Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Tue, 5 Apr 2005 13:28:06 -0500

Ok, As we had predicted, the inter-working needs to work on its identity management issues :-)

We see that many of the issues revolve around whether we should use HoA or NAI for MN and IP versus NAI for mobility agents.

So lets get organized here.

Case 1: CcoA, there is no FA in this case. HA acts as a NAS.

RRQ goes from MN to HA and becomes a RADIUS Access Request to RADIUS server.

     Option 1: MN has a HoA address and is AAA-routable. MN knows its HA.

     (I guess we assume routability assertion is made by HA, acting as a NAS)

MN includes its HoA in the RRQ. There is no MN-NAI according to RFC 3344.

If MN has HA IP address, it includes it in the RRQ, otherwise what value?

HA inserts MN-HoA in user-name Attr. 

HA inserts own IP address in NAS-IP. 

Optionally, HA inserts own NAI in MIP-HA-NAI to help routing.

If no HA address was included in RRQ, HA sets the proper bits in feature vector to indicate the need for HA allocation.

    Option 2: MN does not have an HoA, but has an HA.

            MN includes an NAI in RRQ. There is no MN HoA in RRQ.

            If MN has HA IP address, it includes it, otherwise what value?

            HA inserts MN-NAI in user name attr.

            HA inserts own IP address in NAS-IP.

            Optionally, HA inserts own NAI in MIP-HA-NAI and proper bits in feature vector if HA allocation is needed.

   Option 3: MN does not have a routable HoA (MN probably does not know this). 

            MN includes its HoA in the RRQ, and does not include NAI according to RFC 3344.

            Well now what? HA cannot build a routable RADIUS Access request, since neither HoA nor NAI is present?

            Should the HA build an NAI for the MN? 

Case 2: FA based CoA.

I suggest we agree on a solution for case 1 first before we go on to the FA based CoAs later.

Comments, opinions, answers are welcome,

Madjid

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: Kent Leung <[email-masked]>
Date: Tue, 05 Apr 2005 21:37:35 -0700

Hi Madjid.  Comments below.

At 01:28 PM 4/5/2005 -0500, Nakhjiri Madjid-MNAKHJI1 wrote:

>Ok, As we had predicted, the inter-working needs to work on its identity 
>management issues J
>
>We see that many of the issues revolve around whether we should use HoA or 
>NAI for MN and IP versus NAI for mobility agents.

MN identifier issue:

In general, I believe deployments which don't use NAI for MNs are not
concerned about AAA-routability.  In this case, the AAA server is in the
same administrative domain as the HA (or NAS).

When NAI is used to identify the MNs, then AAA-routability is important
to address.

So I think we can simplify the scope by eliminating support for AAA-routability
for non-NAI MNs, IMHO.

FA/HA identifier issue:

In general, allow support for either NAI or IP address.  Currently only IP
address is in use, but NAI is a good way to identify the FA/HA for the
FA-HA Authentication Extension validation as the IP address is
problematic in NAT traversal scenarios.  Since this is interface between
HA and AAA server, it should be safe to define both IP and NAI and
let deployments decide which one is used, IMHO.

>If no HA address was included in RRQ, HA sets the proper bits in feature 
>vector to indicate the need for HA allocation.

See above.  I don't see a need for AAA-routing in the case of MN identified by
HoA (no NAI).  Technically feasible, but not necessary.

Also, it's highly unlikely for HoA to be set without the HA address 
known.  So the
HoA and HA should both be set in the RRQ.

>             Optionally, HA inserts own NAI in MIP-HA-NAI and proper bits 
> in feature vector if HA allocation is needed.

In this case, the HA may be set to all 1s or 0s for dynamic HA assignment.

>             Well now what? HA cannot build a routable RADIUS Access 
> request, since neither HoA nor NAI is present?
>

I would treat this case same as #1.  The MN is identified by its HoA.

At this point, I expect that deployments will all be using NAI to
identify the MN.  NAI can support static IP address or dynamic
address allocation for the MN, as well as dynamic HA assignment.
Also, NAI allows integration with AAA for authentication.  If we
keep the HoA based MN support only in non-AAA-routable mode,
I don't see much harm and this would benefit from some
simplification.  :)  Of course, if anyone out there who is deploying
MIPv4 and wants AAA-routability for HoA based MN, I'm willing
to listen to the reasons.

Kent

--
      |           |                   Kent Leung
     :|:         :|:                  IP Mobility Development
    :|||:       :|||:                 Internet Technologies Division
   :|||||||:   :|||||||:              Voice: 408.526.5030
.:|||||||||:.:|||||||||:.             Fax:   408.525.1653
  c i s c o S y s t e m s             Email: [email-masked]

---

From: Avi Lior <[email-masked]>
Date: Wed, 6 Apr 2005 11:53:42 -0400

Kent said:

This seems to make sense (at least) to me.  If NAI is not used other thing
such as HoA or even other identifiers such as device ids, can and are being
used to route AAA.  AAA allows for that and we should allow for that as
well.  I dont think though that we have to limit how routing is done.  We
just have to explain how MIPv4 attributes are mapped to RADIUS attributet.
For people who understand MIP and RADIUS it is painfully obvious how you
would deploy.  So for the rest of us what would be usefull is informative
text to explain things a bit.
 
So here is my understanding:
 
MIP                                            RADIUS
 
NAI    if available will be placed in   UserName
HA IP if avialable will be place in    HA-IP attribute
HoA   if available will be placed in  HoA-IP attribute
 
We can say:
AAA can route over any of these attribute and other attributes as well.
However, for general roaming NAI SHOULD be available and placed in the
UserName.
 
Device   acting as NAS                 RADIUS
 
HA or FA  IP address          ----->    NAS-IP
HA or FA FQDN if availabe   ----->    NAS-ID
 
I am assuming HA or FA NAI is really the FQDN and that belongs in the NAS-ID
attribute in RADIUS.

-----Original Message-----
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 12:38 AM
To: Nakhjiri Madjid-MNAKHJI1
Cc: 'Avi Lior'; Chowdhury, Kuntal; Nakhjiri Madjid-MNAKHJI1; Mobile IPv4
Mailing List
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

management issues :-)

MN identifier issue:

So I think we can simplify the scope by eliminating support for
AAA-routability
for non-NAI MNs, IMHO.

FA/HA identifier issue:

     (I guess we assume routability assertion is made by HA, acting as a
NAS)

See above.  I don't see a need for AAA-routing in the case of MN identified
by
HoA (no NAI).  Technically feasible, but not necessary.

Also, it's highly unlikely for HoA to be set without the HA address known.
So the
HoA and HA should both be set in the RRQ.  

            Optionally, HA inserts own NAI in MIP-HA-NAI and proper bits in
feature vector if HA allocation is needed.

   Option 3: MN does not have a routable HoA (MN probably does not know
this). 

            MN includes its HoA in the RRQ, and does not include NAI
according to RFC 3344.

            Well now what? HA cannot build a routable RADIUS Access request,
since neither HoA nor NAI is present?

Kent

Case 2: FA based CoA.

I suggest we agree on a solution for case 1 first before we go on to the FA
based CoAs later.

Madjid 

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
<https://www1.ietf.org/mailman/listinfo/mip4> 
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
<http://www.ietf.org/html.charters/mip4-charter.html> 
Supplemental site: http://www.mip4.org/ <http://www.mip4.org/>

---

From: Kent Leung <[email-masked]>
Date: Wed, 06 Apr 2005 10:53:52 -0700

Hi Avi.

At 11:53 AM 4/6/2005 -0400, Avi Lior wrote:
>such as HoA or even other identifiers such as device ids, can and are 
>being used to route AAA.  AAA allows for that and we should allow for that 
>as well.  I dont think though that we have to limit how routing is 
>done.  We just have to explain how MIPv4 attributes are mapped to RADIUS 
>attributet.

Agree.

>HA IP if avialable will be place in    HA-IP attribute

OK.

>HoA   if available will be placed in  HoA-IP attribute

HoA in the absence of NAI will be placed in the UserName,
as the HoA is the MN identifier (username) to the RADIUS server
in this case.  I'm not sure if HoA should also be placed in
the HoA-IP AVP as well?

When NAI is present, HoA will be placed in the HoA-IP AVP.

>We can say:
>AAA can route over any of these attribute and other attributes as 
>well.  However, for general roaming NAI SHOULD be available and placed in 
>the UserName.
>
>I am assuming HA or FA NAI is really the FQDN and that belongs in the 
>NAS-ID attribute in RADIUS.

I would like a clarification.

There's a shared secret (AAA-Key) between NAS (IP address A) and RADIUS server.
The HA (NAS) processes registration with HA field set to IP address B.  So we
expect that A = B in all cases?

Currently, I'm not sure if there's any reason for A != B.  Unless someone
comes up with a practical scenario, I'm fine with this.

As for FQDN, RFC 3846 defines the HA NAI.  The NAI format would need to
be mapped to FQDN.  Excerpt from spec:

    "It contains the NAI of the HA in the form hostname@realm.  Together the
    hostname and realm form the complete FQDN (hostname.realm) of the HA."

Kent

---

From: Avi Lior <[email-masked]>
Date: Wed, 6 Apr 2005 14:56:26 -0400

Hi Kent,
 
See inline......

-----Original Message-----
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 1:54 PM
To: Avi Lior
Cc: Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; Chowdhury, Kuntal;
Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

Hi Avi.

Kent said:

Agree.

 
MIP                                            RADIUS

OK.

HoA in the absence of NAI will be placed in the UserName,
as the HoA is the MN identifier (username) to the RADIUS server
in this case.  I'm not sure if HoA should also be placed in
the HoA-IP AVP as well?
[Avi] Actually why do you need the HOA in the UserName? 

We can say:

 

[Avi] I need to understand what you are saying. 
There's a shared secret (AAA-Key) between NAS (IP address A) and RADIUS
server.
  
The HA (NAS) processes registration with HA field set to IP address B.  So
we
expect that A = B in all cases?

   "It contains the NAI of the HA in the form hostname@realm.  Together the
   hostname and realm form the complete FQDN (hostname.realm) of the HA."
[Avi] Actually, Kent, the definition of 3846 is okay.  It will fit in the
NAS-Identifier attribute just fine.  NAS-Identifier can have any value as
long as we know what the format is. So we can convert it to a FQDN or just
leave it as is. 

Kent

---

From: Kent Leung <[email-masked]>
Date: Wed, 06 Apr 2005 13:11:10 -0700

At 02:56 PM 4/6/2005 -0400, Avi Lior wrote:
<snip>
>[Avi] Actually why do you need the HOA in the UserName?

Just wondering how the MN is going to be identified for authentication
without UserName?  I thought typically this is the attribute used to
lookup the authentication key in the RADIUS server.

>[Avi] I need to understand what you are saying.

Sure, I'm not clear which part is confusing or unclear.  Maybe the entire 
thought
process? :)

Is it expected that the HA field in the RRQ/RRP is the same as the NAS IP 
address?
What happens when HA field is set to all 1s or 0s?

Here is an example to highlight the issue.

There is a box that does both PPP termination and Mobile IP.

For PPP sessions, the NAS will set the NAS-IP-Address to the interface's
IP address (10.1.0.1) that is used to send the Access-Req to the RADIUS 
server.
The RADIUS server authenticates the Access-Req from the NAS, which is
identified by the NAS-IP-Address.

For Mobile IP, the box acts as HA.  MN sends RRQ to the HA with HA field
set to 10.10.0.1.  HA creates the Access-Req with NAS-IP-Address before
sending to RADIUS server.  Which IP address should HA set, egress
interface (10.1.0.1) or HA address (10.10.0.1)?

The RADIUS server has a shared secret with the RADIUS client 10.1.0.1.
If NAS-IP-Address is 10.10.0.1, the RADIUS server would not be able to
authenticate the Access-Req and drop this message.

>long as we know what the format is. So we can convert it to a FQDN or just 

OK.  I thought your mention of FQDN in the NAS-ID meant that the AVP restricted
the format to only FQDN.  Sounds like as long as RADIUS server can figure 
out the
format, we're fine.

Kent

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Wed, 6 Apr 2005 16:32:56 -0400

Kent,
 
In your scenario the HA should set the NAS-IP address to 10.1.0.1. The HA address (10.10.0.1) from the RRQ can be put into the HA-IP address AVP. The HA address extracted from the RRQ should always be sent in a separate AVP from the NAS-IP address AVP, since there is no guarantee that the interface address of the NAS that is used to communicate with the AAA is same as it's HA address.
 
-Kuntal

-----Original Message-----
From: Kent Leung [mailto:[email-masked]]
Sent: Wednesday, April 06, 2005 3:11 PM
To: Avi Lior
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; Chowdhury, Kuntal; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

the HoA-IP AVP as well? 

We can say: 

AAA can route over any of these attribute and other attributes as well.  However, for general roaming NAI SHOULD be available and placed in the UserName. 

I am assuming HA or FA NAI is really the FQDN and that belongs in the NAS-ID attribute in RADIUS.

Sure, I'm not clear which part is confusing or unclear.  Maybe the entire thought
process? :)

Is it expected that the HA field in the RRQ/RRP is the same as the NAS IP address?
What happens when HA field is set to all 1s or 0s?

For PPP sessions, the NAS will set the NAS-IP-Address to the interface's
IP address (10.1.0.1) that is used to send the Access-Req to the RADIUS server.  
The RADIUS server authenticates the Access-Req from the NAS, which is 
identified by the NAS-IP-Address.

[Avi] Actually, Kent, the definition of 3846 is okay.  It will fit in the NAS-Identifier attribute just fine.  NAS-Identifier can have any value as long as we know what the format is. So we can convert it to a FQDN or just leave it as is. 

OK.  I thought your mention of FQDN in the NAS-ID meant that the AVP restricted
the format to only FQDN.  Sounds like as long as RADIUS server can figure out the 
format, we're fine.

Kent

---

From: Kent Leung <[email-masked]>
Date: Wed, 06 Apr 2005 14:18:32 -0700

Hi Kuntal.  If it's agreed on that the NAS-IP-Address and the HA address may
not be the same, we need to fix the following.

So, it will be?

HA or FA  IP address          ----->    HA-IP or FA-IP
HA or FA FQDN if availabe   ----->    HA-ID or FA-ID

Kent

At 04:32 PM 4/6/2005 -0400, Chowdhury, Kuntal wrote:
>Content-class: urn:content-classes:message
>Content-Type: multipart/alternative;
>         boundary="----_=_NextPart_001_01C53AE7.D0FC63EC"
>
>Kent,
>
>In your scenario the HA should set the NAS-IP address to 10.1.0.1. The HA 
>address (10.10.0.1) from the RRQ can be put into the HA-IP address AVP. 
>The HA address extracted from the RRQ should always be sent in a separate 
>AVP from the NAS-IP address AVP, since there is no guarantee that the 
>interface address of the NAS that is used to communicate with the AAA is 
>same as it's HA address.
>
>-Kuntal
>Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; 
>Chowdhury, Kuntal; Mobile IPv4 Mailing List; Avi Lior
>>>well.  However, for general roaming NAI SHOULD be available and placed 
>>>in the UserName.
>>long as we know what the format is. So we can convert it to a FQDN or 
>>just leave it as is.
>

---

From: Kent Leung <[email-masked]>
Date: Wed, 06 Apr 2005 14:18:32 -0700

So, it will be?

Kent

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Wed, 6 Apr 2005 16:48:21 -0500

I agree with Kent here, there is an issue with an HoA IP attribute.

consider the case, where you have HoA, but not NAI. 

HA includes HoA in HoA IP attributes, but sends an empty user name attribute. 

How does RADIUS server locates and authenticates the user?

I would say you stick whatever you have (HoA or NAI) in the user-name. Seems that 

 MIP RFC rules out having both HoA and NAI. I wonder whether we could modify the RFC

so that the MN can send NAI even if it has an HoA. 

On the HA ingress and egress address, I think the ingress should be included in HA IP address (from the RRQ) and egress should be included in the NAS-IP address so that the RADIUS server could locate the shared secret. Why would the RADIUS server care about the HA IP being different from NAS IP? As long as the RADIUS server can make sure both IP addresses belong to the same device (how I don't know) it could encrypt the MN-HA key (based on HA IP ) with RADIUS-NAS key (based on NAS IP). If the RADIUS can't make sure NAS and HA are the same device, the NAS-HA security is not RADIUS problem anyway.

I am still not sure about why the interfaces are different though, but with the solution above we should be fine. I think this is just complicating the matter to an impractical level.

Madjid

-----Original Message-----
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 3:11 PM
To: Avi Lior
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; Chowdhury, Kuntal; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

 

the HoA-IP AVP as well? 

We can say: 

Kent

--

     |           |                   Kent Leung

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Wed, 6 Apr 2005 16:49:38 -0500

There you go, exact same suggestion. Thanks Kuntal.

-----Original Message-----
From: Chowdhury, Kuntal [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 3:33 PM
To: Kent Leung; Avi Lior
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

Kent,

-Kuntal

-----Original Message-----
From: Kent Leung [mailto:[email-masked]]
Sent: Wednesday, April 06, 2005 3:11 PM
To: Avi Lior
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; Chowdhury, Kuntal; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

 

the HoA-IP AVP as well? 

We can say: 

Kent

--

     |           |                   Kent Leung

---

From: Avi Lior <[email-masked]>
Date: Wed, 6 Apr 2005 18:08:04 -0400

Hi Madjid,

-----Original Message-----
From: Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 5:48 PM
To: 'Kent Leung'; Avi Lior
Cc: Avi Lior; Chowdhury, Kuntal; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

<snip>

 HA includes HoA in HoA IP attributes, but sends an empty user name
attribute. 

How does RADIUS server locates and authenticates the user?
[Avi] RADIUS can use the HOA attribute to locate and authenticate the
user!!!  RADIUS can do that.  

If you look at the RAIDUS spec the User-Name is 0-1 2865 says the User-Name
MUST be filled in if the username attribute is available.

I would say you stick whatever you have (HoA or NAI) in the user-name. 
[Avi] Well I disagree. Since the HOA may be a non routable address and it
would create probelms. 

 Seems that MIP RFC rules out having both HoA and NAI.
[Avi] BTW Can you show me which RFC says that.?

[AVI] snip the rest....

Madjid

-----Original Message-----
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 3:11 PM
To: Avi Lior
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; Chowdhury,
Kuntal; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

 

the HoA-IP AVP as well? 

We can say: 

OK.  I thought your mention of FQDN in the NAS-ID meant that the AVP
restricted
the format to only FQDN.  Sounds like as long as RADIUS server can figure
out the 
format, we're fine.

Kent

--

     |           |                   Kent Leung

---

From: Kent Leung <[email-masked]>
Date: Wed, 06 Apr 2005 15:51:02 -0700

At 06:08 PM 4/6/2005 -0400, Avi Lior wrote:

>If you look at the RAIDUS spec the User-Name is 0-1 2865 says the 
>User-Name MUST be filled in if the username attribute is available.

KL> I correlate User-Name to the identifier of the user (MN) for 
authentication purpose.
So it seems to make sense to put the HoA in the User-Name as the MN 
identifier.  The
RADIUS server doesn't need special processing such as looking for HoA AVP 
to look
up key.  That's the reason that I said _typically_ the User-Name identifies 
the user for
authentication.  Wondering why we can't populate User-Name with HoA?

>[Avi] Well I disagree. Since the HOA may be a non routable address and it 

KL> I thought that we agree to map MIP/RADIUS and let deployment deal with 
routing
issues.   So it is completely up to them to decide how to route such 
messages if that
is ever needed.  Other AVPs may be used for such logic.  The User-Name 
should be
just identifier of the MN which is the HoA when NAI is absent.

>[Avi] BTW Can you show me which RFC says that.?

KL>  Here are the cases of non-null NAI and non-zero HoA:

         - NAI and HoA (NAI in User-Name, HoA in HoA-IP)
         - NAI only (NAI in User-Name)
         - HoA only (HoA in User-Name)

My recommendations in parentheses. :)  The Access-Req is authenticated
by the RADIUS server, which always looks up the user by the User-Name AVP.

Kent

---

From: Avi Lior <[email-masked]>
Date: Wed, 6 Apr 2005 19:11:22 -0400

Let me summarize:
 
I think the following should be the general mapping.
 
When RADIUS Access-Request comes from HA:
 
MN-NAI  if available    RADIUS User-Name
HA-IP     if available    RADIUS HA-IP address
HOA      if available    RADIUS HOA attribute.
 
COA  (FA-COA or CCOA)     will be placed in  COA attribute
 
IP address of the RADIUS interface of the HA goes into the NAS-IP attribute
and/or the NAS ID of the HA goes into the NAS-Identifier attribute
 
Note: the RADIUS interface of the HA may or may not be the same as the HA-IP
address.
 
Now the case of Access-Request comes for FA:
 
MN-NAI  if available    RADIUS User-Name
HA-IP     if available    RADIUS HA-IP address
COA      goes into the COA.
HOA      if available     RADIUS HOA attribute.
 
IP address of the RADIUS interface of the FA goes into the NAS-IP attribute
and/or the NAS ID of the FA goes into the NAS-Identifier attribute
 
Note: the RADIUS interface of the FA may or may not be the same as the COA
address.
 
So if you look at the above you can probably match merge the table.

Now if the NAI is missing etc and therefore the User-Name is empty we could
add some text to instruct implementors what to put in the User-Name
attribute.  But note simply blindly putting in the HOA address will not work
(as stated before).  There are many possibilities for what you put in the
UserName attribute.
 
Thoughts on above?

-----Original Message-----
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 5:19 PM
To: Chowdhury, Kuntal
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

So, it will be?

Kent

Kent,
 
In your scenario the HA should set the NAS-IP address to 10.1.0.1. The HA
address (10.10.0.1) from the RRQ can be put into the HA-IP address AVP. The
HA address extracted from the RRQ should always be sent in a separate AVP
from the NAS-IP address AVP, since there is no guarantee that the interface
address of the NAS that is used to communicate with the AAA is same as it's
HA address.
 
-Kuntal 

-----Original Message----- 

From: Kent Leung [mailto:[email-masked] <mailto:[email-masked]> ] 

To: Avi Lior 

<snip> 

We can say: 

Kent

---

From: Avi Lior <[email-masked]>
Date: Wed, 6 Apr 2005 19:18:35 -0400

Ken See inline:

-----Original Message-----
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 6:51 PM
To: Avi Lior
Cc: 'Nakhjiri Madjid-MNAKHJI1'; Avi Lior; Avi Lior; Chowdhury, Kuntal;

KL> I correlate User-Name to the identifier of the user (MN) for
authentication purpose.
So it seems to make sense to put the HoA in the User-Name as the MN
identifier.  The
RADIUS server doesn't need special processing such as looking for HoA AVP to
look
up key.  That's the reason that I said _typically_ the User-Name identifies
the user for 
authentication.  Wondering why we can't populate User-Name with HoA?
[Avi] What if the HOA is 10.10.10.10? How do we route the message?  There
maybe other things I can put in the Username to do the routing.  But by
saying put in the HOA when NAI is not there you are prohibiting me from
putting what I really want in the Username (like for instance the HA-IP
address).

KL> I thought that we agree to map MIP/RADIUS and let deployment deal with
routing
issues.   So it is completely up to them to decide how to route such
messages if that
is ever needed.  Other AVPs may be used for such logic.  The User-Name
should be
just identifier of the MN which is the HoA when NAI is absent.
[Avi] Great this is good.  So the home network will then use HOA attribute
to look up the user. RADIUS does this already.  For example in EAP it knows
to use the inner identity of EAP and not the UserName to lookup the user.
Why are we creating a problem when one does not exists.  

My recommendations in parentheses. :)  The Access-Req is authenticated
by the RADIUS server, which always looks up the user by the User-Name AVP.
[Avi] If you just put HOA in the HOA attribute then the above is nice and
clean:
         NAI ----> User-Name
         HOA ----> HOA-Attribute
 
Some text to suggest what happens with NAI is not available: 

Kent

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Wed, 6 Apr 2005 19:48:55 -0400

This is a good summary. Basically various RRQ fields need to go to the respective RADIUS attributes. The only open question seems to be:

What happens when the RRQ does not contain the NAI extension?

Some of the possible choices that can be suggested are:

a. do a reverse DNS query on the HoA to find the username and then set the User-Name attribute to the returned DNS record 
b. Set the User-Name attribute to the HoA if the HoA is a routable address (the HoA attribute can also be included in this case)
c. If nothing comes back from the DNS and the HoA is non-routable, reject the RRQ

Does this work for you folks?

-Kuntal

-----Original Message-----
From: Avi Lior [mailto:[email-masked]]
Sent: Wednesday, April 06, 2005 6:11 PM
To: 'Kent Leung'; Chowdhury, Kuntal
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

Let me summarize:

Note: the RADIUS interface of the HA may or may not be the same as the HA-IP address.

Note: the RADIUS interface of the FA may or may not be the same as the COA address.

Now if the NAI is missing etc and therefore the User-Name is empty we could add some text to instruct implementors what to put in the User-Name attribute.  But note simply blindly putting in the HOA address will not work (as stated before).  There are many possibilities for what you put in the UserName attribute.

Thoughts on above?

-----Original Message-----
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 5:19 PM
To: Chowdhury, Kuntal
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Mobile IPv4 Mailing List; Avi Lior
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

So, it will be?

Kent

Kent,

-Kuntal 
-----Original Message----- 
From: Kent Leung [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 3:11 PM 
To: Avi Lior 
Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri Madjid-MNAKHJI1; Chowdhury, Kuntal; Mobile IPv4 Mailing List; Avi Lior 
Subject: RE: [Mip4] draft on RADIUS support for Mobile IP

We can say: 

  

Kent

---

From: Avi Lior <[email-masked]>
Date: Fri, 8 Apr 2005 13:07:59 -0400

Hi Kuntal,

Actually I agree with what you said and then there is even more you can do.
See this summary:

> a. do a reverse DNS query on the HoA to find the username and 
> then set the User-Name attribute to the returned DNS record 
> b. Set the User-Name attribute to the HoA if the HoA is a 
> routable address (the HoA attribute can also be included in 
> this case) c. If nothing comes back from the DNS and the HoA 
> is non-routable, reject the RRQ

You can do all of the above.  Plus, if your HOA is not routable you can
perhaps use the HA-IP address if it is availabe. Either do a reverse lookup
or use as is.

What we shouldn't mandate is that we reject the RRQ.  Because an SDO may use
other identites such as the Calling-Station-Id to determine the user's realm
and hence route the call. 

We should only reject the RRQ where nothing else is available.  

So that is why I said that there are different things that can be done and
that we should not specify them.  We should make recommendations.

> Sent: Wednesday, April 06, 2005 7:49 PM
> To: Avi Lior; Kent Leung
> Cc: Nakhjiri Madjid-MNAKHJI1; Mobile IPv4 Mailing List
> This is a good summary. Basically various RRQ fields need to 
> go to the respective RADIUS attributes. The only open 
> question seems to be:
> 
> a. do a reverse DNS query on the HoA to find the username and 
> then set the User-Name attribute to the returned DNS record 
> b. Set the User-Name attribute to the HoA if the HoA is a 
> routable address (the HoA attribute can also be included in 
> this case) c. If nothing comes back from the DNS and the HoA 
> is non-routable, reject the RRQ
> 
> IP address of the RADIUS interface of the HA goes into the 
> NAS-IP attribute and/or the NAS ID of the HA goes into the 
> NAS-Identifier attribute
> 
> IP address of the RADIUS interface of the FA goes into the 
> NAS-IP attribute and/or the NAS ID of the FA goes into the 
> NAS-Identifier attribute
> 
> Now if the NAI is missing etc and therefore the User-Name is 
> empty we could add some text to instruct implementors what to 
> put in the User-Name attribute.  But note simply blindly 
> putting in the HOA address will not work (as stated before).  
> There are many possibilities for what you put in the UserName 
> attribute.
> 
> Thoughts on above?
> 
> 
> Hi Kuntal.  If it's agreed on that the NAS-IP-Address and the 
> HA address may not be the same, we need to fix the following.
> 
> In your scenario the HA should set the NAS-IP address to 
> 10.1.0.1. The HA address (10.10.0.1) from the RRQ can be put 
> into the HA-IP address AVP. The HA address extracted from the 
> RRQ should always be sent in a separate AVP from the NAS-IP 
> address AVP, since there is no guarantee that the interface 
> address of the NAS that is used to communicate with the AAA 
> is same as it's HA address.
>  
> -Kuntal 
> Cc: Avi Lior; Nakhjiri Madjid-MNAKHJI1; Nakhjiri 
> Madjid-MNAKHJI1; Chowdhury, Kuntal; Mobile IPv4 Mailing List; 
> Avi Lior 
> Just wondering how the MN is going to be identified for 
> authentication without UserName?  I thought typically this is 
> the attribute used to lookup the authentication key in the 
> RADIUS server.
> 
> 
> AAA can route over any of these attribute and other 
> attributes as well.  However, for general roaming NAI SHOULD 
> be available and placed in the UserName. 
> I am assuming HA or FA NAI is really the FQDN and that 
> belongs in the NAS-ID attribute in RADIUS. I would like a 
> clarification.
> 
> 
> Sure, I'm not clear which part is confusing or unclear.  
> Maybe the entire thought process? :)
> 
> Is it expected that the HA field in the RRQ/RRP is the same 
> as the NAS IP address? What happens when HA field is set to 
> all 1s or 0s?
> 
> For PPP sessions, the NAS will set the NAS-IP-Address to the 
> interface's IP address (10.1.0.1) that is used to send the 
> Access-Req to the RADIUS server.  
> For Mobile IP, the box acts as HA.  MN sends RRQ to the HA 
> with HA field set to 10.10.0.1.  HA creates the Access-Req 
> with NAS-IP-Address before 
> The RADIUS server has a shared secret with the RADIUS client 
> 10.1.0.1. If NAS-IP-Address is 10.10.0.1, the RADIUS server 
> would not be able to authenticate the Access-Req and drop 
> this message.
> 
> 
> [Avi] Actually, Kent, the definition of 3846 is okay.  It 
> will fit in the NAS-Identifier attribute just fine.  
> NAS-Identifier can have any value as long as we know what the 
> format is. So we can convert it to a FQDN or just leave it as is. 
> 
> OK.  I thought your mention of FQDN in the NAS-ID meant that 
> the AVP restricted the format to only FQDN.  Sounds like as 
> long as RADIUS server can figure out the 
> format, we're fine.
> 
> Kent
> 
> --
>      |           |                   Kent Leung