Subject: [Dime] follow-up of Chicago meeting: comments on draft-korhonen-dime-pmip6-00.txt.

From: Frank Xia <[email-masked]>
Date: Fri, 03 Aug 2007 14:11:32 -0500

Hi all

I have some comments in the DIME WG when the draft is presented in Chicago.
I would like to summarize my comments here.

The main idea of the draft is based on that " 
The access authentication procedure into the Proxy
Mobile IPv6 Domain resembles the Mobile IPv6 integrated scenario
bootstrapping"

I would like to highlight some differences and their influence on AAA interface.
1)The security association is between MAG and LMA, not MN and LMA
2)PMIPv6 now only deals with the P-t-P link model, in which case
  it is very probable that the LMA has no any idea about the MN's IP addess
3)In the PMIPv6 ,there is another important function, that is,
  the all MAGs should run consistently to emulate the MN's home link characteritics

The following is the detailed comments:
1)Adding information exchange between LMA and AAA server to convey
  key material when LMA<->MAG SA is established using EAP authentication.
2)Clarifying the meaning FQDN, and enabling dynamical LMA discovery
3)DNS update. It is possible for MAG to initate DNS update
4)the usage of PMIP6-MAG-Address.
5)Adding address configuration mode attribute to emulate the link.

BR
Frank

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: <[email-masked]>
Date: Fri, 10 Aug 2007 13:03:48 +0200

Hi Frank,
 
Thanks for the review. This is good discussion start for subsequent
revisions of the I-D. Sorry for the slow reply.. I am still on summer
vacation mode ;-)

Please see some of my random thoughts inline.
 
Cheers,
    Jouni
 
________________________________

	From: Frank Xia [mailto:[email-masked]] 
	Sent: Friday, August 03, 2007 10:12 PM
	To: [email-masked]; [email-masked]
	Subject: [Dime] follow-up of Chicago meeting: comments on
draft-korhonen-dime-pmip6-00.txt.

	Hi all
	 
	I have some comments in the DIME WG when the draft is presented
in Chicago.
	I would like to summarize my comments here.

	I would like to highlight some differences and their influence
on AAA interface.
	1)The security association is between MAG and LMA, not MN and
LMA

[JiK] Yes.. how does this affect the authentication procedure between
the NAS(MAG)
      and the AAA? At the end you still authenticate a MN..

	2)PMIPv6 now only deals with the P-t-P link model, in which case
	  it is very probable that the LMA has no any idea about the
MN's IP addess

[JiK] Yes.. there is currently no assumption that LMA would know the
MN-HoA..
      It can learn it though.

	3)In the PMIPv6 ,there is another important function, that is,
	  the all MAGs should run consistently to emulate the MN's home
link characteritics

[JiK] Yes.. How does this affect to the said AAA interface? I am a bit
      confused about the three above points and their relation to the
MAG-AAA 
      interface when it comes to MN attaching & authenticating to a
PMIP6 domain..

	The following is the detailed comments:
	1)Adding information exchange between LMA and AAA server to
convey
	  key material when LMA<->MAG SA is established using EAP
authentication.

[JiK] Hmm.. a MN attaching to a MAG may trigger a dynamic establishment
of the
      MAG-LMA SA, if it does not exist at that point. What information
do you
      think will be PMIP6 specific betweem LMA and AAA during the IKEv2
IPSec
      SA setup? By the way, we should not restrict ourselves to EAP
only.

	2)Clarifying the meaning FQDN, and enabling dynamical LMA
discovery

[JiK] Meaning of the FQDN? Would stating that it is the FQDN of the LMA
be
      enough? Dynamic discovery of LMA is alrady in the I-D. Using both
DNS
      and AAA options.

[JiK] Yes. This is missing.

[JiK] Right.. the original intention of this was to support deployment
an option
      where a NAS/authenticator is not co-located with a MAG rather
looking after
      a pool of MAGs. There the AAA might want to know which MAG the
authentication
      concerns as PBUs and AAA messages originate from different IPs.

	5)Adding address configuration mode attribute to emulate the
link.

[JiK] Originally we thought to handle this with the feature vector AVP
we
      have in the I-D.

	BR
	Frank

---

From: Frank Xia <[email-masked]>
Date: Fri, 10 Aug 2007 14:28:37 -0500

Hi Jouni

Please see my inlines comments...

BR
Frank

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Friday, August 10, 2007 6:03 AM
Subject: RE: [Dime] follow-up of Chicago meeting: comments on draft-korhonen-dime-pmip6-00.txt.

Hi Frank,
 
Thanks for the review. This is good discussion start for subsequent
revisions of the I-D. Sorry for the slow reply.. I am still on summer
vacation mode ;-)
Frank=> I will  benefit from the discussion too.

Cheers,
    Jouni

Hi all

[JiK] Yes.. how does this affect the authentication procedure between
the NAS(MAG)  and the AAA? At the end you still authenticate a MN..

Frank=>My point is how to build SA between MAG and LMA.  For example,
after authentication of the first MN named  [email-masked],  
there is a SA establishment process between MAG and LMA.  As to second MN named [email-masked]
it is not necessary for MAG to initate the SA estbalishment because the second MN can share existing
SA.   The SA establishment needs the support of AAA infrastructure. 

[JiK] Yes.. there is currently no assumption that LMA would know the
MN-HoA.  It can learn it though.

[JiK] Yes.. How does this affect to the said AAA interface? I am a bit
      confused about the three above points and their relation to the
MAG-AAA  interface when it comes to MN attaching & authenticating to a
PMIP6 domain..

Frank=> The above are general comments  to highlight the differences.
The following are the specific comments.

[JiK] Hmm.. a MN attaching to a MAG may trigger a dynamic establishment
of the  MAG-LMA SA, if it does not exist at that point. What information
do you   think will be PMIP6 specific betweem LMA and AAA during the IKEv2
IPSec  SA setup? By the way, we should not restrict ourselves to EAP
only.
Frank=>New attribute PMIP6-LMA-MAG-Pair-Keys is necessary. 
It is true we should not restrict to EAP, but we should support EAP.

[JiK] Meaning of the FQDN? Would stating that it is the FQDN of the LMA
be   enough? Dynamic discovery of LMA is alrady in the I-D. Using both
DNS  and AAA options.
Frank=>Could you give me the text about Dynamic discovery of LMA in the I-D?

[JiK] Right.. the original intention of this was to support deployment
an option    where a NAS/authenticator is not co-located with a MAG rather
looking after   a pool of MAGs. There the AAA might want to know which MAG the
authentication  concerns as PBUs and AAA messages originate from different IPs.

Frank=>Even though NAS/authenticator is not co-located with MAG,  AAA should
be agnostic with the relationship between NAS/authenticator and MAG.
Any way, could you give  a more specific scenario?

[JiK] Originally we thought to handle this with the feature vector AVP
we   have in the I-D.
Frank=>I can't find related description till now.

BR
Frank