Subject: [Mip6] Dynamic HoA assignment

From: Basavaraj Patil <[email-masked]>
Date: Thu, 05 Apr 2007 17:06:43 -0500

Hello,

Currently the I-D draft-ietf-mip6-hiopt proposes the MN obtain the HoA as
well in addition to the HA address and prefix via DHCP.

I think the MN should obtain the minimal information required to bootstrap.
It is better to have the HA assign the MN an HoA. To do this we would
require capability similar to MIP4 wherein the BU can be sent with an
unspecified HoA. This is currently not possible as per RFC3775.

Should we consider allowing the MN sending a BU with the unspecified HoA and
obtain an HoA (assigned by the HA) in the BAck?

I-D: draft-devarapalli-mip6-authprotocol-bootstrap proposes such capability.
Also do we need to consider standardizing the bootstrapping mechanism for
the auth protocol (RFC 4285)?

-Basavaraj

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Fri, 6 Apr 2007 10:52:41 +0200

Hi Raj,

> It is better to have the HA assign the MN an HoA.

I fully agree. The HA is the node in the better position to assign the
HoA. This is the rationale behind the choices made by the
bootstrapping DT two years ago.

> To do this we would

I guess you are talking about rfc4285 (auth protocol). If IPsec is
used, IKEv2 can be used to assign the HoA, as specified in
draft-ietf-mip6-bootstrapping-split

> obtain an HoA (assigned by the HA) in the BAck?

Again this would be needed only for auth protocol. No need for this if
IPsec is used.

> the auth protocol (RFC 4285)?

Some SDOs use rfc4285 authentication for MIPv6, but as far as I know,
they have already defined their own bootstrapping solution. What would
be the role of an IETF solution with regards to those?

--Gerardo

---

From: Pars Mutaf <[email-masked]>
Date: Fri, 06 Apr 2007 16:26:59 +0200

Hello, 

I'm probably offside but I think this is a great 
idea. I would fully encourage any technique for 
dynamically generating HoAs (IKEv2 CONFIG_PAYLOAD or 
MIPv6 BU/BACK). 

I think that sharing the Same HoA with all correspondents 
is really a bad idea. Assuming that a mobile host will 
be reachable via a public phone directory (or DNS, or
alike) is also unrealistic. This model was left by
cellular users longtime ago. Users share private 
reachability information (phone number currently)
in a manner that is under their control.

I suspect that a mobile user will need 
(and will prefer having) as many as 100 or 200 home 
addresses (for example) that are configured/removed 
dynamically by the mobile host upon user request, and
distributed under user control. 
IPv6 space is not as precious as IPv4 space.

A different HoA will be distributed to each known 
mobile host. Details are local policy issues.

http://www.ietf.org/internet-drafts/draft-mutaf-dhoa-00.txt

(note: the I-D needs a lot of work but 
the home addresses I'm talking about in this I-D
have nothing new, I'm rather proposing a novel MIPv6 
usage model)

I seriously hope that this usage model is possible.

Best regards,

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Fri, 6 Apr 2007 11:39:35 -0400

HI Gerardo, Raj,

> -----Original Message-----
> From: Gerardo Giaretta [mailto:[email-masked]]
> Sent: Friday, April 06, 2007 3:53 AM
> To: Basavaraj Patil
> Cc: Mobile IPv6 Mailing List
> Subject: Re: [Mip6] Dynamic HoA assignment
> 
> Hi Raj,
> 
> > Hello,
> >
> > Currently the I-D draft-ietf-mip6-hiopt proposes the MN obtain the
HoA
> as
[KC>] We are talking about basic DHCP capability as defined in
draft-ietf-mip6-hiopt. We are NOT talking about the MIP6 bootstrapping
solutions that came out of the DT. The inclusion of HoA in
draft-ietf-mip6-bootstrapping-integrated-02.txt was debated over the ML
and in Prague meeting. At this time, we have decided to NOT include HoA
in draft-ietf-mip6-bootstrapping-integrated-02.txt. However, this should
not be linked with what can be done in DHCP. If someone wants to assign
HoA via DHCP regardless of which mip6 bootstrapping solution is used or
not used, it should be allowed, IMHO. BTW, it was added in the
draft-ietf-mip6-hiopt because SDOs like WiMAX forum needed such info in
DHCP.

> draft-ietf-mip6-bootstrapping-split
[KC>] Again, regardless of IKEv2, we should allow the dynamic HoA
assignment via mip6 BU/BA. People may like to do HoA (address)
management based on MIP6 _authorization_ and NOT IKEv2 _authentication_.

> > Should we consider allowing the MN sending a BU with the unspecified
HoA
> and
[KC>] Nope, we should allow it via BU/BA as well.

> > Also do we need to consider standardizing the bootstrapping
mechanism
> for
[KC>] role of IETF is to define an IETF way to provide dynamic HoA
allocation capability via mip6 BU/BA. We don't have that today. Also,
you are forgetting the per-Node SA model that is used in PMIP6. We need
this capability for PMIP6 also.

---

From: <[email-masked]>
Date: Fri, 6 Apr 2007 16:36:44 -0500

Hi Pars,

I think we may be talking past each other in the context
of dynamic HoA assignment.

What I was proposing was to simply have a mechanism for 
bootstrapping in which the HoA is assigned by the HA via
the BAck.

Your proposal of using different HoAs with different CNs
is not what I had in mind. I think your idea may have more
relevance in the monami6 WG. At the moment MIP6 (RFC3775) only 
allows a single primary HoA binding for an MN at the HA. 

-Raj

>From: ext Pars Mutaf [mailto:[email-masked]] 
>Sent: Friday, April 06, 2007 9:27 AM
>To: Patil Basavaraj (NSN US/Irving)
>mechanism for

---

From: <[email-masked]>
Date: Fri, 6 Apr 2007 16:40:06 -0500

Inline: 

>From: ext Chowdhury, Kuntal [mailto:[email-masked]] 
>Sent: Friday, April 06, 2007 10:40 AM
>To: Gerardo Giaretta; Patil Basavaraj (NSN US/Irving)
>Subject: RE: [Mip6] Dynamic HoA assignment
>
>HI Gerardo, Raj,
>

Raj> Having multiple ways to assign the MN an HoA via the bootstrap
process
is not a good idea. At the moment the bootstrapping mechanisms suggest:
1. HoA assignment via IKEv2
2. HoA assignment via DHCP

Now we are discussing the possibility of the HA assigning the MN an HoA
in the BAck. 

I think it would be best to recommend a single method. And from that
perspective assigning the HoA in the BAck is more attractive since the
HA is the one doing the address assignment.

So if we were to recommend only a single way for HoA assignment, we 
could consider not having the HoA option in the hiopt I-D. 

>management based on MIP6 _authorization_ and NOT IKEv2 

Raj> Yes. I think that even in the case of bootstrapping with IKEv2,
we should still have the HoA assigned by the HA. Is there a reason 
why this would not work? Is there an issue with the IPsec SA
establishment
in case the HoA assignment has to be delayed until the MN sends the BU?
Or can the SA be modified to reflect the HoA assigned by the HA?

>[KC>] Nope, we should allow it via BU/BA as well.

Raj> I agree... Note the comment above. 

>this capability for PMIP6 also.

Raj> I think it makes sense for the MIP6 WG to define bootstrapping
which
covers all the cases. Having a solution for bootstrapping in the IETF
would
enable other SDOs to use it instead of defining their own specific
methods.

-Raj

>"This email message and any attachments are confidential 
>information of Starent Networks, Corp. The information 
>transmitted may not be used to create or change any 
>contractual obligations of Starent Networks, Corp.  Any 
>review, retransmission, dissemination or other use of, or 
>taking of any action in reliance upon this e-mail and its 
>attachments by persons or entities other than the intended 
>recipient is prohibited. If you are not the intended 
>recipient, please notify the sender immediately -- by replying 
>to this message or by sending an email to 
>[email-masked] -- and destroy all copies of 
>this message and any attachments without reading or disclosing 
>their contents. Thank you."
>

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Mon, 9 Apr 2007 19:00:29 -0700

Hi Raj,
I agree that there is no need to define assignment of HoA via DHCP.
Assignment of HoA via IKEv2 seems sufficient for normal bootstrapping.
I'm not quite sure if we need assignment of HoA through BU/BA - but,
that basically depends on whether we are defining Auth protocol based
bootstrapping or not. In either case, assignment via DHCP seems
unnecessary. 

Vidya

> From: Basavaraj Patil [mailto:[email-masked]] 
> Sent: Thursday, April 05, 2007 3:07 PM
> To: Mobile IPv6 Mailing List
> Subject: [Mip6] Dynamic HoA assignment 
> 
> 
> Hello,
> 
> Currently the I-D draft-ietf-mip6-hiopt proposes the MN 
> obtain the HoA as well in addition to the HA address and 
> prefix via DHCP.
> 
> It is better to have the HA assign the MN an HoA. To do this 
> we would require capability similar to MIP4 wherein the BU 
> can be sent with an unspecified HoA. This is currently not 
> possible as per RFC3775.
> 
> Should we consider allowing the MN sending a BU with the 
> unspecified HoA and obtain an HoA (assigned by the HA) in the BAck?
> 
> mechanism for the auth protocol (RFC 4285)?
> 
> -Basavaraj
> 
>

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Tue, 10 Apr 2007 11:05:45 +0200

Hi Kuntal,

some comments inline...

> management based on MIP6 _authorization_ and NOT IKEv2 _authentication_.

Can you please clarify?

In the Diameter Application we are designing in DIME WG, we are
dealing with both authentication and authorization based on the IKEv2
exchange between the MN and the HA. The HoA assignment is done via
IKEv2 through the configuration payload: I don't understand why an
authorization step is not possible if this HoA assignment method is
used.
So I don't think that HoA assignment in BA enables authorization and
IKEv2 does not.

> this capability for PMIP6 also.

I'm still trying to understand why this is needed. Again, if rfc4285
is used, I'm fine. But if IKEv2/IPsec is used, I don't see any reason
why such a new mechanism should be defined.

--Gerardo

> "This email message and any attachments are confidential information of Starent Networks, Corp. The information transmitted may not be used to create or change any contractual obligations of Starent Networks, Corp.  Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this e-mail and its attachments by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify the sender immediately -- by replying to this message or by sending an email to [email-masked] -- and destroy all copies of this message and any attachments without reading or disclosing their contents. Thank you."
>

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Tue, 10 Apr 2007 11:20:20 +0200

Hi Raj,

inline please...

On 4/6/07, [email-masked] <[email-masked]> wrote:

> I think it would be best to recommend a single method.

Are you suggesting to define a single method between DHCP and BAck or
are you suggesting to deprecate HoA assignment via IKEv2?

> And from that

I agree, as mentioned earlier. This is why I prefer HoA assignment via
BA rather via DHCP if auth protocol is used.

If IKEv2/IPsec is used, the HoA assignment is done by the IKEv2
responder, which is the HA.

> why this would not work?

I see the other way around: is there a reason to introduce a new
mechanism, since we have already two WG documents (one in RFC Ed queue
and one in AD review status) that suggest doing it through IKEv2?
Note that when HoA assignment is done via IKEv2, it is still the HA
assigning the HoA.

> Is there an issue with the IPsec SA
> establishment

I would leave the floor to Vijay or Francis here. I have some
comments/doubts though.

Usually the MN specifies the HoA in the TSi payload when setting up
the SA for BU/BA. This is replaced with the correct HoA by the HA in
the IKEv2 response if dynamic HoA assignment is done via IKEv2. In
this case at the end of the IKEv2 exchange, the MN and the HA can
update the SPD entries with the corrects TSi (i.e. Home Address).

How this can be done if the HoA assignment is done via BA? Which is
the TSi in the meanwhile? Just HoA=all zeros? If so, when the HoA is
assigned, should the MN update the TSi creating a child SA?

It seems to me this is adding unnecessary complexity to the
bootstrapping procedure.

--Gerardo

> >unspecified

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Tue, 10 Apr 2007 10:39:46 -0400

Hi Gerardo, 

Please see inline...

> Sent: Tuesday, April 10, 2007 4:06 AM
> To: Chowdhury, Kuntal
> Cc: Basavaraj Patil; Mobile IPv6 Mailing List
> > > > require capability similar to MIP4 wherein the BU can be sent
with
> > an
[KC>] Yes, I am aware of that. However, as I mentioned on the DIME
mailing list, authorizing the MN for MIP6 service (HoA assignment) when
the MN is just negotiating IKE/IPsec SA is sort of a blind
authorization. There is no standard way defined in IKE_AUTH/EAP
transactions to indicate that the MN is actually trying to access MIP6
service. One can assume that simply because the MN is setting up an
IPsec SA with the HA, it intends to do MIP6. As I have mentioned during
the DIME discussion, this assumption won't be true in all cases. So,
there will be various ways to figure out MN's intent and authorize the
MN accordingly. While this is what you are alluding to, I think we need
to allow the BU/BA based HoA assignment so that the HoA assignment is
tied to MIP6 access rather than IKE/IPsec access.

> why such a new mechanism should be defined.
[KC>] Such a mechanism should be defined unless there is something
technically wrong with setting HoA=0::0 in the BU.  

> > "This email message and any attachments are confidential information
of
> Starent Networks, Corp. The information transmitted may not be used to
> create or change any contractual obligations of Starent Networks,
Corp.
> Any review, retransmission, dissemination or other use of, or taking
of
> any action in reliance upon this e-mail and its attachments by persons
or
> entities other than the intended recipient is prohibited. If you are
not
> the intended recipient, please notify the sender immediately -- by
> replying to this message or by sending an email to
> [email-masked] -- and destroy all copies of this
message
> and any attachments without reading or disclosing their contents.
Thank
> you."

---

From: "Junghoon Jee" <[email-masked]>
Date: Wed, 11 Apr 2007 01:09:47 +0900

Hello Raj,
I'd say that we need not necessary limit the ways of configuring HoA.
Therefore, I am in favor of keeping the HoA configuration way specified from
draft-ietf-mip6-hiopt.

Junghoon

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 10 Apr 2007 15:20:09 -0700

Gerardo Giaretta wrote:

> I would leave the floor to Vijay or Francis here. 

The IPsec SA is based on the mobile node's home address.
So the home address is needed before the SA can be created.

I have some
> It seems to me this is adding unnecessary complexity to the

Agreed. You could make it work, but only through a bunch
of hacks.

Vijay

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Wed, 11 Apr 2007 10:23:45 +0200

> Agreed. You could make it work, but only through a bunch

Good. So it seems that there are technical issues with HoA assignment
via BA if IPsec is used. Moreover, as stated before, I don't see a
need for this new mechanism, since IKEv2 already provides a similar
solution. Therefore, I'm strongly against defining it, at least if
IPsec is used.

We can discuss this further for rfc4285.

--Gerardo