Subject: Re: [MOBILE-IP] draft-calhoun-diameter-mobileip-10.txt and existi ng authorization infrastructures

From: Henry Haverinen <[email-masked]>
Date: Wed, 11 Oct 2000 12:24:31 +0300

Fredrik,

Thanks for your comments. Please see my notes below.

> > >    a) If the AMA Command doesn't contain a MIP-Reg-Reply AVP,
> > >       the FA must forward the Reg.Request in question
> > >       to the HA itself.
>
> How will the foreign agent know the address of the home agent, MIP/AAA
> enables dynamic assignment of home agent, thus the home agent
> field in the
> registration request may be set to 0.0.0.0

If the MN doesn't know its home agent and sets the home agent field to
0.0.0.0 or 255.255.255.255, then this rule cannot be applied. This rule
doesn't break dynamic home agent assignment, but it can be useful when
the MN already knows its HA. Either a home agent has been assigned for the
MN with an earlier registration (perhaps through another access network),
or the MN is statically configured with the address of the home agent.

Suppose that a MN is assigned a HA though the first network it visits.
Perhaps the first network assigns the HA, or the first network has AAA
connectivity to the user's corporate network which assigns the HA.
Suppose that the MN then moves to another network, and the AAA cloud of
the second access network is isolated from the HA, for example because
the second network only has a backend GSM authentication server. In this
case, a FA on the second access network could authorize the Reg.Request
using its local AAA, and then apply the rule above and forward the request
to the HA.

> > > The HA may receive a Reg.Request (from a co-located MN or
> a FA) that
> > > contains the MN-AAA Authentication extension. The HA
> could then pass
> > > the request to the AAA network, for example with the DIAMETER AMR
> > > Command, and the AAA network would respond with the AMA
> command, using
> > > the AAAH on the GSM network. Here we probably need a new flag
> > > in the AAA
> > > request that tells the AAA server that it does not have
> to contact the
> > > home agent, and that the request came directly from the
> home agent.
> > >
>
> Why not go through a local AAA which may provide the AAAH with the
> Foreign-Home-Agent-Available AVP, the AAAH can then
> authenticate the user
> and its a policy decision in the AAAH to allow the AAA in the
> local network
> to provide a HA, thus no need for the AAAH to contact a HA.
> So the mechanism
> is available today without any modifications to the draft.

There is no mechanism available for the case that the MN already
has a HA which isn't reachable by the AAA of the visited network.
The Foreign-Home-Agent-Available AVP doesn't help here, although
it can be used to assign the HA in the beginning.

Regards,
Henry