Subject: [AAA-WG]: Solution to issue #326 and #305

From: Tony Johansson <[email-masked]>
Date: Fri, 12 Apr 2002 09:27:47 -0700

All,

From all of the discussion made regarding issue #305 and #326. I've come
to the following conclusions:

* Adopt issue #305 with removing the MIP-Foriegn-Agent-Host AVP, since
the spec does not specify any real use for it and no real need for it
have been concluded.

* Reject issue #326, since no one have really stated that this is needed
or even allowed in mobile ip.

Any comments / objections to this?

/Tony

---

From: Sivasundar Ramamurthy <[email-masked]>
Date: Fri, 12 Apr 2002 09:52:30 -0700 (PDT)

Hi Tony,
 
> or even allowed in mobile ip.

The only scenario where we need the FA-address is when a co-located MN
registers via the FA. Nothing in the standards say that the FA cannot
create an AMR and request FA-HA keys in this case; and the HA cannot
use the COA of the reg-request AVP to store the HA-FA key.

thanks,

Siva

---

From: Tony Johansson <[email-masked]>
Date: Fri, 12 Apr 2002 10:10:06 -0700

Hi Siva,

Can you please elaborate this a bit further. I don't really understand your
point here?

/Tony

---

From: Sivasundar Ramamurthy <[email-masked]>
Date: Fri, 12 Apr 2002 10:26:24 -0700 (PDT)

Hi Tony,

> Can you please elaborate this a bit further. I don't really understand your

I'll try :-)

The scenario is when a MN is using a co-located COA but needs to
register via the FA since the 'r' bit is turned on in the
advertisement (RFC3220).

The MN includes a MN-AAA auth ext in the request, probably to renew
the MN-HA key. The FA converts the request to an AMR, and adds a FA-HA
key request since it does not have a key to the HA.

When the HAR is receieved by the HA, it contains the FA-HA key but the
key is not for the COA; The key is for the FA that sent the AMR. To
HA needs to store the HA-FA key against the correct FA (IP address).
This address cannot be obtained in the HAR and thus the Address AVP
might be needed.

I have thought through this for a while, and dont see anything that
prevents this scenario from taking place.

(NOTE: As I understand the HA-FA authentication by the HA, it is to
authenticate the entity that forwarded the request (FA), not the
COA in the request.)

thanks,

Siva

---

From: Johan Johansson <[email-masked]>
Date: Mon, 15 Apr 2002 11:36:20 +0200

Tony,

What has happened with regard to issue #326 is that nobody has explained 
why it is *not* allowed in mobile ip, or maybe I have missed some 
emails. As I said, I'd be extatic to say that the CoA should always be 
used but I can not find any support for this in rfc 3220.

j

---

From: Tony Johansson <[email-masked]>
Date: Tue, 16 Apr 2002 10:25:42 -0700

I think Siva may have a point regarding co-located CoA and  the 'R' bit in
advertisements, see previous mail discussion. The question has also been
brought up on the mip_wg list and  I hope that we soon can get some
clarifications regarding this issue.

/Tony

---

From: Sivasundar Ramamurthy <[email-masked]>
Date: Tue, 16 Apr 2002 11:10:13 -0700 (PDT)

> used but I can not find any support for this in rfc 3220.

I could not find anything in RFC3220 that says that the (multi-homed)
FA MUST use the COA as the src address in forwarding request to the
HA. From what I can recollect, I think the MN MUST forward the request
to the src address in the advertisement, irrespective of the COA it
chooses from the advertisement.

It seems like the COA != src-of-UDP-request scenario (at the HA) can
happen even when the MN is using a FA COA.

Siva

---

From: Tony Johansson <[email-masked]>
Date: Tue, 16 Apr 2002 11:29:13 -0700

Hello Siva,

This is RFC3220 specific questions, so can you please bring it up on the
mip_wg instead. It's much better  if we can get all of this clarified on the
list where the RFC3220 belong. I assume that all of us that do care about the
Diameter MIPv4 appl also follows the mip_wg list regarding these issues.

Regards,

/Tony

---

From: Joe Lau <[email-masked]>
Date: Tue, 16 Apr 2002 12:09:35 -0700 (PDT)

> chooses from the advertisement.

This is because the MN, while visiting on the foreign network, can not use
ARP.  Instead, it retrieves the link-layer address from the advertisment
that the FA sends out on its mobility interface.  The mobility interface
may not be the FA's COA interface, which is usually the "best connected"
interface.

Joe Lau