Subject: RE: [AAA-WG]: AAA for IPv6

From: Thomas Eklund <[email-masked]>
Date: Sat, 11 Aug 2001 17:47:34 +0200

Dear Pat and AAA WG,
I belive that it should be a working group item. 

The draft shows how access control could be done for IPv6. It does not
propose any new accounting protocol it proposes how authentication and
authorazation could be done with both a stateful approach (i.e. DHCPv6) and
a stateless approach (ND).

-- Best Regards
      Thomas

-----Original Message-----
From: Pat Calhoun
To: Charlie Perkins
Cc: IPng Working Group; AAA Working Group Mailing List
Sent: 2001-08-11 16:38
Subject: Re: [AAA-WG]: AAA for IPv6

I think that the AAA WG should expand its charter to allow for folks in
other WGs looking at using AAA in their application to come forth.
Perhaps
the AAA WG would be a place for the Diameter application to be created.

I am, however, afraid of boiling the ocean, so we need to be very
careful
in what work items we accept. We do, however, want to make sure that we
don't end up with n number of accounting protocols in the IETF
(something
that is actually happening as I type). So, keeping some order is a good
thing. If the WG goes away, it becomes the IESG's responsibility.

My 2 cents,

PatC
On Fri, Aug 10, 2001 at 05:40:31PM -0700, Charlie Perkins wrote:
> 
> Hello folks,
> 
> At the IPv6 meeting in IETF 51, there was a discussion about whether
> the AAA working group should consider the possibility of accepting a
> work item to standardize a protocol to enable the use of AAA to
> authorize network access for IPv6 nodes.  The general sense of the
> working group seemed quite positive on suggesting that such a thing
> would be appropriate.
> 
> I am specifically _not_ asking whether our AAAv6 document should
> be considered as a working group document within the AAA working
> group.  That would be a matter for the AAA working group to consider.
> I am only attempting to find out whether the general sense of the
> working group is the same as the general sense that was expressed
> at IETF 51.  If approval is voiced, or at least objections are not
> raised, then I will relay the information to the AAA working group.
> 
> Regards,
> Charlie P.
> 
> 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Kobylarz, Thaddeus" <[email-masked]>
Date: Sat, 11 Aug 2001 13:19:08 -0400

Pat,
	I agree with your suggestion that the "AAA WG would be a place for
the Diameter application to be created".  Consideration is being given in
3GPP SA5 to utilize in several application scenarios that have requirements
variations.  It would be very helpful to have the AAA WG as a resource to
examine the scenario requirements and provide their advice.  
	At least two perspectives of advice are needed: (1) whether it is
feasible to use Diameter in a scenario and (2)whether its specific scenario
configuration is correct.  Other observations and suggestions would, of
course, be welcomed by 3GPP SA5.
	The dissolution of the AAA WG, at this time, would hamper
utilization of the Diameter knowledge resource.  Hopefully, a dissolution
decision will not occur.
Thad 
-----Original Message-----
From: Pat Calhoun [mailto:[email-masked]]
Sent: Saturday, August 11, 2001 10:38 AM
To: Charlie Perkins
Cc: IPng Working Group; AAA Working Group Mailing List
Subject: Re: [AAA-WG]: AAA for IPv6

I think that the AAA WG should expand its charter to allow for folks in
other WGs looking at using AAA in their application to come forth. Perhaps
the AAA WG would be a place for the Diameter application to be created.

I am, however, afraid of boiling the ocean, so we need to be very careful
in what work items we accept. We do, however, want to make sure that we
don't end up with n number of accounting protocols in the IETF (something
that is actually happening as I type). So, keeping some order is a good
thing. If the WG goes away, it becomes the IESG's responsibility.

My 2 cents,

PatC

---

From: Thomas Eklund <[email-masked]>
Date: Tue, 21 Aug 2001 14:23:27 +0200

Dear George,
What you are suggesting is already done in the draft.
 
It proposes two mechanism to do access control for IPv6 where, one way of
doing it is a stateful approach is based on ND and the other is to do it in
the stateful approach with DHCPv6.

Instead of people bouncing back and forth I belive that the correct WG now
is the AAA WG.

-- thomas

>From: George Tsirtsis [mailto:[email-masked]]
>Sent: den 21 augusti 2001 14:07
>To: 'Bernard Aboba'; Charlie Perkins
>Cc: [email-masked]; [email-masked]; 
>[email-masked];
>[email-masked]
>Subject: RE: [AAA-WG]: AAA for IPv6
>
>
>It seams to me that the subject of "AAA for IPv6" has at least two
>components that may potentially belong to different WGs. One is the
>communication between the end node and the access router and 
>the other is
>the communication between the AAA client in the Access Router 
>and the rest
>of the AAA infrastructure. 
>
>The latter is all about IPv6 support in the AAA protocol 
>(Radius, diameter,
>cops)...and thus belongs to the AAA/COPS WGs...
>
>The former is about challenging the end node and transporting the
>identification and authentication parameters over the access 
>link. This is
>not part of the AAA protocol (e.g.: typically Radius does not 
>run over the
>access link). What is needed is a "carrier" mechanism for the 
>parameters
>that need to be fed to the AAA protocol. PPPv6 for example 
>provides such a
>carrier. MIPv4 also provides such a carrier to IPv4 nodes that 
>use Mobile IP
>but, MIPv6, due to the lack of FAs, does not provide such an obvious
>carrier...hence Charlie's work. Now, there are a couple of 
>things that can
>be done IMO.
>
>1. Use Neighbor Discovery (ND) as a carrier for the AAA 
>parameters. e.g.:
>extend Neighbor Advertisements and Router Advertisements to carry
>challenge/response messages....this to me is the job of IPv6 
>WG and could be
>the start of a much bigger fish called authenticated ND or
>
>2. Create a new carrier, independent from ND and with the 
>specific task of
>carrying the appropriate challenge/response parameters...this 
>to me belongs
>to URP WG.
>
>...my two drachma
>
>Regards
>George
>From: Bernard Aboba [mailto:[email-masked]]
>Sent: Tuesday, August 21, 2001 8:06 AM
>To: Charlie Perkins
>Cc: [email-masked]; [email-masked]; 
>[email-masked];
>[email-masked]
>The AAA WG only considers work items resulting from a consensus draft
>within a subject area WG. Until the IPNG or URP WG progresses 
>a draft on
>the subject, we cannot consider a work item relating to AAA for IPV6. 
>

---

From: "Patil Basavaraj (NET/Dallas)" <[email-masked]>
Date: Tue, 21 Aug 2001 11:02:24 -0500

>> communication between the end node and the access router
>

It may be the "access router" or some other entity in the access
network. 

>This first component would appear to be exactly what the URP effort is
>focusing on. That is, URP is focused on the problem of how does an
>edge device "log in" and authenticate itself to the network. This
>initial step (becoming authorized to use the network) may be tied in
>with access control on a router, but that is a separate issue and does
>not appear to be directly tied to the URP protocol. I.e., URP allows a
>device to authenticate itself with some local server, that local
>server may then (behind the scenes) grant permission to other devices
>on the local network (e.g., routers) to allow packets from the device
>to be forwarded. But the mechanism for doing that would likely be
>separate (and possibly already existing) protocols rather than URP
>itself.
>

Precisely.
Thank you Thomas for "URP in a nutshell".

>Thomas

-Basavaraj

---

From: [email-masked]
Date: Wed, 22 Aug 2001 16:36:49 +0300

Bernard Aboba wrote:
> > 
> > I think the URP WG should be chartered ASAP and AAAv6 taken 
> there as a
> > possible solution. Where can I find the current proposal for the URP
> > charter?
> > 
> 
> Just as the AAA WG is not the appropriate place to do the 
> work of subject
> area WGs, it is not appropriate for subject area WGs to design AAA
> protocols. We have separate WGs so that subject matter experts can
> congregate and focus on their area of expertise. So it would 
> be best for
> URP to be handled in URP WG,  AAA in AAA WG, and IPv6 in IPNG WG. 
> 

Well, I meant the part of the AAAv6 draft that is applicable to the URP
scope. The protocol stuff in the draft is focused on the interface(s)
between the host and an "attendant" node in the network, which clearly is
not in the AAA WG scope.

	Jarno

---

From: George Tsirtsis <[email-masked]>
Date: Wed, 22 Aug 2001 10:42:51 -0400

I wonder if people think that IPv6 introduces additional requirements to the
AAA protocols (Radius/Diameter). My viewpoint is that a AAA protocol has to
be able to do 2 things to be compatible with IPv6:
1. Use IPv6 for transport i.e.: a AAA client in an IPv6 Only or Dual Stack
node to be able to communicate over IPv6 with a AAA server of similar
configuration. Same requirements holds between AAA servers.
2. All the AVPs (or equivalent) in the AAA protocol that happen to include
IP addresses should also support IPv6 addresses. e.g.: NASREQ related AVPs
should work for both IPv4 and IPv6 end nodes.
Both of the above are I hope already taken care of.

Now, the question is, are there new AVPs or other requirements that IPv6
introduces with no IPv4 equivalents? If there are then I will have to agree
with Bernard that other WGs should define these requirements before they are
taken up by AAA WG. So, extensions to DHCPv6 for end node credentials should
be defined in DHC WG, and a URP carrier for these purpose should be defined
in URP WG...any new requirements to AAA that might come up from that may
then be fed back to AAA WG for consideration.

Regards
George

-----Original Message-----
From: Bernard Aboba [mailto:[email-masked]]
Sent: Wednesday, August 22, 2001 7:07 AM
To: Thomas Narten
Cc: Charlie Perkins; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [AAA-WG]: AAA for IPv6 

For NASREQ, MIPv4, and ROAMOPS we had drafts specifying the
architecture/framework, as well as requirements for a solution. 
The access protocols (e.g. PPP, MIPv4) were also well specified. 
That meant that the AAA WG only had to interface AAA to an architecture
and access protocol that was understood. This makes the job *much* easier. 

On Tue, 21 Aug 2001, Thomas Narten wrote:

> Bernard,
> 
> Can you clarify a bit on what sort of consensus draft you would want
> out of a subject area WG. Would that be (for example) a problem
> statement and a corresponding set of requirements, as opposed to a
> particular solution?
> 
> Thomas
>