Subject: RE: [Mip6] Issue with mipv6 charter

From: Soliman Hesham <[email-masked]>
Date: Sun, 14 Sep 2003 22:02:04 -0400

> I am assuming that Alpesh is trying to get some level of network 
 > authentication/authorization via MIP signalling.
 > 
 > I am assuming you mean NAS (network Access server), in which 
 > case what is 
 > the protocol that you
 > have in mind for L3 authentication/authorization? (assuming that L2 
 > authentication/authorization may or may not exist).

=> I'm not quite sure what you mean because people
are running L3 authentication into L2 packets.
So, naturally, the authentication is L2-dependent
today (perhaps EAP is an exception). So to answer
your question, you can use: EAP, PPP, AKA, ...etc depending
on your link. If you don't want to depend on the 
link layer, use EAP over layer 4, i.e. use PANA
when it's done.

Hesham

 > 
 > Thanks
 > Gopal
 > 
 > 
 > At 04:36 PM 9/10/2003 -0400, Soliman Hesham wrote:
 > 
 > 
 > >  > Wondering if the charter should include an entity in the
 > >  > visited domain/roaming network to aid in AAA/Diameter 
 > authentication,
 > >  > access control etc?
 > >
 > >=> a NAS ? ;) The description of this entity doesn't
 > >seem to be related to mobility in any way. I think
 > >this work is generic for fixed and mobile nodes.
 > >
 > >    Currently, there is little, if any mechanism
 > >  > to restrict a mobile node's activities in visited domain.
 > >
 > >=> Why do you say that? A NAS will do this job very well
 > >provided that AAA mechanisms and roaming agreements
 > >are in place.
 > >
 > >  > For practical deployment issues and network management/control
 > >  > purposes, I think such an entity is needed.
 > >
 > >=> Absolutely, but MIP6 has nothing to do with it.
 > >
 > >Hesham
 > >
 > >_______________________________________________
 > >Mip6 mailing list
 > >[email-masked]
 > >https://www.ietf.org/mailman/listinfo/mip6
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Gopal Dommety <[email-masked]>
Date: Tue, 23 Sep 2003 18:29:37 -0700

Hesham,

Sorry for the delay.

I cam of the opinion that  802.1x authentication based authentication is L2 
authentication
It typically terminates on the AP and not on the access router. Typically 
AP is like a bridge. (PANA is another story).

Anyway, what I am trying to ask is whether there needs to be a L3 access 
control point
(if I can use that term) to help in authentication, access control, roaming 
etc. I think this is useful in service
provider environments (CDMA 2000 for example).

Thanks
Gopal

---

From: Thierry Ernst <[email-masked]>
Date: Wed, 24 Sep 2003 11:50:40 +0900

Dear all,

I'm sorry I didn't have the time to follow the discussion on the list
recently, so I may be mistaken.

I didn't see anything related to interface switiching mechanisms for
mobile hosts, is this something that could be considered in the
definition of the new charter ? I consider this mechanism as
tremendously important if we want to fully deploy mobility.

Thierry

---

From: "James Kempf" <[email-masked]>
Date: Wed, 24 Sep 2003 08:54:02 -0700

Hi Gopal,

I think there is probably some work to be done in authentication for MIPv6,
but I don't believe that it is at the MIP protocol level in the access
network. That should be handled by L2 authentication or PANA. The kind of
work I have in mind are Diameter extensions or possibly just Diameter/Radius
AVPs that allow interoperable authentication among roaming clients. To my
knowledge, the current Diameter MIP extension is IPv4 only, and I believe
3GPP2 uses some kind of Radius extension now though I don't know whether
that is IPv4 or version independent. There is also a question of how this
authentication interacts with the IKE setup back on the home agent.
Currently, if the mobile host authenticates via, say, an L2 protocol in the
access network to the NAS and Radius from the NAS to the foreign and home
network AAA servers, the only way the home agent would know that the client
is authenticated is via some kind of back end API between the home AAA
server and home agent. That is, there is no interaction at the protocol
level between, say, ESP Auth and the AAA auth that ties the IKE session
required for securing the MIP link to the AAA.

On another, more advanced level, the ability to dynamically obtain
bidirectionally authenticated MIPv6 service from a dynamically discovered
home agent in a foreign network might be of interest to carriers, and this
might require some work, possibly with IKEv2 and/or the above
Diameter/Radius extensions. I know there has been a good deal of interest
from 3GPP2 in this for MIPv4.

At any rate, I'm not sure whether it makes sense to put this in the charter
at this point. IMHO, the charter already has a lot of items and the schedule
for completing them is very aggressive (overly so, I think, given the number
of items). I do belive there is some interesting technical work here, that
could result in a very useful draft: examining requirements, how existing
mechanisms match them, and identifying where additional work is necessary,
and I think such a draft would necessarily require review by the MIP group.
If that review identifies some action items that require work on the MIPv6
protocol, that would be the time to think about adding them to the charter.

            jak

----- Original Message ----- 
From: "Gopal Dommety" <[email-masked]>
To: "Soliman Hesham" <[email-masked]>; "'Alpesh'" <[email-masked]>;
<[email-masked]>
Sent: Tuesday, September 23, 2003 6:29 PM
Subject: RE: [Mip6] Issue with mipv6 charter

---

From: Gopal Dommety <[email-masked]>
Date: Wed, 24 Sep 2003 09:26:09 -0700

James,

I agree that we could leave it out  for now...

thanks
-Gopal