Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

From: "Ahmad Muhanna" <[email-masked]>
Date: Tue, 11 Dec 2001 09:28:55 -0600

Bob;

I think our concern here is how the FA handles the RRQ message in these
scenarios.
Let us remember, if it is a re-transmission, FA does not authenticate the
user through AAA.
However, if it is considered a new registration, FA MUST authenticate the
RRQ message 
"the USER" before relaying the RRQ to HA.
I hope this clarifies the issue at hand.

Thanks;

Ahmad Muhanna

-----Original Message-----
From: Robert J Marks [mailto:[email-masked]]
Sent: Tuesday, December 11, 2001 7:05 AM
To: [email-masked]; 'Patil Basavaraj (NET/Dallas)';
'Perkins Charles (IPRG)'
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; 'Pat Calhoun'
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

Ahmad,

Some observations on your scenarios.
 
Ahmad Muhanna wrote:

> What about the following scenario:

> 1. MN sends a RRQ message with NAI1, Home Address 0.0.0.0.
> 2. MN sends 1st retry of RRQ with NAI1, Home address 0.0.0.0.
>
> 3. Now, we have a SMART MN, which figures out that it can use another
>    Profile with NAI2 and Home Address 0.0.0.0.
>
> 4. Since section 3.7.1 in RFC2002 does not talk about the user NAI,
> PDSN will consider this as a retransmission while may be the user
> would have failed authentication at the AAA.

This situation will be treated as a new Registration Request,
independent
of the request that used NAI1. The Home Agent will not correlate the two
requests, since it identifies the MN by the NAI in this case.

> ** Another thing, what about if we support different NAIs over the
> same PPP session and let us say NAI1, NAI2, and NAI3 have the same
> HA and all requesting Dynamic MIP calls with Home Addresses of
0.0.0.0.

All three requests will be treated as independent registrations. The HA
does not know about PPP, and again uses the NAI to identify the MN.
 
> **********
> Ahmad Muhanna 

Bob

Robert J Marks
Cambia Networks
Office: +1 847 627 3703
Mobile: +1 708 829 6329

 -----Original Message-----
From: Patil Basavaraj (NET/Dallas) [mailto:[email-masked]]
Sent: Tuesday, November 13, 2001 4:20 PM
To: Muhanna, Ahmad [RICH1:2Q20:EXCH]; Perkins Charles (IPRG)
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; Mobile IP Working Group; Pat Calhoun
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

Charlie proposed the following text:
>=======================================================================

>
>Here is the new relevant text, in the same paragraph as your original 
>quote: 
>
>      ....      The Foreign Agent SHOULD check that the mobile node is 
>   actually performing a retransmission, by verifying that the relevant

>   fields of the retransmitted request are the same as represented in 
>   the visitor list entry for the pending Registration Request (section

>   3.7.1 of [8]).  This verification MUST NOT include the "remaining 
>   Lifetime of the pending registration", or the Identification field 
>   since those values are likely to change even for requests that are 
>   merely retransmissions and not new Registration Requests.  In all 
>   other circumstances, if the Foreign Agent receives   .... 
>
>=======================================================================

>
>Comments? 
>
>>Ahmad Muhanna: 
>>I hope you would agree that the following change will satisfy the
need: 
>>
>>"If a mobile node retransmits a Registration Request with the same 
>>Identification field and the same Challenge extension, and the Foreign

>>Agent still has a pending Registration Request record in effect for
the 
>>mobile node, then the Foreign Agent forwards the Registration Request
to 
>>the Home Agent again (see Registration Retransmission, section
3.6.3[8]). 
>>In all other circumstances, if the Foreign Agent receives a
Registration 
>>Request with a Challenge extension containing a Challenge value
previously 
>>used by that mobile node, the Foreign Agent SHOULD send a Registration

>>Reply to the mobile node containing the Code value STALE_CHALLENGE." 
>
>Regards, 
>Charlie P. 
>

I think the text that Charlie proposes makes it quite clear as to what
the FA must do in order to recognize, if it is a retransmission. So I
would recommend going with Charlie's text in the revision for this
spec. 

-Basavaraj

---

From: "Robert J Marks" <[email-masked]>
Date: Tue, 11 Dec 2001 10:07:04 -0600

Ahmad,
 
I agree. The presence of a "new" NAI at the FA signals that
authentication should be performed.
If a MN sends a Registration Request using a new NAI, the FA should
treat it as a new registration.
I guess I don't see the issue.
 
Bob 
 
From: Ahmad Muhanna

Bob; 

I think our concern here is how the FA handles the RRQ message in these
scenarios. 
Let us remember, if it is a re-transmission, FA does not authenticate
the user through AAA. 
However, if it is considered a new registration, FA MUST authenticate
the RRQ message 
"the USER" before relaying the RRQ to HA. 
I hope this clarifies the issue at hand. 

Thanks; 

Ahmad Muhanna 

-----Original Message----- 
From: Robert J Marks [mailto:[email-masked]] 
Sent: Tuesday, December 11, 2001 7:05 AM 
To: [email-masked]; 'Patil Basavaraj (NET/Dallas)'; 
'Perkins Charles (IPRG)' 

Ahmad, 

0.0.0.0. 

Bob 

Robert J Marks 
Cambia Networks 
Office: +1 847 627 3703 
Mobile: +1 708 829 6329 

 -----Original Message----- 
From: Patil Basavaraj (NET/Dallas) [mailto:[email-masked]] 
Sent: Tuesday, November 13, 2001 4:20 PM 
To: Muhanna, Ahmad [RICH1:2Q20:EXCH]; Perkins Charles (IPRG) 
Cc: Wenzel, Pete [RICH2:2Q00:EXCH]; Mobile IP Working Group; Pat Calhoun

the 
to 
3.6.3[8]). 
Registration 
previously 

-Basavaraj