Subject: Re: [mobile-ip] RFC3012 extra questions

From: [email-masked]
Date: Tue, 13 Nov 2001 07:31:26 -0600

The answer to question 2 is that it is done (at least in some systems) in
two
passes.  I don't believe there is any clean way of doing it in one with
RADIUS.

Mike

"Juan Caballero" <[email-masked]>@sunroof.eng.sun.com on 11/13/2001
04:49:56 AM

Please respond to [email-masked]

Sent by:  [email-masked]

To:   <[email-masked]>
cc:
Subject:  [mobile-ip] RFC3012 extra questions

Sorry to bring up again the subject but I am doing a thesis work with
Mobile
IP and I am trying to integrate AAA (Radius) with Mobile IP and found some
questions regarding the Challenge-Response RFC. I apologize if I just
misunderstood the standards.

1-How is this suppose to work with Hierarchical Mobile IP?

I believe that if a hierarchical structure of FA is used, the lowest FA is
the one sending the Challenge and waiting for the response but it is most
probable the Highest FA the one which communicates with the AAA structure.
Then if the Lowest FA removes the MN-AAA Authentication Extension there is
no info for the highest FA to perform the authentication. Should the lowest
FA just forward the Challenge extension to the Highest FA and this one
takes
care of the rest? How are the extensions handled?

2-RFC 2977 (Mobile IP AAA Requirements) states:
"All needed AAA and Mobile IP functions SHOULD be processed during a single
Internet traversal.  This MUST be done without requiring AAA servers to
process protocol messages sent to Mobile IP agents.  The AAA servers MUST
identify the Mobile IP agents and security associations necessary to
process
the Mobile IP registration, pass the necessary registration data to those
Mobile IP agents, and remain uninvolved in the routing and authentication
processing steps particular to Mobile IP registration."

In the specific case of Radius, I do not see how to meet both ideas. Either
I try to make a single Internet traversal and then the AAA server needs to
take care of delivering the Mobile IP Registration to the HA or the FA
blocks the Registration Request until the Authentication process is
completed but then two Internet traversals are done.

Should the FA send the registration request to the HA without delay and
just
block the reply until it gets a message from the AAA authentication? This
will shorten the delay in the registration even if two Internet traversals
are still needed. But on the other hand the Home Agent will receive a
MN-AAA
authentication extension which does not know how to handle since RFC 3012
states:
"The Foreign Agent MUST NOT remove the MN-AAA Authentication Extension from
the Registration Request prior to the completion of the authentication
performed by the AAA infrastructure.  "

It would be nice if some of the people implementing this would show their
opinion.
Thanks,

Juan Caballero