Subject: Re: [netlmm] FW: I-D Action:draft-ietf-netlmm-grekey-option-08.txt

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 01 May 2009 08:48:00 -0700

Hi Ahmad,

On 4/30/09 10:41 PM, "Ahmad Muhanna" wrote:

> Hello Folks,
> 
> We submitted a new revision with 2 changes:
> 
> 1. Minor editorial changes to always use of mobile access gateway and
> local mobility anchor for consistency.
> 
> 2. Demoting the "MUST" to "SHOULD" when requiring the LMA to return the
> "same" uplink GRE key that was exchanged in the last successful Proxy
> Binding Update. This ensures the case when the LMA needs to generate a
> new GRE key due to a case of failure.

We need some text to say when the LMA can change the uplink GRE key. With
the 'MUST' we had earlier, the MAG could expect to use the same uplink GRE
key for the lifetime of the mobility session. But now with a 'SHOULD', an
LMA implementation could decide to change the uplink GRE key in the middle
of a session for reasons other than a "LMA reboot".

Vijay

> 
> Thanks!
> 
> Regards,
> Ahmad
> 
> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of
> [email-masked]
> Sent: Thursday, April 30, 2009 5:00 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: I-D Action:draft-ietf-netlmm-grekey-option-08.txt
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Network-based Localized Mobility
> Management Working Group of the IETF.
> 
> 
> Title           : GRE Key Option for Proxy Mobile IPv6
> Author(s)       : A. Muhanna, et al.
> Filename        : draft-ietf-netlmm-grekey-option-08.txt
> Pages           : 24
> Date            : 2009-04-30
> 
> This specification defines a new Mobility Option for allowing the mobile
> access gateway and the local mobility anchor to negotiate GRE (Generic
> Routing Encapsulation) encapsulation mode and exchange the downlink and
> uplink GRE keys which are used for marking the downlink and uplink
> traffic that belong to a specific mobility session.  In addition, the
> same mobility option can be used to negotiate the GRE encapsulation mode
> without exchanging the GRE keys.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-netlmm-grekey-option-08.t
> xt
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
> _______________________________________________
> netlmm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netlmm

---

From: Sri Gundavelli <[email-masked]>
Date: Fri, 1 May 2009 08:52:41 -0700 (PDT)

> of a session for reasons other than a "LMA reboot".

We can say for administrative reasons and leave it there ... the
hook to change it is the provision for any usecase ..

Sri

---

From: <[email-masked]>
Date: Fri, 1 May 2009 17:55:39 +0200

Vijay,

What are some good reasons why the LMA would change the UL GRE key (other
than the reboot that you mentioned)? IMO the UL GRE key can remain constant
for the duration of the mobility session.

-Raj

---

From: <[email-masked]>
Date: Fri, 1 May 2009 17:57:17 +0200

Sri.

> hook to change it is the provision for any usecase ..

This is just handwaving and not really providing clear guidelines. Either
you specify the reason and the scenario so that there is no ambiguity or
keep the text which indicates that the UL GRE key is unchanged.

-Raj

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 01 May 2009 09:02:12 -0700

Hi Raj,

I guess I wasn't clear. I don't want the LMA to change the uplink GRE key in
the middle of a session. Earlier we didn't even have the option of including
the GRE key for binding refreshes. So it couldn't have been changed anyway.
Some offline discussion led to Ahmad including text about including it. Now
the 'MUST' for returning the same uplink GRE key is being downgraded to a
'SHOULD'.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 01 May 2009 09:04:37 -0700

Why don't we for once make it more deterministic and make an implementer's
job easier? How do you expect one to implement when to change the uplink GRE
key?

I am getting tired of all these optional mechanisms and vague specification
text.

Vijay

---

From: Sri Gundavelli <[email-masked]>
Date: Fri, 1 May 2009 09:05:36 -0700 (PDT)

Raj,

> keep the text which indicates that the UL GRE key is unchanged.

The generation of keys, if its managed centrally in a PMIP domain
and the application of the keys can be very vendor specic manner.
A given implementation may use a key for blade identification
and on failure may change the key. Or, in the LMA reboot scenario,
the key may not be persisted and the same cant be generated upon
reboot, or if centralized, a different key may be generated. So,
we are already preparing the MAG to handle key change. So, allowing
the LMA to change it for other vendor specific reasons, might help,
IMO.

Sri

---

From: Sri Gundavelli <[email-masked]>
Date: Fri, 1 May 2009 09:08:06 -0700 (PDT)

> I am getting tired of all these optional mechanisms and vague specification

Come on .. dont use this thread. I'm tired with your adamant stand
in many cases as well. This did not come from me. I'm ok either way.
If you want to argue and force the key fixation, I'm fine. I dont
need this usecase.

Sri

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Fri, 1 May 2009 11:09:44 -0500

Hi Vijay,

I understand this is a tricky area. My understanding of "SHOULD" is that
LMA "MUST" do it unless there is a strong and valid reason NOT do it;
but I agree that keeps the door open for interpretation.

May be what we can do is have a general statement which says:

"The LMA MUST maintain the same negotiated uplink GRE key for the
lifetime of the mobility session. However, for administrative reasons,
e.g., LMA reboot, the LMA MAY change the uplink GRE key for some the
mobility session. In that case, some packet loss may be experienced."

Then we maintain MUST in all other cases of the text.

Regards,
Ahmad

> From: Vijay Devarapalli [mailto:[email-masked]] 
> Sent: Friday, May 01, 2009 10:48 AM
> To: Muhanna, Ahmad (RICH1:2H10); [email-masked]
> Subject: Re: [netlmm] FW: I-D 
> Action:draft-ietf-netlmm-grekey-option-08.txt
> 
> Hi Ahmad,
> 
> > 2. Demoting the "MUST" to "SHOULD" when requiring the LMA to return 
> > the "same" uplink GRE key that was exchanged in the last successful 
> > Proxy Binding Update. This ensures the case when the LMA needs to 
> > generate a new GRE key due to a case of failure.
> 
> We need some text to say when the LMA can change the uplink 
> GRE key. With the 'MUST' we had earlier, the MAG could expect 
> to use the same uplink GRE key for the lifetime of the 
> mobility session. But now with a 'SHOULD', an LMA 
> implementation could decide to change the uplink GRE key in 
> the middle of a session for reasons other than a "LMA reboot".
> 
> Vijay
> 
> > 
> > Thanks!
> > 
> > Regards,
> > Ahmad
> > 
> > This specification defines a new Mobility Option for allowing the 
> > mobile access gateway and the local mobility anchor to 
> negotiate GRE 
> > (Generic Routing Encapsulation) encapsulation mode and exchange the 
> > downlink and uplink GRE keys which are used for marking the 
> downlink 
> > and uplink traffic that belong to a specific mobility session.  In 
> > addition, the same mobility option can be used to negotiate the GRE 
> > encapsulation mode without exchanging the GRE keys.
> >

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 01 May 2009 09:12:22 -0700

Hi Ahmad,

> Then we maintain MUST in all other cases of the text.

This sounds good to me.

Vijay

---

From: <[email-masked]>
Date: Fri, 1 May 2009 18:34:36 +0200

Thanks for the clarification.
FWIW, I think that it is fine to mandate the LMA to return the same UL GRE key (i.e keep it a MUST).

-Raj

-----Original Message-----
From: ext Vijay Devarapalli [mailto:[email-masked]] 
Sent: Friday, May 01, 2009 11:02 AM
To: Patil Basavaraj (Nokia-D/Dallas); [email-masked]; [email-masked]
Subject: Re: [netlmm] FW: I-D Action:draft-ietf-netlmm-grekey-option-08.txt

Hi Raj,

I guess I wasn't clear. I don't want the LMA to change the uplink GRE key in the middle of a session. Earlier we didn't even have the option of including the GRE key for binding refreshes. So it couldn't have been changed anyway.
Some offline discussion led to Ahmad including text about including it. Now the 'MUST' for returning the same uplink GRE key is being downgraded to a 'SHOULD'.

Vijay

On 5/1/09 8:55 AM, "[email-masked]" wrote:

> 
> Vijay,
> 
> What are some good reasons why the LMA would change the UL GRE key 
> (other than the reboot that you mentioned)? IMO the UL GRE key can 
> remain constant for the duration of the mobility session.
> 
> -Raj
> 
> 
>>> 1. Minor editorial changes to always use of mobile access gateway 
>>> and local mobility anchor for consistency.
>>> 
>> We need some text to say when the LMA can change the uplink GRE key. 
>> With the 'MUST' we had earlier, the MAG could expect to use the same 
>> uplink GRE key for the lifetime of the mobility session. But now with 
>> a 'SHOULD', an LMA implementation could decide to change the uplink 
>> GRE key in the middle of a session for reasons other than a "LMA reboot".
>> 
>> Vijay
>> 
>>> 
>>> Thanks!
>>> 
>>> Regards,
>>> Ahmad
>>> 
>>> mobile access gateway and the local mobility anchor to negotiate GRE 
>>> downlink and uplink GRE keys which are used for marking the downlink

---

From: Sri Gundavelli <[email-masked]>
Date: Fri, 1 May 2009 09:39:39 -0700 (PDT)

> FWIW, I think that it is fine to mandate the LMA to return the same UL GRE key (i.e keep it a MUST).

So, you are saying this is OK. For administrative reasons, it may
be changed ? Or, it should not be in any case ?

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Fri, 1 May 2009 11:46:00 -0500

Hello Folks,
If there is anyone who does NOT agree with the proposed change below,
please speak up.

Thanks!

Regards,
Ahmad

> Sent: Friday, May 01, 2009 11:12 AM
> > I understand this is a tricky area. My understanding of "SHOULD" is 
> > that LMA "MUST" do it unless there is a strong and valid 
> reason NOT do 
> > it; but I agree that keeps the door open for interpretation.
> > 
> http://www.ietf.org/internet-drafts/draft-ietf-netlmm-grekey-option-0
> >> 8
> >>> .t
> >>> xt
> >>>

---

From: jouni <[email-masked]>
Date: Sat, 2 May 2009 21:08:54 +0300

Hi Ahmad,

Sounds OK.

Cheers,
	Jouni

---

From: Yungui Wang <[email-masked]>
Date: Mon, 04 May 2009 08:46:41 +0800

Agree with Sri, GRE key management is vendor specific.
Since exception case exists, SHOULD is okey. I don't 
see other document is drafted as 'MUST... except...".

B.R.
Yungui 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Ahmad Muhanna
> Sent: Saturday, May 02, 2009 12:46 AM
> To: Vijay Devarapalli; [email-masked]