Subject: RE: [AAA-WG]: HA sending AMR

From: "Pat R. Calhoun" <[email-masked]>
Date: Fri, 22 Feb 2002 14:50:23 -0800

Upon deregistration, shouldn't the HA send a
Session-Termination-Request?

PatC
- -----Original Message-----
From: Sivasundar Ramamurthy [mailto:[email-masked]] 
Sent: Friday, February 22, 2002 2:50 PM
To: AAA Working Group
Subject: [AAA-WG]: HA sending AMR

Hello,

This is regarding AAA Mobile IP application.

Consider the scenario when a MN returns home and sends a registration
request to the HA for deregistration. Also, the MN-HA key has expired
and the MN makes the deregistration request a AAA request. I am
assuming that no standards prevent the MN using a AAA request for
deregistration.

While it is clear that the HA can send an AMR for a AAA request with
a co-located COA, it is not clear as to what the HA should do in the
de-registration case. And if the HA "can" send an AMR, current
standards imply that the registration would go through the
AMR-HAR-HAA-AMA cycle, all exchanged between the AAAH and the HA. (It
seems like the AAAH directly sends an AMA for an AMR only if the
co-located bit is set in the mip-feature-vector).

I am guessing that the Mobile IP draft implicitly addresses this case
and that going through AMR-HAR-HAA-AMA cycle is the implied solution.
If so, can we optimize it similar to the co-located COA MN and have
the HA and the AAAH just exchange AMR and AMA messages (maybe an
extra bit in the feature vector).

If going though the AMR-HAR-HAA-AMA cycle is not the implied
solution, can someone tell me how this case is handled by the HA (and
the AAAH)?

If the draft does not cosider this scenario at all and all the
"implied solution" is my imagination, can we specify what the HA
should do in this case?

thanks!

Siva

---

From: Sivasundar Ramamurthy <[email-masked]>
Date: Fri, 22 Feb 2002 15:03:43 -0800 (PST)

Hello Pat,

> Session-Termination-Request?

It probably should (eventually), but how does the HA authenticate the
deregistration request, given that there is no MN-HA authentication
ext in the request? It seems like the HA needs to use the AAA
infrastructure to authenticate the request....

Also, the HA MUST reply to the MN. For the MN to accept this reply, it
probably needs to add a MN-HA auth ext, using the keys that
the AAA server provides it when authenticating the user....

Is my thinking correct?

thanks,

Siva

> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
> 
> iQA/AwUBPHbLLzN1fXKoxmisEQK8BgCdEFYNA3ZtCHFgWgCWbV0Ya7OysD8Anjhm
> DXJQ8qkml9O/GL8OFvuQSSeW
> =rqAL
> -----END PGP SIGNATURE-----
> 

Thanks,

Siva

====================================
Sivasundar Ramamurthy		
(She-va-su-ndar Ra-ma-moor-thee)

Engineer, Mobile IP Project
Hewlett Packard
(408) 447 7255
====================================