Subject: Re: [Dime] Re: [Mip6] Diameter Mobile IPv6 Bootstrapping: AuthorizingRoute Optimization

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 5 Sep 2007 10:03:00 -0700 (PDT)

How about this?
RO authorization is part of the subscriber profile and using HA-AAA interface and MIP6-Feature-Vector AVP, this is communicated to HA. 

MN is free to attempt RO as Raj wants. HA would block HoTI if MN is not authorized.

My suggestion would be to enable RO as much as possible.

Regards,

Behcet

----- Original Message ----
From: "[email-masked]" <[email-masked]>
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Sent: Wednesday, September 5, 2007 1:31:47 AM
Subject: RE: [Dime] Re: [Mip6] Diameter Mobile IPv6 Bootstrapping: AuthorizingRoute Optimization

Hmm.. lets clarify what my "yes" was supposed to mean. An operator
needs to have a way to indicate to a HA per subscriber basis whether
a RO procedure is enabled / disabled (in the HA). This information
can be conveyed e.g. in the current dime-split draft using the
MIP6-Feature-Vector AVP. IMO this is more a policy decision than an
authorization.

Cheers,
    Jouni

________________________________

    From: Behcet Sarikaya [mailto:[email-masked]] 
    Sent: Tuesday, September 04, 2007 10:55 PM
    To: Hannes Tschofenig
    Cc: Mobile IPv6 Mailing List; [email-masked]
    Subject: Re: [Dime] Re: [Mip6] Diameter Mobile IPv6
Bootstrapping: AuthorizingRoute Optimization

    I like Jouni's idea of making RO authorization part of the
subscriber profile. I think such a thing fits better into the (AAA)
managed network model. Defining an AVP probably is not necessary.
    
    Regards,
    
    Behcet

    ----- Original Message ----
    From: Hannes Tschofenig <[email-masked]>
    To: Basavaraj Patil <[email-masked]>
    Cc: Mobile IPv6 Mailing List <[email-masked]>; [email-masked]
    Sent: Tuesday, September 4, 2007 2:34:20 PM
    Subject: [Dime] Re: [Mip6] Diameter Mobile IPv6 Bootstrapping:
Authorizing Route Optimization

    Hi Raj,
    
    you raise a good point. There is no doubt that a network
operator can 
    prevent all end hosts from using the RO procedure.
    
    The main question therefore is whether the RO procedure has to
enabled / 
    disabled on a per user basis.
    
    Ciao
    Hannes
    
    Basavaraj Patil wrote:
    > Hi Ahmad,
    >
    > I am skeptical about the need for an MN being authorized to
use an inherent
    > feature of MIP6. It makes no sense for an MN to be authorized
depending on
    > the network that it is attached to whether it is able to use
RO with CNs.
    >
    > -Raj
    >
    >
    > On 9/4/07 8:57 AM, "ext Ahmad Muhanna" <[email-masked]>
wrote:
    >
    >   
    >> Hi Alex,
    >>
    >> Just some background:
    >>
    >> The proposed Diameter MIPv6 Application is used to enable
MIPv6 service
    >> authorization + dynamic security association allocation. As
per the
    >> current application, the user is authorized for MIPv6 service
without a
    >> clear indication if the user is allowed to use Route
Optimization or
    >> not. Allowing the operator this flexibility makes a lot of
sense. Let us
    >> remember in order for the MN to establish a RO, it needs to
have at
    >> least HoTI and HoT signals transmitted via the HA which can
act as the
    >> authorization enforcement point.
    >>
    >> Of course, we are talking about a network which is controlled
by AAA
    >> infrastructure since the proposed application is for Diameter
MIPv6.
    >>
    >> Also, please see comments inline.
    >>
    >> Regards,
    >> Ahmad
    >>  
    >>
    >>     
    >>> Subject: Re: [Mip6] Diameter Mobile IPv6 Bootstrapping:
    >>> Authorizing Route Optimization
    >>>
    >>> Hannes Tschofenig wrote:
    >>>       
    >>>> Hi all, during his review of "Diameter Mobile IPv6:
HA<->AAA" Ahmad
    >>>> made the following comment:
    >>>>         
    >>>> We discussed before that AUTHORIZATION for ROUTE
OPTIMIZATION is
    >>>> needed. I did not see it included here?! As we discussed
last time,
    >>>> operators do care about having control over the willingness
    >>>>         
    >>> of the MN 
    >>>       
    >>>> to have route optimization. If that the case, then there
    >>>>         
    >>> should be a 
    >>>       
    >>>> process to enable that kind of authorization. No? <<<
    >>>>
    >>>> Does the group think that we need to provide any backend
    >>>> infrastructure support to enable this type of
functionality?
    >>>>         
    >>> Which group(s)?
    >>>
    >>> I think RO is designed to work across the entire Internet,
    >>> not limited to a AAA-controlled domain.
    >>>
    >>>  From tests, the benefits of running RO on the MN are
    >>> apparent only when the distance MN-CN is much shorter than
    >>> both MN-HA and CN-HA, in terms of IP hops.
    >>>
    >>> In a closed system, that equation is not valid, ie, MN is
    >>> close to both CN and to its HA, and the benefits of running
    >>> RO are minimal, one doesn't gain much at all.
    >>>
    >>> So, in first place I don't see why would a MN want to run RO
    >>> at all while in a AAA-controlled (closed) domain.  It may
    >>> very well be that MN is not interested at all to run RO to a
    >>> CN outside the AAA-controlled domain, because it wouldn't
    >>> gain much.  Then, even if MN would want to do that, I don't
    >>> see why asking the local AAA to be authorized to perform RO.
    >>>       
    >> [Ahmad]
    >> Are you assuming that the HA is always in the visited
network? Also,
    >> V-AAA does not communicate with H-AAA?
    >> I just want to understand what you meant here.
    >> Thanks.
    >>
    >>     
    >>> Finally, are you talking about AAA backend authorizing the
MN
    >>> or the CN to do RO?
    >>>       
    >> [Ahmad]
    >> AAA infrastructure only can control the MN to have RO or not
and hence
    >> authorization is for the MN not the CN.
    >>     
    >>> Alex
    >>>
    >>>
______________________________________________________________________
    >>> This email has been scanned by the MessageLabs Email
Security System.
    >>> For more information please visit
    >>> http://www.messagelabs.com/email
    >>>
______________________________________________________________________
    >>>
    >>> _______________________________________________
    >>> Mip6 mailing list
    >>> [email-masked]
    >>> https://www1.ietf.org/mailman/listinfo/mip6
    >>>
    >>>       
    >> _______________________________________________
    >> Mip6 mailing list
    >> [email-masked]
    >> https://www1.ietf.org/mailman/listinfo/mip6
    >>     

    _______________________________________________
    DiME mailing list
    [email-masked]
    https://www1.ietf.org/mailman/listinfo/dime

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 5 Sep 2007 14:23:06 -0500

Thanks Behcet,
This is a good suggestion and it is absolutely fine with me.

Regards, 
Ahmad 

	From: Behcet Sarikaya [mailto:[email-masked]] 
	Sent: Wednesday, September 05, 2007 12:03 PM
	To: [email-masked]; [email-masked]
	Cc: [email-masked]
	Subject: Re: [Dime] Re: [Mip6] Diameter Mobile IPv6
Bootstrapping: AuthorizingRoute Optimization

	How about this?
	RO authorization is part of the subscriber profile and using
HA-AAA interface and MIP6-Feature-Vector AVP, this is communicated to
HA. 
	
	MN is free to attempt RO as Raj wants. HA would block HoTI if MN
is not authorized.

	Regards,
	
	Behcet

	----- Original Message ----
	From: "[email-masked]"
<[email-masked]>
	To: [email-masked]; [email-masked]
	Cc: [email-masked]; [email-masked]
	Sent: Wednesday, September 5, 2007 1:31:47 AM
	Subject: RE: [Dime] Re: [Mip6] Diameter Mobile IPv6
Bootstrapping: AuthorizingRoute Optimization

	Hmm.. lets clarify what my "yes" was supposed to mean. An
operator
	needs to have a way to indicate to a HA per subscriber basis
whether
	a RO procedure is enabled / disabled (in the HA). This
information
	can be conveyed e.g. in the current dime-split draft using the
	MIP6-Feature-Vector AVP. IMO this is more a policy decision than
an
	authorization.
	
	Cheers,
	    Jouni

	

	    I like Jouni's idea of making RO authorization part of the
	subscriber profile. I think such a thing fits better into the
(AAA)
	managed network model. Defining an AVP probably is not
necessary.
	    
	    Regards,
	    
	    Behcet

	    ----- Original Message ----
	    From: Hannes Tschofenig <[email-masked]>
	    To: Basavaraj Patil <[email-masked]>
	    Cc: Mobile IPv6 Mailing List <[email-masked]>; [email-masked]
	    Sent: Tuesday, September 4, 2007 2:34:20 PM
	    Subject: [Dime] Re: [Mip6] Diameter Mobile IPv6
Bootstrapping:
	Authorizing Route Optimization

	    Hi Raj,

	    The main question therefore is whether the RO procedure has
to
	enabled / 
	    disabled on a per user basis.
	    
	    Ciao
	    Hannes
	    
	use an inherent
	depending on
	RO with CNs.
	MIPv6 service
	per the
	without a
	Optimization or
	sense. Let us
	have at
	act as the
	by AAA
	MIPv6.
	HA<->AAA" Ahmad
	OPTIMIZATION is
	last time,
	functionality?
	network? Also,
	MN
	and hence
	
	Security System.