Subject: RE: [Mip6] comments on chakrabarti-mip6-bmip

From: "Soliman, Hesham" <[email-masked]>
Date: Thu, 9 Dec 2004 10:59:21 -0500

Sorry, late comment.

 > This is an interesting I-D for "discovering HA" part of MIP6
 > bootstrapping problem. Instead of knowing a home subnet or IPv6
 > addresses of home agents, knowing the domain name is 
 > sufficient to learn
 > HA addresses. 
 > 
 > I think for the "AAA" discussions, the document should clearly state
 > what AAA-enabled service is being addressed. The implicit 
 > assumption is
 > that it refers to "AAA for network access service". But in 
 > fact, there
 > is also "AAA for Mobile IPv6 service", and I'm not sure if a complete
 > solution can be developed without that. The I-D is not 
 > discussing how MN
 > is authenticated/authorized for the mobility service.

=> One general point to note here is that the "Mobility service"
has its own method built in for authentication/authorisation.
So, while AAA can be leveraged for authentication and authorisation
for many services, this doesn't mean it has to. 

Hesham

 > 
 > It is not likely that an HA learned via DNS would already have
 > authentication/authorization information for the MN. Hence, even a
 > DNS-learned HA is likely to rely on a MIP6-AAA application to
 > authenticate the MN. Please see draft-yegin-mip6-aaa-fwk-00.txt. And
 > (imho) real value of IKEv2 is that it allows use of EAP, 
 > which fits into
 > MN-HA-AAA model described in mip6-aaa-fwk I-D. Not a standard, but
 > products already assign IP addresses via IKEv1. 
 > 
 > Alper
 > 
 > 
 > 
 > _______________________________________________
 > Mip6 mailing list
 > [email-masked]
 > https://www1.ietf.org/mailman/listinfo/mip6
 > 

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alper Yegin <[email-masked]>
Date: Thu, 09 Dec 2004 10:23:15 -0800

Hi Hesham,

> has its own method built in for authentication/authorisation.

Yes, and that stops at HA. If HA does not know anything about the MN,
then we need something else in there (HA-AAA interaction).

> for many services, this doesn't mean it has to.

I said that in the context of bootstrapping -- discovering a HA via DNS,
and getting Mobile IPv6 service from it. Can we always assume that MN
has a pre-established SA with all such possible HAs? If not, we still
need to get HA in touch with some server that knows MN. That's what I
was referring to as "AAA for Mobile IPv6 service". 

Do you have some alternative thoughts?

Alper

> This email may contain confidential and privileged material for the
sole
> use

---

From: "James Kempf" <[email-masked]>
Date: Thu, 9 Dec 2004 11:28:01 -0800

> Do you have some alternative thoughts?

Well, the HA could use LDAP or some other protocol, as long as there's no
interdomain traffic. It's like the relationship between the PAA and
authentication server in the PANA architecture
(draft-ietf-pana-framework-02.txt, Section 3, paragraph 5).

            jak

---

From: Alper Yegin <[email-masked]>
Date: Thu, 09 Dec 2004 16:01:32 -0800

> (draft-ietf-pana-framework-02.txt, Section 3, paragraph 5).

Sure, that would be one way to implement a "AAA for Mobile IPv6
service". Writing a AAA for Mobile IPv6 application over LDAP is an
alternative to doing that over RADIUS or Diameter. In the context of
IETF, the latter two are the protocols of choice though.

We agree.

Alper