Subject: [Mip6] Comments on I-D draft-yegin-mip6-aaa-fwk-00

From: [email-masked]
Date: Tue, 2 Nov 2004 11:43:58 -0600

1.
"In the presence of multiple HAs on a home subnet, reliance on
 pre-configuration increases the network management overhead."

Using IKE, you can establish an SA with any HA on the home subnet. The
keys or cert used in IKE/IPsec can be on some LDAP server shared by
the HAs. You dont really have to pre-configure every HA. It depends on
your deployment.

However I do agree that using AAA for authentication/authorization in
MIP6 deployemnt scenarios is useful.

2. 
"   The current Mobile IPv6 design relies on use of IPsec for
   authentication of protocol signaling between the MN and the HA.  The
   associated IPsec SA is created by running IKE [RFC3776] between the
   two.  The initial authentication and authorization of MN and HA
   should be performed during the IKE execution.  This is where HA must
   consult the AAA infrastructure.
"
   With IKEv2, dont you think it is possible that there could be AAA
   interaction in the backend (HA-AAA). Hence MIP6/HA really does not
   have to do anything to enable the establishment of an IPsec SA. I
   dont know if the IKEv2 I-D (MIP6) covers this scenario.

3. W.r.t accounting, I dont think you can rely entirely on the
   HA. Of course it depends on whether your accounting is based on
   time vs amount of data. If the MN is capable of RO, then you cannot
   generate charging data based on data volumes. 

4. After reading the I-D, I am not so sure that we are talking about a
   AAA framework here. The I-D proposes the need for an HA-AAA
   interface that enables an MN to be authenticated and aithorized for
   MIP6 service. Additionally this interface is also used for
   charging. 
   I think a AAA framework for MIP6 should also include the ability to
   bootstrap. You do mention it in the I-D, but this should be
   integral to the I-D as well. 

>From the perspective of the MIP6 WG, I think we need to identify the
AAA requirements and define a new AAA application, AVPs or extensions
in the AAA and Radext WGs. 

-Basavaraj

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alper Yegin <[email-masked]>
Date: Tue, 02 Nov 2004 11:47:41 -0800

Hi Raj,

Thank you for reading the I-D and the feedback.

> the HAs. You dont really have to pre-configure every HA. It depends on

Sure, LDAP can be used between the HA and a centralized server. Whether
it is LDAP or a AAA protocol, we'd need to define what is carried,
protocol flow, etc. So, yes, LDAP can be another way to achieve the
same/similar effect.

>    dont know if the IKEv2 I-D (MIP6) covers this scenario.

I described that in conjunction with the use of EAP/IKEv2 in the text.
Yes, that's possible. We need to transport EAP/AAA between the HA and
the AAA server. That specification already exists, but for the NAS
application/service. We need one for the MIP6 application/service. Delta
may be small.

>    generate charging data based on data volumes.

Agreed. This is only for the accounting on the HA. 

>    integral to the I-D as well.

I tried to cover the relation between AAA for MIP6 and the bootstrapping
in section 4. The framework I described does not allow HA discovery. HA
discovery can be achieved by other means, such as described in
draft-jang-dhc-haopt-00. (the HA information can be delivered to the
DHCP server as part of the network access AAA)

> in the AAA and Radext WGs.

There are many ways to use AAA in the context of MIP6, as the current
array of proposals indicates. My recommendation is to agree on the
framework(s) first before working out the requirements.

Alper