Subject: Mobile IPv4 'R' bit and multiple routers

From: "Alper E. YEGIN" <[email-masked]>
Date: Thu, 19 Sep 2002 20:15:16 -0700

Hello,

I'd like to solicit some comments/feedback on a Mobile IPv4
feature...

When 'R' bit in the mobility agent advertisement is set, that
means the MNs have to register with the FA even if they are using
co-located care-of address. They have to get authenticated and
authorized. My understanding is that this feature is meant to be
used as an access control mechanism...

Question is: what happens when there are more than one router
on the subnet? One or more of them might be implementing an
FA functionality. Is a MN supposed to be registering with every
one of the FAs? Even if it does, how are the non-FA routers notified
about this MN? Even if an FA requires MNs to register, they can
still get around this if other routers do not apply access control.

Any thoughts/feedback, especially design/deployment experience 
on this matter??

We are looking at a similar scenario with PANA, and need to make
a design decision. PANA authentication agents are likely to be
co-located with first hop routers, and there can be multiple such
agents. Therefore the same issue....

Thanks.

alper

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 24 Sep 2002 12:25:06 -0700

Hi Yoshi,

> Hi Alper,
> 
>  Good point.  I think it will depend on the policy of a visited
>  subnet and an MN's capability.  But, from my understanding,
>  registration requests via one FA that sends advertisements
>  with an R-bit should be enough.
> 
>  One policy and a desirable MN's capability will be as follows:
>  - Those FAs that send advertisements with an R-bit know
>    how to pass through a firewall.  So, registration requests
>    via those FAs may succeed.
>  - But, via other FAs or routers, registration request packes
>    will be blocked at a firewall.  So, registration requests will
>    never succeed via those other FAs or routers.
>  - MNs should select or change the 1st hop FA to those FAs
>    that send advertisements with an R-bit.

This says MN should only use the FA it has registered with.
I was looking for an answer that enables MN to use any
router/FA on the network once it's registered.

alper

> 
> Cheers.
> -Yoshi
> 
> at Thu, 19 Sep 2002 20:15:16 -0700, Alper E. YEGIN wrote:
> >Hello,
> >