Subject: [Mip6] identifying the home network

From: "Alper Yegin" <[email-masked]>
Date: Tue, 19 Dec 2006 19:54:39 +0200

In regards to draft-ietf-mip6-hiopt-00.txt...

When the MN (DHCP client) requests information about a Mobile IP home
network (HA IP address, etc.), it identifies the target network as either
"the visited network", or "from a given domain." If, for example, the target
is from a given domain, but the DHCP server cannot fulfill the request, it
returns an empty list. 

The current I-D does not provide a way for the MN to say "give me anything."
So, going back to the previous example... Instead of the first failed
attempt followed by another request to solicit information about home
networks within the visited network, we should be able to let MN ask for any
home network information and get whatever the DHCP server can offer.

We can enable this by adding one more id-type ("any domain") in the spec.

Feedback is welcome.

Alper

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Basavaraj Patil <[email-masked]>
Date: Tue, 19 Dec 2006 15:58:31 -0600

Alper,

A few questions:

> is from a given domain, but the DHCP server cannot fulfill the request, it

What would constitute the MNs home network? Would this home network be
identified by the realm part of the NAI that is the MNs identifier? How does
the MN even know if an HA is available in the visited network?

> The current I-D does not provide a way for the MN to say "give me anything."

Do you really want any HA address to be provided to the MN? Would this not
be a security concern? The MN has no way of verifying the authenticity of
any random HA. The HA assigned by the home network can be trusted because of
the trust relationship that the MN has with the home and hence can establish
the IPsec SA with the HA or send a BU with a valid authenticator.

> home network information and get whatever the DHCP server can offer.

"Home networks within the visited network"????

If an MN is not "homed", then it is okay to assign the MN any HA. Else the
HA even if it happens to be in the visited network should be assigned by the
home network, i.e the entity with which the MN has the trust relationship.

-Raj

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 20 Dec 2006 00:18:25 +0200

Hi Raj,

> What would constitute the MNs home network? 

Mobile IP home network is the network that is willing to provide a home
address and a serving home agent for the mobile node. Given that now we deal
with dynamic HA assignment, this way of looking at Mobile IP home networks
is needed.

> Would this home network be
> identified by the realm part of the NAI that is the MNs identifier? 

It can. And our spec allows that.

> How
> does

Does it have to know?

> the IPsec SA with the HA or send a BU with a valid authenticator.

Whatever HA is supplied by the network goes through the same process. 

> "Home networks within the visited network"????

Hmmm. I wasn't too comfortable when I typed that either. The point is,
within the visited (serving) network, an HA can be offered to the MN. 

> home network, i.e the entity with which the MN has the trust relationship.

HA IP address is delivered by the DHCP. DHCP server is in the visited
network. I'm not sure how the trust relationship factors into this.

Alper

---

From: Basavaraj Patil <[email-masked]>
Date: Wed, 20 Dec 2006 16:20:43 -0600

Hi Alper,

Inline:

> with dynamic HA assignment, this way of looking at Mobile IP home networks

The reason why I asked what constitutes an MNs home network is because of
the mention of "home network, visited network, given domain" in your email.
A network that is willing to provide an HA address and maybe a prefix advt
to an MS does not necessarily ensure that the MS is able to use it since it
has no way to establish an SA (IPsec or 4285 type) to secure the BU/BAck
messages. But I guess you are assuming that the keys etc. would somehow be
made available to this dynamic HA wherever it may happen to be.
As you recollect in the bootstrapping discussion, we said that bootstrapping
is only possible as long as the MS has some trust relationship with an
entity (eg. AAA in home network).  So the point is that the home network
definition (at least IMO) is the entity with with which the MS shares a
trust relationship or Security association. You could bootstrap MIP6 with an
HA which exists in an entirely different domain for an MS based on
transitive trust. I am fine with that.

>> the MN even know if an HA is available in the visited network?

If an MS is homed (as per my interpretation of a home network :) ) in
network X and is currently attached to network Y, why would the MS ask for
an HA in network Y? Of course if you establish a new trust relationship with
network Y then you could ask for an HA..
So I agree that maybe the MN does not have to know and can just request for
one. 

> Whatever HA is supplied by the network goes through the same process.

I guess you are assuming that the HA assigned would somehow obtain the keys
or parameters that would enable the establishment of an IPsec SA. This is
possible, but I think the pieces of the puzzle of how are missing (unless
you believe this is covered in the bootstrapping solution I-Ds).

> within the visited (serving) network, an HA can be offered to the MN.

Ok.

> network. I'm not sure how the trust relationship factors into this.

The DHCP part of it is okay. I am wondering about the subsequent MIP
registration which requires a trust relationship with that HA. I guess you
are essentially allowing DHCP to deliver such an option. The rest of the
MIP6 operation with that HA is out-of-scope with this I-D, right?

-Raj

---

From: "Alper Yegin" <[email-masked]>
Date: Thu, 21 Dec 2006 13:44:48 +0200

Hi Raj,

MN's discovery of HA IP address is within the scope of this I-D, but
bootstrapping a security association between the MN and the discovered HA is
outside the scope. The latter is another part of the overall bootstrapping
solution, and it is defined elsewhere (using EAP/IKEv2, HA-AAA
RADIUS/Diameter interfaces, etc.)(

Alper

> -----Original Message-----
> From: Basavaraj Patil [mailto:[email-masked]]
> Sent: Thursday, December 21, 2006 12:21 AM
> To: Alper Yegin; [email-masked]
> Subject: Re: [Mip6] identifying the home network
> 
> 
> Hi Alper,
> 
> Inline:
> 
> 
> >>> is from a given domain, but the DHCP server cannot fulfill the
request,
> >> it
> >> any random HA. The HA assigned by the home network can be trusted
> because
> >> of
> >>> networks within the visited network, we should be able to let MN ask
> for
> >> any
> >> HA even if it happens to be in the visited network should be assigned
> by
> >> the

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 28 Dec 2006 11:49:52 -0800

Hi Alper,

What is the desired behavior?

Do you want the DHCP server in the visited network
to return the home agent in the visited network by
default if it cannot provide any home agent from
the realm the MN asked for?

We have always treated home agent assignment from
the visited link as a special case and a home agent
from the MN's home network (identified by the realm
part of the MN's identifier) as the default. We
seem to be changing that....

Irrespective of what the MN asks for, wouldn't the
policies in the network decide which HA the MN gets
assigned?

> We can enable this by adding one more id-type ("any domain") in the spec.

If you set the id-type to "any domain", is the Home
Network Identifier still used? I assume it is. The
DHCP server should still return the HA from the
realm the MN is asking for, but in case it is not
able to, it should return a HA from the visited
network.

A comment on draft-ietf-mip6-hiopt-00.txt. In section
3.1

    Id-type 0 indicates the mobile node is interested in learning the
    home network information that pertains to the immediately connected
    (visited) network.  In that case, Home Network Identifier field is
    not used.

If the id-type is set to 0, is the Home Network
Identifier field set to 0 or excluded in the option?
It would be good if the text says the Home Network
Identifier field is set to 0 and ignored by the
receiver, when the id-type is set to 0.

Vijay

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 29 Dec 2006 01:17:21 +0200

Hi Vijay,

> the realm the MN asked for?

Yes.

> policies in the network decide which HA the MN gets

MS indicates the target domain for the HA assignment.

> able to, it should return a HA from the visited

Yes.

> receiver, when the id-type is set to 0.

Yes, we missed that important detail. I'd say we shall have no Home Network
Identifier field (i.e., option-len is 6 bytes).

Alper

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 28 Dec 2006 15:31:31 -0800

> MS indicates the target domain for the HA assignment.

Right, but a policy in the network or the type of
service might ultimately decide which HA is assigned
to the mobile node.

> Identifier field (i.e., option-len is 6 bytes).

This would work, but I prefer fixed length options
whenever possible. Just set the field to zero when
not used. Makes it easier to process the message
on the receiving side.

Vijay

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 29 Dec 2006 10:16:14 +0200

> service might ultimately decide which HA is assigned

If MN says "give me an HA from domain myISP.com", it'd be an operational
error if the network decides to return an HA from "anotherISP.com." But yes,
if the MN says "give me an HA from domain myISP.com or something else" (as
the new option introduces), then it is perfectly fine that the network
policy decides.

> not used. Makes it easier to process the message

I'm fine either way.

Alper