Subject: [mobile-ip] Question about AAA and MIP

From: "Tom van Sebille" <[email-masked]>
Date: Fri, 4 Oct 2002 18:23:09 +0200

I have just read RFC 2977 and the Internet Draft "AAA keys for MIP", but still have some questions about it:

-1-
From the Internet Draft I can't find out how the Home Agent (HA) is involved (Draft figures 7-10). Is the HA part of the AAAH or just connected to the AAAH?

-2-
When an MN requests an MN-FA key and/or an MN-HA key, the FA relays the request to the AAA infrastructure.
Does it relay the complete MIP Registration Request (including the AAA extensions) or some AAA message containing the AAA extensions?
Perhaps the same question, but in other words: does a registration reply received via the AAA infrastructure mean that the HA has created a mobility binding for the MN or does this reply only provide the key material to calculate a key, that can be used for normal MIP registration via FA and HA?

Thank you very much in advance,
Tom.

T.C. van Sebille
The Netherlands
[email-masked]

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 04 Oct 2002 09:35:12 -0700

Hello Tom,

> Tom van Sebille wrote:

> -1-
> From the Internet Draft I can't find out how the Home Agent (HA) is involved
> (Draft figures 7-10). Is the HA part of the AAAH or just connected to the
> AAAH?

It is expected that they would be separated entities, but of course in many
designs they could be combined.

> Does it relay the complete MIP Registration Request (including the AAA
> extensions) or some AAA message containing the AAA extensions?

It puts the MIP registration request into an AAA message with
some other AAA extensions.

> Perhaps the same question, but in other words: does a registration reply
> received via the AAA infrastructure mean that the HA has created a mobility
> binding for the MN or does this reply only provide the key material to
> calculate a key, that can be used for normal MIP registration via FA and HA?

The HA has created a mobility binding for the MN, and the mobile node
creates its security association with the HA from the information
supplied in the Registration Reply.  That security association can be
used for subsequent Mobile IP registrations.

Regards,
Charlie P.

---

From: "s. goswami" <[email-masked]>
Date: Fri, 4 Oct 2002 13:54:03 -0400 (EDT)

Charlie, a related question. When exactly does the HA start
tunneling traffic to the MN ? After the MN receives the
reply (HAA->MIP Reply ) ?  Are not some packet going to
be dropped if the HA starts tunneling right after HAR ?

Also, implict in the draft is the assumption that HA is
a AAA entity.   A section on implications to existing
IPv4 mobility and AAA agents would be enlightening.

Subrata

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 04 Oct 2002 11:00:09 -0700

Hello Subrata,

> be dropped if the HA starts tunneling right after HAR ?

This is a distinct possibility.  It could be that some
consideration should be given for it, but on the other
hand IP as a best-effort protocol would typically push
that requirement up to the transport.  Perhaps the tunnel
endpoint at the care-of address should wait a few milliseconds
before dropping unauthorized packets that might be authorized
very soon.  I remember discussion on this matter some years
ago, but no action points were taken.

> IPv4 mobility and AAA agents would be enlightening.

Text is always appreciated, and yes this draft does indeed
implicitly or maybe even explicitly assume that the home
agent has the ability to run some AAA protocol.

Regards,
Charlie P.

---

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 04 Oct 2002 13:25:07 -0500

Hi Tom,
  You are looking at the requirements draft, if you look at the 
solution, e.g.

> draft-ietf-aaa-diameter-mobileip-12.txt

there is HA!

Regards,

Tom van Sebille wrote:

> From the Internet Draft I can't find out how the Home Agent (HA) is 
> involved (Draft figures 7-10). Is the HA part of the AAAH or just 
> connected to the AAAH?
>  
> -2-
> When an MN requests an MN-FA key and/or an MN-HA key, the FA 
> relays the request to the AAA infrastructure.
> Perhaps the same question, but in other words: does a registration 
> reply received via the AAA infrastructure mean that the HA has created 
> a mobility binding for the MN or does this reply only provide the key 
> material to calculate a key, that can be used for normal MIP 
> registration via FA and HA?
>  
> [email-masked] <mailto:[email-masked]>

-- 
Behcet

---

From: "Fredrik Johansson" <[email-masked]>
Date: Tue, 8 Oct 2002 08:33:30 +0200

Subrata,

> be dropped if the HA starts tunneling right after HAR ?

I can't see any difference from regular mobile ip, if the HA starts
forwarding packets directly after it sends the registration reply then some
packets might get lost.

/fredrik