Subject: RE: [Mip6] Issue with mipv6 charter

From: Gopal Dommety <[email-masked]>
Date: Wed, 24 Sep 2003 08:48:39 -0700

Hesham,

Two comments:

   AP is a bridge and performs L2 access authentication.
It need not have much of L3 knowledge.  It does not matter
what you are using for authentication (NAI/MAC address). It is still L2
  authentication, since it allows L2 access (There are systems such as
  Public Access where L3 access has an additional authentication,
That is when L3 access control happens).

I am not saying that access control cannot be done by some other protocol 
or independent of Mobility.
I think it is a good idea to keep them separate in some environments. 
However,  I think it adds to latency (that might not be acceptable) in 
other environments.
For example, one needs to perform L2 authentication (can be optional), then 
L3 access
control (today some systems do this with http for lack of a better protocol 
), then you need to perform MIP.
I feel that some environments benefit from MIP having access control (I am 
not saying that this is always desirable).

Look at the following 3 environments:

1. Take CDMA for example, what about clients with mobile IP service?. 
They  benefits from Access control in MIPv4 (Mobile IP
service deployed today).

2. Take Public access WLANs, they use http for access control.

3. One way to get VoIP over WLAN today is to use MIP
in WLAN envs  with no L2 authentication (only way to get decent roam times
(with out CCKM or TKIP). I think MIP having access control

I am fine with leaving this access control from MIP6 charter for now (for I 
think
that when the time is right, some deployments will  mandate it. I understand
  why you feel that Access control at MIP level is not important in GPRS 
like environment.

Thanks
Gopal

At 10:07 PM 9/23/2003 -0400, Soliman Hesham wrote:

>  > I cam of the opinion that  802.1x authentication based
>  > authentication is L2
>  > authentication
>  > It typically terminates on the AP and not on the access
>  > router. Typically
>  > AP is like a bridge. (PANA is another story).
>
>=> (I'll drift slightly off topic here but hopefully
>it helps). You call it L2 authentication because it
>is transported over L2. However, it is actually authenticating
>a much higher layer identifier (NAI). So there is some layer
>violation here but people don't seem to be keen on changing
>that. That's why I thought PANA was a step in the right direction.
>
>  >
>  > Anyway, what I am trying to ask is whether there needs to be
>  > a L3 access
>  > control point
>  > (if I can use that term) to help in authentication, access
>  > control, roaming
>  > etc. I think this is useful in service
>  > provider environments (CDMA 2000 for example).
>
>=> I agree with the need for an L3 access control point
>and that it would be useful for several systems. However,
>since such function is needed independently of mobility,
>it should not be included inside a mobility protocol.
>For instance, you refer to CDMA 2000 which offers a Simple
>IP service where no mobility is needed in the terminal.
>Also, other systems (e.g. GPRS) do not require MIP, yet
>they still need this function. In fact, WLANs today are
>deployed in a way that doesn't require the use of MIP,
>yet they still need this function. So, including this function
>in MIP does not seem useful.
>
>Hesham
>
>
>  >
>  >
>  > Thanks
>  > Gopal
>  >
>  >
>  > At 10:02 PM 9/14/2003 -0400, Soliman Hesham wrote:
>  >
>  >
>  > >  > I am assuming that Alpesh is trying to get some level of network
>  > >  > authentication/authorization via MIP signalling.
>  > >  >
>  > >  > I am assuming you mean NAS (network Access server), in which
>  > >  > case what is
>  > >  > the protocol that you
>  > >  > have in mind for L3 authentication/authorization?
>  > (assuming that L2
>  > >  > authentication/authorization may or may not exist).
>  > >
>  > >=> I'm not quite sure what you mean because people
>  > >are running L3 authentication into L2 packets.
>  > >So, naturally, the authentication is L2-dependent
>  > >today (perhaps EAP is an exception). So to answer
>  > >your question, you can use: EAP, PPP, AKA, ...etc depending
>  > >on your link. If you don't want to depend on the
>  > >link layer, use EAP over layer 4, i.e. use PANA
>  > >when it's done.
>  > >
>  > >Hesham
>  > >
>  > >
>  > >  >
>  > >  > Thanks
>  > >  > Gopal
>  > >  >
>  > >  >
>  > >  > At 04:36 PM 9/10/2003 -0400, Soliman Hesham wrote:
>  > >  >
>  > >  >
>  > >  > >  > Wondering if the charter should include an entity in the
>  > >  > >  > visited domain/roaming network to aid in AAA/Diameter
>  > >  > authentication,
>  > >  > >  > access control etc?
>  > >  > >
>  > >  > >=> a NAS ? ;) The description of this entity doesn't
>  > >  > >seem to be related to mobility in any way. I think
>  > >  > >this work is generic for fixed and mobile nodes.
>  > >  > >
>  > >  > >    Currently, there is little, if any mechanism
>  > >  > >  > to restrict a mobile node's activities in visited domain.
>  > >  > >
>  > >  > >=> Why do you say that? A NAS will do this job very well
>  > >  > >provided that AAA mechanisms and roaming agreements
>  > >  > >are in place.
>  > >  > >
>  > >  > >  > For practical deployment issues and network
>  > management/control
>  > >  > >  > purposes, I think such an entity is needed.
>  > >  > >
>  > >  > >=> Absolutely, but MIP6 has nothing to do with it.
>  > >  > >
>  > >  > >Hesham
>  > >  > >
>  > >  > >_______________________________________________
>  > >  > >Mip6 mailing list
>  > >  > >[email-masked]
>  > >  > >https://www.ietf.org/mailman/listinfo/mip6
>  > >  >
>  > >
>  > >_______________________________________________
>  > >Mip6 mailing list
>  > >[email-masked]
>  > >https://www.ietf.org/mailman/listinfo/mip6
>  >

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 24 Sep 2003 12:19:53 -0700

Gopal,

Last time this issue was discussed, there were two cases.

1) MN booting up in a visited network.
2) MN moving in a visited network.

For (1) the latency is not a big issue. For (2), James replied earlier that
Seamoby is looking at
context transfer protocol which might be useful here.

So depending on how you classify your items below, we may not need anything
special.

-mohan