Subject: [mobile-ip] Regional Registration Last Call Resolution Issue #4

From: Phil Roberts <[email-masked]>
Date: Tue, 14 May 2002 16:24:56 -0400

Several folks raised the issue of to what extent introducing regional
registration entities in the visited network violates principles of the
Internet architecture, specifically with regard to the introduction of
single points of failure in the communication path of visiting nodes.

I've excerpted the relevant text from rfc 1958 on the architectural
principle which is at issue.

   "The end-to-end argument is discussed in depth in [Saltzer].  The
    basic argument is that, as a first principle, certain required end-
   to-end functions can only be performed correctly by the end-systems
   themselves. A specific case is that any network, however carefully
   designed, will be subject to failures of transmission at some
   statistically determined rate. The best way to cope with this is to
   accept it, and give responsibility for the integrity of communication
   to the end systems. Another specific case is end-to-end security.

   To quote from [Saltzer], "The function in question can completely and
   correctly be implemented only with the knowledge and help of the
   application standing at the endpoints of the communication system.
   Therefore, providing that questioned function as a feature of the
   communication system itself is not possible. (Sometimes an incomplete
   version of the function provided by the communication system may be
   useful as a performance enhancement.")

   This principle has important consequences if we require applications
   to survive partial network failures. An end-to-end protocol design
   should not rely on the maintenance of state (i.e. information about
   the state of the end-to-end communication) inside the network. Such
   state should be maintained only in the endpoints, in such a way that
   the state can only be destroyed when the endpoint itself breaks
   (known as fate-sharing). An immediate consequence of this is that
   datagrams are better than classical virtual circuits.  The network's
   job is to transmit datagrams as efficiently and flexibly as possible."

draft-iab-arch-changes-00.txt provides a discussion of this issue of
fate-sharing in middleboxes and asserts that the principle is preserved in
the case that the middlebox is a partner in the communication when the
failure can be detected and dealt with.:

   "The idea of fate-sharing survives this recursion, but requires that
   all application state created in middleboxes must be capable of re-
   creation after failure. Additionally, to support this requirement,
   where a function cannot be fulfilled completely, reliably and
   securely by two endpoints of a conversation, the necessary
   middleboxes to fulfil the function should be explicit partners in
   explicit communication with at least one endpoint (or, by recursion
   of the same principle, with an intermediate middlebox). In other
   words, middleboxes should not be invisible, because their failures
   need to be detected and dealt with by their communication partners."

As currently specified it's not immediately obvious how the regional
registration agents are compatible with the above guidelines.  It's
conceivable that they can be made so, and perhaps it's immediately obvious
to others how they are so.

This issue is not insurmountable but the functionality does need to be
specified in a way that preserves the fate sharing principle and allows for
one party in the communication to detect and deal with a failure of one of
the new registration entities.

---

From: "Emad Qaddoura" <[email-masked]>
Date: Wed, 15 May 2002 07:25:04 +0200

Phil,

	How is the GFA is different from the HA and FA from the stand
point of single point of failure or other reliability issues? I believe
this can be implementation dependent, i.e. someone can implement GFA as
a cluster.

	I believe the regional registration draft has some complexity
into it, and without some a bake-off like tests, it should remain at the
experimental level.

Thx.

> -----Original Message-----
> From: [email-masked] [mailto:owner-mobile-
> [email-masked]] On Behalf Of Phil Roberts
> Sent: Tuesday, May 14, 2002 10:25 PM
> To: [email-masked]'
> Subject: [mobile-ip] Regional Registration Last Call Resolution Issue
#4
> specified in a way that preserves the fate sharing principle and
allows
> for

---

From: "James Kempf" <[email-masked]>
Date: Sun, 19 May 2002 17:17:27 -0700

Phil,

There are just a few points to add to your excellent presentation of the
architectural issues involved in introducing regional routing agents, to
which I AGREE.

The GFA constitutes a routing proxy. RFC 3238 gives architectural
considerations for defining services on application proxies, but many of
the considerations involved in introducing fate-sharing between the
application proxies and end hosts are difficult to envision for a
routing proxy.

One argument I have heard in favor is that the Home Agent functions
essentially as a routing proxy, so why is introducing a routing proxy in
the foreign network any different? The answer is that the Home Agent is
architecturally necessary to achieve the separation between node
identifier and routing identifier, while the GFA is just a performance
enhancement. While there are other ways of achieving the node/routing
identifier separation, they all have more serious problems
architecturally and practically than the Home Agent. With the GFA, there
are other ways to achieve the same performance enhancement, and these
are not difficult to implement and probably not particularly more
difficult to deploy, since they are based on enhanced edge routing.
Their reliability characterstics essentially match those of the access
routers.

            jak

----- Original Message -----
From: "Phil Roberts" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, May 14, 2002 1:24 PM
Subject: [mobile-ip] Regional Registration Last Call Resolution Issue #4

> specified in a way that preserves the fate sharing principle and
allows for

---

From: "James Kempf" <[email-masked]>
Date: Sun, 19 May 2002 17:27:19 -0700

EQ,

> this can be implementation dependent, i.e. someone can implement GFA
as

In my reply to Phil's message, I explained why the GFA is different from
the HA.

With regard to the FA, the FA was removed from the MIPv6 design for many
of the reasons cited by Phil in his note.
Unfortunately, the FA can't be removed from MIPv4, but I don't see that
as a reason to introduce another level of routing proxy.

            jak

---

From: "Dana L. Blair" <[email-masked]>
Date: Thu, 23 May 2002 06:48:50 -0400

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Emad Qaddoura
> Sent: Wednesday, May 15, 2002 1:25 AM
> To: 'Phil Roberts'; [email-masked]
> Subject: RE: [mobile-ip] Regional Registration Last Call Resolution
> Issue #4
> 
> 
> Phil,
> 
> point of single point of failure or other reliability issues? I 

The FA is not a single point of failure but you can have
more than one FA advertising to the same subnet.  If one
FA goes away, the MN will hear an advertisement from the
other and can still register.

thanks,
Dana

believe