Re: [Mip6] Bootstrapping DT solution draft

Hi Gerardo, hi DT members,

thanks for the bootstrapping I-D; you did a very good job!

Some comments (and questions) from my side:

(1)  The DT draft doesn't yet specify the backend AAA protocol, e.g., a
Diameter application.  Is this your next step?  (IMO, considering a
split scenario makes sense only when you specify the AAA protocol, too,
because that AAA protocol---neither the DNS lookup nor the MN-HA IKEv2
exchange---is affected by the split.)

(2)  Draft-ietf-mip6-ikev2-ipsec-01.txt already defines how to
dynamically assign a HoA during the IKEv2 handshake.  Why do you use
different Configuration Payloads?

(3) In order to contact DNS, the MN needs IP connectivity.  Is your
assumption that the visited network (ASP/ASA) authorizes the MN for IP
connectivity first, and the MN bootstraps Mobile IPv6 thereafter?  (This
would preclude an all-in-one solution like, e.g., the one described in
draft-le-aaa-diameter-mobileipv6-04.txt.)

(4) Are you assuming that the DNS server belongs to the MSA?  If not,
the MN probably won't have an SA with the DNS server, so DNS requests
are unauthenticated and DNS responses are not encrypted.  (Note that I
am NOT talking about DNS updates here.)  As a consequence, information
about the home topology is accessible to anybody.  Is this an issue?

(5)  The DNS server can store multiple HA addresses, so dynamic HA
assignment is possible in principle.  Do you assume that the DNS server
is in charge of load balancing or that it can assign a HA topologically
close to the MN?  (Fault tolerance could be handled by DHAAD.)

Allright then.

- Christian

--
Christian Vogt, Institute of Telematics, University of Karlsruhe
www.tm.uka.de/~chvogt/pubkey/

Gerardo Giaretta wrote:
> Dear WG,
>
> the bootstrapping DT has submitted a solution draft. The document
> defines how a Mobile Node can bootstrap MIPv6 operations from
> non-topological information and pre-configured security credentials. The
> solution solves the boostrapping problem when the Mobile Node's mobility
> service is authorized by a different service provider than basic network
> access (i.e. split scenario).
>
> The draft can be found at
> http://www.ietf.org/internet-drafts/draft-ietf-mip6-bootstrapping-split-
> 00.txt.
>
> The DT is currently working on optimized solutions for integrated
> scenario (i.e. mobility service and basic network access are authorized
> by the same entity).
>
> Please read the document and provide comments.
>
> Thanks and regards,
>
> --Gerardo (DT editor)

Re: [Mip6] Bootstrapping DT solution draft

Attachment: signature.asc