Subject: [Mip6] Issue with mipv6 charter

From: Alpesh <[email-masked]>
Date: Wed, 10 Sep 2003 13:21:04 -0700

WG Folks:

Wondering if the charter should include an entity in the
visited domain/roaming network to aid in AAA/Diameter authentication,
access control etc? Currently, there is little, if any mechanism
to restrict a mobile node's activities in visited domain.

For practical deployment issues and network management/control
purposes, I think such an entity is needed.

Anyone else thinking on similar lines?

Alpesh

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Soliman Hesham <[email-masked]>
Date: Wed, 10 Sep 2003 16:36:23 -0400

> access control etc? 

=> a NAS ? ;) The description of this entity doesn't 
seem to be related to mobility in any way. I think
this work is generic for fixed and mobile nodes.

   Currently, there is little, if any mechanism
 > to restrict a mobile node's activities in visited domain.

=> Why do you say that? A NAS will do this job very well
provided that AAA mechanisms and roaming agreements 
are in place. 

 > purposes, I think such an entity is needed.

=> Absolutely, but MIP6 has nothing to do with it.

Hesham

---

From: Gopal Dommety <[email-masked]>
Date: Thu, 11 Sep 2003 16:18:51 -0700

Hesham,

I am assuming that Alpesh is trying to get some level of network 
authentication/authorization via MIP signalling.

I am assuming you mean NAS (network Access server), in which case what is 
the protocol that you
have in mind for L3 authentication/authorization? (assuming that L2 
authentication/authorization may or may not exist).

Thanks
Gopal

---

From: [email-masked]
Date: Thu, 11 Sep 2003 21:58:51 -0500

PANA is a possible solution for authentication at Layer 3 to the access router. So please
take a look at the PANA WG.
 
-Basavaraj

 Raj:

My point is we already have layer 2 authentication and mobile
may be forced to do that in certain environments (but it may 
as well not do be). What is the auth/authorization mechanism
available at layer 3? How can the access router control the
roaming node from attaching and using its services? This is
the functionality that I am looking at tying with MIP signalling
to be used by access router.

-a

---

From: Soliman Hesham <[email-masked]>
Date: Tue, 23 Sep 2003 22:07:21 -0400

> I cam of the opinion that  802.1x authentication based 
 > authentication is L2 
 > authentication
 > It typically terminates on the AP and not on the access 
 > router. Typically 
 > AP is like a bridge. (PANA is another story).

=> (I'll drift slightly off topic here but hopefully 
it helps). You call it L2 authentication because it 
is transported over L2. However, it is actually authenticating
a much higher layer identifier (NAI). So there is some layer
violation here but people don't seem to be keen on changing
that. That's why I thought PANA was a step in the right direction.

 > 
 > Anyway, what I am trying to ask is whether there needs to be 
 > a L3 access 
 > control point
 > (if I can use that term) to help in authentication, access 
 > control, roaming 
 > etc. I think this is useful in service
 > provider environments (CDMA 2000 for example).

=> I agree with the need for an L3 access control point
and that it would be useful for several systems. However, 
since such function is needed independently of mobility, 
it should not be included inside a mobility protocol. 
For instance, you refer to CDMA 2000 which offers a Simple
IP service where no mobility is needed in the terminal.
Also, other systems (e.g. GPRS) do not require MIP, yet
they still need this function. In fact, WLANs today are 
deployed in a way that doesn't require the use of MIP, 
yet they still need this function. So, including this function
in MIP does not seem useful. 

Hesham

 > 
 > 
 > Thanks
 > Gopal
 > 
 > 
 > At 10:02 PM 9/14/2003 -0400, Soliman Hesham wrote:
 > 
 > 
 > >=> I'm not quite sure what you mean because people
 > >are running L3 authentication into L2 packets.
 > >So, naturally, the authentication is L2-dependent
 > >today (perhaps EAP is an exception). So to answer
 > >your question, you can use: EAP, PPP, AKA, ...etc depending
 > >on your link. If you don't want to depend on the
 > >link layer, use EAP over layer 4, i.e. use PANA
 > >when it's done.
 > >
 > >Hesham
 > >
 > >
 > >  >
 > >  > Thanks
 > >  > Gopal
 > >  >
 > >  >

---

From: Gopal Dommety <[email-masked]>
Date: Thu, 25 Sep 2003 09:44:29 -0700

Hesham,

If there is CT enabled on the edges and there is another access
  control protocol, then it helps (big ifs in my opinion).
Anyway, let us drop this item for now.

Thanks for the comments
Gopal

At 08:53 PM 9/24/2003 -0400, Soliman Hesham wrote:
>Gopal,
>
>Mohan's email below is a good summary. I don't
>see any latency issues in either of the cases listed
>below. At boot up it's a non issue and after that you
>use CT, which is needed anyway.
>
>Also, whether authentication is carried on L2 or L3
>it _is_ authenticating for network access and
>for charging. Some people chose to do it on L2 (actually
>pretty much everyone chose that) but that doesn't mean
>you need another L3 protocol on top. Of course, if we're
>starting fresh we could start with a L3 authentication
>mechanism that can bootstrap L2 security. This is where
>I think PANA will be useful.
>
>Hesham
>
>  > -----Original Message-----
>  > From: Mohan Parthasarathy [mailto:[email-masked]]
>  > Sent: Wednesday, September 24, 2003 3:20 PM
>  > To: Soliman Hesham; 'Alpesh'; [email-masked]; Gopal Dommety
>  > Subject: Re: [Mip6] Issue with mipv6 charter
>  >
>  >
>  >  Gopal,
>  >
>  > Last time this issue was discussed, there were two cases.
>  >
>  > 1) MN booting up in a visited network.
>  > 2) MN moving in a visited network.
>  >
>  > For (1) the latency is not a big issue. For (2), James
>  > replied earlier that
>  > Seamoby is looking at
>  > context transfer protocol which might be useful here.
>  >
>  > So depending on how you classify your items below, we may
>  > not need anything
>  > special.
>  >
>  > -mohan
>  >
>  >
>  >
>  > >
>  > >    AP is a bridge and performs L2 access authentication.
>  > > It need not have much of L3 knowledge.  It does not matter
>  > > what you are using for authentication (NAI/MAC address).
>  > It is still L2
>  > >   authentication, since it allows L2 access (There are
>  > systems such as
>  > >   Public Access where L3 access has an additional authentication,
>  > > That is when L3 access control happens).
>  > >
>  > > I am not saying that access control cannot be done by some
>  > other protocol
>  > > or independent of Mobility.
>  > > I think it is a good idea to keep them separate in some
>  > environments.
>  > > However,  I think it adds to latency (that might not be
>  > acceptable) in
>  > > other environments.
>  > > For example, one needs to perform L2 authentication (can
>  > be optional),
>  > then
>  > > L3 access
>  > > control (today some systems do this with http for lack of a better
>  > protocol
>  > > ), then you need to perform MIP.
>  > > I feel that some environments benefit from MIP having
>  > access control (I am
>  > > not saying that this is always desirable).
>  > >
>  > > Look at the following 3 environments:
>  > >
>  > > 1. Take CDMA for example, what about clients with mobile
>  > IP service?.
>  > > They  benefits from Access control in MIPv4 (Mobile IP
>  > > service deployed today).
>  > >
>  >  > 2. Take Public access WLANs, they use http for access control.
>  > >
>  > > 3. One way to get VoIP over WLAN today is to use MIP
>  > > in WLAN envs  with no L2 authentication (only way to get
>  > decent roam times
>  > > (with out CCKM or TKIP). I think MIP having access control
>  > >
>  > > I am fine with leaving this access control from MIP6
>  > charter for now (for
>  > I
>  > > think
>  > > that when the time is right, some deployments will  mandate it. I
>  > understand
>  > >   why you feel that Access control at MIP level is not
>  > important in GPRS
>  > > like environment.
>  > >
>  > >
>  > > Thanks
>  > > Gopal
>  > >
>  > >
>  > >
>  > > At 10:07 PM 9/23/2003 -0400, Soliman Hesham wrote:
>  > >
>  > > >  > >  > I am assuming you mean NAS (network Access
>  > server), in which
>  > > >  > >  > case what is
>  > > >  > >  > the protocol that you
>  > > >  > >  > >  > visited domain/roaming network to aid in
>  > AAA/Diameter
>  > > >  > >  > authentication,
>  > > >  > >  > >  > access control etc?
>  > > >  > >  > >