Subject: [fmc] Minutes of today's Bar BoF

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 2 Aug 2013 05:46:48 -0500

Folks, let's take this discussion to the list:

here is what has been exchanged so far:

Hi Marco,

Just to understand the scenario better… only to help frame the problem in
terms that people in IETF can follow (it would be quite onerous to ask
folks here to follow 3GPP, or BBF in detail.. ..).

Considering the untrusted scenario, routed model (not shared prefix):
 untrusted (S2b) case with IPv6 and WLAN:

1)      Host H1 authenticates to AP/BBF network and obtains IPv6 prefix A1
(per host prefix, not shared).

2)      H1 sets up IPsec tunnel (IKE signaling, etc) to SEGW/ePDG, extracts
source prefix A1 (and IMSI).
(Note: BNG has no idea that IKE signaling is from H1.)

3)      SEGW/ePDG uses Gxb, S9+, R to convey policy request to BNG (e.g.
provide QoS, police flows X with src=A1).

4)      BNG polices/handles QoS for flows with src=A1.

Don’t see the problem for above case. However, if the IP prefix A1 is
shared by all hosts behind the RG, ePDG/BNG should base PCC handling on
entire source address, e.g. src=A1:ID1 (obtained in IKE signaling).

For trusted cases – bridged mode/shared link should not be a problem since
the authenticator and policer are at BNG.

Is it for routed model, trusted scenario that there is an issue (if so,
could you outline a short sequence/prefix and node assumptions). Or
something I’ve completely missed …

Thanks &

Best Regards,

John

PS: Don’t want to explain all of this on the fmc mailing list at this time,
since we cannot have a focused discussion.

*From:* Marco Spini
*Sent:* Thursday, August 01, 2013 8:01 AM
*To:* Sri Gundavelli (sgundave); John Kaippallimalil; Behcet Sarikaya
*Subject:* RE: [fmc] Minutes of today's Bar BoF

Hi Sri,

For the trusted scenario I agree with you. For EPC-routed the point is
related to the PCC control, i.e. to the IP-CAN session which requires to
associated an IP address and an identity. So the main problem is related to
the capability of the BNG acting  as PCEF to know the which is the actual
IP address of the UE/device behind a RG with a IPv6 prefix delegation
configuration to be able to start an IP-CAN session establishment with
Device ID/IPv6 address. If this is not possible from PCC point of view, it
is equivalent to the IPv4 NAT scenario.

BR

marco

*From:* Sri Gundavelli (sgundave)
[mailto:[email-masked]<[email-masked]>]

*Sent:* giovedì 1 agosto 2013 14:49
*To:* John Kaippallimalil; Behcet Sarikaya; Marco Spini
*Subject:* Re: [fmc] Minutes of today's Bar BoF

Hi Marco,

For the RG in the bridge mode (layer-2 link between the UE and the BNG),
the link is indeed a shared link. However, the BNG clearly has the ability
to unicast RA with the subscriber specific prefix. This is per RFC-6085, L2
unicast, L3 multicast. If the user is a EPC  user, the TWAG function
collocated with the BNG will any ways send unicast RA with the EPC provided
prefix. For non-EPC users, the BNG can just do the same, unicast a prefix
from the access network. In affect, the BNG builds a logical layer-2 links
on a shared physical media.

There are other options as well, leveraging NAT logging data. In any case,
the burden is on the authors to explain the use-case clearly. This was
indeed a clarifying question, which the presenter was not able to explain.

Regards

Sri

PS: Bechet – This is OFFLIST discussion.

*From: *John Kaippallimalil <[email-masked]>
*Date: *Thursday, August 1, 2013 5:01 AM
*To: *Behcet Sarikaya <[email-masked]>, Marco Spini <
[email-masked]>
*Cc: *Sri Gundavelli <[email-masked]>
*Subject: *RE: [fmc] Minutes of today's Bar BoF

Hi Behcet,

OK – I think I understand (copying from TR-177):

“The main focus of TR-177 is on following scenarios:

§ a subscriber having a routed RG. This RG can be connected to the access
loop either directly

or through a bridged RG. The routed RG acts as a Requesting Router (as per
RFC 3633), and

possibly embeds DHCPv6-based address allocation capabilities.

§ a subscriber having a bridged RG, in which case the first hop router for
their hosts is the

BNG. The subscriber hosts support DHCPv6 address allocation capabilities.

In all cases SLAAC is supported to obtain link-local addresses and perform
Duplicate Address

Detection (DAD).”

So, there is a case with a bridged RG – which then lends itself to a shared
IP link.

BR,

John

---

From: "Sri Gundavelli (sgundave)" <[email-masked]>
Date: Fri, 2 Aug 2013 10:57:10 +0000

Behcet - Can you unsubscribe me from this  list ? I dont remember subscribing to this list.

Sri

Sent from my iPhone

On Aug 2, 2013, at 12:47 PM, "Behcet Sarikaya" <[email-masked]<mailto:[email-masked]>> wrote:

Hi Marco,

Just to understand the scenario better… only to help frame the problem in terms that people in IETF can follow (it would be quite onerous to ask folks here to follow 3GPP, or BBF in detail.. ..).

Considering the untrusted scenario, routed model (not shared prefix):  untrusted (S2b) case with IPv6 and WLAN:

1)      Host H1 authenticates to AP/BBF network and obtains IPv6 prefix A1 (per host prefix, not shared).

2)      H1 sets up IPsec tunnel (IKE signaling, etc) to SEGW/ePDG, extracts source prefix A1 (and IMSI).
(Note: BNG has no idea that IKE signaling is from H1.)

3)      SEGW/ePDG uses Gxb, S9+, R to convey policy request to BNG (e.g. provide QoS, police flows X with src=A1).

Don’t see the problem for above case. However, if the IP prefix A1 is shared by all hosts behind the RG, ePDG/BNG should base PCC handling on entire source address, e.g. src=A1:ID1 (obtained in IKE signaling).

For trusted cases – bridged mode/shared link should not be a problem since the authenticator and policer are at BNG.

Is it for routed model, trusted scenario that there is an issue (if so, could you outline a short sequence/prefix and node assumptions). Or something I’ve completely missed …

Thanks &

Best Regards,

John

PS: Don’t want to explain all of this on the fmc mailing list at this time, since we cannot have a focused discussion.

From: Marco Spini
Sent: Thursday, August 01, 2013 8:01 AM
To: Sri Gundavelli (sgundave); John Kaippallimalil; Behcet Sarikaya
Subject: RE: [fmc] Minutes of today's Bar BoF

Hi Sri,

For the trusted scenario I agree with you. For EPC-routed the point is related to the PCC control, i.e. to the IP-CAN session which requires to associated an IP address and an identity. So the main problem is related to the capability of the BNG acting  as PCEF to know the which is the actual IP address of the UE/device behind a RG with a IPv6 prefix delegation configuration to be able to start an IP-CAN session establishment with Device ID/IPv6 address. If this is not possible from PCC point of view, it is equivalent to the IPv4 NAT scenario.

BR

marco

From: Sri Gundavelli (sgundave) [mailto:[email-masked]]
Sent: giovedì 1 agosto 2013 14:49
To: John Kaippallimalil; Behcet Sarikaya; Marco Spini
Subject: Re: [fmc] Minutes of today's Bar BoF

Hi Marco,

For the RG in the bridge mode (layer-2 link between the UE and the BNG), the link is indeed a shared link. However, the BNG clearly has the ability to unicast RA with the subscriber specific prefix. This is per RFC-6085, L2 unicast, L3 multicast. If the user is a EPC  user, the TWAG function collocated with the BNG will any ways send unicast RA with the EPC provided prefix. For non-EPC users, the BNG can just do the same, unicast a prefix from the access network. In affect, the BNG builds a logical layer-2 links on a shared physical media.

There are other options as well, leveraging NAT logging data. In any case, the burden is on the authors to explain the use-case clearly. This was indeed a clarifying question, which the presenter was not able to explain.

Regards

Sri

From: John Kaippallimalil <[email-masked]<mailto:[email-masked]>>
Date: Thursday, August 1, 2013 5:01 AM
To: Behcet Sarikaya <[email-masked]<mailto:[email-masked]>>, Marco Spini <[email-masked]<mailto:[email-masked]>>
Cc: Sri Gundavelli <[email-masked]<mailto:[email-masked]>>
Subject: RE: [fmc] Minutes of today's Bar BoF

Hi Behcet,

• a subscriber having a routed RG. This RG can be connected to the access loop either directly

or through a bridged RG. The routed RG acts as a Requesting Router (as per RFC 3633), and

• a subscriber having a bridged RG, in which case the first hop router for their hosts is the

In all cases SLAAC is supported to obtain link-local addresses and perform Duplicate Address

Detection (DAD).”

So, there is a case with a bridged RG – which then lends itself to a shared IP link.

BR,

John

---

From: "THIEBAUT, LAURENT (LAURENT)" <[email-masked]>
Date: Fri, 2 Aug 2013 11:11:44 +0000

Hello all

1)    I do not fully understand the statement below
For the trusted scenario I agree with you. For EPC-routed the point is related to the PCC control, i.e. to the IP-CAN session which requires to associated an IP address and an identity. So the main problem is related to the capability of the BNG acting  as PCEF to know the which is the actual IP address of the UE/device behind a RG with a IPv6 prefix delegation configuration to be able to start an IP-CAN session establishment with Device ID/IPv6 address. If this is not possible from PCC point of view, it is equivalent to the IPv4 NAT scenario.

For EPC-routed, the BNG is not a PCEF (policy enforcement  function), the PCEF is in the PGW/PDN-GW

2)    but I agree that the TWAG (entity of the fixed access that maps a Wireline IP session to a Wireless S2a EPC-routed connection to a PGW) shall be able to associate an IPv6 address/prefix (of the mobile/UE) with an EPC-routed/SAMOG/S2a session

Actually in case of EPC-routed (S2a), the IP @ / Prefix of the UE is allocated by the PGW, NOT by the RGW.

In EPC-routed case, the UE is on a 'virtual' link of the PGW.
Best Regards
Laurent
ALCATEL-LUCENT
De : [email-masked] [mailto:[email-masked]] De la part de Behcet Sarikaya
Envoyé : vendredi 2 août 2013 12:47
À : [email-masked]
Cc : [email-masked]; Marco Spini; Sri Gundavelli
Objet : [fmc] Minutes of today's Bar BoF

Folks, let's take this discussion to the list:
here is what has been exchanged so far:
Hi Marco,
Just to understand the scenario better... only to help frame the problem in terms that people in IETF can follow (it would be quite onerous to ask folks here to follow 3GPP, or BBF in detail.. ..).

Don't see the problem for above case. However, if the IP prefix A1 is shared by all hosts behind the RG, ePDG/BNG should base PCC handling on entire source address, e.g. src=A1:ID1 (obtained in IKE signaling).
For trusted cases - bridged mode/shared link should not be a problem since the authenticator and policer are at BNG.

Is it for routed model, trusted scenario that there is an issue (if so, could you outline a short sequence/prefix and node assumptions). Or something I've completely missed ...

Thanks &
Best Regards,
John

PS: Don't want to explain all of this on the fmc mailing list at this time, since we cannot have a focused discussion.

From: Marco Spini

Hi Sri,

BR
marco

Hi Marco,

Regards
Sri
PS: Bechet - This is OFFLIST discussion.

Hi Behcet,
OK - I think I understand (copying from TR-177):
"The main focus of TR-177 is on following scenarios:
* a subscriber having a routed RG. This RG can be connected to the access loop either directly
or through a bridged RG. The routed RG acts as a Requesting Router (as per RFC 3633), and
possibly embeds DHCPv6-based address allocation capabilities.
* a subscriber having a bridged RG, in which case the first hop router for their hosts is the
BNG. The subscriber hosts support DHCPv6 address allocation capabilities.
In all cases SLAAC is supported to obtain link-local addresses and perform Duplicate Address
Detection (DAD)."

So, there is a case with a bridged RG - which then lends itself to a shared IP link.
BR,
John