Subject: [mobile-ip] Mobile IPv4 related question on FA-endpoint in FA-HA key

From: [email-masked]
Date: Thu, 17 Apr 2003 14:53:26 -0500

At IETF56, Siva approached me and said that he has not been
able to get a proper answer for the following question. Any
takers for answering this one?

My take on this is that the FA end-point used should be the
CoA advertised by the FA.

In order to make this clear, maybe some text needs to be added
in the RFC3344 when we move towards DS.

-Basavaraj

>From: Sivasundar Ramamurthy <[email-masked]>
>To: Mobile IP Working Group <[email-masked]>
>Subject: Mobile IPv4: FA-HA Sec Assoc revisited.
>
>
>Hello,
>
>RFC3344 does not clearly state what the FA endpoint is in the
>FA-HA key, which may lead to interop problems. One school of
>thought is that the endpoint is the COA in request, and the other is
>that the endpoint is the src address used by the FA to forward the
>request.
>
>There are two scenarios when the source address used by the FA to 
>forward a reg request to a HA is different from the COA in request:
>
>1. MN with CO-COA registering with FA due to 'R' bit set in advert. 
>
>2. Multihomed FA seperating control interface from tunneling interface
>for the sake of performance (RFC3344 does not disallow this).
>
>From case #1, one can deduce that FA endpoint should actually be the
>source address used by the FA to forward the packet, and not the COA
>in the request.
>
>Can the Working Group probably please clarify what the FA endpoint is?
>
>
>thanks,
>
>Siva
>
>
>ps: this issue had brought up before but unless I am mistaken there
>has not been a conclusion

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 17 Apr 2003 13:47:14 -0700

Hello Basavaraj,

As best I can remember, no decision has ever been reached
on this issue, and the question didn't arise before when
the document was under review.  I'm not really sure it
matters for interoperability, because if the mobility
security association is dependent on the address of the
foreign agent, and the foreign agent owns both addresses,
then either one should work.  It would matter a lot more
during the establishment of the mobility security association,
but RFC 3344 doesn't specify that.  If the foreign agent does
not own the care-of address, then the home agent would know
that anyway and naturally not try to use the care-of address
as the selector for the security association (but I don't
think the "selector" terminology is used in the draft).

On the other hand, if someone wishes to be more restrictive
about this for some reason, I don't see that it's a
terrible problem.  I didn't spend a lot of time trying
to find problems, though, so maybe there is some reason
to allow the small bit of extra flexibility.

How's that for not answering the question?

Regards,
Charlie P.

---

From: Sivasundar Ramamurthy <[email-masked]>
Date: Mon, 21 Apr 2003 16:08:22 -0700 (PDT)

Hello Charlie,

On Thu, 17 Apr 2003, Charles E. Perkins wrote:

...
< snip>
...
> It would matter a lot more
> but RFC 3344 doesn't specify that.  

I want to clarify that the main reason I brought up this issue in this
WG is indeed related to the above. 

I raised the following issue in the AAA wg wrt the Diameter MIPv4
application. When the FA-HA key is distributed, one cannot simply use
COA in the registration request AVP (in the AAA registration message)
as the FA-endpoint (IP address) of the key. I felt that the endpoint
is the control interface based on a couple of reasons:

1. R bit registrations (COA belongs to MN)
2. FA seperating control interface from COA

The AAA WG felt that the MIP WG should be the one to clarify whether
the FA-HA key is between the COA and HA or the control interface and
the HA.

I would like to make it clear that my only intention here to resolve
this problem (if it is indeed one!) before the Diameter MIPv4 becomes
RFC.

thanks,

Siva

---

From: Bjorn Andersson <[email-masked]>
Date: Mon, 28 Apr 2003 13:28:39 +0300

On Thu, Apr 17 2003, at 13:47:14 -0700, Charles E. Perkins wrote:
> then either one should work.  

I don't know, but my guess is that if you take two MIPv4
implementations today they will have interoperability problems
becuase only either way is supported. In the same way that HMAC-MD5
for authentication and timestamp for replay protection support is
mandated for interoperabilty reasons, support for either address as a
"selector" should be mandated. Or then it should be clearly stated
that both addresses shoud work. It should be OK to support other
methods as well to identify the remote node.

As a side note, I would like to have the FA add its NAI in
registration messages so that the HA could use that as an SA selector
identifier. This would be useful for example when the FA is behind
a NAT gateway.

  Bjorn

-- 
Bjorn Andersson <[email-masked]>
PGP id 5AFC144B
Mobile +358 40 7723074