Subject: RE: [Mip6] Issue with mipv6 charter

From: Soliman Hesham <[email-masked]>
Date: Wed, 24 Sep 2003 20:53:27 -0400

Gopal, 

Mohan's email below is a good summary. I don't 
see any latency issues in either of the cases listed 
below. At boot up it's a non issue and after that you
use CT, which is needed anyway. 

Also, whether authentication is carried on L2 or L3
it _is_ authenticating for network access and 
for charging. Some people chose to do it on L2 (actually
pretty much everyone chose that) but that doesn't mean
you need another L3 protocol on top. Of course, if we're 
starting fresh we could start with a L3 authentication 
mechanism that can bootstrap L2 security. This is where 
I think PANA will be useful. 

Hesham

 > -----Original Message-----
 > From: Mohan Parthasarathy [mailto:[email-masked]]
 > Sent: Wednesday, September 24, 2003 3:20 PM
 > To: Soliman Hesham; 'Alpesh'; [email-masked]; Gopal Dommety
 > Subject: Re: [Mip6] Issue with mipv6 charter
 > 
 > 
 >  Gopal,
 > 
 > Last time this issue was discussed, there were two cases.
 > 
 > 1) MN booting up in a visited network.
 > 2) MN moving in a visited network.
 > 
 > For (1) the latency is not a big issue. For (2), James 
 > replied earlier that
 > Seamoby is looking at
 > context transfer protocol which might be useful here.
 > 
 > So depending on how you classify your items below, we may 
 > not need anything
 > special.
 > 
 > -mohan
 > 
 > 
 > 
 > >
 > >    AP is a bridge and performs L2 access authentication.
 > > It need not have much of L3 knowledge.  It does not matter
 > > what you are using for authentication (NAI/MAC address). 
 > It is still L2
 > >   authentication, since it allows L2 access (There are 
 > systems such as
 > >   Public Access where L3 access has an additional authentication,
 > > That is when L3 access control happens).
 > >
 > > I am not saying that access control cannot be done by some 
 > other protocol
 > > or independent of Mobility.
 > > I think it is a good idea to keep them separate in some 
 > environments.
 > > However,  I think it adds to latency (that might not be 
 > acceptable) in
 > > other environments.
 > > For example, one needs to perform L2 authentication (can 
 > be optional),
 > then
 > > L3 access
 > > control (today some systems do this with http for lack of a better
 > protocol
 > > ), then you need to perform MIP.
 > > I feel that some environments benefit from MIP having 
 > access control (I am
 > > not saying that this is always desirable).
 > >
 > > Look at the following 3 environments:
 > >
 > > 1. Take CDMA for example, what about clients with mobile 
 > IP service?.
 > > They  benefits from Access control in MIPv4 (Mobile IP
 > > service deployed today).
 > >
 >  > 2. Take Public access WLANs, they use http for access control.
 > >
 > > 3. One way to get VoIP over WLAN today is to use MIP
 > > in WLAN envs  with no L2 authentication (only way to get 
 > decent roam times
 > > (with out CCKM or TKIP). I think MIP having access control
 > >
 > > I am fine with leaving this access control from MIP6 
 > charter for now (for
 > I
 > > think
 > > that when the time is right, some deployments will  mandate it. I
 > understand
 > >   why you feel that Access control at MIP level is not 
 > important in GPRS
 > > like environment.
 > >
 > >
 > > Thanks
 > > Gopal
 > >
 > >
 > >
 > > At 10:07 PM 9/23/2003 -0400, Soliman Hesham wrote:
 > >
 > > >  > I cam of the opinion that  802.1x authentication based
 > > >  > authentication is L2
 > > >  > authentication
 > > >  > It typically terminates on the AP and not on the access
 > > >  > router. Typically
 > > >  > AP is like a bridge. (PANA is another story).
 > > >
 > > >=> (I'll drift slightly off topic here but hopefully
 > > >it helps). You call it L2 authentication because it
 > > >is transported over L2. However, it is actually authenticating
 > > >a much higher layer identifier (NAI). So there is some layer
 > > >violation here but people don't seem to be keen on changing
 > > >that. That's why I thought PANA was a step in the right direction.
 > > >
 > > >  >
 > > >  > Anyway, what I am trying to ask is whether there needs to be
 > > >  > a L3 access
 > > >  > control point
 > > >  > (if I can use that term) to help in authentication, access
 > > >  > control, roaming
 > > >  > etc. I think this is useful in service
 > > >  > provider environments (CDMA 2000 for example).
 > > >
 > > >=> I agree with the need for an L3 access control point
 > > >and that it would be useful for several systems. However,
 > > >since such function is needed independently of mobility,
 > > >it should not be included inside a mobility protocol.
 > > >For instance, you refer to CDMA 2000 which offers a Simple
 > > >IP service where no mobility is needed in the terminal.
 > > >Also, other systems (e.g. GPRS) do not require MIP, yet
 > > >they still need this function. In fact, WLANs today are
 > > >deployed in a way that doesn't require the use of MIP,
 > > >yet they still need this function. So, including this function
 > > >in MIP does not seem useful.
 > > >
 > > >Hesham
 > > >
 > > >
 > > >  >
 > > >  >
 > > >  > Thanks
 > > >  > Gopal
 > > >  >
 > > >  >
 > > >  > At 10:02 PM 9/14/2003 -0400, Soliman Hesham wrote:
 > > >  >
 > > >  >
 > > >  > >  > I am assuming that Alpesh is trying to get some 
 > level of network
 > > >  > >  > authentication/authorization via MIP signalling.
 > > >  > >  >
 > > >  > >  > I am assuming you mean NAS (network Access 
 > server), in which
 > > >  > >  > case what is
 > > >  > >  > the protocol that you
 > > >  > >  > have in mind for L3 authentication/authorization?
 > > >  > (assuming that L2
 > > >  > >  > authentication/authorization may or may not exist).
 > > >  > >
 > > >  > >=> I'm not quite sure what you mean because people
 > > >  > >are running L3 authentication into L2 packets.
 > > >  > >So, naturally, the authentication is L2-dependent
 > > >  > >today (perhaps EAP is an exception). So to answer
 > > >  > >your question, you can use: EAP, PPP, AKA, ...etc depending
 > > >  > >on your link. If you don't want to depend on the
 > > >  > >link layer, use EAP over layer 4, i.e. use PANA
 > > >  > >when it's done.
 > > >  > >
 > > >  > >Hesham
 > > >  > >
 > > >  > >
 > > >  > >  >
 > > >  > >  > Thanks
 > > >  > >  > Gopal
 > > >  > >  >
 > > >  > >  >
 > > >  > >  > At 04:36 PM 9/10/2003 -0400, Soliman Hesham wrote:
 > > >  > >  >
 > > >  > >  >
 > > >  > >  > >  > Wondering if the charter should include an 
 > entity in the
 > > >  > >  > >  > visited domain/roaming network to aid in 
 > AAA/Diameter
 > > >  > >  > authentication,
 > > >  > >  > >  > access control etc?
 > > >  > >  > >
 > > >  > >  > >=> a NAS ? ;) The description of this entity doesn't
 > > >  > >  > >seem to be related to mobility in any way. I think
 > > >  > >  > >this work is generic for fixed and mobile nodes.
 > > >  > >  > >
 > > >  > >  > >    Currently, there is little, if any mechanism
 > > >  > >  > >  > to restrict a mobile node's activities in 
 > visited domain.
 > > >  > >  > >
 > > >  > >  > >=> Why do you say that? A NAS will do this job very well
 > > >  > >  > >provided that AAA mechanisms and roaming agreements
 > > >  > >  > >are in place.
 > > >  > >  > >
 > > >  > >  > >  > For practical deployment issues and network
 > > >  > management/control
 > > >  > >  > >  > purposes, I think such an entity is needed.
 > > >  > >  > >
 > > >  > >  > >=> Absolutely, but MIP6 has nothing to do with it.
 > > >  > >  > >
 > > >  > >  > >Hesham
 > > >  > >  > >
 > > >  > >  > >_______________________________________________
 > > >  > >  > >Mip6 mailing list
 > > >  > >  > >[email-masked]
 > > >  > >  > >https://www.ietf.org/mailman/listinfo/mip6
 > > >  > >  >
 > > >  > >
 > > >  > >_______________________________________________
 > > >  > >Mip6 mailing list
 > > >  > >[email-masked]
 > > >  > >https://www.ietf.org/mailman/listinfo/mip6
 > > >  >
 > >
 > >
 > > _______________________________________________
 > > Mip6 mailing list
 > > [email-masked]
 > > https://www.ietf.org/mailman/listinfo/mip6
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Alpesh <[email-masked]>
Date: Mon, 29 Sep 2003 13:18:06 -0700

Hesham and others:

I still have my reservations to this - mostly arising out of latency,
cross layer authentication (and dependency there on - not a
strong opponent).

On the other hand, I am pretty much hearing the vote to leave
this issue outside the current charter and see how the work in
other WGs can solve/mitigate the issues for MiPv6 authentication.

We can leave it outside the charter.

-a