Subject: RE: [AAA-WG]: AAA for IPv6

From: George Tsirtsis <[email-masked]>
Date: Tue, 21 Aug 2001 08:06:30 -0400

It seams to me that the subject of "AAA for IPv6" has at least two
components that may potentially belong to different WGs. One is the
communication between the end node and the access router and the other is
the communication between the AAA client in the Access Router and the rest
of the AAA infrastructure. 

The latter is all about IPv6 support in the AAA protocol (Radius, diameter,
cops)...and thus belongs to the AAA/COPS WGs...

The former is about challenging the end node and transporting the
identification and authentication parameters over the access link. This is
not part of the AAA protocol (e.g.: typically Radius does not run over the
access link). What is needed is a "carrier" mechanism for the parameters
that need to be fed to the AAA protocol. PPPv6 for example provides such a
carrier. MIPv4 also provides such a carrier to IPv4 nodes that use Mobile IP
but, MIPv6, due to the lack of FAs, does not provide such an obvious
carrier...hence Charlie's work. Now, there are a couple of things that can
be done IMO.

1. Use Neighbor Discovery (ND) as a carrier for the AAA parameters. e.g.:
extend Neighbor Advertisements and Router Advertisements to carry
challenge/response messages....this to me is the job of IPv6 WG and could be
the start of a much bigger fish called authenticated ND or

2. Create a new carrier, independent from ND and with the specific task of
carrying the appropriate challenge/response parameters...this to me belongs
to URP WG.

...my two drachma

Regards
George
-----Original Message-----
From: Bernard Aboba [mailto:[email-masked]]
Sent: Tuesday, August 21, 2001 8:06 AM
To: Charlie Perkins
Cc: [email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject: Re: [AAA-WG]: AAA for IPv6

The AAA WG only considers work items resulting from a consensus draft
within a subject area WG. Until the IPNG or URP WG progresses a draft on
the subject, we cannot consider a work item relating to AAA for IPV6. 

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Thomas Narten <[email-masked]>
Date: Tue, 21 Aug 2001 10:40:54 -0400

> communication between the end node and the access router

This first component would appear to be exactly what the URP effort is
focusing on. That is, URP is focused on the problem of how does an
edge device "log in" and authenticate itself to the network. This
initial step (becoming authorized to use the network) may be tied in
with access control on a router, but that is a separate issue and does
not appear to be directly tied to the URP protocol. I.e., URP allows a
device to authenticate itself with some local server, that local
server may then (behind the scenes) grant permission to other devices
on the local network (e.g., routers) to allow packets from the device
to be forwarded. But the mechanism for doing that would likely be
separate (and possibly already existing) protocols rather than URP
itself.

> the other is the communication between the AAA client in the Access
> Router and the rest of the AAA infrastructure.

Note specifically that this interaction does not directly involve the
client device that is seeking access to the  network.

I would expect that this is already being handled in the  AAA WG and
that IPv6 is already being supported (e.g., via diameter).

Thomas