Subject: [AAA-WG]: Route-Record question in MobileIP

From: Michael Chen <[email-masked]>
Date: Tue, 03 Apr 2001 15:52:27 -0700

I have a "Route-Record" question while MN registation in Foreign HA. I
assume that all the AAA servers are stateless in my example. Here is the
message flow which I guess will use in our 02 version.

FA(mno.net)   HA(mno.net)    AAAF(mno.net)   AAAP(xyz.com)
AAAH(abc.com)
-----------   -----------    -------------   -------------  ------------

   -------------AMR1--------------->
                                  ------AMR2------>
                                                     -----AMR3------>
                                                     <----HAR1-------
                                  <------HAR2------
                 <------HAR3-------
                  ------HAA1------>
                                  ------HAA2------>
                                                     -----HAA3----->
                                                     <----AMA1------
                                   <-----AMA2------
  <-------------AMA3----------------

    1. AMR1: send to it's own AAA server(local policy)
               User-Name=[email-masked]
               Origin-FQDN=fa.mno.net
               Origin-Realm=mno.net
               Destination-Realm=abc.com
    2. AMR2: route on Destination-Realm, add Route-Record
               User-Name=[email-masked]
               Origin-FQDN=fa.mno.net
               Origin-Realm=mno.net
               Destination-Realm=abc.com
               Route-Record=dia1.mno.net
    3. AMR3: route on Destination-Realm, add Route-Record
               User-Name=[email-masked]
               Origin-FQDN=fa.mno.net
               Origin-Realm=mno.net
               Destination-Realm=abc.com
               Route-Record=dia1.mno.net
               Route-Record=dia2.xyz.net

********Here is the question, we have two options
    4A. HAR1: route on Destination-Realm, put original Route-Records in
Proxy-State, add Route-Record
               User-Name=[email-masked]
               Origin-FQDN=dia3.abc.com
               Origin-Realm=abc.com
               Destination-Realm=mno.net
               Proxy-State
               Route-Record=dia3.abc.com
    4B. HAR1: route on Route-Record
               User-Name=[email-masked]
               Origin-FQDN=dia3.abc.com
               Origin-Realm=abc.com
               Destination-Realm=mno.net
               Route-Record=dia1.mno.net
               Route-Record=dia2.xyz.net

HAR1 is a request, we use route-record to route the request message OR
we add route-record which will be used in reply message(HAA)?
4A is correct or 4B is correct?   Why?

-Michael

---

From: Patrice Calhoun <[email-masked]>
Date: Tue, 3 Apr 2001 15:58:15 -0700 (PDT)

> 4A is correct or 4B is correct?   Why?

It really doesn't matter whether 4A or 4B is used, as this is an
implementation issue. Some AAAH simply update the command code on the AMR to
an HAR, and change some of the AVPs, while other implementations actually
create a brand new message. Both ways are valid, and these implementation
differences would result in the 4A and 4B examples you've described.

Of course, the Home Agent must be prepared to accept both, since even if 4A
was used, there could still be an additional proxy between the AAAH and the HA
(say the AAAF in a visited Home Agent).

In fact 4C (below) would also be valid:

Hope this helps,

PatC

---

From: Michael Chen <[email-masked]>
Date: Tue, 03 Apr 2001 16:26:58 -0700

Pat,

  correct me if I am wrong.
  4C (below) would  NOT  be valid:  because AAAP would complain "loop detect"
before send HAR2
4C.      HAR1: route on Route-Record
               User-Name=[email-masked]
               Origin-FQDN=dia3.abc.com
               Origin-Realm=abc.com
               Destination-Realm=mno.net
               Route-Record=dia1.mno.net
               Route-Record=dia2.xyz.net
               Route-Record=dia3.abc.com

According  to session 12.4.1 in base protocol
"A Diameter server that proxies a message or type Request, Query or
   Indication MUST append a Route-Record AVP, which includes its
   identity.  Diameter Servers that receive messages MUST validate the
   last Route-Record AVP in the message and ensure that the host
   identified in the AVP is the same as the sender of the message."
I would say only 4A is correct. In other words, 4B is not valid. Here is the
reason:

4B       HAR1: route on Route-Record
               User-Name=[email-masked]
               Origin-FQDN=dia3.abc.com
               Origin-Realm=abc.com
               Destination-Realm=mno.net
               Route-Record=dia1.mno.net
               Route-Record=dia2.xyz.net
               NO Route-Record=dia3.abc.com

5.       HAR2: route on Route-Record
               User-Name=[email-masked]
               Origin-FQDN=dia3.abc.com
               Origin-Realm=abc.com
               Destination-Realm=mno.net
               Route-Record=dia1.mno.net
               NO  Route-Record=dia2.xyz.net
               NO Route-Record=dia3.abc.com

HAR is a request not a reply so we should add route-record not remove the
route-record
but if we add route-record in the request, LOOP DECTECT happen.  To sum up, only
4A is correct.

FA(mno.net)   HA(mno.net)    AAAF(mno.net)  AAAP(xyz.com) AAAH(abc.com)
-----------   -----------    -------------   -------------  ------------

   -------------AMR1--------------->
                                  ------AMR2------>
                                                     -----AMR3------>
                                                     <----HAR1-------
                                  <------HAR2------
                 <------HAR3-------
...........message skip.....

---

From: Patrice Calhoun <[email-masked]>
Date: Tue, 3 Apr 2001 16:46:16 -0700 (PDT)

Let me try again, as I am confused with the host names ( just did a cut and
paste, and it was obviously wrong).

What I meant to say is this. When the AAAH receives the AMR, it can either
create a new HAR (and have no Route-Record AVPs), or simply update the AMR to
an HAR (and append its own Route-Record AVP). When the HA receives the HAR,
processes it, and prepares the response, it will delete the AAAH's
Route-Record AVP, and forward the message. So there is no loop involved,
unless the HA did not remove the last Route-Record AVP, which would be bad
behavior.

PatC

> before send HAR2 4C.      HAR1: route on Route-Record
>                User-Name=[email-masked]
>                Origin-FQDN=dia3.abc.com
>                Origin-Realm=abc.com
> but if we add route-record in the request, LOOP DECTECT happen.  To sum up,
> only 4A is correct.
> 
>

---

From: Michael Chen <[email-masked]>
Date: Tue, 10 Apr 2001 15:57:08 -0700

In base protocol

1.
  section 12.1. Figure2.
    dia3--->dia2
        Route-Record=dia1.mno.net (missing)
        Route-Record=dia2.xyz.com

   dia2--->dia1
        Route-Record=dia1.mno.net (missing)

2.
  section 10.1.3
    "The Failed-Command-Code-Vendor-Id AVP (AVP Code 262)...."
    It should be Failed-Vendor-Id AVP

3.
  section 12.4.7
     "......type Answer of Reply......."
     It should be "or" instead of "of"