Subject: [AAA-WG]: Back to extensions...

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 27 Feb 2001 09:23:55 -0800

From the discussion, it seems that we have consensus that
accounting should be mandatory, on NAS, proxy and server.

Do we have suggested language on other extensions? I
think the sense so far is that NASREQ and MOBILEIP are
MAY on NAS, Proxy and Server. End to end security is a 
MUST (one of drafts, haven't decided which one yet) on
NAS and Server. Not required on proxy (except to pass it).  

We have had discussions about how proxies will behave
with respect to extensions. It seems to me that a 
"routing proxy" will advertise all extensions, correct?
Other types of proxies will behave differently, no? Can
we define what this behavior will look like?

The original question was whether it could be assumed that
a NAS will be configured with proxies/servers that are
homogeneous with respect to their extensions. This simplifies
load balancing considerably. Can we make this assumption?

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 27 Feb 2001 09:47:21 -0800 (PST)

> accounting should be mandatory, on NAS, proxy and server.

Correct.

> NAS and Server. Not required on proxy (except to pass it).  

So does the base protocol NEED to state the above???

> "routing proxy" will advertise all extensions, correct?

Or a wildcard extension, since we do not know what's next.

> we define what this behavior will look like?

Yes, they advertise the extensions they support. This is already in the spec.

> load balancing considerably. Can we make this assumption?

No configuration required. Extensions are advertised as part of capabilities
negotiation. The NAS can then load balance on the servers that handle the
extension desired.

I'd like to get this firmed up for -01, so please comment ASAP.

PatC

---

From: Jari Arkko <[email-masked]>
Date: Tue, 27 Feb 2001 23:13:20 +0200

> NAS and Server. Not required on proxy (except to pass it).  
I am uncomfortable with end-to-end security being mandatory.
There are applications of Diameter where it is not needed, and
it does have high implementation cost both in terms of complexity
and power requirements. Would it be possible to relax this
requirement, at least for NASes?

Jari

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 28 Feb 2001 20:43:17 -0800

>requirement, at least for NASes?

End-to-end security is mandatory to implement, it is not 
mandatory to use. So if it is not needed, you don't have
to turn it on.