Subject: RE: [mobile-ip] MN-FA authentication - appropriate behavior

From: "Das, Kaustubh" <[email-masked]>
Date: Thu, 18 Oct 2001 21:12:20 -0700

Hi All,
I needed some clarification on the desired FA behavior in the following
situation
The setup is 

MN------------Router-------------------HA
        |
        |
        |
      FA

The MN wishes to register through the FA and is configured to use MN-FA
authentication extension.
The FA however is not configured to use MN-FA authentication extension. This
may perhaps be a misconfiguration.
Now The MN sends out a packet with a MN-FA authentication to the FA. What
should the FA do?

Should it:
1. Silently discard the packet.
OR
2. Send back a reply to the MN with a reject code. What reject code?
OR
3. Ignore the MN-FA authentication extension, but strip the extension off
and forward the request to the HA. 
When a reply comes around it should relay the reply to the MN "without a
MN-FA authentication extension"
OR
4. Some other behavior.

Any clarification/ thoughts are greatly appreciated.
Thanks and regards,
Kaustubh

---

From: Amit Shakya <[email-masked]>
Date: Fri, 19 Oct 2001 10:42:05 +0530

hi Das
wat i feel abt this is that the MN-FA authenctication is valid only if both
the parties are aware of that. 
Moreover if u go thru. RFC 2977  that is the AAA requirements for Mobile IP,
it says that the extension values are provided dynamically to FA and MN so
that they can use it for future references, till the lifetime of the keys.
So when a MN sends a MN-FA authentication value to FA, thats a fault on the
MN side. RFC 2002 is quite clear abt. this that FA wont process MN-FA auth.
ext., if Mobile security association does not exists between them and wat i
fell is that the Request shud be rejected with code as 70 (poorly formed
request).
Hope this helps u...
Amit

-----Original Message-----
From: Das, Kaustubh [mailto:[email-masked]]
Sent: Friday, October 19, 2001 9:31 AM
To: [email-masked]'
Cc: Das, Kaustubh
Subject: [mobile-ip] MN-FA authentication - appropriate behavior

Hi All,

Should it: