Subject: RE: Support for multiple default routers

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 18 Sep 2002 00:22:40 +0200

> One useful exercise could be to look at how a similar
  > case is handled with Mobile IPv4.
  > 
  > Mobile IPv4 has its own authentication mechanism
  > between the mobile node and the foreign agent (co-located
  > with first hop router). Even if a mobile node can bypass 
  > foreign agent service by acquiring a co-located care-of
  > address, foreign agent can request the mobile node to 
  > register (i.e. get authenticated and authorized) by setting
  > the R bit in the agent advertisements. See section 2.4.1
  > of RFC 3344.
  > 
  > So, using the analogy of MN -> PaC, and FA -> PAA,
  > understanding how multi-FA (or multi-router) case is handled 
  > would be useful. I'm not aware of any inter-FA communication 
  > specification for this purpose. The RFC doesn't get into this 
  > scenario either. Which leaves the people to resort to multiple 
  > registration on multi-FA (or multi-router) networks, I guess.
  > 
  > Any thoughts?

=> True. However, in this case IMHO it would be 
better to take a small step forward from MIPv4
and specify something between the PaC and the EP. 
This doesn't need to be done from day one. My earlier
note was mainly looking at technical issues rather
than WG management issues. So I think that we can go for
option 2, but from a WG process point of view focus
on the protocol design first then specify any additional
PaC - EP protocol later. Whether all should be in the same
document or not is yet to be seen, but it would make
sense to consider our default from the start (i.e.
rule out something that would not work in a split 
PaC - EP configuration). 

Hesham

  > 
  > alper 
  > 
  > 
  > 
  > ----- Original Message ----- 
  > From: "Hesham Soliman (EAB)" <[email-masked]>
  > To: "Pana (E-mail)" <[email-masked]>
  > Sent: Tuesday, September 10, 2002 5:49 AM
  > Subject: Support for multiple default routers
  > 
  > 
  > > Hi, 
  > > 
  > > I'd like to bring up this issue for discussion/comments. 
  > > 
  > > While simplifying the PANA charter it was suggested that
  > > we assume that the PAA is always in the first hop router. 
  > > There seemed to be another assumption that the PAA and the 
  > > EP are also colocated to eliminate the need (initially) to
  > > define a protocol (not necessarily a new one) to run
  > > between the PAA and the EP. 
  > > 
  > > However, we also have a requirement on PANA to support
  > > multi-access links. It is likely that these links would 
  > > have more than one default router, mainly for load sharing
  > > or redundancy. If these links require authentication for 
  > > network access (i.e. PANA) while running multiple default 
  > > routers (EPs), we need to consider one or more of the following 
  > > options:
  > > 
  > > 1. Each default router is a colocated PAA and EP. A PaC 
  > >    would need to find all PAAs and register with each one
  > >    of them to be granted network access through either one.
  > > Pros: 
  > > - We do not specify a protocol between the EP
  > >   and the PAA.
  > > 
  > > Cons: 
  > > - Multiple unnecessary registrations (and reauthentication/
  > >   Heartbeats later) for the same link.
  > > - Additional state in the hosts
  > > 
  > > 2. One of the default routers is a PAA and the rest are EPs.
  > >    Hosts would discover and register with one PAA only.   
  > >    A protocol is defined to run between the PAA and the EPs. 
  > >    Pros: 
  > > - A single registration for the link.
  > > - Less complexity in hosts.
  > > 
  > > Cons: 
  > > - Additional work to specify a protocol between
  > >   the PAA and the EP. The security requirements
  > >   would need to be investigated for this protocol. 
  > >               possible options: 
  > > - SNMP.
  > > - Future stuff: Midcom, Context transfer, others ?
  > > 
  > > 
  > > Have I missed other pros or cons? 
  > > Which option do you think we should go for? 
  > > 
  > > Hesham 
  > > 
  > > 
  >

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Thu, 19 Sep 2002 13:57:14 -0700

> rule out something that would not work in a split 

(just a minor correction. You mean "PAA-EP" separation/
protocol/etc..)

I think it'd be good to understand if and how this case is handled
by Mobile IPv4 implementation/deployment. I'll ask this
on the Mobile IP WG list and cc PANA list as well.

alper

---

From: Ilkka Vesa <[email-masked]>
Date: Mon, 23 Sep 2002 16:16:44 +0300 (EEST)

Hi,
some comments and questions...

If there are many PAAs in the same link, they all are most probably
connected to some kind of local AAA server. If PaC's authentication
succeeds, AAA server could send Success -message with needed information
about PaC (e.g. IP-address, lifetime, ...) to all PAAs in that link.
Separation of PAA and EPs would be avoided and there would be no
unnecessary registrations or bandwith consumption.
Could this be one possibility?

If PANA is used to deliver keying material to PaC and PAA, how is it
handled when multiple default routers are present? PaC needs different
pair of authentication and encrypting keys to every default router it
uses. Could a new protocol between PAAs and many EPs handle this? Or would
it still be simpler to PaC to authenticate to all those PAAs/routers it
really needs? Or could the proposal above be used, so that AAA server
delivers keying material to all PAAs?

It would be nice to hear some comments on these,

Ilkka

--
Ilkka Vesa ([email-masked])
Tampere University of Technology

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 23 Sep 2002 11:28:18 -0400

> Could this be one possibility?

I think this is actually considering a separation of PAA and EP in
which AAA protocol is used for indirect communication between PAA and
EP via a AAA server.

> delivers keying material to all PAAs?

It is not necessary to use PANA for directly distributing encryption
keys.  Instead, it is possible to use a local security association
which would be established between PaC and PAA as a result of
successful authentication as a "security enabler" in the access
network.  For example, IKE credentials can be derived from the local
security association and assuming that the PAA distributes IKE
credentials to EP(s), the derived IKE credentials can be used by the
PaC device and each EP on the link to establish an IPsec SA which is
associated with a distinct set of per-packet protection keys.
Although the same functionality can be also done by using PIC, my
point here is that the issue of key distribution can be separately
discussed from the issue on PAA-EP co-location/separation.

Yoshihiro Ohba