Subject: RE: [Sipping] New version of the SIP-AAA reqs draft

From: Jiri Kuthan <[email-masked]>
Date: Thu, 13 Feb 2003 19:56:42 +0100

At 07:46 PM 2/11/2003, [email-masked] wrote:
>Hi Henry,
>
>> >but one option is develop a solution using 
>> > Diameter in RADIUS-compatibility mode.
>> 
>> OK, this is better than nothing. We'll take what we can :-)
>> 
>> As mentioned, the installed base is RADIUS, no matter how 
>> voluminous the DIAMETER literature may be.
>
>I think the issues is that the IETF should recommend what is the
>right thing to do & why.  If people choose to do something else,
>well, that is life.  

Remember that running code does not necessarily mean something known
to compile -- that is something known to be deployed.

>I understand what you are asking but I do note that some
>people have thought that the potential for AAA is much greater
>than the existing installed base.

I actually think that the deployment argument is a very important one.

-Jiri 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Allison Mankin <[email-masked]>
Date: Fri, 14 Feb 2003 21:58:40 -0800

Jiri,

It always seems good to be able to stay with installed base, but
there's a factor against our supporting RADIUS drafts for SIP's
accounting - safety.  Even though there is deployment, there are
some extremely bad cases of damage in production, and the IETF 
has concluded that RADIUS is not suitable for usage-based accounting
(RFC2975). 

Unless there is no intention of having in SIP accounting usage-based,
monetary, auditable applications, RADIUS is not the solution.  The
protocol just does not preserve a complete stream of reliable
accounting records that are auditable on any level, especially with
any roaming.  As Bernard Aboba stated to this WG, quoting Mike O'Dell,
the use of RADIUS may even be illegal in situations where there is an
authority over the billing.  Records are too easily lost by the
protocol. This is stated clearly by RFC2975.  This is the reason why
the Operations and Mgt Area developed Diameter.  On these technical*
grounds, that the RADIUS protocol does not have enough reliability,
the work must be based on the Diameter protocol, which is now
approved.  Alternatively, work could be done that does not include
usage-based accounting, but this does not seem to be what is 
envisioned in the SIPPING AAA requirements.  

Allison

P.S. There's a current investigation of RADIUS compatibility mode
in Diameter for this - more needs to be thought about it.

---

From: Henry Sinnreich <[email-masked]>
Date: Mon, 17 Feb 2003 10:07:46 -0600

Why not get help from the aaaarch RG on what the next generation of AAA
should be?

I have taken the liberty to copy here John Vollbrecht and Cees deLat to
see if some consultation with the aaarch folks is doable during the
March IETF. The aaaarch charter addresses exactly the dilemma we are
discussing here: The NG AAA.

http://www.aaaarch.org/charter.html

Note: RADIUS may not be perfect but is used for 100's of millions of
Internet dial-up users all over the world, so maybe it is just good
enough -  valid IETF principle if I remember well.

This is the reason, several of us like the I-D on SIP and RADIUS by
Henning Schulzrinne. It is for real and I suggest it should be advanced
to an informational RFC. See also

http://www.cs.columbia.edu/~hgs/sip/drafts/draft-byerly-sip-radius-00.tx
t

http://www.cs.columbia.edu/~hgs/sip/drafts/draft-sterman-sip-radius-00.t
xt

http://www.cs.columbia.edu/~hgs/research/IRT/cinema/release/radius_notes
.html

But let's see what we can learn from aaaarch.

What do you all think?

Thanks, Henry

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> On Behalf Of Allison Mankin
> Sent: Friday, February 14, 2003 11:59 PM
> To: Jiri Kuthan
> Cc: [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]; 
> [email-masked]
> Subject: Re: [Sipping] New version of the SIP-AAA reqs draft
> 
> 
> 
> Jiri,
> 
> It always seems good to be able to stay with installed base,
> but there's a factor against our supporting RADIUS drafts for 
> SIP's accounting - safety.  Even though there is deployment, 
> there are some extremely bad cases of damage in production, 
> and the IETF 
> has concluded that RADIUS is not suitable for usage-based 
> accounting (RFC2975). 
> 
> Unless there is no intention of having in SIP accounting
> usage-based, monetary, auditable applications, RADIUS is not 
> the solution.  The protocol just does not preserve a complete 
> stream of reliable accounting records that are auditable on 
> any level, especially with any roaming.  As Bernard Aboba 
> stated to this WG, quoting Mike O'Dell, the use of RADIUS may 
> even be illegal in situations where there is an authority 
> over the billing.  Records are too easily lost by the 
> protocol. This is stated clearly by RFC2975.  This is the 
> reason why the Operations and Mgt Area developed Diameter.  
> On these technical* grounds, that the RADIUS protocol does 
> not have enough reliability, the work must be based on the 
> Diameter protocol, which is now approved.  Alternatively, 
> work could be done that does not include usage-based 
> accounting, but this does not seem to be what is 
> P.S. There's a current investigation of RADIUS compatibility
> mode in Diameter for this - more needs to be thought about it.
> > 
> people have
> > >thought that the potential for AAA is much greater than
> the existing
> > >installed base.
> > 
> > This list is for NEW development of the application of SIP Use
> > [email-masked] for questions on current sip Use 
> > [email-masked] for new developments of core SIP
> This list is for NEW development of the application of SIP Use 
> [email-masked] for questions on current sip Use 
> [email-masked] for new developments of core SIP
>

---

From: Jiri Kuthan <[email-masked]>
Date: Tue, 18 Feb 2003 20:50:04 +0100

Allison,

I am no way opposed to the critique of RADIUS -- but where is the
DIAMETER running code?

-jiri

---

From: Stuart Jacobs <[email-masked]>
Date: Wed, 19 Feb 2003 13:44:29 -0500

Allison,

Within Verizon, accounting of SIP based services will most likely not use 
Diameter in our Next Generation Network (NGN) VoIP Services.  We will be 
doing our usage accounting within SIP Proxies and intend to transfer said 
accounting "call detail records" back to our billing OSSes via other 
protocols with IPsec providing authentication and confidentiality for these 
transfers.  We currently do not plan on any deployment of Diameter within 
Verizon's wireline NGN architecture.  We will probably continue to use 
Radius for remote access authentication at the application layer for a 
number or years into the future.

Stu Jacobs

> > I actually think that the deployment argument is a very important one.

==========================
Stuart Jacobs CISSP
PMTS - Sr. Technologist
Verizon Laboratories
40 Sylvan Road Waltham, MA 02451-1128     USA
telephone: (781) 466-3076   fax: (781) 466-2838
[email-masked] [email-masked]  [email-masked]
==========================

---

From: Henry Sinnreich <[email-masked]>
Date: Thu, 20 Feb 2003 17:45:38 -0600

Is there any service provider planning to use SIP-DIAMETER? If yes,
please speak up.

(Though a count for SIP-RADIUS would be just as interesting)

It looks not only is RADIUS the installed base, but it will continue to
be so.

The design group should therefore give priority to the SIP-RADIUS work.
Actually, the old I-D by Henning Schulzrinne is pretty solid and
probably could be used 'as is'.

Thanks, Henry

> On Behalf Of Stuart Jacobs
> Sent: Wednesday, February 19, 2003 12:44 PM
> To: Allison Mankin
> Cc: [email-masked]
> >accounting - safety.  Even though there is deployment, there 
> are some 
> >extremely bad cases of damage in production, and the IETF 
> has concluded 
> >that RADIUS is not suitable for usage-based accounting (RFC2975).
> >
> usage-based, 
> >accounting records that are auditable on any level, 
> especially with any 
> >roaming.  As Bernard Aboba stated to this WG, quoting Mike 
> O'Dell, the 
> >use of RADIUS may even be illegal in situations where there is an 
> >grounds, that the RADIUS protocol does not have enough 
> reliability, the 
> >work must be based on the Diameter protocol, which is now approved.  
> >Alternatively, work could be done that does not include usage-based 
> >accounting, but this does not seem to be what is envisioned in the 
> >SIPPING AAA requirements.
> >
> >Allison
> >
> >P.S. There's a current investigation of RADIUS compatibility mode in 
> >Diameter for this - more needs to be thought about it.
> > >
> > > >I understand what you are asking but I do note that some people 
> > > >have thought that the potential for AAA is much greater than the 
> > > >existing installed base.
> > >
> > > Sipping mailing list  
> https://www1.ietf.org/mailman/listi> nfo/sipping
> > > This list 
> is for NEW development of the 
> application of SIP Use 
> >Use [email-masked] for questions on 
> current sip Use 
> [email-masked] [email-masked]  
> [email-masked] ==========================
> 
> Use [email-masked] for questions on current 
> sip Use [email-masked] for new developments of core SIP
>

---

From: Jari Arkko <[email-masked]>
Date: Fri, 21 Feb 2003 02:00:13 +0200

> Is there any service provider planning to use SIP-DIAMETER? If yes,

Any of the 3G operators count for this? I'm not sure how many
of the subscribe to this group though, even if their vendors
do...

Jari

---

From: [email-masked]
Date: Fri, 21 Feb 2003 07:24:19 +0200

> of the subscribe to this group though, even if their vendors

it depends.  will the vendors really give 3g operators a free choice
which diameter server they want to use in their 3g network?  which
diameter servers has nokia tested interoperability against?  does any of
these servers come from non-3g vendors?  or is the use of diameter in 3g
networks similar fake as use of sip in 3g im?

-- juha

---

From: Jari Arkko <[email-masked]>
Date: Fri, 21 Feb 2003 11:03:31 +0200

> which diameter server they want to use in their 3g network?  which

I'm not quite sure what you mean by free choice in this context, but
perhaps you are after standardized interfaces? These would be publicly
available in the form of RFCs (eg DIAMETER base) and 3G specifications
on how DIAMETER is used for multimedia application.

> diameter servers has nokia tested interoperability against?  does any of

I don't know but there's been Diameter interoperability events. Perhaps
you John could dig up the Nokia information from those if you participated?
I know Ericsson particpated at least.

> networks similar fake as use of sip in 3g im?

The question was if anyone was going to deploy and I answered ;-)

I don't fully agree with the way 3G sets up their AAA. But we are
discussing the creation of an IETF standard for SIP AAA. 3G folks
had to create a multimedia AAA application because the IETF does
not have one. My opinion is that we need an IETF standard in this
space, so that the 3G folks, SIP vendor groups, or other parties
don't all diverge on how to do this. IMHO, this is really crucial
for SIP. My belief is also that the IETF standard will be better than
any of these groups could do themselves. As far as 3G goes, my
understanding was that they are happy to switch to an IETF standard
when it becomes available.

Jari

---

From: Henry Sinnreich <[email-masked]>
Date: Fri, 21 Feb 2003 08:45:57 -0600

>  > of the subscribe to this group though, even if their vendors

I doubt any service providers will agree vendors are entitled to speak
for them, wired or wireless. The service providers on this list have
given solid arguments why we prefer RADIUS at present. As for what comes
beyond RADIUS, we have the OSP token I-D

http://www.ietf.org/internet-drafts/draft-johnston-sip-osp-token-04.txt

 and the IETF work at

DIAMETER is just too little, too late IMHO, when looking at the options
in these links.

Question: Has anyone predetermined in SIPPING that DIAMETER good for
service providers? Interesting...

Thanks, Henry

> On Behalf Of Jari Arkko
> Sent: Friday, February 21, 2003 3:04 AM
> To: [email-masked]
> Cc: 'John Loughney'; [email-masked]
> >  > > Is there any service provider planning to use SIP-DIAMETER? If 
> > yes,  > > please speak up.  >
> I'm not quite sure what you mean by free choice in this 
> context, but perhaps you are after standardized interfaces? 
> These would be publicly available in the form of RFCs (eg 
> DIAMETER base) and 3G specifications on how DIAMETER is used 
> for multimedia application.
> 
> > diameter servers has nokia tested interoperability against? 
>  does any 
> > of
> 
> I don't know but there's been Diameter interoperability 
> events. Perhaps you John could dig up the Nokia information 
> from those if you participated? I know Ericsson particpated at least.
> 
> > these servers come from non-3g vendors?  or is the use of 
> diameter in 
> > 3g networks similar fake as use of sip in 3g im?
> 
> I don't fully agree with the way 3G sets up their AAA. But we 
> are discussing the creation of an IETF standard for SIP AAA. 
> 3G folks had to create a multimedia AAA application because 
> the IETF does not have one. My opinion is that we need an 
> IETF standard in this space, so that the 3G folks, SIP vendor 
> groups, or other parties don't all diverge on how to do this. 
> IMHO, this is really crucial for SIP. My belief is also that 
> the IETF standard will be better than any of these groups 
> could do themselves. As far as 3G goes, my understanding was 
> that they are happy to switch to an IETF standard when it 
> becomes available.
> 
> Jari
>

---

From: "Dean Willis" <[email-masked]>
Date: Tue, 25 Feb 2003 09:17:41 -0600

Jari asked:
> of the subscribe to this group though, even if their vendors do...

Of the two 3G deployments I have my hands in daily, neither uses DIAMETER
for authentication. One uses a database accessible by a proxy (using
conventional database interfaces), and the other uses RADIUS. Both use
database methods for accounting.

This is not to say that they might not use DIAMETER someday. It's just not
in their existing networks, and most of todays 3G deployments are coupled to
older infrastructure elements, because that makes business sense. I think
most of the mobile operators plan on using DIAMETER in the future, some as
soon as within the next six months. Making DIAMETER work right will make
supporting a couple of hundred million subscribers much easier for them.

However, I think we can show existence proofs that RADIUS can be made to do
authentication for SIP. Since there IS a constituency, tackling this effort
might be a reasonable thing to do in the IETF. 

Having done RADIUS accounting for several large ISPs, I can also say that
only someone with a far higher pain tolerance than mine would try to use
RADIUS for time-based usage accounting. Something about unreliable record
delivery causes many annoying glitches. I don't want to go there.

--
Dean