Subject: [mobile-ip] MN-FA authentication - appropriate behavior

From: "Das, Kaustubh" <[email-masked]>
Date: Thu, 18 Oct 2001 21:00:50 -0700

Hi All,
I needed some clarification on the desired FA behavior in the following
situation
The setup is 

MN------------Router-------------------HA
        |
        |
        |
      FA

The MN wishes to register through the FA and is configured to use MN-FA
authentication extension.
The FA however is not configured to use MN-FA authentication extension. This
may perhaps be a misconfiguration.
Now The MN sends out a packet with a MN-FA authentication to the FA. What
should the FA do?

Should it:
1. Silently discard the packet.
OR
2. Send back a reply to the MN with a reject code. What reject code?
OR
3. Ignore the MN-FA authentication extension, but strip the extension off
and forward the request to the HA. 
When a reply comes around it should relay the reply to the MN "without a
MN-FA authentication extension"
OR
4. Some other behavior.

Any clarification/ thoughts are greatly appreciated.
Thanks and regards,
Kaustubh

---

From: "Chae-yong Chong" <[email-masked]>
Date: Fri, 19 Oct 2001 14:08:04 +0900

Hi.

I think authentication means that the initiator request its validity to the authenticator.
In this case, the authenticator does not care to check the initiator's validity but initiator wants.
As you know the RFC2002 does not state about this case. 
I think the current spec does not have any solution for this case.

If FA selects first solution, just silently discard, there is no way to inform MN that
FA does not want to authenticate the MN. So, the registration would fail over and over.

If FA selects second solution, reject the Request, FA maybe send reply with code 67 "authenticaion failed".
This is not the clear explanation to MN why the FA reject the registration request. 
But I think this is the best solution for this case because the authentication fail mean a 

If FA selects final solution, MN should discard the reply from FA whether it is acceptance or reject. It is 
due to the MN's requirement for processing the Registration Reply. MN just think MN and FA have a
Security association. So if MN got a reply without MN-FA authentication, it should just discard the reply.

But as you know the MN-FA authentication is not really applicable for the real world, I think. 
In the commercial case like 3GPP2, the MN-FA authenticaiton is not mandatory.

Chae-yong