Subject: [MOBILE-IP] NAI and MN-HA authentication

From: Madhavi Subbarao <[email-masked]>
Date: Thu, 21 Dec 2000 12:03:21 -0500

HI All,

We are proposing a Binding ID as a way to obtain multiple dynamic IP addresses with a single NAI (draft
should be announced soon.)  In looking at the behavior of the FA in RFC 2794 (MIP NAI ext), it seems that
MN-HA authentication is dubious in some scenarios.  Under certain circumstances, the FA is changing
the error code of the Registration Reply before forwarding it to the MN.  But, now authentication
will fail at the MN.  Since the MN will attempt to re-register, all is not lost except that the MN
will continually try with the same HA.

Is this behavior intentional?

-Madhavi

---

From: Woo-June Kim <[email-masked]>
Date: Fri, 29 Dec 2000 11:17:00 +0900

Hi,

Until I see the draft, not much to say, but...

>will fail at the MN.  

If the FA denies the registration, the MN_HA authentication should not be checked by the MN. (cf. RFC2002-bis)

> Since the MN will attempt to re-register, all is not lost except that the MN

I guess the point you are making is that if there is a problem with the HA, such that it does 1) not include the NAi ext, 2) not include nonzero HA address, or 3) not include nonzero Mobile's home address the end user will continuously go to the same HA. Repeating history !

But this really can't be helped can it ? It's a problem with the HA implementation... 

Of the 4 error codes that are possible except for  NONZERO_HOMEADDR_REQD, the other 3 (MISSING_NAI, MISSING_HOME_AGENT, MISSING_HOMEADDR) could only of occured if the HA messed up. So the mobile should intelligently handle this case by trying to connect with another HA. (Or more exactly maybe it should be the FA ?)

cheers

Woojune Kim
Samsung Electronics
e-mail : [email-masked]