Subject: Re: [Mip6] comments on draft-giaretta-mip6-authorization-eap-00.txt

From: Rafa Marin Lopez <[email-masked]>
Date: Fri, 16 Apr 2004 23:21:14 +0200

Hello Gerardo

I would like to do a question about interaction between AAA server and 
HA. As you comment in your draft, you use a new Diameter application in 
order to communicate AAA and HA each other. My question is: could SNMPv3 
be used instead of this new application by using 
<draft-ietf-mip6-mipv6-mib-01.txt> specification.

Regards.

Giaretta Gerardo wrote:

>Hi Jari and Franck,
>
>  
>
>>Technically, this is not exactly the case. There is no reason 
>>why you'd
>>have to bind network access and mobility service together. In fact,
>>doing so may limit the deployment of mobility to only those locations
>>which offer a sufficiently updated network service, AAA 
>>infrastructure,
>>and are willing to provide this service.
>>
>>Don't get me wrong -- I think AAA support for MIPv6 would be a good
>>thing. Just that I think the stated reason is not as you write above.
>>I believe the reason has more to do with the ease at which you can
>>enroll yourself to a "Mobile IPv6" service. Here AAA can help, in
>>different ways, not all necessarily binding access and mobility to
>>each other.
>>
>>    
>>
>
>This is exactly what I would say in my previous post (maybe I have been less clear). 	
>I think that network access authorization and "Mobile IPv6 service" authorization should not be bound together; indeed I think it is desirable to authorize the use of "Mobile IPv6" service separately from the network access authorization.
>
>  
>
>>To give you a practical example, the use of EAP authentication is
>>currently popular in many planned networks and protocols, such as
>>802.11 or PANA. Now, if you mobile node is doing EAP FOO 
>>authentication
>>to get access, would we really need anything else than a way to
>>do EAP FOO with your home agent as well? Both the access network
>>and the home agent could then, independently, contact the user's
>>authentication server using AAA protocols such as RADIUS or Diameter.
>>    
>>
>
>I think this could be a very good approach... 
>
>  
>
>>>   The Diameter Mobile IPv6 Application is a new 
>>>      
>>>
>>application extension
>>
>>Does this mean that a network which currently offers e.g. 802.11i +
>>RADIUS + IPv6 would be unable to support Mobile IPv6 until the network
>>has been upgraded to use Diameter? I would really like to promote
>>Diameter usage, but realistically, I think we need assume 
>>that existing
>>AAA networks are used too, and we should try to place as little new
>>requirements on them as possible.
>>
>>For instance, is there a way where we could accommodate MIPv6 AAA
>>requirements without requiring more than RADIUS EAP or Diameter EAP
>>support at the AAA infrastructure? Or can we make some parts of the
>>AAA exchange optional, so that you get *some* functionality even
>>if you just do basic 802.1X + RADIUS.
>>
>>    
>>
>
>Well, I know we are talking about requirements and not about solutions, but we have proposed (see http://www.ietf.org/internet-drafts/draft-giaretta-mip6-authorization-eap-00.txt) a way to authorize and configure Mobile IPv6 based on EAP. MIPv6 information are carried by EAP-TLV and for this reason the solution requires only RADIUS EAP or Diameter EAP. Only AAAH - HA communication needs a new Diameter Application. Moreover, also this new application could be avoided if, as you said, we have a way to do EAP between MN and HA.
>
>Regards,
>
>--Gerardo
>
>
>====================================================================
>CONFIDENTIALITY NOTICE
>This message and its attachments are addressed solely to the persons
>above and may contain confidential information. If you have received
>the message in error, be informed that any use of the content hereof
>is prohibited. Please return it immediately to the sender and delete
>the message. Should you have any questions, please contact us by
>replying to [email-masked]. Thank you
>====================================================================
>
>_______________________________________________
>Mip6 mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/mip6
>
>
>  
>

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: [email-masked]
------------------------------------------------------ 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Giaretta Gerardo <[email-masked]>
Date: Wed, 21 Apr 2004 17:01:29 +0200

Hi Rafa,

I think that SNMPv3 might be useful to collect accounting information
from the HA and for configuration purposes, using MIPv6 MIBs defined in
draft-ietf-mip6-mipv6-mib-01.txt and eventually some other MIBs for PSK
delivery. 
However, as pointed out in rfc 3127, SNMPv3 is not suitable for
authorization purposes. I think this is the main issue regarding the
usage of SNMPv3 in the commmunication between HA and AAAH, since the HA
has to perform some authorization stuff. For example, the HA sends an
Authorization Refresh Request to the AAAH server to refresh the MIPv6
service authorization as the authorization lifetime is going to expire. 

Regards,
--Gerardo

> -----Original Message-----
> From: Rafa Marin Lopez [mailto:[email-masked]] 
> Sent: Friday, April 16, 2004 11:21 PM
> To: Giaretta Gerardo
> Cc: [email-masked]
> Subject: Re: [Mip6] comments on 
> draft-giaretta-mip6-authorization-eap-00.txt
> 
> 
> Hello Gerardo
> 
> >I think that network access authorization and "Mobile IPv6 service" 
> >authorization should not be bound together; indeed I think it is 
> >desirable to authorize the use of "Mobile IPv6" service 
> separately from 
> >the network access authorization.
> >
> >  
> >
> >>authentication to get access, would we really need anything 
> else than 
> >>a way to do EAP FOO with your home agent as well? Both the access 
> >>network and the home agent could then, independently, contact the 
> >>user's authentication server using AAA protocols such as RADIUS or 
> >>Diameter.
> >>    
> >>
> >
> >>Diameter usage, but realistically, I think we need assume that 
> >>existing AAA networks are used too, and we should try to place as 
> >>little new requirements on them as possible.
> >>
> >>AAA exchange optional, so that you get *some* functionality even if 
> >>you just do basic 802.1X + RADIUS.
> >>
> >>    
> >>
> >
> >Well, I know we are talking about requirements and not about 
> solutions, 
> >but we have proposed (see 
> >http://www.ietf.org/internet-drafts/draft-giaretta-mip6-autho
rization-e
>ap-00.txt) a way to authorize and configure Mobile IPv6 based on EAP. 
>MIPv6 information are carried by EAP-TLV and for this reason the 
>solution requires only RADIUS EAP or Diameter EAP. Only AAAH - HA 
>communication needs a new Diameter Application. Moreover, also this new

>application could be avoided if, as you said, we have a way to do EAP 
>between MN and HA.
>
>Regards,
>
>--Gerardo
>
>
>the message in error, be informed that any use of the content hereof is

>prohibited. Please return it immediately to the sender and delete the 
>message. Should you have any questions, please contact us by replying 
>to [email-masked]. Thank you 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.