Subject: [MOBILE-IP] Dial-up scenario with Mobile IP - help needed

From: "G. Ensuque" <[email-masked]>
Date: Fri, 13 Aug 1999 17:45:08 +0100

Hi all

I am trying to get my head 'round what happens when a Mobile Node dials up a
NAS using PPP and the ISP uses RADIUS to authenticate him.

Has anyone already looked at that? I would be very grateful if someone could
point me towards web resources, slide packs, articles... describing the
whole session setup process

I have problems figuring out the interactions and message exchanges between
PPP, IPCP, RADIUS and Mobile IP NAI and Challenge/response extensions.

Are Challenge/Response and RADIUS authentication mutually exclusive ?

Is a double authentication needed:
1) with PPP/RADIUS to access the link layer
2) with the FA to be able to register the FCoA with the HA

Thanks for any bit of help

Guilhem Ensuque

Mobility Futures Unit                           [email-masked]
B55-131B
BT Advanced Communications Technology Centre
Adastral Park, Martlesham Heath
IPSWICH IP5 3RE                              Tel: +44 1473 645 232
UK                                                   Fax: +44 1473 646 885

---

From: Pete McCann <[email-masked]>
Date: Fri, 13 Aug 1999 12:01:15 -0500

Hi, Guilhem,

You ask good questions.

My understanding is that the basic authentication algorithm given in
Charlie's Mobile IP Challenge-Response document is incompatible with
current RADIUS implementations.  However, nothing prevents you from
using a different algorithm; your infrastructure should use the SPI to
determine which one is used.  Ken Pierce made a presentation in Oslo
describing how to use the Challenge-Response extension with RADIUS.
So, Mobile IP has the potential to replace CHAP as an authentication
mechanism.  It has the advantage of being link-layer independent.  So
double authentication is not necessary, although certain deployment
scenarios (where support of non-Mobile IP devices is needed) might do
this.

Some aspects of IPCP are also redundant if Mobile IP is used to assign
a home address (which is possible when using the NAI extension) and
when using an FA-located COA.  For instance, address assignment should
not be done with IPCP in this case - the PPP implementation should
leave out the "IP Address" option in the Configure-Request, and use
the source address 0.0.0.0 until it is assigned an address.

-Pete

"G. Ensuque" <[email-masked]> (GE) writes:

GE> Hi all
GE> I am trying to get my head 'round what happens when a Mobile Node dials up a
GE> NAS using PPP and the ISP uses RADIUS to authenticate him.

GE> Has anyone already looked at that? I would be very grateful if someone could
GE> point me towards web resources, slide packs, articles... describing the
GE> whole session setup process

GE> I have problems figuring out the interactions and message exchanges between
GE> PPP, IPCP, RADIUS and Mobile IP NAI and Challenge/response extensions.

GE> Are Challenge/Response and RADIUS authentication mutually exclusive ?

GE> Is a double authentication needed:
GE> 1) with PPP/RADIUS to access the link layer
GE> 2) with the FA to be able to register the FCoA with the HA

GE> Thanks for any bit of help

GE> Guilhem Ensuque

GE> Mobility Futures Unit                           [email-masked]
GE> B55-131B
GE> BT Advanced Communications Technology Centre
GE> Adastral Park, Martlesham Heath
GE> IPSWICH IP5 3RE                              Tel: +44 1473 645 232
GE> UK                                                   Fax: +44 1473 646 885