Subject: Re: [Mip6] Dynamic HoA assignment

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 10 Apr 2007 09:36:43 -0700 (PDT)

Hi Kuntal,
  RFC 3775 requires BU's to contain HoA destination option. HoA destination option must contain a routable unicast address in HoA field so 0::0 is not possible. 
  I remember WiMAX NWG had asked hiopt to add HoA option as well. I think this is OK so long as HoA is not used as the interface address.
  What Raj is asking is a unified method, then I would say the one that fits best to RFC 3775 is IKEv2 assignment. If this does not satisfy SDOs then maybe they should adopt it to their needs, e.g. using hiopt.

Regards,

Behcet

----- Original Message ----
From: "Chowdhury, Kuntal" <[email-masked]>
To: Gerardo Giaretta <[email-masked]>
Cc: Mobile IPv6 Mailing List <[email-masked]>
Sent: Tuesday, April 10, 2007 9:39:46 AM
Subject: RE: [Mip6] Dynamic HoA assignment

Hi Gerardo, 

Please see inline...

> -----Original Message-----
> From: Gerardo Giaretta [mailto:[email-masked]]
> Sent: Tuesday, April 10, 2007 4:06 AM
> To: Chowdhury, Kuntal
> Cc: Basavaraj Patil; Mobile IPv6 Mailing List
> Subject: Re: [Mip6] Dynamic HoA assignment
> 
> Hi Kuntal,
> 
> some comments inline...
> 
> On 4/6/07, Chowdhury, Kuntal <[email-masked]> wrote:
> >
> > > > To do this we would
> > > > require capability similar to MIP4 wherein the BU can be sent
with
> > an
> > > > unspecified HoA. This is currently not possible as per RFC3775.
> > > >
> > >
> > > I guess you are talking about rfc4285 (auth protocol). If IPsec is
> > > used, IKEv2 can be used to assign the HoA, as specified in
> > > draft-ietf-mip6-bootstrapping-split
> > >
> > [KC>] Again, regardless of IKEv2, we should allow the dynamic HoA
> > assignment via mip6 BU/BA. People may like to do HoA (address)
> > management based on MIP6 _authorization_ and NOT IKEv2
_authentication_.
> >
> 
> Can you please clarify?
> 
> In the Diameter Application we are designing in DIME WG, we are
> dealing with both authentication and authorization based on the IKEv2
> exchange between the MN and the HA. The HoA assignment is done via
> IKEv2 through the configuration payload: I don't understand why an
> authorization step is not possible if this HoA assignment method is
> used.
> So I don't think that HoA assignment in BA enables authorization and
> IKEv2 does not.
> 
[KC>] Yes, I am aware of that. However, as I mentioned on the DIME
mailing list, authorizing the MN for MIP6 service (HoA assignment) when
the MN is just negotiating IKE/IPsec SA is sort of a blind
authorization. There is no standard way defined in IKE_AUTH/EAP
transactions to indicate that the MN is actually trying to access MIP6
service. One can assume that simply because the MN is setting up an
IPsec SA with the HA, it intends to do MIP6. As I have mentioned during
the DIME discussion, this assumption won't be true in all cases. So,
there will be various ways to figure out MN's intent and authorize the
MN accordingly. While this is what you are alluding to, I think we need
to allow the BU/BA based HoA assignment so that the HoA assignment is
tied to MIP6 access rather than IKE/IPsec access.

> >
> > > > I-D: draft-devarapalli-mip6-authprotocol-bootstrap proposes such
> > > capability.
> > > > Also do we need to consider standardizing the bootstrapping
> > mechanism
> > > for
> > > > the auth protocol (RFC 4285)?
> > > >
> > >
> > > Some SDOs use rfc4285 authentication for MIPv6, but as far as I
know,
> > > they have already defined their own bootstrapping solution. What
would
> > > be the role of an IETF solution with regards to those?
> > >
> > [KC>] role of IETF is to define an IETF way to provide dynamic HoA
> > allocation capability via mip6 BU/BA. We don't have that today.
Also,
> > you are forgetting the per-Node SA model that is used in PMIP6. We
need
> > this capability for PMIP6 also.
> >
> 
> I'm still trying to understand why this is needed. Again, if rfc4285
> is used, I'm fine. But if IKEv2/IPsec is used, I don't see any reason
> why such a new mechanism should be defined.
> 
[KC>] Such a mechanism should be defined unless there is something
technically wrong with setting HoA=0::0 in the BU.  

> --Gerardo
> 
> >
> >
> > > --Gerardo
> > >
> > > > -Basavaraj
> > > >
> > > >
> > > > _______________________________________________
> > > > Mip6 mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/mip6
> > > >
> > >
> > > _______________________________________________
> > > Mip6 mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/mip6
> >
> >
> > "This email message and any attachments are confidential information
of
> Starent Networks, Corp. The information transmitted may not be used to
> create or change any contractual obligations of Starent Networks,
Corp.
> Any review, retransmission, dissemination or other use of, or taking
of
> any action in reliance upon this e-mail and its attachments by persons
or
> entities other than the intended recipient is prohibited. If you are
not
> the intended recipient, please notify the sender immediately -- by
> replying to this message or by sending an email to
> [email-masked] -- and destroy all copies of this
message
> and any attachments without reading or disclosing their contents.
Thank
> you."

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Tue, 10 Apr 2007 14:11:00 -0400

________________________________

From: Behcet Sarikaya [mailto:[email-masked]] 
Sent: Tuesday, April 10, 2007 11:37 AM
To: Chowdhury, Kuntal
Cc: Mobile IPv6 Mailing List
Subject: Re: [Mip6] Dynamic HoA assignment

Hi Kuntal,

  RFC 3775 requires BU's to contain HoA destination option. HoA
destination option must contain a routable unicast address in HoA field
so 0::0 is not possible. 

[KC>] Yes. But, the proposal is to relax that requirement.

  I remember WiMAX NWG had asked hiopt to add HoA option as well. I
think this is OK so long as HoA is not used as the interface address.

[KC>] HoA has an explicit DHCP op-code. So, it should not be used as
anything other than as a HoA.

  What Raj is asking is a unified method, then I would say the one that
fits best to RFC 3775 is IKEv2 assignment. If this does not satisfy SDOs
then maybe they should adopt it to their needs, e.g. using hiopt.

[KC>] IMHO, a DHCP op-code to carry HoA should suffice. We don't have to
go any further than that in IETF.

Regards,

Behcet

----- Original Message ----
From: "Chowdhury, Kuntal" <[email-masked]>
To: Gerardo Giaretta <[email-masked]>
Cc: Mobile IPv6 Mailing List <[email-masked]>
Sent: Tuesday, April 10, 2007 9:39:46 AM
Subject: RE: [Mip6] Dynamic HoA assignment

Hi Gerardo, 

Please see inline...

with
_authentication_.

know,
would
Also,
need

of
Corp.
of
or
not
message
Thank