Subject: RE: [mobile-ip] RFC3012bis-04 Available

From: "Kuntal Chowdhury" <[email-masked]>
Date: Fri, 3 Jan 2003 17:56:13 -0600

Charles E. Perkins wrote:
> 
> > But the similar type of extension is essential when there is no 
> > security association between the MN and the FA. Hence, this draft 
> > defines MN-AAA authentication extension so that a mobile node can 
> > still supply credentials for the MN authorization. We have 
> currently 
> > mentioned in the draft that MN-AAA must be included if the MN-FA 
> > extension is not present. Having both extensions in the 
> same message 
> > doesn't serve any added value.
> 
> There might be cases when both are needed.  For instance, the 
> mobile node might need to get a new home agent for some 
> reason, perhaps if the last registration reply indicated a 
> failure condition.
> 

When the MN needs a new HA, it should set the HA field to 0s or 255s
in the RRQ. That should be enough hint to the FA to contact AAA server if
that's how it is configured to do dynamic HA assignment. Otherwise, the 
FA should follow Dynamic HA discovery procedure specified in the base 
MIP protocol. I don't see the need for MN-FA authentication extension 
when MN-AAA auth extension is present. May be we should add a sentence
in this draft to say that, if the MN wants to include MN-AAA auth extension 
, then it should not include MN-FA auth extension regardless of it's
security
association with the FA.

> >                                                    Putting explicit 
> > text on allowing only one extension in the same 
> Registration Request 
> > message will prevent further confusion.
> 
> I didn't see why it was needed, but I didn't read all of the 
> previous messages.  Is the confusion just based on ordering?
> 
> > It seems you are trying to use MN-AAA authentication extension to 
> > instruct the FA to use the AAA infrastructure.
> 
> This seems to put the cart before the horse.  The FA is 
> likely to be using the AAA infrastructure regardless of the 
> mobile node's operation.  If the FA can't use the AAA 
> infrastructure because of some lack of the mobile node, it 
> won't accept the registration.
> 

Whether the FA will always use AAA for auth/authz is based on local
policy of the access provider. It is perfectly legal to provide
access service w/o requiring FA to perform auth/authz with AAA.

Regards,
Kuntal

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 06 Jan 2003 10:35:37 -0800

Hello Kuntal,

Kuntal Chowdhury wrote:

> in the RRQ.

Agreed.

>         That should be enough hint to the FA to contact AAA server if
> that's how it is configured to do dynamic HA assignment.

It seems to me that the foreign agent should not contact the AAA
infrastructure unless the MN-AAA authentication extension is present.

>                                                       Otherwise, the
> MIP protocol.

That procedure is controlled by the mobile node, not the foreign agent.
It is done by using the directed broadcast address, which isn't very
useful nowadays.

>                I don't see the need for MN-FA authentication extension
> when MN-AAA auth extension is present.

The base Mobile IP specification requires it, so it has to be there.

>                             May be we should add a sentence in this
> draft to say that, if the MN wants to include MN-AAA auth extension,
> then it should not include MN-FA auth extension regardless of it's
> security association with the FA.

I do not think we should add this language.   There does not seem
to be any downside for including the Mobile-Foreign authentication
extension, and it works better for interoperability.

> access service w/o requiring FA to perform auth/authz with AAA.

Yes, I agree.  My intention in the paragraph above was to
emphasize that the foreign agent makes the decision (or,
perhaps, is configured) to use the AAA infrastructure or
not to use it, and that this matter of policy is not under
the control of the mobile node.

Regards,
Charlie P.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 06 Jan 2003 11:02:43 -0800

> The base Mobile IP specification requires it, so it has to be there.

I meant this in the context of the discussion when the mobile
node shares a mobility security association with the foreign
agent.  Of course, the Mobile-Foreign extension is NOT
required when there is no such mobility security association.

Regards,
Charlie P.