Subject: [AAA-WG]: AAA-MIP comments

From: "Kuntal Chowdhury" <[email-masked]>
Date: Wed, 27 Nov 2002 12:28:13 -0600

Hello all,
I have a few comments on draft-ietf-aaa-diameter-mobileip-13.txt. My apology
for sending these comments so late in the process. Most of the comments are
editorial and I believe they can be easily fixed. Please let me know if you
need further clarification on these comments.

-Kuntal

-----------------------------------------------------------------------

Section 1.4:

   In the event that the mobile node with AAA NAI extension support
   [AAANAI] has been previously authorized by the AAAH and now needs to
   be re-authenticated, and requests to keep the assigned home agent in
   the foreign network, the mobile node MUST include the HA NAI and the
   AAAH NAI in the registration request to the FA. Upon receipt, the FA
   will create the AMR including the MIP-Home-Agent-Address AVP, the
   Destination-Host AVP based on the AAAH NAI and include the MIP-Home-
   Agent-Host AVP based on the home agent NAI. If the AAAF authorizes
   the use of the requested home agent, the AAAF MUST set the Home-
   Agent-In-Foreign-Network bit in the MIP-Feature-Vector AVP.

   In the event that the mobile node that does not support the AAA NAI
   extension has been previously authorized by the AAAH and now needs to
   be re-authenticated, and requests to keep the assigned home agent in
   the foreign network, the mobile node sends a registration request
   without the AAA NAI and the HA NAI. Upon receipt, the FA will create
   the AMR including the MIP-Home-Agent-Address AVP. If the AAAF
   authorizes the use of the requested home agent, and if it has
   knowledge that the requested home agent is in its own domain, the
   AAAF MUST set the Home-Agent-In-Foreign-Network bit in the MIP-
   Feature-Vector AVP.

Comment:
If the requested HA is not in the same domain of the AAAF, then the AAAF
cannot really authorize the use of it (paragraph 1 above). 
Therefore change the text like:

"  
   In the event that the mobile node with AAA NAI extension support
   [AAANAI] has been previously authorized by the AAAH and now needs to
   be re-authenticated, and requests to keep the assigned home agent in
   the foreign network, the mobile node MUST include the HA NAI and the
   AAAH NAI in the registration request to the FA. Upon receipt, the FA
   will create the AMR including the MIP-Home-Agent-Address AVP, the
   Destination-Host AVP based on the AAAH NAI and include the MIP-Home-
   Agent-Host AVP based on the home agent NAI.

   In the event that the mobile node that does not support the AAA NAI
   extension has been previously authorized by the AAAH and now needs to
   be re-authenticated, and requests to keep the assigned home agent in
   the foreign network, the mobile node sends a registration request
   without the AAA NAI and the HA NAI. Upon receipt, the FA will create
   the AMR including the MIP-Home-Agent-Address AVP.

   If the AAAF authorizes the use of the requested home agent, and if it 
   has knowledge that the requested home agent is in its own domain, the
   AAAF MUST set the Home-Agent-In-Foreign-Network bit in the MIP-Feature
   -Vector AVP.
"

Section 1.4:

   Mobile Node   Foreign Agent    Home Agent        AAAF         AAAH
   -----------   -------------  -------------   ----------    ----------

      <----Challenge----
    Reg-Req (Response)->
                         ------------AMR------------->
                                                     -----AMR---->
                                                     <----HAR-----
                                      <-----HAR------
                                      ------HAA------>
                                                     -----HAA---->
  <----AMA-----
                       <-------------AMA------------
       <---Reg-Reply----
   Figure 6: Mobile IP/Diameter Message Exchange when HA is allocated in
                               Visited Realm

Comment: Why is the FA sending back an AMA to the MN? I think it is an
editorial
problem.

Section 2.1:

   If a foreign agent is used in a visited network, the AAAF MAY set the
   Foreign-Home-Agent-Available flag in the MIP-Feature-Vector AVP in
   the AMR message to indicate that it is willing to assign a Home Agent
   in the visited realm.

Comment: It should be: "If a home agent is used in a visited....."

Section 2.1:

If the mobile node's home address is all ones, the foreign or home
agent MUST include a MIP-Mobile-Node-Address AVP, set to all ones.

Comment: 
1. RFC 3344 talks about dynamic Home Address allocation based on Home 
Address= 0.0.0.0 in the RRQ. No mention of Home Address = 255.255.255.255. 

Section 2.1:

      <AA-Mobile-Node-Request> ::= < Diameter Header: 260, REQ, PXY >
                                   < Session-ID >
                                   { Auth-Application-Id }
                                   { User-Name }
                                   { Destination-Realm }
                                   { Origin-Host }
                                   { Origin-Realm }
                                   { MIP-Reg-Request }
                                   { MIP-MN-AAA-Auth }
                                   [ Acct-Multi-Session-Id ]
                                   [ Destination-Host ]
                                   [ Origin-State-Id ]
                                   [ MIP-Mobile-Node-Address ]
                                   [ MIP-Home-Agent-Address ]
                                   [ MIP-Feature-Vector ]
                                   [ MIP-Originating-Foreign-AAA ]
                                   [ Authorization-Lifetime ]
                                   [ Auth-Session-State ]
                                   [ MIP-FA-Challenge ]
                                   [ MIP-Candidate-Home-Agent-Host ]
                                 * [ Proxy-Info ]
                                 * [ Route-Record ]
                                 * [ AVP ]

Question: Why MIP-Home-Agent-Host AVP is missing?

Section 2.3:

   If the HAR message does not include a MIP-Mobile-Node-Address
   AVP, and the Registration Request has 0.0.0.0 for the home address,
   and the HAR is successfully processed, the Home Agent MUST allocate
   one such address to the mobile node.

Comment: The last sentence says "...one such address...". Which address?

Section 4.5:

   If the mobile node includes a valid home address (i.e., not equal to
   0.0.0.0 or 255.255.255.255) in its Registration Request, the foreign
   agent zeroes the Mobile-Node-Home-Address-Requested flag in the MIP-
   Feature-Vector AVP.

   If the mobile node sets the home address field equal to 0.0.0.0 in
   its Registration Request, the foreign agent sets the Mobile-Node-
   Home-Address-Requested flag to one.

   If the mobile node sets the home agent field equal to 255.255.255.255
   in its Registration Request, the foreign agent sets both the Home-
   Agent-Requested flag and the Home-Address-Allocatable-Only-in-Home-
   Realm flag to one in the MIP-Feature-Vector AVP.

Comment: Some of the options here are unnecessary. The Home Address request 
should only be analyzed by the AAAH and HA as the field appears in the 
MIP-Reg-Request AVP. The FA or the AAAF should not worry about Home Address 
field.

Section 4.5:

   If the mobile node requests a home agent in the foreign network
   either by setting the home address field to all ones, or by
   specifying a home agent in the foreign network, and the AAAF
   authorizes the request, the AAAF MUST set the Home-Agent-In-Foreign-
   Network bit to one.

Comment: MN requesting HA assignment by an indication in the Home Address
field is unnecessary. Why can't the MN indicate it's preference for
HA assignment in the HA field in the RRQ?

Section 5.3:

   If, on the other hand, the home agent is to be allocated in the
   visited realm, the AAAH transmits the HAR to the foreign home agent,
   where, prior to delivery to the home agent, it is perused by the AAAF
   hosting the home agent. If the session key needs to be encrypted the
   AAAH will encrypt the MIP-HA-to-MN Key AVP and the MIP-FA-to-MN AVP
   with help of CMS security application [CMS] using the security
   association with the AAAF associated with the home agent.

Comment: This paragraph is confusing. It starts with an if statement: "If,
on the
.....it is perused by the AAAF hosting the home agent."

Question:
Why AAAF is perusing/examining the Mobile-Home session key? 
If for some reason the AAAF finds the Mobile-Home session key to be wrong,
what
does it do?

----------------------------------------------------------------------------
--