +1100, Hesham Soliman (EPA) wrote:
>Perhaps you have another entity in mind ? Because the current MIPv6  draft
>does not have foreign agents.
And therefore doesn't have a soft hand off option unless one can literally
talk with both routers during the hand off. The Hierarchical Mobility draft
suggests having an external system offer one of its addresses a second
care-of address to provide this; to me, that's a foreign agent in disguise,
and would be useful in that case. Sorry I was quick on the language.

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Wed, 18 Oct 2000 14:25:23 +1100

> talk with both routers during the hand off.
>
        => As far as I'm aware the term "soft handoff" is related to
        certain radio technologies that allow data to be received
        from multiple access points. This in no way implies receiving
        two separate traffic streams. It is an L2 feature that is used
        for handoffs and also as a mechanism for improving the
        received signal quality.

        IMO having foreign agents is not relevant for achieving soft
        handoffs. In fact the soft handoffs concept (as used today)
        is completely transparent to MIP (v4 and v6) or any L3
        function as it happens on L2.

> The Hierarchical Mobility draft
        => No problems. I obviously agree with comment on the
        usefulness of the MAP function.
        We avoided using the term FA in the draft because
        it is associated with the current understanding of FAs in IPv4.
        There certainly are differences.

        - FAs are mandatory on each link in MIPv4. MAPs are not.

        - FAs in MIPv4 perform other tasks like authentication
          which is a AAA function and need not be tied to mobility
          functions.

        -  A MN can choose MAPs in the hierarchy
           based on various information in the MAP option.
           You can't do that with FAs.

        - MAPs can exist on any level of a hierarchy including
          first hop routers and are completely independant from
          each other.

        You can probably see more differences in the draft.

        What we tried to do is go away from the FA concept because
        we don't believe FAs ( as introduced in V4) are needed in IPv6.
        Perhaps some of the functions in FAs can be useful. But it
        seems unnecessary to copy and paste the functionality into IPv6.

        Hesham

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Fri, 20 Oct 2000 16:57:24 +1100

> I thought that the idea was to have the home agent advertise all
> of the "available" prefixes.  If the mobile node is on a link that
> doesn't have a home agent, then it should still be able to listen
> for regular advertisements, but then it doesn't have to worry about
> renumbering its home address.  Whatever strategy is realistic for
> renumbering non-mobile nodes, will also work for mobile nodes
> and their care-of addresses.
>
        => My main concern was that we shouldn't have routers
        advertising with the H bit set and not act as HAs, which is what
        was suggested for the case when the MN is in a foreign network.
        I didn't see a reason for that and it is against the current
standard.

> I don't think there is any problem here.  I thought that the only
> problem was when the mobile node might have been away from
> home for long enough to miss out on some transitional advertisements
> from its home agent.  Is there something else?
>
        => If you mean "if the MN is turned off for a long time ?" then
        I agree. Because the MN can still receive the renumbering
        information from the HA while it's away. Unless I
        misunderstood the renumbering chapter ?

        My understanding is that the HA will take important information
        (like renumbering) out of the advertisements on link and forward
        them to the MN when it's away.
        The only problem I see is if the MN is turned off for a very
        long period of time (does not register with the HA)
        and does not receive this information.

> "Hesham Soliman (EPA)" wrote:
>
> > > On Wed, 18 Oct 2000, Jarno Rajahalme wrote:
> > >
> > > > John F. Leser wrote:
> > > > > - Then, whenever a MN receives an RA with the H bit set, it will
> know
> > > > > with certainty whether that RA came from the current home or
> foreign
> > > > > network, or from some new network, based on whether the prefix of
> the
> > > > > MN's home or current CO address is advertised in the RA. This way,
> > > > > movement onto a new link is detected as soon as any home agent on
> that
> > > > > link sends an advertisement.
> > > > >
> > > >
> > > > What if the MN never receives a RA with the H bit set?
> > >
> > > Then the mobile node falls back on some slower mode of movement
> > > detection.
> > >
> >         => I'm not sure why you're emphasising the 'H' bit.
> >         The H bit is only a flag that means "I'm a HA".
> >         It does NOT mean "I'm YOUR HA". So having said that,
> >         I would say you don't have to worry about having the HA
> >         tell if you're at home or not. You know that from the RA,
> >         whether it comes from your HA or another router.
> >
> > > > I hope you do not assume all links have home agents.
> > > >
> > > Routers could be configured to fill this role while not accepting home
> > > registrations by setting the H bit and inclunding a home agent
> information
> > > option with 0 home agent lifetime (This is currently against spec, but
> > > could be defined to mean 'I have complete prefix information but will
> not
> > > serve as a home agent')  Or, perhapse it would be better/cleaner to
> define
> > > another bit the RA to indicate that this router has the complete
> prefix
> > > list.
> > >
> >         => Why not just advertise the RA ? What is the point
> >         of the H bit ?
> >
> >         I'd like to repeat a comment that was said before.
> >         A MN does not have to move when it has a new
> >         prefix. It has to move when it hears a new prefix
> >         and the old default router disappears.
> >
> >         If you think that it is too slow to probe the old router
> >         then you can move as soon as you hear a new prefix.
> >         This is ok as long as you don't oscillate.
> >
> >         Hesham

---

From: "Powell, Ken" <[email-masked]>
Date: Mon, 30 Oct 2000 17:54:46 -0500

Hi Charlie,

> Hello John,
<snip>
>
> Your suggestion:
>
> > - Require that a home agent's router advertisements always
> contain all
> > of the prefixes on the network that are valid for home or
> CO addresses.
>
> seems to solve the problem with least harm.  I particularly think
> it compares well with another alternative which was suggested,
> according to which the mobile node would have to assume that every
> advertising home agent was its own home agent.  I think the strategy
> above will introduce less traffic on the wireless link.

This will also simplify the requirements in section 9.7 of
draft-ietf-mobileip-ipv6-12.txt. Specifically:

  "The home agent determines these conditions based on its own
   configuration as a router AND BASED ON THE ROUTER ADVERTISEMENTS
   THAT IT RECEIVES ON THE HOME LINK."

The part in caps implies significant extra work on the part of the
mobile agent to track what other routers on the home subnet advertise
and relay that information to the mobile nodes. If you adopt John's
proposal, would it make sense to remove this requirement?

>
> I also agree with previous statements that renumbering should happen
> gently.  In the context of your suggestion, this would mean that the
> deprecated prefix would be carried by agent advertisements for quite
> a while.  I think that whatever is specified in the Neighbor Discovery
> draft SHOULD cover the required time durations for deprecated
> addresses,
> but I didn't go check the wording before sending this message.  If it
> is not sufficient there, then we should make some explicit parameter
> value specifications in the Mobile IPv6 draft.

Default valid address lifetime in the ND spec is 30 days,
preferred lifetime is 7 days. This implies to me that if
I start a renumbering process today, I can reasonably expect
that no system will be configured with the old addresses
after 30 days when the valid lifetimes expire. This makes
sense for the gentle renumbering approach. But I would not
build a product to always rely on gentle. There is another
option.

The ND and stateless address autoconfiguration specs allow
renumbering to happen in two hours without IPsec, and less with
IPsec. Of course deleting addresses abruptly like this will
disrupt the network, but I don't think that is always a bad
thing. For example, I'm not worried about service disruption
when I renumber the network in my lab or my home, I just want
to get the job done quickly and hopefully easily.

IMHO, mobile IPv6 should handle:

  1) Careful renumbering, takes a month, minimal disruption
     to applications and users.

  2) Quick renumbering, short period of network down time
     expected. Existing connections will fail, but can be
     re-established with little effort.

> > Of course, the danger here is that the network could be
> misconfigured so
> > that home agents are not advertising all prefixes.  This would be
> > sub-optimal (mobility would be uses when it is not needed),
> but wouldn't
> > prevent the mobile node from communicating.
>
> A lot of things can go wrong if the network is misconfigured!
>
> Maybe we can put mandatory requirements in the draft so that such
> misconfigurations go against explicitly stated MUSTs.  Your help
> in determining some correct wording would be appreciated.

Using words like MUST on network configurations seems odd to
me. Would it make sense to state configuration limitations as
a fact; then, mandate that home agents MUST (SHOULD?) check for
inconsistencies in received router advertisements and report any
errors?

Ken

---

From: "Powell, Ken" <[email-masked]>
Date: Tue, 31 Oct 2000 10:39:09 -0500

Sorry for the delay, still catching up on
this thread.

> From: John F. Leser [mailto:[email-masked]]
> Sent: Wednesday, October 18, 2000 11:11 AM
> To: Thomas Eklund
> Cc: Francis Dupont; [email-masked];
> [email-masked]

<snip>

> - Require that a home agent's router advertisements always contain all
> of the prefixes on the network that are valid for home or CO
> addresses.

I like the idea and think it makes sense for stateless address
autoconfiguration, but how would it work with other address
configuration methods like DHCPv6? Does this put restrictions
on where DHCPv6 could be used?

---

From: "Powell, Ken" <[email-masked]>
Date: Tue, 31 Oct 2000 13:26:38 -0500

Following upon a comment I made yesterday about John Leser's
proposal...

> > contain all of the prefixes on the network that are valid
> > for home or CO addresses.

<snip>

> Would it make sense to state configuration limitations as
> a fact; then, mandate that home agents MUST (SHOULD?) check
> for inconsistencies in received router advertisements and
> report any errors?

I was thinking that in addition to the consistency
checks required by RFC 2461 section 6.2.7, the
following specific checks SHOULD be made on a home
agent when it receives a Router Advertisement on the
home subnet:

 1) If the M or O flag is set in the received Router
    Advertisement, verify the corresponding bit is
    set in the home agents own router advertisements.

 2) Verify all prefixes received in the Prefix
    Information option are included in the home agent's
    own AdvPrefixList.

 3) If the value of the L or A flag of a received
    prefix is set, verify the corresponding flag in
    the home agent's AdvPrefixList is also set.

The R flag in received Prefix Information option
should be ignored by the home agent.

Any inconsistencies SHOULD be logged to system or
network management.

Ken