netext F. Xia
Internet-Draft B. Sarikaya
Intended status: Standards Track Huawei USA
Expires: September 15, 2011 J. Korhonen
Nokia Siemens Networks
S. Gundavelli
Cisco
D. Damic
Siemens
March 14, 2011
RADIUS Support for Proxy Mobile IPv6
draft-ietf-netext-radius-pmip6-02
Abstract
This document defines new attributes to facilitate Proxy Mobile IPv6
operations using the RADIUS infrastructure. The RADIUS interactions
between the Mobile Access Gateway and the AAA RADIUS server take
place when the Mobile Node attaches, authenticates and authorizes to
a Proxy Mobile IPv6 domain. Furthermore, this document defines the
RADIUS-based interface between the Local Mobility Anchor and the AAA
RADIUS server for authorizing received Proxy Binding Update messages
for the MN's mobility session. In addition to the mobility session
setup related interactions, this document defines the baseline for
the Mobile Access Gateway and the Local Mobility Anchor generated
accounting.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 15, 2011.
Copyright Notice
Xia, et al. Expires September 15, 2011 [Page 1]
Internet-Draft RADIUS-PMIPv6 March 2011
Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Xia, et al. Expires September 15, 2011 [Page 2]
Internet-Draft RADIUS-PMIPv6 March 2011
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Solution Overview . . . . . . . . . . . . . . . . . . . . . . 5
4. Attribute definitions . . . . . . . . . . . . . . . . . . . . 8
4.1. MIP6-Feature-Vector . . . . . . . . . . . . . . . . . . . 8
4.2. Mobile-Node-Identifier . . . . . . . . . . . . . . . . . . 9
4.3. PMIP6-Home-LMA-IPv6-Address . . . . . . . . . . . . . . . 10
4.4. PMIP6-Visited-LMA-IPv6-Address . . . . . . . . . . . . . . 11
4.5. PMIP6-Home-LMA-IPv4-Address . . . . . . . . . . . . . . . 12
4.6. PMIP6-Visited-LMA-IPv4-Address . . . . . . . . . . . . . . 13
4.7. PMIP6-Home-LMA-Identifier . . . . . . . . . . . . . . . . 14
4.8. PMIP6-Visited-LMA-Identifer . . . . . . . . . . . . . . . 14
4.9. PMIP6-Home-HN-Prefix . . . . . . . . . . . . . . . . . . . 15
4.10. PMIP6-Visited-HN-Prefix . . . . . . . . . . . . . . . . . 16
4.11. PMIP6-Home-Interface-ID . . . . . . . . . . . . . . . . . 17
4.12. PMIP6-Visited-Interface-ID . . . . . . . . . . . . . . . . 18
4.13. PMIP6-Home-IPv4-HoA . . . . . . . . . . . . . . . . . . . 19
4.14. PMIP6-Visited-IPv4-HoA . . . . . . . . . . . . . . . . . . 20
4.15. PMIP6-Home-DHCP4-Server-Address . . . . . . . . . . . . . 21
4.16. PMIP6-Visited-DHCP4-Server-Address . . . . . . . . . . . . 22
4.17. PMIP6-Home-DHCP6-Server-Address . . . . . . . . . . . . . 23
4.18. PMIP6-Visited-DHCP6-Server-Address . . . . . . . . . . . . 24
4.19. Service-Selection . . . . . . . . . . . . . . . . . . . . 25
4.20. Calling-Station-Id . . . . . . . . . . . . . . . . . . . . 26
4.21. Chargeable-User-Identity . . . . . . . . . . . . . . . . . 26
5. MAG to RADIUS AAA interface . . . . . . . . . . . . . . . . . 26
5.1. Interface operations . . . . . . . . . . . . . . . . . . . 27
5.2. Table of Attributes . . . . . . . . . . . . . . . . . . . 27
6. LMA to RADIUS AAA interface . . . . . . . . . . . . . . . . . 28
6.1. Interface operations . . . . . . . . . . . . . . . . . . . 28
6.2. Table of Attributes . . . . . . . . . . . . . . . . . . . 28
7. Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . 29
7.1. Accounting at LMA . . . . . . . . . . . . . . . . . . . . 29
7.2. Accounting at MAG . . . . . . . . . . . . . . . . . . . . 29
7.3. Table of Attributes . . . . . . . . . . . . . . . . . . . 29
8. Security Considerations . . . . . . . . . . . . . . . . . . . 30
9. IANA consideration . . . . . . . . . . . . . . . . . . . . . . 30
9.1. Attribute Type Codes . . . . . . . . . . . . . . . . . . . 30
9.2. Namespaces . . . . . . . . . . . . . . . . . . . . . . . . 31
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 31
11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 32
11.1. Normative References . . . . . . . . . . . . . . . . . . . 32
11.2. Informative references . . . . . . . . . . . . . . . . . . 32
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 33
Xia, et al. Expires September 15, 2011 [Page 3]
Internet-Draft RADIUS-PMIPv6 March 2011
1. Introduction
Proxy Mobile IPv6 (PMIPv6) [RFC5213] is a network-based mobility
management protocol which allows IP mobility session continuity for a
Mobile Node (MN) without MN's actual involvement in mobility
management signaling. A Mobile Access Gateway (MAG) represents the
MN and is authorized to send mobility management signaling messages
on behalf of the MN. Before the MAG initiates mobility management
procedures, at minium it needs to know the IP address of the Local
Mobility Anchor (LMA), and the MN Identifier (MN-ID). The individual
per MN Policy Profile (PP) information is stored in a Policy Store
(PS), which may be local to the MAG or remotely accessible, for
example, through the authentication, authorization and accounting
(AAA) infrastructure.
This document defines the RADIUS-based [RFC2865] profile and
corresponding attributes to be used on the AAA interface between the
MAG and the RADIUS server. This interface is used to retrieve the
per MN Policy Profile from the remote Policy Store to the MAG.
Furthermore, this document also defines the RADIUS-based interface
between the LMA and the AAA RADIUS server for authorization of the
received Proxy Binding Update (PBU) messages. The AAA procedures
defined in this document cover two deployment models: the PMIPv6
scenario where MN connects via the Visited access network, and
scenario where MN directly attaches in its Home network.
2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
The terminology in this document is based on the definitions found in
[RFC5213] and [RFC5844]. The following additional or clarified terms
are used in this document:
Network Access Server (NAS):
A device that provides the access service for a user to a network.
The NAS device contains the RADIUS Client that communicates with
the AAA RADIUS Server. In the context of this document the NAS
function may be integrated with the MAG.
Xia, et al. Expires September 15, 2011 [Page 4]
Internet-Draft RADIUS-PMIPv6 March 2011
Home AAA (HAAA):
An Authentication, Authorization, and Accounting (AAA) server
located in MN's home network. In scope of this document the HAAA
corresponds to the RADIUS Server and the PMIPv6 Policy Store.
Visited AAA (VAAA):
An Authentication, Authorization, and Accounting (AAA) server
located in MN's visited network. For this document, VAAA is the
AAA server that acts as a RADIUS Proxy when the MN moves or
attaches through the Visited network. The VAAA receives an
authentication (or accounting) request from an AAA client such as
a NAS, forwards the request to the HAAA server, receives the reply
from the HAAA, and sends that reply back to the AAA client, if
needed adding changes to reflect local administrative policy.
3. Solution Overview
This document defines the RADIUS-based AAA interactions on two PMIPv6
interfaces:
o between the MAG and the AAA RADIUS Server, and
o between the LMA and the AAA RADIUS Server.
The Policy Profile is retrieved from the corresponding RADIUS server
to the MAG during the MN attachment to the PMIPv6 domain. The LMA
asks for authorization from the RADIUS server upon receiving the
Proxy Binding Update (PBU) messages for the mobility service session.
The concerning AAA procedures use the RADIUS protocol.
When a MN attaches to a PMIPv6 Domain, a network access
authentication procedure is started. The choice of the
authentication mechanism is specific to the access network
deployment, however it is commonly based on the Extensible
Authentication Protocol (EAP) [RFC3748]. During the network access
authentication, the MAG acting as a NAS queries the HAAA through the
AAA infrastructure. If the HAAA detects that the subscriber is
authorized for PMIPv6 services, the RADIUS Access-Accept shall return
to the MAG the Policy Profile including PMIPv6-specific information.
After successfully authenticating the MN, the MAG sends a PBU to the
LMA based on MN's policy profile information. Upon receiving the
PBU, the LMA interacts with the HAAA, and fetches the relevant Policy
Profile and authorization information for the MN's mobility service
session.
Xia, et al. Expires September 15, 2011 [Page 5]
Internet-Draft RADIUS-PMIPv6 March 2011
This document adds support for three distinct PMIPv6 mobility use
cases, taking into account the administrative domains to which the
attended MAG and the LMA belong to. The observed network topologies
are identified by following conditions:
1. the MAG and LMA are both in the home network,
2. the MAG and LMA are both in the visited network, or
3. the MAG is in the visited network while the LMA is in the home
network.
Figure 1 shows participating network entities for the PMIPv6 mobility
session which is located in the home network. The MAG and LMA
interact only with the HAAA.
+--------+
| HAAA & | RADIUS +-----+
| Policy |<-------->| LMA |
| Profile| +-----+
+--------+ | <--- LMA-Address
^ |
| // \\
+---|------------- //---\\----------------+
( | IPv4/IPv6 // \\ )
( | Network // \\ )
+---|-----------//---------\\-------------+
| // \\
RADIUS // <- Tunnel1 \\ <- Tunnel2
| // \\
| |- MAG1-Address |- MAG2-Address
| +----+ +----+
+---->|MAG1| |MAG2|
+----+ +----+
| |
| |
[MN1] [MN2]
Figure 1: The MAG and LMA are both in the home network
Figure 2 shows both the LMA and MAG are in the visited network. The
MAG and LMA exchange signaling with the HAAA through the VAAA which
acts as a Proxy. The visited network may append additional
information to the HAAA replies in order to reflect the local policy.
Xia, et al. Expires September 15, 2011 [Page 6]
Internet-Draft RADIUS-PMIPv6 March 2011
+---------------+
| HAAA & |
+----------| Policy Profile|
| +---------------+
|
+--------+
| VAAA & | RADIUS +-----+
| Policy |<-------->| LMA |
| Profile| +-----+
+--------+ | <--- LMA-Address
^ // \\
+---|------------- //---\\----------------+
( | IPv4/IPv6 // \\ )
( | Network // \\ )
+---|-----------//---------\\-------------+
| // \\
RADIUS // <- Tunnel1 \\ <- Tunnel2
| // \\
| |- MAG1-Address |- MAG2-Address
| +----+ +----+
+---->|MAG1| |MAG2|
+----+ +----+
| |
[MN1] [MN2]
Figure 2: The MAG and LMA are both in the visited network
Figure 3 illustrates topology where MAG resides in the visited
network while the associated LMA is in MN's home network. Any
message between the MAG and the HAAA passes through the VAAA that
acts as a Proxy. During the network authentication, the visited
network's specific policy may also be propagated from the VAAA to the
MAG. The LMA has a direct access the HAAA.
Xia, et al. Expires September 15, 2011 [Page 7]
Internet-Draft RADIUS-PMIPv6 March 2011
+---------------+
| HAAA & |
+----------| Policy Profile|
| +---------------+
| |
| RADIUS
+--------+ |
| VAAA & | +-----+
| Policy | | LMA |
| Profile| +-----+
+--------+ | <--- LMA-Address
^ // \\
+---|------------- //---\\----------------+
( | IPv4/IPv6 // \\ )
( | Network // \\ )
+---|-----------//---------\\-------------+
| // \\
RADIUS // <- Tunnel1 \\ <- Tunnel2
| // \\
| |- MAG1-Address |- MAG2-Address
| +----+ +----+
+---->|MAG1| |MAG2|
+----+ +----+
| |
[MN1] [MN2]
Figure 3: Visited MAG and home LMA topology
4. Attribute definitions
4.1. MIP6-Feature-Vector
Diameter [RFC3588] reserves AVP Code space 1-255 as RADIUS attribute
compatibility space. The MIP6-Feature-Vector AVP (AVP Code 124)
defined in [RFC5447] is of type Unsigned64 and contains a 64-bit
flags field of supported mobility capabilities. This document
reserves a new capability bit according to the rules in [RFC5447],
and reuses the PMIPv6 capability bits defined by [RFC5779]. The
following capability flag bits are used or defined in this document:
PMIP6_SUPPORTED (0x0000010000000000)
This capability bit is used as defined in [RFC5779].
Xia, et al. Expires September 15, 2011 [Page 8]
Internet-Draft RADIUS-PMIPv6 March 2011
IP4_HOA_SUPPORTED (0x0000020000000000)
This capability bit is used as defined in [RFC5779]. Assignment
of the IPv4-HoA is defined by [RFC5844].
LOCAL_MAG_ROUTING_SUPPORTED (0x0000040000000000)
This capability bit is used as defined in [RFC5779].
IP4_TRANSPORT_SUPPORTED (0x0000080000000000)
This capability bit is used for negotiation of the IPv4 transport
support between the MAG and AAA. When the MAG sets this flag bit
in the MIP6-Feature-Vector, it indicates ability of the MAG to
provide IPv4 transport (i.e., IPv4-based encapsulation) for
carrying IP traffic between the MAG and the LMA. If this flag bit
is unset in the returned MIP6-Feature-Vector AVP, the AAA does not
authorize the use IPv4 transport on the MAG-to-LMA tunnel.
The MIP6-Feature-Vector attribute is also used on the LMA to the
RADIUS AAA interface. This capability announcement attribute enables
direct capability negotiation between the LMA and the AAA. The
capabilities that are announced by both parties in the MIP6-Feature-
Vector are known to be mutually supported. The LMA may use this
mechanism during authorization of the received PBU against the AAA to
check individual PMIPv6 feature permissions for a particular MN.
4.2. Mobile-Node-Identifier
The Mobile-Node-Identifier attribute (AVP Code TBD) is of type String
and contains the mobile node identifier (MN-Identifier) see
[RFC5213]) in a form of a NAI [RFC4282] format. This AVP is used on
the interface between MAG and the AAA server. The Mobile-Node-
Identifier attribute is designed for deployments where the MAG does
not have means to find out the MN identity that could be used in
subsequent PBU/PBA exchanges (e.g., due to identity hiding during the
network access authentication) or when the HAAA wants to assign
periodically changing identities to the MN.
The Mobile-Node-Identifier attribute is returned by HAAA in the
RADIUS Access-Accept message that completes a successful
authentication and authorization exchange between the MAG and the
HAAA (if HAAA is able to provide the MN-Identifier in the first
place). If the MAG has not acquired a valid MN-Identifier by other
means, it MUST use the received MN-Identifier.
Xia, et al. Expires September 15, 2011 [Page 9]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Mobile Node Identifier... ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
Mobile-Node-Identifier to be defined by IANA.
Length:
>= 3 octets
Mobile Node Identifier:
This field is of type String and contains the MN-ID
of the MN to be used in the PBU/PBA exchange.
4.3. PMIP6-Home-LMA-IPv6-Address
This attribute (AVP Code TBD) is used to deliver the IPv6 address of
the LMA located in the Home network.
Before the MAG can engage in Proxy Mobile IPv6 signaling it must be
aware of the LMA's IP address either by means of pre-configuration or
through dynamic discovery. After the MN has been successfully
authenticated, the MAG retrieves the IPv6 address of the LMA by
fetching MN's policy profile information from the AAA.
When the LMA is assigned to the MN from the home network, this
attribute MAY be sent by the HAAA to the MAG in the RADIUS Access-
Accept message.
Xia, et al. Expires September 15, 2011 [Page 10]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Home LMA IPv6 address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. . .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. . .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. . .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Home LMA IPv6 address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-LMA-IPv6-Address to be defined by IANA.
Length:
= 18 octets
Home LMA IPv6 address:
128-bit IPv6 address of the assigned home LMA IPv6 address.
4.4. PMIP6-Visited-LMA-IPv6-Address
This attribute (AVP Code TBD) is used to deliver the IPv6 address of
the LMA located in the Visited network. When the MN is attaching in
the visited network, the MAG interacts with the HAAA through the
visited AAA. The LMA in the visited network may be assigned by the
visited AAA as the result of retrieved Policy Profile.
This attribute MAY be sent by the MAG to the VAAA in the RADIUS
Access-Request packet as a proposal to allocate the particular LMA
for the MN. When included by VAAA in the RADIUS Access-Accept sent
to the MAG, the attribute SHALL carry the IPv6 address of the visited
LMA being assigned for the particular MN.
Xia, et al. Expires September 15, 2011 [Page 11]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Visited LMA IPv6 address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. . .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. . .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. . .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Visited LMA IPv6 address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-LMA-IPv6-Address to be defined by IANA.
Length:
= 18 octets
Visited LMA IPv6 address:
128-bit IPv6 address of the assigned visited LMA IPv6 address.
4.5. PMIP6-Home-LMA-IPv4-Address
The PMIP6-Home-LMA-IPv4-Address attribute (AVP Code TBD) contains the
IPv4 address of the LMA assigned by the HAAA. The [RFC5844] supports
Proxy Mobile IPv6 signaling exchange between MAG and LMA using the
IPv4 transport. That is, scenario is supported where LMA and MAG
employ IPv4 addresses to source the PMIPv6 signaling messages and to
establish the IPv4-based transport path for the MN's payload.
When the LMA is located in the home network, this attribute MAY be
sent by the HAAA to the MAG in the RADIUS Access-Accept message.
Xia, et al. Expires September 15, 2011 [Page 12]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Home LMA IPv4 address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Home LMA IPv4 address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-LMA-IPv4-Address to be defined by IANA.
Length:
= 6 octets
Home LMA IPv4 address:
32-bit IPv4 address of the assigned LMA.
4.6. PMIP6-Visited-LMA-IPv4-Address
This attribute (AVP Code TBD) contains the IPv4 address of the LMA
assigned in the Visited network. When the LMA with an IPv4 address
is present in the visited network, depending on authentication
outcome and policy information the VAAA may assign the visited LMA
for the PMIPv6 session in question.
PMIP6-Visited-LMA-IPv4-Address attribute MAY be included by the MAG
to VAAA in the RADIUS Access-Request packet as a proposal to allocate
the particular LMA to the MN. The VAAA MAY include this attribute in
the RADIUS Access-Accept sent to the MAG to indicate authorization of
the specific network topology.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Visited LMA IPv4 address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Visited LMA IPv4 address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-LMA-IPv4-Address to be defined by IANA.
Length:
= 6 octets
Xia, et al. Expires September 15, 2011 [Page 13]
Internet-Draft RADIUS-PMIPv6 March 2011
IPv4 LMA address:
32-bit IPv4 address of the assigned LMA.
4.7. PMIP6-Home-LMA-Identifier
This attribute (AVP Code TBD) carries the identifier of the assigned
LMA that is located in MN's home network. The attribute MAY be sent
by the HAAA to the MAG in the RADIUS Access-Accept.
The identifier SHOULD be unique in the context of the PMIPV6 mobility
session, and can be used by the MAG to derive additional information
about the LMA. The common type of identifier type expected is the
Fully Qualified Domain Name (FQDN) of the LMA. The MAG can perform
DNS query with the FQDN to derive the LMA address.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Identifier of home LMA....
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-LMA-Identifier to be defined by IANA.
Length:
>= 3 octets
String:
The data field contains an appropriate LMA identifier string.
The format is application specific, unless for FQDN in which case
format described in RFC 1035 MUST be considered.
4.8. PMIP6-Visited-LMA-Identifer
This attribute (AVP Code TBD) carries an identifier of the assigned
LMA that is located in the visited network. It MAY be sent by the
MAG to VAAA in the RADIUS Access-Request as a proposal to allocate
the particular LMA to the MN. The attribute MAY be sent by the VAAA
to the MAG in the RADIUS Access-Accept, however it MUST be present if
the previous Access-Request included it.
The identifier SHOULD be unique in the context of the mobility
session, and can be used by the MAG to derive additional information
Xia, et al. Expires September 15, 2011 [Page 14]
Internet-Draft RADIUS-PMIPv6 March 2011
about the LMA. The common type of identifier type expected is the
Fully Qualified Domain Name (FQDN) of the LMA.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Identifier of visited LMA...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-LMA-Identifier to be defined by IANA.
Length:
>= 3 octets
String:
The data field contains an appropriate LMA identifier string.
The format is application specific, unless for FQDN in which case
format described in RFC 1035 MUST be considered.
4.9. PMIP6-Home-HN-Prefix
Mobile Node's Home Network Prefix (MN-HNP) is the IPv6 prefix (i.e.,
the high 64 bits) assigned to the link between the MN and the MAG.
The MN configures its IP interface from its home network prefix(es).
When the LMA is located in the home network, PMIP6-Home-HN-Prefix
attribute (AVP Code TBD) is used to deliver the MN-HNP from the HAAA
to the MAG
The PMIP6-Home-HN-Prefix attribute is also used on the LMA-to-HAAA
interface containing the prefix assigned to the MN. If the LMA
delegates the MN-HNP assignment to the HAAA, the attribute MUST
contain all zeroes address (i.e., 0::0) in the Access-Request
message. The attribute MUST be present in RADIUS Access-Accept if
the prior request already included one, and SHOULD carry the MN-HNP
the HAAA assigned to the MN.
Xia, et al. Expires September 15, 2011 [Page 15]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved | Prefix-Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Home MN-HNP
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Home MN-HNP |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-HN-Prefix to be defined by IANA.
Length:
= 12 octets.
Reserved:
Reserved for future use. The bits MUST be set to zero by the
sender, and MUST be ignored by the receiver.
Prefix-Length:
This field indicates the prefix length of the Home Network Prefix (maximum 8 octets).
Home Network Prefix:
Home Network Prefix for the MN's IPv6 address configuration.
4.10. PMIP6-Visited-HN-Prefix
When the LMA is assigned from the visited network, PMIP6-Visited-HN-
Prefix attribute (AVP Code TBD) is used to deliver the concerning MN-
HNP from the VAAA to the MAG.
The PMIP6-Visited-HN-Prefix attribute is also used on the LMA to VAAA
interface containing the IPv6 prefix assigned to the MN. If the LMA
delegates the assignment of the MN-HNP to the VAAA, the AVP MUST
contain all zeroes address (i.e., 0::0) in the RADIUS Access-Reques.
The attribute MUST be present in Access-Accept if the prior request
already included one, and SHOULD carry the MN-HNP the VAAA assigned
to the MN.
Xia, et al. Expires September 15, 2011 [Page 16]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved | Prefix-Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Visited MN-HNP
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Visited MN-HNP |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-HN-Prefix to be defined by IANA.
Length:
= 12 octets.
Reserved:
Reserved for future use. The bits MUST be set to zero by the
sender, and MUST be ignored by the receiver.
Prefix-Length:
This field indicates the prefix length of the Visited MN-HNP (maximum 8 octets).
Visited Home Network Prefix:
Home Network Prefix for the MN's IPv6 address configuration.
4.11. PMIP6-Home-Interface-ID
For Proxy Mobile IPv6 the Home Network Prefixes assigned to the
mobile node have to be maintained on a per-interface basis. When the
LMA is located in the home network, PMIP6-Home-Interface-ID attribute
conveys 64 bits interface identifier representing a particular MN's
interface. The attribute is assigned by the HAAA to the MAG for
derivation of the MN-HoA.
This attribute MAY be sent by the LMA or the MAG to the HAAA in the
RADIUS Access-Request packet as a proposal. This attribute MAY be
sent by HAAA to the LMA in an Access-Accept packet, however MUST be
present if the prior request already included one.
Xia, et al. Expires September 15, 2011 [Page 17]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Home Interface Identifier
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Home Interface Identifier
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Home Interface Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-Interface-ID to be defined by IANA.
Length:
= 10 octets.
Home Interface Identifier:
The home interface identifier field is 8 octets.
4.12. PMIP6-Visited-Interface-ID
For Proxy Mobile IPv6 the visited Home Network Prefixes assigned to
the mobile node have to be maintained on a per-interface basis. When
the LMA is located in the visited network, the attribute conveys 64
bits interface identifier representing a particular MN's interface.
The attribute is assigned by the VAAA to MAG for the derivation of
MN-HoA.
This attribute MAY be sent by the LMA or the MAG to the VAAA in an
Access-Request packet as a proposal. This attribute MAY be sent by
HAAA to the LMA in an Access-Accept packet, however MUST be present
if the prior request already included one.
Xia, et al. Expires September 15, 2011 [Page 18]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Visited Interface Identifier
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Visited Interface Identifier
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Visited Interface Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-Interface-ID to be defined by IANA.
Length:
= 10 octets.
Visited Interface Identifier:
The visited interface identifier field is 8 octets.
4.13. PMIP6-Home-IPv4-HoA
[RFC5844] specifies extensions to Proxy Mobile IPv6 protocol which
enable IPv4 home address mobility support to the MN. The PMIP6-Home-
IPv4-HoA attribute (AVP Code TBD) is of type Address and contains the
IPv4 Home Address of the MN. The primary use of this attribute is to
deliver the assigned IPv4-HoA from HAAA to the MAG.
The PMIP6-Home-IPv4-HoA is also used on the LMA-to-HAAA interface.
If the LMA in the home network delegates the assignment of the IPv4-
HoA to the HAAA, the attribute MUST contain all zeroes address in the
request message. The attibute MUST be included in by HAAA in the
response if the previous request included it, and it contains the
IPv4-HoA assigned to the MN.
Xia, et al. Expires September 15, 2011 [Page 19]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |Prefix-Len | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Home IPv4 HoA |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-IPv4-HoA to be defined by IANA.
Length:
= 8 octets
Prefix-Len
The 6-bit unsigned integer indicating the prefix length of the trailing IPv4 HoA
Reserved
The 10-bit field reserved for future use. Value MUST beinitialized to
zero by sender, and MUST be ignored by the receiver.
Home IPv4 HoA:
This field is of type Address and contains the IPv4 home
address of the MN in the home network.
4.14. PMIP6-Visited-IPv4-HoA
When both MAG and the LMA are in the visited network, the PMIP6-
Visited-IPv4-HoA attribute (AVP Code TBD) is used to exchange
information between the VAAA and the MAG on the assignment of the
IPv4 Home Address to the MN being present in the Visited network.
The PMIP6-Visited-IPv4-HoA is also used on the LMA-to-VAAA interface.
If the LMA delegates the assignment of the IPv4-HoA to the VAAA, the
attribute MUST contain all zeroes address in the RADIUS Access-
Request. The Access-Accept message MUST have the attribute present
if the prior request to VAAA already included one.
Xia, et al. Expires September 15, 2011 [Page 20]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |Prefix-Len | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Visited IPv4 HoA |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-IPv4-HoA to be defined by IANA.
Length:
= 8 octets
Prefix-Len:
6-bit unsigned integer indicating the prefix length of the trailing IPv4 HoA
Reserved:
The 10-bit field reserved for future use. Value MUST be initialized to
zero by the sender, and MUST be ignored by the receiver.
Visited IPv4 HoA:
This field is of type Address and contains the IPv4 home
address of the MN in the visited network.
4.15. PMIP6-Home-DHCP4-Server-Address
The PMIP6-Home-DHCP4-Server-Address (AVP Code TBD) contains the IPv4
address of the DHCPv4 server in the home network. The particular
DHCP server address is indicated to the MAG that serves the
concerning MN. The HAAA MAY assign a DHCP server to the MAG in
deployments where the MAG acts as a DHCP Relay, as defined in
[RFC5844].
Xia, et al. Expires September 15, 2011 [Page 21]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Home DHCPv4 server address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-DHCP4-Server-Address to be defined by IANA.
Length:
= 8 octets.
Reserved:
Reserved for future use. The bits MUST be set to zero by the
sender, and MUST be ignored by the receiver.
Home DHCPv4 server address:
This field is of type Address and contains a 4-octet IPv4 address of the DHCP server.
4.16. PMIP6-Visited-DHCP4-Server-Address
When both MAG and the LMA are in the visited network, the VAAA uses
PMIP6-Visited-DHCP4-Server-Address attribute (AVP Code TBD) to
deliver the IPv4 address of the DHCPv4 server from the visited
network to the MAG. The VAAA MAY assign a DHCPv4 server to the MAG
in deployments where the MAG acts as a DHCP Relay, as defined in
[RFC5844].
Xia, et al. Expires September 15, 2011 [Page 22]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Visited DHCPv4 server address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-DHCP4-Server-Address to be defined by IANA.
Length:
= 8 octets
Reserved:
Reserved for future use. The bits MUST be set to zero by the
sender, and MUST be ignored by the receiver.
Visited DHCPv4 server address:
This field is of type Address and contains a 4-octet IPv4 address of the DHCPv4
server
4.17. PMIP6-Home-DHCP6-Server-Address
The PMIP6-Home-DHCP6-Server-Address (AVP Code TBD) contains the IPv6
address of the DHCPv6 server in the home network indicated by HAAA to
the MAG that serves the concerning MN. The HAAA MAY assign a DHCPv6
server to the MAG in deployments where the MAG acts as a DHCP Relay,
as defined in [RFC5213].
Xia, et al. Expires September 15, 2011 [Page 23]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. Home DHCPv6 server address .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Home-DHCP6-Server-Address to be defined by IANA.
Length:
= 20 octets
Reserved:
Reserved for future use. The bits MUST be set to zero by the
sender, and MUST be ignored by the receiver.
Home DHCPv6 server address:
This field is of type Address and contains 16-octet IPv6 address of the DHCPv6 server.
4.18. PMIP6-Visited-DHCP6-Server-Address
When both MAG and the LMA are located in the visited network, the
PMIP6-Visited-DHCP6-Server-Address attribute (AVP Code TBD) is used
to deliver the IPv6 address of the DHCPv6 server from the visited
network to the MAG that serves the MN. The VAAA MAY assign a DHCPv6
server to the MAG in deployments where the MAG acts as a DHCP Relay,
as defined in [RFC5213].
Xia, et al. Expires September 15, 2011 [Page 24]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. Visited DHCPv6 server address .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
PMIP6-Visited-DHCP6-Server-Address to be defined by IANA.
Length:
= 20 octets
Reserved:
Reserved for future use. The bits MUST be set to zero by the
sender, and MUST be ignored by the receiver.
Visited DHCPv6 server address:
This field is of type Address and contains the 16-octet IPv6 address of the DHCPv6 server.
4.19. Service-Selection
The Service-Selection attribute (AVP Code TBD) contains the name of
the service or the external network that the mobility service for the
particual MN SHOULD be associated with. The identifier MUST be
unique within the PMIPv6 Domain.
The MAG MUST include the Service-Selection attribute in the Access-
Request sent to the AAA if the information was acquired. The AAA MAY
return the Service-Selection to the MAG even if it was no included in
the Access-Request as means to indicate MN's default service to the
MAG.
On the LMA-to-AAA interface, the LMA MAY populate the Service-
Selection attribute in the Access-Request message using the service
information found in the received PBU, if such mobility option was
included. The Service-Selection identifier should be used to assist
the PBU authorization, the assignment of the MN-HNP and the IPv4-MN-
HoA as described in [RFC5149].
Xia, et al. Expires September 15, 2011 [Page 25]
Internet-Draft RADIUS-PMIPv6 March 2011
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Service Identifier... ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
Service-Selection to be defined by IANA.
Length:
>= 3 octets
Service Identifier:
This field is of type UTF8String and contains the Service Identifier
the MN is associated with.
4.20. Calling-Station-Id
The Calling-Station-Id AVP (AVP Code 31) is of type UTF8String and
contains a link-layer identifier of the MN. This identifier
corresponds to the link-layer identifier as defined in [RFC5213],
Sections 2.2 and 8.6. The Link-Layer Identifier is encoded in ASCII
format (upper case only), with octet values separated by a "-".
Example: "00-23-32-C9-79-38". The encoding is actually the same as
the MAC address encoding in Section 3.21 of [RFC3580].
4.21. Chargeable-User-Identity
The Chargeable-User-Identity attribute or CUI (AVP Code 89) is an
unique temporary handle used as means to, for example, correlate
authentication, accounting and bill post-processing for a particular
chargeable subscriber. The CUI format and use follows guidelines
defined by [RFC4372].
In scope of this PMIPv6 related document, the CUI attribute MAY be
present in the Access-Request. The CUI MAY also be present in the
Access-Accept. The CUI Identity MUST be present in the Access-Accept
if it was present in the Access-Request. If the use of the
Chargeable User Identity is supported, then the MAG and/or the LMA
commits to include the Chargeable User Identity in all subsequent
RADIUS Accounting packets they send for the given user.
5. MAG to RADIUS AAA interface
Xia, et al. Expires September 15, 2011 [Page 26]
Internet-Draft RADIUS-PMIPv6 March 2011
5.1. Interface operations
The MAG to the AAA RADIUS server interface is used for retrieval of
the Policy Profile (i.e., for bootstrapping of the Proxy Mobile IPv6
mobility service session) when a MN tries to attach, authenticate and
authorize to a PMIPv6 domain. Depending on the policies and network
capabilities the MAG may retrieve different sets of PMIPv6-session
related parameters:
o Configuration attributes for Home- or Visited Network access
scenario, depending on the location and attachment point of the
MN,
o The IPv6 or IPv4 address of the designated LMA, depending on the
access network's actual IP topology,
o The IPv6 or IPv4 configuration parameters for the MN, depending on
the utilized IP configuration method and individual MN's service
Policy,
o The DHCP Relay support attributes (IPv4 or IPv6) in case such
functionality is supported in the network.
In addition to the particular PMIPv6 RADIUS attributes, other common
AVPs are also concerened. Whenever the MAG sends a RADIUS Access-
Request message to the AAA server, the User-Name attribute (1) SHOULD
contain the MN identity. At minimum, the home realm of the MN MUST
be available at the MAG when the network access authentication takes
place. Otherwise the MAG will not be able to route the RADIUS
Access-Request messages towards the correct AAA server. The MN
identity MUST be in Network Access Identifier (NAI) [RFC4282] format.
5.2. Table of Attributes
The following table provides a guide to attributes that may be found
in authentication and authorization RADIUS messages.
Xia, et al. Expires September 15, 2011 [Page 27]
Internet-Draft RADIUS-PMIPv6 March 2011
Request Accept Reject Challenge # Attribute
0 0-1 0 0 TBD PMIP6-Home-LMA-IPv6-Address
0-1 0-1 0 0 TBD PMIP6-Visited-LMA-IPv6-Address
0 0-1 0 0 TBD PMIP6-Home-LMA-IPv4-Address
0-1 0-1 0 0 TBD PMIP6-Visited-LMA-IPv4-Address
0 0-1 0 0 TBD PMIP6-Home-LMA-Identifier
0-1 0-1 0 0 TBD PMIP6-Visited-LMA-Identifier
0 0-1 0 0 TBD PMIP6-Home-HN-Prefix
0 0-1 0 0 TBD PMIP6-Visited-HN-Prefix
0 0-1 0 0 TBD PMIP6-Home-Interface-ID
0 0-1 0 0 TBD PMIP6-Visited-Interface-ID
0 0-1 0 0 TBD PMIP6-Home-IPv4-HoA
0 0-1 0 0 TBD PMIP6-Visited-IPv4-HoA
0 0-1 0 0 TBD PMIP6-Home-DHCP4-Server-Address
0-1 0-1 0 0 TBD PMIP6-Visited-DHCP4-Server-Address
0 0-1 0 0 TBD PMIP6-Home-DHCP6-Server-Address
0-1 0-1 0 0 TBD PMIP6-Visited-DHCP6-Server-Address
0 1 0 0 TBD Mobile-Node-Identifier
0-1 0-1 0 0 124 MIP6-Feature-Vector
0-1 0-1 0 0 TBD Service-Selection
0-1 0 0 0 31 Calling-Station-Id
0-1 0-1 0 0 89 Chargeable-User-Identity
6. LMA to RADIUS AAA interface
6.1. Interface operations
The LMA-to-HAAA interface may be used for multiple purposes. These
include the authorization of the incoming PBU, updating the LMA
address to the HAAA, accounting and PMIPv6 session management.
6.2. Table of Attributes
The following table provides a guide to which attributes may be found
in authentication and authorization process.
Xia, et al. Expires September 15, 2011 [Page 28]
Internet-Draft RADIUS-PMIPv6 March 2011
Request Accept Reject Challenge # Attribute
0-1 0-1 0 0 TBD PMIP6-Home-HN-Prefix
0-1 0-1 0 0 TBD PMIP6-Home-IPv4-HoA
0 0-1 0 0 TBD PMIP6-Home-Interface-ID
0-1 0 0 0 TBD PMIP6-Home-LMA-Identifier
0-1 0 0 0 TBD PMIP6-Visited-LMA-Identifier
0 0-1 0 0 TBD PMIP6-Visited-Interface-ID
1 0 0 0 TBD Mobile-Node-Identifier
0-1 0-1 0 0 124 MIP6-Feature-Vector
0-1 0-1 0 0 TBD Service-Selection
0-1 0 0 0 31 Calling-Station-Id
0-1 0-1 0 0 89 Chargeable-User-Identity
7. Accounting
7.1. Accounting at LMA
The accounting at the LMA to AAA server interface is based on
[RFC2865] and [RFC2866]. This interface must support the transfer of
accounting records needed for service control and charging. These
records should include (but may not be limited to): time of binding
cache entry creation and deletion, number of the octets sent and
received by the MN over the bi-directional tunnel, etc.
7.2. Accounting at MAG
The accounting at the MAG to AAA server interface is based on
[RFC2865] and [RFC2866]. The interface must also support the
transfer of accounting records which should include: time of binding
cache entry creation and deletion, number of the octets sent and
received by the MN over tge bi-directional tunnel, etc.
If there is data traffic between a visiting MN and a correspondent
node that is locally attached to an access link connected to the same
MAG, the mobile access gateway MAY optimize on the delivery efforts
by locally routing the packets instead of using reverse tunneling to
the mobile node's LMA. In this case, the local data traffic too MUST
be reported to AAA Accounting servers by means of RADIUS protocol.
7.3. Table of Attributes
The following table provides a list of attributes that may be
included in the RADIUS Accounting messages.
Xia, et al. Expires September 15, 2011 [Page 29]
Internet-Draft RADIUS-PMIPv6 March 2011
Request Interim Stop Attribute
0-1 0 0-1 PMIP6-Home-LMA-IPv6-Address
0-1 0 0-1 PMIP6-Visited-LMA-IPv6-Address
0-1 0 0-1 PMIP6-Home-LMA-IPv4-Address
0-1 0 0-1 PMIP6-Visited-LMA-IPv4-Address
0-1 0 0-1 PMIP6-Home-HN-Prefix
0-1 0 0-1 PMIP6-Visited-HN-Prefix
0-1 0 0-1 PMIP6-Home-IPv4-HoA
0-1 0 0-1 PMIP6-Visited-IPv4-HoA
0-1 0 0-1 Service-Selection
0-1 0 0-1 MIP6-Feature-Vector
0-1 0-1 0-1 Mobile-Node-Identifier
0-1 0 0-1 Calling-Station-Id
0-1 0-1 0-1 Chargeable-User-Identity
8. Security Considerations
The RADIUS messages may be transported between the MAG and/or the LMA
to the RADIUS server via one or more AAA brokers or RADIUS proxies.
In this case the LMA to the RADIUS AAA server communication relies on
the security properties of the intermediate AAA brokers and RADIUS
proxies.
9. IANA consideration
9.1. Attribute Type Codes
This specification defines the following new RADIUS attribute type
codes:
Xia, et al. Expires September 15, 2011 [Page 30]
Internet-Draft RADIUS-PMIPv6 March 2011
Mobile-Node-Identifier is set to TBD
PMIP6-Home-LMA-IPv6-Address is set to TBD
PMIP6-Visited-LMA-IPv6-Address is set to TBD
PMIP6-Home-LMA-IPv4-Address is set to TBD
PMIP6-Visited-LMA-IPv4-Address is set to TBD
PMIP6-Home-LMA-FQDN is set to TBD
PMIP6-Visited-LMA-FQDN is set to TBD
PMIP6-Home-HN-Prefix is set to TBD
PMIP6-Visited-HN-Prefix is set to TBD
PMIP6-Home-Interface-ID is set to TBD
PMIP6-Visited-Interface-ID is set to TBD
PMIP6-Home-IPv4-HoA is set to TBD
PMIP6-Visited-IPv4-HoA is set to TBD
PMIP6-Home-DHCP4-Server-Address is set to TBD
PMIP6-Visited-DHCP4-Server-Address is set to TBD
PMIP6-Home-DHCP6-Server-Address is set to TBD
PMIP6-Visited-DHCP6-Server-Address is set to TBD
9.2. Namespaces
This specification defines new values to the Mobility Capability
registry (see [RFC5447]) for use with the MIP6- Feature-Vector AVP:
Token | Value
----------------------------------+--------------------
IP4_TRANSPORT_SUPPORTED | 0x0000080000000000
10. Acknowledgements
The authors would like to thank Glen Zorn, Avi Lior and Alan DeKok
for reviewing the document. The authors would also like to thank the
authors of [RFC5779] as this document re-uses some procedural ideas
of the mentioned specification.
Xia, et al. Expires September 15, 2011 [Page 31]
Internet-Draft RADIUS-PMIPv6 March 2011
11. References
11.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)",
RFC 2865, June 2000.
[RFC5213] Gundavelli, S., Leung, K., Devarapalli, V., Chowdhury, K.,
and B. Patil, "Proxy Mobile IPv6", RFC 5213, August 2008.
[RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The
Network Access Identifier", RFC 4282, December 2005.
[RFC5447] Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C.,
and K. Chowdhury, "Diameter Mobile IPv6: Support for
Network Access Server to Diameter Server Interaction",
RFC 5447, February 2009.
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
Arkko, "Diameter Base Protocol", RFC 3588, September 2003.
[RFC5844] Wakikawa, R. and S. Gundavelli, "IPv4 Support for Proxy
Mobile IPv6", RFC 5844, May 2010.
[RFC5779] Korhonen, J., Bournelle, J., Chowdhury, K., Muhanna, A.,
and U. Meyer, "Diameter Proxy Mobile IPv6: Mobile Access
Gateway and Local Mobility Anchor Interaction with
Diameter Server", RFC 5779, February 2010.
[RFC4372] Adrangi, F., Lior, A., Korhonen, J., and J. Loughney,
"Chargeable User Identity", RFC 4372, January 2006.
11.2. Informative references
[RFC2866] Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
[RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
Levkowetz, "Extensible Authentication Protocol (EAP)",
RFC 3748, June 2004.
[RFC5149] Korhonen, J., Nilsson, U., and V. Devarapalli, "Service
Selection for Mobile IPv6", RFC 5149, February 2008.
[RFC3580] Congdon, P., Aboba, B., Smith, A., Zorn, G., and J. Roese,
Xia, et al. Expires September 15, 2011 [Page 32]
Internet-Draft RADIUS-PMIPv6 March 2011
"IEEE 802.1X Remote Authentication Dial In User Service
(RADIUS) Usage Guidelines", RFC 3580, September 2003.
Authors' Addresses
Frank Xia
Huawei USA
1700 Alma Dr. Suite 500
Plano, TX 75075
Phone: +1 972-509-5599
Email: xiayangsong@huawei.com
Behcet Sarikaya
Huawei USA
1700 Alma Dr. Suite 500
Plano, TX 75075
Phone: +1 972-509-5599
Email: sarikaya@ieee.org
Jouni Korhonen
Nokia Siemens Networks
Linnoitustie 6
Espoo FI-02600
Finland
Email: jouni.nospam@gmail.com
Sri Gundavelli
Cisco
170 West Tasman Drive
San Jose, CA 95134
Email: sgundave@cisco.com
Xia, et al. Expires September 15, 2011 [Page 33]
Internet-Draft RADIUS-PMIPv6 March 2011
Damjan Damic
Siemens
Heinzelova 70a
Zagreb 10000
Croatia
Email: damjan.damic@siemens.com
Xia, et al. Expires September 15, 2011 [Page 34]
