MIP6-AAA Fwk 3 (was RE: [Mip6] mip6-aaa frameworks)

> > Framework 3:
> > ------------
> > Piggybacking MIP6 signaling (BU) with network access AAA. In-band
with
> > the network access authentication execution, the MN delivers
> > (piggybacks) a BU to the AAA server. The AAA server may have to
relay
> > the BU to the HA (unless collocated).
> >
> > Related I-D:
> >
> > draft-le-aaa-mipv6-requirements-03
> >
> > Discussion:
> >
> > While the performance benefits are clear, limited applicability (not
> > always the network access and mobility services are bundled) and
> > complexity are concerning.
> >
> Can you elaborate on the complexity issue ?

- By the time network access AAA is executed:
  - MN must know its HA (may not be possible if the HA 
    discovery is done after the access is authorized -- e.g., 
    DHCP, DNS-based schemes)
  - MN must know its care-of address. (may not be possible if the
    CoA allocation depends on the network access authentication.
- AAA_home server must decapsulate the BU and forward it to the HA. What
is the source address in BU packets? (may be a ingress-filtering
concern).
- The BUack from the HA: is it sent back to MN directly, or forwarded to
AAA_home and piggybacked in the AAA response to MN?
- The results of mobility management and access authorization may need
to be coordinated? What happens when one succeeds and other fails?
- What is the transport for BU? EAP, or EAP lower layers, PPP+RADIUS, ?

I don't claim these are impossible to answer, but clearly each answer
would lead to additional complexity.

Alper

_______________________________________________
Mip6 mailing list
Mip6@ietf.org
https://www1.ietf.org/mailman/listinfo/mip6