Subject: [netext] Review of I-D: draft-ietf-netext-radius-pmip6-03

From: <[email-masked]>
Date: Tue, 19 Jul 2011 17:00:21 +0000

A few comments on the I-D:

1. I-D states:

>The AAA procedures
>   defined in this document cover the following two deployment models:
>
>   o  a mobile node connects to the Proxy Mobile IPv6 domain from the
>      home network
>
>   o  a mobile node connects to the Proxy Mobile IPv6 domain from a
>      visitor network

The above bullet points are not deployment models. Its just
illustrative of the type of networks from which an MN may
attach. Suggest rephrasing it.

2. You could reference the definition of NAS as per one of the RADIUS
   RFCs instead of redefining it here

3. 
 >  Any time a mobile node attaches to a PMIPv6 Domain, the NAS on that
 >  access network activates the network access authentication
 >  procedure."
   
   is not entirely correct. An access network may require
   authentication by a host attaching to it. And that access network
   may be part of a PMIP6 domain. The statement above implies that
   PMIP6 domains and access networks within those require a NAS and
   access authentication... which is not true.

4. 
> The NAS performs the network access authentication and queries the
> HAAA using RADIUS protocol.

NAS could use Diameter as well. Rephrase the above.

5. 
> If the network access authentication succeeds, the MN is
>  authorized for PMIPv6 service and its Policy Profile is obtained as
>  part of the RADIUS message exchange with the AAA server.

Access network authentication does not imply PMIP6 service
authorization. 

6. 
s/unambiguous indication of the type of address to be
assigned/unambiguous indication of the type of address(es) to be
assigned 

7. 
>IP4_TRANSPORT_SUPPORTED (0x0000080000000000)
>
>      This capability bit is used for negotiation of the IPv4 transport
>      support between the MAG and AAA.

Why does the MAG need to indicate support for IPv4 transport?  Why
would the MAG not support v4? I dont see the need for this.

8. 
> 4.2.  Mobile-Node-Identifier

Is the MN Identifier used in the PMIP6 PBU/PBA messages the same as
the identity used for access authentication? If it is not, how does
the NAS get the PMIP6 MN identifier? It would be maybe useful to even
rename this as the PMIP6-MN-Identifier to avoid ambiguity

9. 
>   The Service-Selection attribute (AVP Code TBD) contains the name of
>   the service or the external network that the mobility service for the
>   particular MN SHOULD be associated with.

Can you give an example of what the service name can be? I am trying
to understand what exactly would the service attribute be.

>     This field is of type UTF8String and contains the Service
>      Identifier the MN is associated with.

I dont understand what is implied by the term "Service Identifier the
MN is associated with".

10. Sec 4.14:
>4.14.  PMIP6-Home-DHCP4-Server-Address
>
>   The PMIP6-Home-DHCP4-Server-Address (AVP Code TBD) contains the IPv4
>   address of the DHCPv4 server in the home network.

Is this attribute needed? Is it not the case that the MAG is already
confgured with the address of the DHCP servers that it interacts with?

Please address these comments before the chairs can forward the I-D to the
IESG.

-Basavaraj

---

From: Sri Gundavelli <[email-masked]>
Date: Thu, 21 Jul 2011 09:37:08 -0700

Hi Raj,

Thanks for the review. Comments inline ..

> attach. Suggest rephrasing it.

Agree, its more about a scenario, not a deployment model. We should rephrase
that.

>    RFCs instead of redefining it here

Ok

>    access authentication... which is not true.

Makes sense

> NAS could use Diameter as well. Rephrase the above.

Sure

> Access network authentication does not imply PMIP6 service

Agree. We need to qualify this statement

> assigned/unambiguous indication of the type of address(es) to be

Ok

> would the MAG not support v4? I dont see the need for this.

This is about the type of transport network between MAG and LMA, IPv4 or
IPv6 to be used. Its more a capability indicator. We can revisit this.

> rename this as the PMIP6-MN-Identifier to avoid ambiguity

The identity in the access network and the identity in the home network need
not be same. It is assumed that the MAG has the ability to use the access
identity and obtain the identity that it can present to LMA. Where that
mapping is maintained is outside the scope of this document. I thought this
was there, can clarify.

> to understand what exactly would the service attribute be.

email.mymobileoperator.net

> I dont understand what is implied by the term "Service Identifier the

Its an APN name

> confgured with the address of the DHCP servers that it interacts with?

Its a fixed link-local address for all DHCP servers, to ensure after roam,
the requests don't go back to the DHCP server in the previous access
network. Its there in 5844, just reflecting that.

Thanks Raj for the good review comments.

Regards
Sri

> _______________________________________________
> netext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netext