Subject: RE: [Mip6] Issue with mipv6 charter

From: [email-masked]
Date: Wed, 10 Sep 2003 17:30:22 -0500

> 
>  > Wondering if the charter should include an entity in the
>  > visited domain/roaming network to aid in AAA/Diameter 
> authentication,
>  > access control etc? 
> 
> => a NAS ? ;) The description of this entity doesn't 
> seem to be related to mobility in any way. I think
> this work is generic for fixed and mobile nodes.
> 
>    Currently, there is little, if any mechanism
>  > to restrict a mobile node's activities in visited domain.
> 
> => Why do you say that? A NAS will do this job very well
> provided that AAA mechanisms and roaming agreements 
> are in place. 
> 
>  > For practical deployment issues and network management/control
>  > purposes, I think such an entity is needed.
> 
> => Absolutely, but MIP6 has nothing to do with it.

I agree with Hesham's comments above. 
Network Access authentication/authorization and roaming is in 
the realm of NAS and AAA. I dont see what the MIP6 WG has to do
with this. 

> 
> Hesham
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mip6
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Alpesh <[email-masked]>
Date: Wed, 10 Sep 2003 15:52:59 -0700

Raj:

I am more or less looking at functionality in access router/first hop
router in the visited domain (home or foreign) to control the MN's
access to the network for authentication, billing, access control etc.

With route optimization, this is an issue from an operator perspective
since the mobile can bypass the HA.

I think this issue is added by the MIP protocol and should ideally be
addressed here.

-alpesh

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 10 Sep 2003 16:01:27 -0700

> Alpesh wrote:

the way I see it, it is one of the best features of MIPv6. :)

Vijay

---

From: "James Kempf" <[email-masked]>
Date: Wed, 10 Sep 2003 16:26:54 -0700

Alpesh,

> I think this issue is added by the MIP protocol and should ideally be

Not sure I understand your point.

Since you've brought up route optimization, I presume your concern is with
movement beyond the first subnet of attachment, right? Because there,
clearly the first NAS can take care of the accounting/authentication.

The MN can bypass the HA but it can't bypass the first hop router. If the
first hop router is connected up to the NAS function somehow, like it does
in a standard dialup network, the accounting/authentication information gets
back to home network in any event.

So, it becomes an issue of co-ordination between the NASes, so that the
mobile's service profile is available at the new NAS when the mobile moves
to a new subnet. There's lots of work going on in various places on this
(IEEE 802.11 is the one I'm most familiar with), not IETF unfortunately. If
you'll permit me a small plug for a WG I co-chair:
<advertisement>
The Seamoby WG is finalizing a protocol for context transfer that might be
useful, but nobody's using it for that right now.
</advertisement>

But none of this is related to Mobile IP, so it really shouldn't be in the
MIPv6 WG charter. There might be some work for other WGs (AAA? PANA?)
however.

            jak

---

From: Jari Arkko <[email-masked]>
Date: Thu, 11 Sep 2003 07:46:54 +0300

Alpesh,

I basically agree with Hesham, Vijay, and James. I'd like to
add that the functionality you seem to be requesting is
already being provided by existing dial-up NASes, wireless
LAN APs (802.1X, 802.11i stds), and so on. And this is
independent of Mobile IPv6, making it easier to deploy
without having to have a special access router where you
are.

However, there has been some discussion of future features
where there would be some linkage between the two. For
instance, it might be useful to be able to use the same
credentials for attaching to the network as well as talking
to your home agent.

--Jari

---

From: Alpesh <[email-masked]>
Date: Thu, 11 Sep 2003 16:36:44 -0700

Raj:

My point is we already have layer 2 authentication and mobile
may be forced to do that in certain environments (but it may
as well not do be). What is the auth/authorization mechanism
available at layer 3? How can the access router control the
roaming node from attaching and using its services? This is
the functionality that I am looking at tying with MIP signalling
to be used by access router.

-a

---

From: Alpesh <[email-masked]>
Date: Thu, 11 Sep 2003 16:44:43 -0700

Jari:

> without having to have a special access router where you

I understand that L2 authentication may or may not be present. I am
not talking about "special access router" , but just some additional
functionality in access router (which is present anyway).

My concern is with Layer3 authentication/authorization for the mobile 
node. If
there is a mechanism available to tie the L2 
authentication/authorization with L3
authentication/authorization, I am okay with that (can you point me to 
something
in that direction?).

With MIP and existing NAS infrastructure - when would you do NAS 
authen/authorization
 for L3 access - before/after MIP signalling?
-a

---

From: Greg Daley <[email-masked]>
Date: Fri, 12 Sep 2003 13:49:54 +1000

Hi Alpesh,

There's really no need to tie this into mobileip.

A host may have no globally addresed unicast
sessions which require mobileip signalling,
but still need access link authentication to prevent
it from causing multicast routing changes within the
access network.

currently PANA WG is looking at providing authentication protocol
transport for when the access router is used as a choke point.
Other protocols back-ending to AAA services are appropriate
if link-layer devices are the chokes.

This is orthogonal to the requirement to provide consistent
unicast addressing for upper layer protocol sessions,
which is the purpose of Mobile IPv6.

Greg Daley