Subject: [netlmm] RE: Review of draft-sgundave-mip6-proxymip6-01

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Tue, 23 Jan 2007 20:36:23 -0500

Hi Christian,

Thanks for your review. Please see inline my remarks on your first two
comments...

> -----Original Message-----
> From: Christian Vogt [mailto:[email-masked]]
> Sent: Tuesday, January 23, 2007 3:23 PM
> To: [email-masked]; [email-masked]; Vijay Devarapalli;
Chowdhury,
> Kuntal; Netlmm
> Cc: Vidya Narayanan; James Kempf; Phil Roberts;
[email-masked];
> [email-masked]
> Subject: Review of draft-sgundave-mip6-proxymip6-01
> 
> Hi authors and NETLMM folks,
> 
> Vidya and Phil asked me for a review of the two Proxy Mobile
> IPv6 proposals that are currently being discussed in the
> NETLMM working group.  Here is one for draft-sgundave-mip6-
> proxymip6-01.  (I will send a the review for draft-singh-
> netlmm-protocol-00 in a separate email.)
> 
> The proposal in draft-sgundave-mip6-proxymip6-01 defines an
> extension to RFC 3775 for localized mobility management (MM)
> support.  It enables the home agent to serve as both an RFC
> 3775 home agent and a PMIPv6 home agent at the same time.  A
> new network entity, the Proxy Mobile Agent (PMA), registers
> a mobile node's current point of attachment with the home
> agent on behalf of the mobile node.  The PMA gives the
> mobile node the illusion of being on its home link while
> actually being away from home.  The draft adapts major RFC
> 3775 concepts to also support localized MM, including home
> agent operation, binding cache entry components,
> bidirectional-tunnel management, message ordering, DHAAD,
> and MPD.  RFC 3775 terminology is reused in the context of
> localized MM.
> 
> While the draft does a good job in addressing the changes
> required to RFC 3775 concepts when adopted to localized MM,
> the close integration of localized and global MM necessarily
> has two conceptual disadvantages:
> 
>     - The security and trust relationships in PMIPv6 are
>     inherently different from those in RFC 3775.  RFC 3775
>     calls for the home agent to authenticate the mobile node
>     during the binding update procedure and to authorize the
>     mobile node for using its particular home address.  In
>     PMIPv6, both of these tasks are the responsiblity of the
>     PMA, and the home agent trusts the proxy mobile agent.
>     From this perspective, it seems to be cleaner to separate
>     localized and global MM.

[KC>] Not sure how you concluded that the Home Agent does not ever
authorize the MN to use a HoA in case of PMIP. The Home Agent can
authorize the use of a HoA by a particular MN regardless of CMIP or
PMIP. It can do that via AAA interaction or via other methods. It
receives the MN's identification via the NAI extension in case of PMIP6
and IDi field in IKE in case of CMIP6. Authentication is based on shared
SA in case of PMIP whereas it is individual SA in case of CMIP. But some
form of authentication takes place regardless of CMIP or PMIP. So, both
Authentication and Authorization takes place in the Home Agent for
PMIP6. The optimization proposed in PMIP6 protocol operation in terms of
the use of shared SA between PMA and Home Agent is not something that
will preclude the use of the basic concepts of MIP6 as defined in RFC
3775.

> 
>     - Combining global and localized MM requires expensive
>     security associations between the home agent and each
>     access router in the localized MM domain if the home
>     agent is from a different administrative domain than the
>     domain that the mobile node currently visits.  IMO global
>     and localized MM are orthogonal, and global MM should
>     remain mobile-initiated.  The mobile node could then
>     perform a binding update with its home agent in domain A
>     while roaming within a PMIPv6 domain B.
> 

[KC>] Inter domain (I guess administrative domain) roaming has several
special considerations that the domain operators need to ensure, such as
roaming agreements and SLAs. There are a number of ways to dynamically
establish IPsec/IKE SA between network nodes even when these nodes are
in different administrative domains. So, I would not rule out the
possibility of roaming with PMIP6 if it makes sense in some situations.
However, roaming situations aside, the base PMIP6 protocol should not be
nailed down to just a single use case, IMHO. 

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: Christian Vogt <[email-masked]>
Date: Wed, 24 Jan 2007 23:41:12 +0100

Hi Kuntal,

> will preclude the use of the basic concepts of MIP6 as defined in RFC

That's actually correct.

> nailed down to just a single use case, IMHO. 

Agreed.  But roaming support between administrative PMIP domains A and B 
does not rule out the use of RFC 3775 Mobile IPv6 for mobility between 
these domains and a domain C that does not share the roaming agreements.

If you change the terminology so as to emphasize the orthogonality
between global and localized MM, you don't loose any flexibility with
respect to roaming between administrative PMIP domains.  A mobile
node could still carry its local home address from PMIP domain A to
PMIP domain B, and use RFC 3775 Mobile IPv6 to bind this local home
address, as a care-of address, to its global home address.

Regards,
- Christian

-- 
Christian Vogt, Institute of Telematics, Universitaet Karlsruhe (TH)
www.tm.uka.de/~chvogt/pubkey/

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Wed, 24 Jan 2007 18:05:14 -0500

Christian,

I guess you are saying that the MN can use the address (HoA) obtained
via PMIP6 as the CoA to run CMIP6 over the IP connection. It certainly
can. As a matter of fact, once the MN obtains an IP address from the
network, it can run any number of applications over that IP connection. 

However, I am not sure why we need to attach these Global/Local tags to
the IP addresses obtained via CMIP6 and PMIP6. In your example, if the
MN moves from PMIP domain A to PMIP domain B and it can still keep the
IP address it was using in PMIP domain A (you call it local HoA), it
should have no problem in continuing its IP sessions/applications w/o
doing anything more. So, why the MN needs to run CMIP6 in PMIP domain B?
  
As a matter of policy, an operator may like the MNs to run CMIP6 by
default. And what you explain i.e. MN using the PMIP6 HoA as the CoA to
register CMIP6 session could very well be one of the deployment use
cases. But it is not the mandatory one.

Regards,
Kuntal

> Sent: Wednesday, January 24, 2007 4:41 PM
> To: Chowdhury, Kuntal
> Cc: [email-masked]; [email-masked]; Vijay Devarapalli; Netlmm
> Subject: Re: Review of draft-sgundave-mip6-proxymip6-01
> 
> Hi Kuntal,
> 
> responses in-line:
>

---

From: Christian Vogt <[email-masked]>
Date: Thu, 25 Jan 2007 09:33:28 +0100

Kuntal -

> network, it can run any number of applications over that IP connection. 

That's right.

> doing anything more. So, why the MN needs to run CMIP6 in PMIP domain B?

If the MN's global home is, say, in domain C, then the MN might wish to
use RFC 3775 MIP6 to register its local HoA from domains A and B, as a
global CoA, with its HA in domain C.

> cases. But it is not the mandatory one.

Yes, it is certainly not mandatory, although IMO typical.  I was
describing it as an example to justify the change from RFC 3775
terminology towards PMIP-specific terminology, like "local HoA" etc.
The terminology change would not preclude any use cases, but it would
help differentiate between global and localized MM, which would be
useful for some use cases such as the one above.

Regards,
- Christian

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Thu, 25 Jan 2007 10:41:25 -0500

Christian,

Please see my comment inline...

-Kuntal

> Sent: Thursday, January 25, 2007 2:35 AM
> To: Basavaraj Patil
> Cc: Netlmm
> Subject: Re: [netlmm] Re: Review of draft-sgundave-mip6-proxymip6-01
> 
> Hi Raj,
> 
> it's not a technical reason that makes me believe separate terminology
> would be better.  It's more the conceptual differences like the trust
> between the HA and an entity in the visited network, or the move
towards
> a virtual home link.
[KC>] Practically the whole Mobile IP deployment today runs on the
virtual home link concept i.e. the MN is never connected to the physical
home link. This is almost all large mobile IP deployment in the world.
So, virtual home link is nothing new.

> Also, if you apply the use case where the MN runs RFC 3775 MIPv6 on
top
> of PMIPv6, you end up with some ambiguity if the terminology of RFC
3775
> and that of PMIPv6 is the same.
> 
> Best,
> - Christian
> 
> --