Subject: Re: [MOBILE-IP] Private FA address [was RE: [MOBILE-IP] Darwinian evolution of proxy tunnelling...]

From: Patrice Calhoun <[email-masked]>
Date: Tue, 21 Sep 1999 11:05:37 -0700

>> >> I think this is a fine idea (and I don't even have to change my
>implementation
>> >:)
>> >>
>> >> PatC
>> >
>> >I tend to agree - if the NAI provides cost-efficient uniqueness.  To
>> >easily obtain a unique NAI with minimal consultation of central
>> >authorities, there might be a recommendation (algorithm) on how to
>> >independently generate a unique NAI. Maybe use a FQDN of the closest
>> >connecting public network in the realm and a string generated from the
>> >address(es) of the FA(s), that is(are) on the path to the public
>> >network, in the NAI username part, to maximize FA address reuse within
>> >and among organizations. This, on the other hand, starts to resemble
>> >the use of a list of regional FA IP source addresses when exposed to a
>> >regional-aware MN in an agent advertisement.. Is there a trivial way
>> >to locally guarantee NAI uniqueness?
>>
>> Of course, we cannot guarantee anything but RFC 2486 (NAI) states:
>>
>>    "NAI realm names are required to be unique and the rights to use a
>>    given NAI realm for roaming purposes are obtained coincident with
>>    acquiring the rights to use a particular fully qualified domain name
>>    (FQDN).  Those wishing to use an NAI realm name should first acquire
>>    the rights to use the corresponding FQDN. Using an NAI realm without
>>    ownership of the corresponding FQDN creates the possibility of
>>    conflict and therefore is to be discouraged."
>
>This paragraph makes one slightly hesitate calling the use of NAIs an
>ideal solution for disambiguating private address leaf FAs. It sounds
>like human interaction, i.e. administrative cost, to get the NAIs.
>Ideally, autoconfiguration of such small scale FAs might be desirable.
>Another easier means for finding the disambiguating token might then
>be worth considering, such as the use of a FA IP address path,
>perhaps. But, if NAIs for other reasons become important enough to be
>required, this private address issue could then be nicely solved
>as a side effect.

All it means is that an organization *must* use a globally unique identifier.
The domain can be allocated via IANA, as suggested in the RFC, while the hostname
is probably already configured on the FA/HA. I am not sure that the NAI does
impose such a heavy configuration burden.

Globally unique and zero configuration are unfortunately not easily achievable.

PatC