Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

From: "Ahmad Muhanna" <[email-masked]>
Date: Tue, 11 Dec 2001 22:48:04 -0600

Bob;
 
By adopting the new version proposed for RFC3012bis, the third paragraph in
section 3.2. of RFC3012bis as mentioned below, specifically identify what FA
should check to determine if the RRQ is a re-transmission or not.
NAI is not one of these criteria.
In other words, if we reference section 3.7.1. of RFC2002 to determine if
the RRQ message is a re-transmission, any RRQ with different NAI on the same
PPP session and using the same Home address still will be considered as a
re-transmission rather than a new RRQ.
 
I hope this makes it clearer.

Regards; 

Ahmad Muhanna 
Nortel Networks 
Shasta PDSN-MIP Development 
Phone. + 1 972 685 1416 ESN. 445-1416 
[email-masked] 

-----Original Message-----
From: Robert J Marks [mailto:[email-masked]]
Sent: Tuesday, December 11, 2001 10:07 AM
To: mobile-ip; 'Patil Basavaraj (NET/Dallas)'; 'Perkins Charles (IPRG)'
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; 'Pat Calhoun'
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

Ahmad,
 
I agree. The presence of a "new" NAI at the FA signals that authentication
should be performed.
If a MN sends a Registration Request using a new NAI, the FA should treat it
as a new registration.
I guess I don't see the issue.
 
Bob 
 
From: Ahmad Muhanna

Bob; 

I think our concern here is how the FA handles the RRQ message in these
scenarios. 
Let us remember, if it is a re-transmission, FA does not authenticate the
user through AAA. 
However, if it is considered a new registration, FA MUST authenticate the
RRQ message 
"the USER" before relaying the RRQ to HA. 
I hope this clarifies the issue at hand. 

Thanks; 

Ahmad Muhanna 

-----Original Message----- 
From: Robert J Marks [ mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Tuesday, December 11, 2001 7:05 AM 
To: [email-masked]; 'Patil Basavaraj (NET/Dallas)'; 
'Perkins Charles (IPRG)' 
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; 'Pat Calhoun' 
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question 

Ahmad, 

Some observations on your scenarios. 
  
Ahmad Muhanna wrote: 

> What about the following scenario: 

> 1. MN sends a RRQ message with NAI1, Home Address 0.0.0.0. 
> 2. MN sends 1st retry of RRQ with NAI1, Home address 0.0.0.0. 
> 
> 3. Now, we have a SMART MN, which figures out that it can use another 
>    Profile with NAI2 and Home Address 0.0.0.0. 
> 
> 4. Since section 3.7.1 in RFC2002 does not talk about the user NAI, 
> PDSN will consider this as a retransmission while may be the user 
> would have failed authentication at the AAA. 

This situation will be treated as a new Registration Request, 
independent 
of the request that used NAI1. The Home Agent will not correlate the two 
requests, since it identifies the MN by the NAI in this case. 

> ** Another thing, what about if we support different NAIs over the 
> same PPP session and let us say NAI1, NAI2, and NAI3 have the same 
> HA and all requesting Dynamic MIP calls with Home Addresses of 
0.0.0.0. 

All three requests will be treated as independent registrations. The HA 
does not know about PPP, and again uses the NAI to identify the MN. 
  
> ********** 
> Ahmad Muhanna 

Bob 

Robert J Marks 
Cambia Networks 
Office: +1 847 627 3703 
Mobile: +1 708 829 6329 

 -----Original Message----- 
From: Patil Basavaraj (NET/Dallas) [ mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Tuesday, November 13, 2001 4:20 PM 
To: Muhanna, Ahmad [RICH1:2Q20:EXCH]; Perkins Charles (IPRG) 
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; Mobile IP Working Group; Pat Calhoun 
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question 

Charlie proposed the following text: 
>======================================================================= 

> 
>Here is the new relevant text, in the same paragraph as your original 
>quote: 
> 
>      ....      The Foreign Agent SHOULD check that the mobile node is 
>   actually performing a retransmission, by verifying that the relevant 

>   fields of the retransmitted request are the same as represented in 
>   the visitor list entry for the pending Registration Request (section 

>   3.7.1 of [8]).  This verification MUST NOT include the "remaining 
>   Lifetime of the pending registration", or the Identification field 
>   since those values are likely to change even for requests that are 
>   merely retransmissions and not new Registration Requests.  In all 
>   other circumstances, if the Foreign Agent receives   .... 
> 
>======================================================================= 

> 
>Comments? 
> 
>>Ahmad Muhanna: 
>>I hope you would agree that the following change will satisfy the 
need: 
>> 
>>"If a mobile node retransmits a Registration Request with the same 
>>Identification field and the same Challenge extension, and the Foreign 

>>Agent still has a pending Registration Request record in effect for 
the 
>>mobile node, then the Foreign Agent forwards the Registration Request 
to 
>>the Home Agent again (see Registration Retransmission, section 
3.6.3[8]). 
>>In all other circumstances, if the Foreign Agent receives a 
Registration 
>>Request with a Challenge extension containing a Challenge value 
previously 
>>used by that mobile node, the Foreign Agent SHOULD send a Registration 

>>Reply to the mobile node containing the Code value STALE_CHALLENGE." 
> 
>Regards, 
>Charlie P. 
> 

I think the text that Charlie proposes makes it quite clear as to what 
the FA must do in order to recognize, if it is a retransmission. So I 
would recommend going with Charlie's text in the revision for this 
spec. 

-Basavaraj

---

From: "Robert J Marks" <[email-masked]>
Date: Wed, 12 Dec 2001 09:30:21 -0600

Ahmad,
 
I understand your point now. However, in regard to NAI, I think that
RFC2794 modifies RFC2002.
 
If the MN requests dynamic home address assignment, then RFC2794
requires the NAI to be recorded in the pending registration request
record, and thus NAI can be used to differentiate retransmissions from
new registration requests.
 
Section 3.2 in rfc3012-bis states that the Foreign Agent "SHOULD check
that the mobile node is actually performing a retransmission, by
verifying that the relevant fields of the retransmitted request are the
same as represented in the visitor list entry for the pending
Registration Request...".
 
So I think the Foreign Agent will use the NAI to determine whether a
request is new or a retransmission.
 
Regards,
 
Bob
 
Robert J Marks
Cambia Networks
Office: +1 847 627 3703
Mobile: +1 708 829 6329

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Ahmad Muhanna
Sent: Tuesday, December 11, 2001 10:48 PM
To: [email-masked]'; 'Patil Basavaraj (NET/Dallas)';
'Perkins Charles (IPRG)'
Cc: Pete Wenzel; 'Pat Calhoun'
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

Bob;
 
By adopting the new version proposed for RFC3012bis, the third paragraph
in section 3.2. of RFC3012bis as mentioned below, specifically identify
what FA should check to determine if the RRQ is a re-transmission or
not.
NAI is not one of these criteria.
In other words, if we reference section 3.7.1. of RFC2002 to determine
if the RRQ message is a re-transmission, any RRQ with different NAI on
the same PPP session and using the same Home address still will be
considered as a re-transmission rather than a new RRQ.

Regards; 

Ahmad Muhanna 
Nortel Networks 

-----Original Message-----
From: Robert J Marks [mailto:[email-masked]]
Sent: Tuesday, December 11, 2001 10:07 AM
To: mobile-ip; 'Patil Basavaraj (NET/Dallas)'; 'Perkins Charles (IPRG)'
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; 'Pat Calhoun'
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

Ahmad,
 
I agree. The presence of a "new" NAI at the FA signals that
authentication should be performed.
If a MN sends a Registration Request using a new NAI, the FA should
treat it as a new registration.
I guess I don't see the issue.
 
Bob 
 
From: Ahmad Muhanna

Bob; 

I think our concern here is how the FA handles the RRQ message in these
scenarios. 
Let us remember, if it is a re-transmission, FA does not authenticate
the user through AAA. 
However, if it is considered a new registration, FA MUST authenticate
the RRQ message 
"the USER" before relaying the RRQ to HA. 
I hope this clarifies the issue at hand. 

Thanks; 

Ahmad Muhanna 

-----Original Message----- 
From: Robert J Marks [mailto:[email-masked]] 
Sent: Tuesday, December 11, 2001 7:05 AM 
To: [email-masked]; 'Patil Basavaraj (NET/Dallas)'; 
'Perkins Charles (IPRG)' 

Ahmad, 

0.0.0.0. 

Bob 

Robert J Marks 
Cambia Networks 
Office: +1 847 627 3703 
Mobile: +1 708 829 6329 

 -----Original Message----- 
From: Patil Basavaraj (NET/Dallas) [mailto:[email-masked]] 
Sent: Tuesday, November 13, 2001 4:20 PM 
To: Muhanna, Ahmad [RICH1:2Q20:EXCH]; Perkins Charles (IPRG) 
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; Mobile IP Working Group; Pat Calhoun

the 
to 
3.6.3[8]). 
Registration 
previously 

-Basavaraj