Re: [HOKEY] adoption ofhttps://datatracker.ietf.org/doc/draft-wu-hokey-ldn-discovery/ as a WG document

Hi again,

Thank you for the clarification. I understand now.

Best regards,
Sebastien.

Le 02/04/2010 15:06, Qin Wu a écrit :
> Hi, Sebastien:
> Thank for raising this issue again. I remembered we talk about this before. My understanding is:
> When the authenticator changes the local domain in case of handover, it usually means inter-AAA-domain handover happens, in this case,
> the peer can just simply fall back to full regular EAP exchange with implicit bootrapping plus DHCP based LDN discovery. With DHCP
> based LDN discovery, the peer can easily fetch the new local domain name. 
>
> Regards!
> -Qin
> ----- Original Message ----- 
> From: "Sebastien Decugis" <sdecugis@nict.go.jp>
> To: "Qin Wu" <sunseawq@huawei.com>
> Cc: <hokey@ietf.org>
> Sent: Friday, April 02, 2010 12:10 PM
> Subject: Re: [HOKEY] adoption ofhttps://datatracker.ietf.org/doc/draft-wu-hokey-ldn-discovery/ as a WG document
>
>
>   
>> Hi Qin,
>>
>> Thank you for the clarification. Anyway, I am still confused. Are you
>> assuming that the new authenticator always belong to the same domain as
>> the previous authenticator in the case of handover?
>>
>> Best regards,
>> Sebastien.
>>
>> Le 02/04/2010 13:03, Qin Wu a écrit :
>>     
>>> Hi, Sebastinen:
>>> Thank for your feedback. Let me do some clarification in response to your comments.
>>>
>>> Regards!
>>> -Qin
>>> ----- Original Message ----- 
>>> From: "Sebastien Decugis" <sdecugis@nict.go.jp>
>>> To: <hokey@ietf.org>
>>> Sent: Friday, April 02, 2010 11:09 AM
>>> Subject: Re: [HOKEY] adoption ofhttps://datatracker.ietf.org/doc/draft-wu-hokey-ldn-discovery/ as a WG document
>>>
>>>
>>> I don't fully understand the purpose of this document.
>>>
>>> If my understanding is correct, in many deployment scenario, the DHCP
>>> traffic is allowed only once the peer is authenticated (ex: 802.1X). 
>>>
>>> [Qin]: It is true in the non-handover scenario. But it is not in the handover scenario.
>>> Each time inter-authenticator handover or inter-AAA handover happens,  DHCP 
>>> procedure should always been performed again.
>>>
>>> To authenticate using ERP protocol, the peer needs to know the local domain
>>> name before the re-authentication starts. Therefore, I really don't
>>> understand how carrying the LDN information in DHCP can help.
>>>
>>> Can you please explain it to me?
>>>
>>> [Qin]: 
>>> The typical scenario is 
>>> i) peer moves from previous authenticator to the new authenticator
>>> ii) the previous authenticator and the new authenticator share the same Local ER server, i.e., local domain name. 
>>> In this scenario, before the peer move to the new authenticator, the implicit bootstapping
>>> is used by local ER server to fetch DSRK from the home domain, unfortuntely, implicit bootrapping can not 
>>> let the peer know the local domain name. In order to help the peer know the local domain before the re-authentication happens between the peer and the local ER server 
>>> in the local domain, DHCP mechanism can be used to fetch local domain from the DHCP server before the peer leaves the previous authenticator. Becos DHCP procedure happen after implicit bootstrapping, but before the peer move to the new authenticator.
>>>
>>> Hope this clarifies. Also you can read the previous version of this draft and presentation slides in the IETF 75 for more details.
>>>
>>> Best regards,
>>> Sebastien.
>>>
>>> Le 27/03/2010 11:22, Glen Zorn a écrit :
>>>   
>>>       
>>>> During yesterday's session, the consensus of the room was to adopt
>>>> https://datatracker.ietf.org/doc/draft-wu-hokey-ldn-discovery/ as a WG
>>>> document; the purpose of this message is to confirm this with the entire WG.
>>>> Please read the document and express an opinion before 2 Apr.  Thanks!
>>>>
>>>> _______________________________________________
>>>> HOKEY mailing list
>>>> HOKEY@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/hokey
>>>>
>>>>   
>>>>     
>>>>         
>>>   
>>>       
>> -- 
>> Sebastien Decugis
>> Research fellow
>> Network Architecture Group
>> NICT (nict.go.jp)
>>     
> >

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)