Subject: RE: results and proposal was: RE: [mobile-ip] RFC2002bis interpre tati on question

From: KASSI-LAHLOU Mohammed FTRD/DMI/CAE <[email-masked]>
Date: Fri, 8 Feb 2002 10:20:02 +0100

The simplest way is to leave the MN to choose between CoA and Co-CoA, but we
may add that the FA can refuse if the MN chooses the Co-CoA. In that case
the FA rejects the registration and the MN may reregister with the FA CoA. I
think that all of these are implementation issues.

Kassi

-----Message d'origine-----
De : kleung [mailto:[email-masked]]
Envoye : jeudi 7 fevrier 2002 19:09
A : [email-masked]
Objet : Re: results and proposal was: RE: [mobile-ip] RFC2002bis
interpretati on question

George Tsirtsis wrote:

> How does a FA indicate that it doesn't
> support "encaps/decaps services based on CoA"?
>
> GT> This is easy. One way would be to allow an FA advert to have Rbit set
> but does not include a CoA. The Mobile Node would then see that there is
no
> CoA so it needs to get a collocated address and since the Rbit is set the
> node will have to register it through the FA.
>

Since FA supports tunneling, why shouldn't FA advert its CoA?  Then
it's up to MNs to decide to use CCoA or FA CoA.

The R bit is for FA access (or MIP service authorization) control.   The
CoA is not meant for tunneling control, but merely advertised service.
But the above scheme use CoA as tunneling control.

As said, MNs will likely use the FA CoA when advert received.  Though
I think the generic properties of existing spec allows flexibility for MN to
choose where it wants tunnel termination.

The access authentication/authorization scheme may factor in MN's
decision since it may go through 2 levels (802.1x and MIP) when
CCOA is used.  Of course, FA may decide to bypass MIP authentication
when it sees RRQ with D bit set and external CoA if it is aware that
802.1x already occurred.

Flexibility comes complexity.  :)  But forcing MNs to use FA COA
with R bit advertised is rigid, though simpler for the common scenario.

So if we leave spec as is, then MNs choose either CCoA or FA CoA
when it sends RRQ to FA, which advert the R bit.  Is this ambiguous?

Seems like the new proposal is to enforce CCOA tunneling by removing
COA in advert.  And on the other end, proposal to mandate that MN
must use FA COA.  Both cases when R bit set in advert.  Both takes
the right to choose from MN.  This is what we want, right?

Kent

>
> We have never run into the problem because our MN always switch to FA
> registered if a adverticements comes out, regardless of R-bit. So, an
> interop with us would be pointless.
>
> If someone perceives to run co-located despite our agents
> adverticements, they will be sean as using our simple IP service and not
> mobile IP. The packets will be treated according to the policy
> configured in the FA (not really a FA in that case, more of a ACD
> (Access Control Device)) and if he is authenticated by some other means
> (like web-login or 802.1x).
>
> My private feeling is that there are no advantage for the MN to run
> co-located over registered with FA. And there is no way for a FA to tell
> that he proposes co-located mode. So, in my mind it's already set, adn
> instead the spec could be clarified to disallow registering with
> co-located address to FA.
>
> GT> No, no, now you are totally missing the point of the Rbit. Just
because
> some implementers chose to prefer CoAs if they can get them it does not
mean
> that CCoAs are not needed and it does not mean that the FA should not be
> able to request registration. The Rbit is useful but it is weakly
specified
> which unfortunately allows you to think that is not needed.
>
> George