diff options
Diffstat (limited to 'doc/rfc/rfc4433.txt')
| -rw-r--r-- | doc/rfc/rfc4433.txt | 1403 | 
1 files changed, 1403 insertions, 0 deletions
| diff --git a/doc/rfc/rfc4433.txt b/doc/rfc/rfc4433.txt new file mode 100644 index 0000000..4809f5e --- /dev/null +++ b/doc/rfc/rfc4433.txt @@ -0,0 +1,1403 @@ + + + + + + +Network Working Group                                        M. Kulkarni +Request for Comments: 4433                                      A. Patel +Category: Standards Track                                       K. Leung +                                                      Cisco Systems Inc. +                                                              March 2006 + + +            Mobile IPv4 Dynamic Home Agent (HA) Assignment + +Status of This Memo + +   This document specifies an Internet standards track protocol for the +   Internet community, and requests discussion and suggestions for +   improvements.  Please refer to the current edition of the "Internet +   Official Protocol Standards" (STD 1) for the standardization state +   and status of this protocol.  Distribution of this memo is unlimited. + +Copyright Notice + +   Copyright (C) The Internet Society (2006). + +Abstract + +   Mobile IPv4 (RFC 3344) uses the home agent (HA) to anchor sessions of +   a roaming mobile node (MN).  This document proposes a messaging +   mechanism for dynamic home agent assignment and HA redirection.  The +   goal is to provide a mechanism to assign an optimal HA for a Mobile +   IP session while allowing any suitable method for HA selection. + + + + + + + + + + + + + + + + + + + + + + + +Kulkarni, et al.            Standards Track                     [Page 1] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +Table of Contents + +   1. Introduction ....................................................3 +   2. Requirements Terminology ........................................3 +   3. Problem Statement ...............................................5 +      3.1. Scope ......................................................5 +      3.2. Dynamic Home Agent Discovery in Mobile IPv4 ................5 +      3.3. NAI Usage and Dynamic HA Assignment ........................6 +      3.4. Dynamic HA Extension .......................................6 +           3.4.1. Requested HA Extension ..............................7 +           3.4.2. Redirected HA Extension .............................7 +   4. Messaging Mechanism for Dynamic HA Assignment/Redirection .......7 +      4.1. Messaging for Dynamic HA Assignment ........................7 +           4.1.1. Example with Message Flow Diagram ...................8 +      4.2. Messaging for HA Redirection ..............................10 +           4.2.1. Example with Message Flow Diagram ..................12 +   5. Mobility Agent Considerations ..................................14 +      5.1. Mobile Node Considerations ................................14 +           5.1.1. MN Using FA CoA ....................................14 +           5.1.2. MN Using Co-Located CoA ............................15 +           5.1.3. Refreshing Assigned HA Address on Mobile Node ......16 +      5.2. Foreign Agent Considerations ..............................16 +      5.3. Home Agent Considerations .................................17 +           5.3.1. Assigned Home Agent Considerations .................17 +   6. Requested Home Agent Selection .................................19 +   7. Error Values ...................................................20 +   8. IANA Considerations ............................................20 +   9. Security Considerations ........................................20 +   10. Backward-Compatibility Considerations .........................21 +   11. Acknowledgements ..............................................23 +   12. Normative References ..........................................23 + + + + + + + + + + + + + + + + + + + + +Kulkarni, et al.            Standards Track                     [Page 2] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +1.  Introduction + +   This document adds to the Mobile IP protocol [1], by proposing a +   messaging mechanism for dynamic home agent assignment and home agent +   redirection during initial registration.  The goal is to assign an +   optimal HA for a Mobile IP session.  The mobile node MUST use the +   Network Access Identifier (NAI) extension [2] when requesting a +   dynamically assigned HA. + +   The MN requests a dynamically assigned HA by setting the HA field in +   the initial Registration Request to ALL-ZERO-ONE-ADDR (defined in +   Section 2).  If the request is accepted, the HA sends a successful +   Registration Reply containing the HA's own address.  The requested HA +   can suggest an alternate HA and if so, the Registration Reply is +   rejected with a new error code REDIRECT-HA-REQ and the alternate HA +   address is specified in a new extension (Redirected HA Extension). + +   This document also defines a new Requested HA Extension for use in +   Registration Requests when the HA field is set to ALL-ZERO-ONE-ADDR. +   The Requested HA address is a hint to the network about the MN's +   preferred HA. + +   The messaging mechanism is defined in this document so that the MN +   can request and receive a dynamic HA address in Mobile IP messages. +   However, the mechanism by which the network selects an HA for +   assignment to the MN is outside the scope of this document.  For +   example, the selection may be made by any network node that receives +   the Registration Request (or information about the Registration +   Request), such as a Foreign Agent, AAA server, or home agent.  The +   node that selects the HA may select one based on a number of +   criteria, including but not limited to HA load-balancing, +   geographical proximity, administrative policy, etc. + +2.  Requirements Terminology + +   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", +   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this +   document are to be interpreted as described in RFC 2119 [6]. + +   The Mobile-IP-related terminology described in RFC 3344 [1] is used +   in this document.  In addition, the following terms are used: + +   ALL-ZERO-ONE-ADDR: IP address 0.0.0.0 or 255.255.255.255.  An +                      address of 255.255.255.255 indicates a preference +                      for an HA in the home domain.  An address of +                      0.0.0.0 indicates no preference for home vs. +                      visited domain. + + + + +Kulkarni, et al.            Standards Track                     [Page 3] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   Requested HA:      Destination IP address of home agent that the +                      Registration Request is sent to.  Must be a +                      unicast IP address.  This address can be +                      obtained as described in Section 6. + +                      Note that this specification defines a new +                      "Requested HA Extension" in Section 3.4, which +                      is different from the term "Requested HA". + +   Assigned HA:       The HA that accepts an MN's Registration Request +                      and returns a successful Registration Reply. + +   Redirected HA:     If the registration is rejected with error code +                      REDIRECT-HA-REQ, the HA being referred to is +                      specified in a new extension (Redirected HA +                      Extension). + +   AAA server:        Authentication, Authorization, and Accounting +                      Server. + +   DNS:               Domain Name System. + +   DHCP:              Dynamic Host Configuration Protocol. + +   MN:                Mobile node as defined in Mobile IPv4 [1]. + +   HA:                Home agent as defined in Mobile IPv4 [1]. + +   FA:                Foreign Agent as defined in Mobile IPv4 [1]. + +   CoA:               Care-of Address. + +   CCoA:              Co-located Care-of Address. + +   MN HoA:            Mobile node's home address. + +   NAI:               Network Access Identifier [2]. + +   Src IP:            Source IP address of the packet. + +   Dest IP:           Destination IP address of the packet. + +   RRQ:               Registration Request. + + + + + + + + +Kulkarni, et al.            Standards Track                     [Page 4] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +3.  Problem Statement + +   The Mobile IPv4 NAI Extension for IPv4 [2] introduced the concept of +   identifying an MN by the NAI and enabling dynamic home address +   assignment.  When the home address is dynamically assigned, it is +   desirable to discover the home agent dynamically or inform the MN +   about an optimal HA to use for a multitude of reasons, such as: + +   - If the distance between the visited network and the home network of +     the mobile node is large, the signaling delay for these +     registrations may be long.  In such a case, the MN will be anchored +     to its distant home agent, resulting in tunneled traffic traveling +     a long distance between home agent and the mobile node.  When a +     Mobile IP session initiates, if the mobile node can be assigned a +     home agent that is close to the mobile node it can drastically +     reduce the latency between the home agent and mobile node. + +   - In a large-scale Mobile IP deployment, it is cumbersome to +     provision MNs with multiple HA addresses. + +   - It is desirable to achieve some form of load balancing between +     multiple HAs in the network.  Dynamic HA assignment and/or HA +     redirection lets the network select the optimal HA from among a set +     of HAs and thus achieve load balancing among a group of HAs. + +   - Local administrative policies. + +3.1.  Scope + +   This specification does not address the problem of distributing a +   security association between the MN and HA, and it can either be +   statically preconfigured or dynamically distributed using other +   mechanisms [7]. + +   The document introduces the terms Requested/Assigned/Redirected HA +   (Section 6).  The discovery of candidate HA addresses for insertion +   into the Redirected HA Extension can be accomplished through various +   means that are network and/or deployment specific and hence are +   outside the scope of this specification. + +   The MN MAY request dynamic HA assignment when it is not aware of any +   HA address and even when it is aware of at least one HA address. + +3.2.  Dynamic Home Agent Discovery in Mobile IPv4 + +   Mobile IPv4 [1] specifies the mechanism for discovering the mobile +   node's home agent using subnet-directed broadcast IP address in the +   home agent field of the Registration Request.  This mechanism was + + + +Kulkarni, et al.            Standards Track                     [Page 5] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   designed for mobile nodes with a static home address and subnet +   prefix, anchored on fixed home network.  However, using subnet- +   directed broadcast as the destination IP address of the Registration +   Request, it is unlikely that the Registration Request will reach the +   home subnet because routers will drop these packets by default.  See +   CERT Advisory CA-1998-01 Smurf IP Denial-of-Service Attacks [3]. + +3.3.  NAI Usage and Dynamic HA Assignment + +   The Mobile IPv4 NAI Extension for IPv4 [2] introduced the concept of +   identifying an MN by the NAI and enabling dynamic home address +   assignment.  This document requires that while using dynamic HA +   assignment, MN MUST use the NAI and obtain a home address.  MN can +   still suggest a static home address in the Registration Request, but +   must take the address in the Registration Reply as the home address +   for the session.  This is compatible with the procedures documented +   in the NAI specification [2]. + +3.4.  Dynamic HA Extension + +   The Dynamic HA Extension, shown in Figure 1, contains the address of +   the HA.  This is a generic extension and can be used in Registration +   Request and Reply messages.  It is a skippable extension. + +   0                   1                   2                   3 +   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +   |     Type      |   Subtype     |           Length              | +   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +   |                           HA-Address                          | +   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + +                Figure 1: The Dynamic HA Address Extension + +      Type         DYNAMIC-HA-ADDRESS (skippable) 139 is the type, +                   which specifies the dynamic HA address. + +      Subtype      Defines the use of this extension as: +                   subtype 1 = Requested HA Extension +                           2 = Redirected HA Extension + +      Length       Indicates the length of the extension not +                   including the type, subtype, and length fields. +                   Length is always 4 bytes. + +      HA-Address   Address of the home agent. + + + + + +Kulkarni, et al.            Standards Track                     [Page 6] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +3.4.1.  Requested HA Extension + +   The Requested HA Extension is a Dynamic HA Extension of subtype 1. + +   The MN may include the Requested HA Extension in the Registration +   Request as a hint to the network where it wishes to be anchored. + +   This extension contains the address of the HA.  A valid unicast IP +   address MUST be used as HA address in this extension. + +   In absence of an FA, the Registration Request is forwarded to this +   HA.  In presence of an FA, the FA MUST forward the Registration +   Request to the HA address in this extension. + +3.4.2.  Redirected HA Extension + +   The Redirected HA Extension is a Dynamic HA Extension of subtype 2. + +   The Redirected HA Extension contains the address of the HA where the +   MN should attempt the next registration.  The HA receiving a +   Registration Request can suggest an alternate HA and, if so, the +   Registration Reply is sent with a new error code REDIRECT-HA-REQ and +   the alternate HA address is specified in this extension. + +   The Redirected HA Extension MUST be included in Registration Reply +   when the reply code is REDIRECT-HA-REQ. + +4.  Messaging Mechanism for Dynamic HA Assignment/Redirection + +   This specification presents two alternatives for home agent +   assignment: + +   (a) Dynamic HA assignment (described in Section 4.1) and +   (b) HA redirection (described in Section 4.2). + +4.1.  Messaging for Dynamic HA Assignment + +   The following sequence of events occurs when the MN requests dynamic +   home agent assignment: + +   1.  The MN sets the Home Agent address field in the Registration +       Request to ALL-ZERO-ONE-ADDR.  If the MN is aware of a desired HA +       address, it can add that address in the Requested HA Extension in +       the Registration Request.  If the HA does not support the +       Requested HA Extension, see step 2 below. + + + + + + +Kulkarni, et al.            Standards Track                     [Page 7] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   2.  This step is applicable, in lieu of step 1, for an MN that is +       aware of the HA address and desires dynamic HA assignment.  Also, +       the MN follows this (when aware of a HA address) when it +       discovers a legacy FA in the path or if the known HA does not +       support the Requested HA Extension (see Section 10). + +       The MN sets the Home Agent address field in the Registration +       Request to the HA address (instead of setting it to ALL-ZERO- +       ONE-ADDR).  The MN also adds the same HA address in the Requested +       HA Extension in the Registration Request. + +   3.  The MN (if using co-located CoA and registering directly with the +       HA) or the FA (if the MN is registering via the FA) sends the +       Registration Request to the "Requested HA".  If the Requested HA +       Extension is present, Requested HA is specified in the "HA +       Address" of this extension. + +       Per Section 10, in case of a legacy FA, legacy FA forwards the +       Registration Request to the address in the HA field of the +       request (thus, MN uses step 2 above in case of legacy FA instead +       of step 1). + +   4.  The "Requested HA" is the home agent that processes the +       Registration Request in accordance with Mobile IPv4 [1] and as +       per the specification in this document.  It creates mobility +       binding for a successful Registration Request.  It also sends a +       Registration Reply to the MN. + +   5.  The MN obtains an "Assigned HA" address from the HA field in the +       successful Registration Reply and uses it for the remainder of +       the session.  (Note that the "Assigned HA" will be the same as +       the "Requested HA".) + +   6.  Subsequent Registration Request messages for renewal are sent to +       the Assigned HA. + +   Section 5.3.1 describes the Assigned HA in detail.  Some ideas on how +   to select the Requested HA are briefly covered in Section 6. + +4.1.1.  Example with Message Flow Diagram + +   Detailed explanation of this alternative is best described with the +   help of a message flow diagram and description. + +   Figure 2 shows one specific example of a mobile node using an +   FA-located Care-of Address (FA CoA) and FA understands the Requested +   HA Extension per this specification. + + + + +Kulkarni, et al.            Standards Track                     [Page 8] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   Other scenarios such as when the mobile node uses a co-located care +   of address and presence of a legacy HA or FA are not described below, +   but the behavior is similar. + +                MN            FA        Requested/Assigned HA +                |      1      |                | +                |------------>|       2        | +                |             |--------------->| +                |             |                | +                |             |                | +                |             |       3        | +                |      4      |<---------------| +                |<------------|                | +                |             |                | +                |             |       5        | +                |----------------------------->| +                |             |                | + +    Figure 2: Example Message Flow for Dynamic HA Assignment + +   1.  The MN sets the Home Agent address field in the Registration +       Request to ALL-ZERO-ONE-ADDR.  Since the MN is using FA CoA in +       this example, it sends the Registration Request to the FA.  The +       Registration Request is formatted as follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |  MN    |    FA      |         | ALL-ZERO-ONE-ADDR |FA CoA | +       +-----------------------------------------------------------+ + +       If the MN is aware of a desired HA address, it can add that +       address in the Requested HA Extension in Registration Request as +       a hint.  That extension is not shown above. + +   2.  The FA sends the Registration Request to the Requested HA.  If +       the Requested HA Extension is present, Requested HA is the HA +       address in this extension.  If the Requested HA Extension is not +       present, the FA determines the Requested HA through means outside +       the scope of this specification.  The Registration Request is +       formatted as follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |  FA    |Requested HA|         | ALL-ZERO-ONE-ADDR |FA CoA | +       +-----------------------------------------------------------+ + + + + + + +Kulkarni, et al.            Standards Track                     [Page 9] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +       (If MN includes the Requested HA Extension, the FA copies that +       extension.  The FA then forwards the Registration Request, along +       with the Requested HA Extension, to the HA address specified in +       Requested HA Extension.) + +   3.  The HA processes the Registration Request in accordance with +       Mobile IPv4 [1] and the messaging defined in this document.  The +       HA creates mobility binding for successful request and becomes +       the Assigned HA.  The HA then sends a Registration Reply to the +       FA, which is formatted as follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |Assigned| Src IP of  |         |    Assigned HA    |FA CoA/| +       |   HA   | the RRQ    |         |                   |       | +       +-----------------------------------------------------------+ + +   4.  The FA relays the Registration Reply to the MN, as follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |  FA    |    MN      |         |    Assigned HA    |FA CoA/| +       +-----------------------------------------------------------+ + +   5.  The MN obtains the Assigned HA address from the HA field in the +       successful Registration Reply and uses it for the remainder of +       the session.  The MN sends subsequent Re-Registration or +       De-Registration Requests for the remainder session directly to +       the Assigned HA.  The Home Agent address field in this +       Registration Request is set to ALL-ZERO-ONE-ADDR.  Note that the +       Assigned HA is the same as the Requested HA. + +4.2.  Messaging for HA Redirection + +       This section describes the events that occur when the Requested +       HA does not accept the Registration Request and redirects the +       mobile node to another HA (aka Redirected HA) instead.  This +       behavior is not exhibited by a legacy HA and so is not referred +       in the description below.  In presence of a legacy FA, please +       refer to Section 4.1 for the specific field in the Registration +       Request. + +   1.  The MN sets the Home Agent address field in the Registration +       Request to ALL-ZERO-ONE-ADDR. + + + + + + + +Kulkarni, et al.            Standards Track                    [Page 10] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   2.  The MN (if using co-located CoA and registering directly with the +       HA) or FA (if the MN is registering via the FA) sends the +       Registration Request to the "Requested HA".  If the MN is aware +       of an HA address, it can add that address in the Requested HA +       Extension in the Registration Request. + +   3.  When the HA receives the Registration Request, if the HA field is +       set to ALL-ZERO-ONE-ADDR, the HA may reject the request with +       Reply code REDIRECT-HA-REQ and suggest an alternate HA. + +       The HA may reject the request for a number of reasons, which are +       outside the scope of this specification.  If the HA rejects the +       Request, the HA field in the Reply is set to this HA's address. +       The IP address of the HA that is the target of the redirection is +       specified in Redirected HA Extension.  The presence of this +       extension is mandatory when the reply code is set to REDIRECT- +       HA-REQ.  HA sends the Reply to the FA/MN. + +   4.  FA sends the Reply to the MN. + +   5.  If the error code is set to REDIRECT-HA-REQ, the MN obtains the +       HA address from Redirected HA Extension.  The MN then sends a +       Registration Request to Redirected HA.  The MN may choose to add +       Requested HA Extension in this new Registration Request.  If a +       registration loop occurs (the case when the Redirected HA is an +       HA that had already directed the MN to register elsewhere), then +       the MN stops sending any further Registration Request and +       provides an indication that the loop event was detected.  The +       number of consecutive Redirected HAs remembered by the MN for +       loop detection is an implementation parameter. + + + + + + + + + + + + + + + + + + + + + +Kulkarni, et al.            Standards Track                    [Page 11] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +4.2.1.  Example with Message Flow Diagram + +   Figure 3 shows one specific example of a mobile node using FA-located +   Care-of Address, where the FA is not a legacy FA. + +      MN           FA          Requested HA    Redirected HA +      |      1      |                |               | +      |------------>|       2        |               | +      |             |--------------->|               | +      |             |                |               | +      |             |                |               | +      |             |       3        |               | +      |      4      |<---------------|               | +      |<------------|                |               | +      |             |                |               | +      |             |       5        |               | +      |--------------------------------------------->| +      |             |                |               | + +      Figure 3: Example Message Flow for HA Redirection + +   1.  The MN sets the Home Agent address field in the Registration +       Request to ALL-ZERO-ONE-ADDR.  Since the MN is using FA CoA in +       this example, it sends the Registration Request to the FA.  The +       Registration Request is formatted as follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |  MN    |    FA      |         | ALL-ZERO-ONE-ADDR |FA CoA | +       +-----------------------------------------------------------+ + +       If the MN is aware of an HA address, it can add that address in +       the Requested HA Extension in the Registration Request as a hint. +       That extension is not shown above. + +   2.  The FA sends the Registration Request to the Requested HA.  If +       Requested HA Extension is present, Requested HA is the HA address +       in this extension.  If the Requested HA Extension is not present, +       the FA determines the Requested HA through means outside the +       scope of this specification.  The Registration Request is +       formatted as follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |  FA    |Requested HA|         | ALL-ZERO-ONE-ADDR |FA CoA | +       +-----------------------------------------------------------+ + + + + + +Kulkarni, et al.            Standards Track                    [Page 12] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   3.  The HA processes the Registration Request in accordance with +       Mobile IPv4 [1] and the messaging defined in this specification. +       If the registration is successful, but local +       configuration/administrative policy, etc., directs the HA to +       refer the MN to another HA, the HA rejects the request with error +       code REDIRECT-HA-REQ.  The HA fills in the address of the +       Redirected HA in the Redirected HA Extension.  The HA then sends +       Registration Reply reject to the FA, which is formatted as +       follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |        | Src IP of  |         |       HA          |FA CoA | +       |   HA   | the RRQ    |         |                   |       | +       +-----------------------------------------------------------+ +       | Redirected HA Extension ...                               | +       +-----------------------------------------------------------+ + +   4.  The FA relays the Registration Reply to the MN, as follows: + +       +-----------------------------------------------------------+ +       | Src IP=| Dest IP =  | MN HoA  |    HA Address =   | CoA = | +       |  FA    |    MN      |         |       HA          |FA CoA/| +       +-----------------------------------------------------------+ +       | Redirected HA Extension ...                               | +       +-----------------------------------------------------------+ + +   5.  If the MN can authenticate the Reply, the MN extracts the HA +       address from the Redirected HA Extension.  The MN then sends a +       Registration Request to the Redirected HA, unless it has already +       received a redirection response from that HA while processing the +       Registration Request.  The MN may choose to add Requested HA +       Extension in this new Registration Request. + + + + + + + + + + + + + + + + + + +Kulkarni, et al.            Standards Track                    [Page 13] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +5.  Mobility Agent Considerations + +   The following sections describe the behavior of each mobility agent +   in detail. + +5.1.  Mobile Node Considerations + +   The mobile node MUST use the NAI extension for home address +   assignment when using the messaging mechanism in this document. +   Since MN uses the NAI extension, the Home Address field is set to +   0.0.0.0. + +   While dynamic HA assignment is in progress and the MN has not +   successfully anchored at a home agent, the MN MUST set the Home Agent +   field in the Registration Request to an ALL-ZERO-ONE-ADDR, which is +   either 255.255.255.255 or 0.0.0.0. + +   The Registration Request MUST be protected by a valid authenticator +   as specified in Mobile IPv4 [1] or Mobile IPv4 Challenge/Response +   Extensions [5].  Configuring security associations is deployment +   specific and hence outside the scope of this specification.  The +   security associations between an MN and an individual HA may also be +   dynamically derived during the dynamic HA assignment, based on a +   shared secret between MN and AAA infrastructure [7]. + +   The mobile node MUST maintain the remaining Mobile IP session with +   the Assigned HA. + +   As mentioned in the Security Considerations (Section 9), there is a +   possibility of more than one HA creating a mobility binding entry for +   a given MN, if a rogue node in the middle captures the Registration +   Request and forwards it to other home agents.  The MN can mitigate +   such condition by using a short lifetime (e.g., 5 seconds) in the +   Registration Request with the Home Agent field set to ALL-ZERO-ONE- +   ADDR. + +   The following sections describe MN behavior in FA CoA mode and co- +   located CoA mode. + +5.1.1.  MN Using FA CoA + +   When a mobile node initiates a Mobile IP session requesting dynamic +   HA assignment, it MUST set the home agent address field in the +   Registration Request to ALL-ZERO-ONE-ADDR.  The destination IP +   address of the Registration Request is the FA.  The FA will determine +   the Requested HA and forward the Registration Request to the +   Requested HA.  Registration Request processing takes place on the +   Requested HA as per the specification in this document. + + + +Kulkarni, et al.            Standards Track                    [Page 14] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   The Registration Request MUST be appropriately authenticated for the +   HA to validate the Request. + +   If a successful Registration Reply is received, the MN obtains the +   Assigned HA from the HA field of Reply.  The Assigned HA address will +   be the same as the Requested HA Extension, if it was included in the +   Registration Request by the MN. + +   If a Registration Reply is received with code REDIRECT-HA-REQ, the MN +   MUST authenticate the Reply based on HA address in HA field of Reply +   and attempt Registration with the HA address specified in the +   Redirected HA Extension.  The MN MUST put the Redirected HA address +   as the Requested HA Extension of the new Registration Request. + +   In some cases, for the first Registration Request the MN may want to +   hint to the network to be anchored at a specific HA.  The MN SHOULD +   put that address in the HA address of the Requested HA Extension. + +5.1.2.  MN Using Co-Located CoA + +   An MN in co-located CoA mode requesting dynamic HA assignment MUST +   set the home agent address field in the Registration Request to ALL- +   ZERO-ONE-ADDR.  The destination IP address of the Registration +   Request is the Requested HA.  Some ideas on how to select a Requested +   HA are briefly covered in Section 6. + +   If a successful Reply is received, the MN obtains the Assigned HA +   address from the successful Registration Reply.  The Assigned HA will +   be the same as Requested HA to which the Registration Request was +   sent.  The MN MUST cache the Assigned HA address for the length of +   the Mobile IP session.  The mobile node then MUST use this previously +   cached Assigned HA address as the home agent address in subsequent +   Re-Registration and De-Registration Request(s).  This will make sure +   that for the duration of the Mobile IP session, the mobile node will +   always be anchored to the assigned home agent with which it was +   initially registered. + +   If a Registration Reply is received with code REDIRECT-HA-REQ, the MN +   MUST authenticate the Reply based on HA address in HA field of Reply +   and attempt Registration with the HA address specified in the +   Redirected HA Extension.  The MN MUST put the Redirected HA in the +   Requested HA Extension of the new Registration Request. + +   In some cases, for the first Registration Request MN may want to hint +   to the network to be anchored at a specific HA and the MN SHOULD put +   that address in the HA address of the Requested HA Extension. + + + + + +Kulkarni, et al.            Standards Track                    [Page 15] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   While requesting dynamic HA assignment and registering directly with +   an HA, the Requested HA Extension MUST be included and MUST contain +   the address of the HA to which the Registration Request is sent. +   When using co-located CoA but registering via a legacy FA, the HA +   field in the Registration Request may be set to Requested HA. + +   If the Registration Request contains the Requested HA Extension, the +   HA address in that extension MUST match the destination IP of the +   Request. + +5.1.3.  Refreshing Assigned HA Address on Mobile Node + +   When the Mobile IP session terminates, the mobile node MAY clear the +   Assigned HA address cached as the home agent address.  It MAY request +   a new HA address for the new Mobile IP session by not including the +   Requested HA Extension.  The advantage of this approach is that the +   mobile node will be always anchored to an optimal home agent from +   where it initiated the Mobile IP session. + +   Alternately, the MN may save the Assigned HA address and use it in +   the Requested HA Extension along with ALL-ZERO-ONE-ADDR HA address in +   Registration Request for a new Mobile IP session. + +5.2.  Foreign Agent Considerations + +   When the mobile node is using an FA CoA, it always registers via the +   FA.  When the MN is using a co-located CoA, it may register through +   an FA or it may register directly with an HA, unless the R bit is set +   in the FA's agent advertisement, in which case it always registers +   through the FA. + +   When the FA receives a Registration Request with HA address field set +   to ALL-ZERO-ONE-ADDR that doesn't contain the Requested HA Extension, +   the FA obtains the Requested HA address to forward the Registration +   Request using means outside the scope of this specification.  Some +   ideas on how to select a Requested HA are briefly covered in Section +   6. + +   If the FA cannot obtain the Requested HA to which to forward a +   Registration Request from the MN, it MUST reject request with error +   code NONZERO-HA-REQD. + +   If the MN has included the Requested HA Extension, the FA MUST +   forward the Registration Request to the address in this extension. +   If the HA address in this extension is not a routable unicast +   address, the FA MUST reject the request with error code NONZERO-HA- +   REQD. + + + + +Kulkarni, et al.            Standards Track                    [Page 16] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   If the Registration Request contains the Requested HA Extension, the +   FA uses that address as the destination for the relayed Registration +   Request. + +   Backward-compatibility issues related to the mobility agents are +   addressed in Section 10. + +5.3.  Home Agent Considerations + +   A home agent can process an incoming Registration Request in one of +   the following two ways: + +   1.  The MN or FA sends the Registration Request to the Requested HA. +       The term Requested HA has meaning in the context of a +       Registration Request message.  When the Requested HA successfully +       processes the Registration Request and creates a binding and +       sends a Reply with its address, it becomes the Assigned HA.  The +       term Assigned HA is meaningful in the context of a Registration +       Reply message. + +   2.  A home agent receiving a Registration Request with HA field set +       to ALL-ZERO-ONE-ADDR MAY reject the request even if successfully +       authenticated and suggest an alternate HA address in Reply.  In +       such a case, the HA puts its own address in HA field of Reply and +       sets the Reply code to REDIRECT-HA-REQ and adds the Redirected HA +       Extension. + +   If the Registration Request contains the Requested HA Extension, the +   HA address in that extension must match the destination IP of the +   Request.  If it does not match, the Requested HA MUST reject the +   Registration Request with error code 136. + +5.3.1.  Assigned Home Agent Considerations + +   The HA that processes the incoming Registration Request fully in +   accordance with Mobile IPv4 [1] and this specification becomes the +   Assigned HA.  The Registration Request terminates at the Assigned HA. + +   The Assigned HA creates one mobility binding per MN and sends the +   Registration Reply to the MN by copying its address in the Home Agent +   field and as the source IP address of the Reply. + +   The following table summarizes the behavior of the Assigned HA, based +   on the value of the destination IP address and Home Agent field of +   the Registration Request. + + + + + + +Kulkarni, et al.            Standards Track                    [Page 17] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   Dest IP Addr   HA field      Processing at Assigned HA +   ------------  ------------ ---------------------------------- + +   Unicast       non-unicast  Mobile IPv4 [1]: There is no change +                              in handling for this case from +   (Must be                   Mobile IPv4.  It is mentioned here +   equal to the               for reference only. +   HA receiving               HA denies the registration with +   the RRQ)                   error code 136 and sets HA field to +                              its own IP address in the reply as +                              per Section 3.8.3.2 in [1]. + + +                 ALL-ZERO-    New Behavior: Accept the RRQ as per +                 ONE-ADDR     this specification.  Authenticate +                              the RRQ and create mobility binding +                              if the HA is acting as Assigned HA. +                              Set HA field to its own IP address +                              in the Registration Reply. + +                                         OR + +                              New Behavior: If authentication is +                              successful, reject RRQ with a new +                              error code REDIRECT-HA-REQ.  HA +                              puts its address in HA address +                              field of Reject.  HA suggests an +                              alternate HA to use in the new +                              Redirected HA Extension. + +     Table 1: Registration Request Handling at Assigned HA + +   As per the messaging proposed here, the mobile node (or the foreign +   agent) sends the Registration Request to the Requested HA address, +   which is a unicast address.  Therefore, this document does not +   specify any new behavior for the case where the HA receives a subnet +   directed broadcast Registration Request as specified in Section +   3.8.2.1 of the Mobile IPv4 specification [1].  Although the Home +   Agent field in the Registration Request is not a unicast address, the +   destination IP address is a unicast address.  This avoids the problem +   associated with subnet-directed broadcast destination IP address that +   may result in multiple HAs responding.  Thus, there is no need to +   deny the registration as stated in Mobile IPv4 [1] Section 3.8.3.2. + +   When the destination IP address is a unicast address and the Home +   Agent field is ALL-ZERO-ONE-ADDR, the HA accepts/denies registration +   and sets the HA field to its own IP address in the reply (i.e., the +   registration is not rejected with error code 136). + + + +Kulkarni, et al.            Standards Track                    [Page 18] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   The HA can reject the request with the error code REDIRECT-HA-REQ and +   suggest an alternate HA.  This redirection can be used for load +   balancing, geographical proximity based on Care-of Address, or other +   reasons.  The HA puts its own address in the HA field of the +   Registration Reply message and puts the address of the redirected HA +   in the Redirected HA Extension.  If the HA accepts the Request, it +   sets the HA field in the Registration Reply to its own address. + +   The Requested HA always performs standard validity checks on the +   Registration Request.  If there is any error, the Registration +   Request is rejected with error codes specified in Mobile IPv4 [1]. + +6.  Requested Home Agent Selection + +   When dynamic HA assignment is requested, the MN (or FA in the case of +   registration via FA) sends the Registration Request to the Requested +   HA.  This address MUST be a unicast IP address.  If the MN has +   included a Requested HA Extension in the Registration Request, the HA +   address in this extension is the Requested HA. + +   Some examples of methods by which the MN or the FA may select the +   Requested HA are briefly described below: + +   DHCP: + +      The MN performs DHCP to obtain an IP address on the visited +      network.  The Requested HA is learned from the DHCP Mobile IP Home +      Agent Option 68 [4].  The MN sends the Registration Request +      directly to this HA and receives the Assigned HA to be used for +      the remainder of the Mobile IP session. + +   AAA: + +      MN performs challenge/response [5] with the FA.  The FA retrieves +      the Requested HA from the AAA server and forwards the Registration +      Request directly to this HA.  The Assigned HA sends a Registration +      Reply to the FA, which relays it to the MN.  MN uses the Assigned +      HA for the remainder of the Mobile IP session. + +   DNS: + +      In this case, the hostname of the HA is configured on the MN or +      obtained by some other means, e.g., using a service location +      protocol.  The MN performs DNS lookup on the HA hostname.  The DNS +      infrastructure provides a resource record with information to +      identify the optimal HA to the MN.  The MN sends a Registration +      Request directly to the HA and receives the Assigned HA to be used +      for the remainder of the Mobile IP session. + + + +Kulkarni, et al.            Standards Track                    [Page 19] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   Static configuration: + +      The HA address is statically configured on the MN.  The MN sends +      the Registration Request to the configured address.  The Requested +      HA may then redirect the MN to a Redirected HA. + +7.  Error Values + +   Each entry in the following table contains the name and value for the +   error code to be returned in a Registration Reply.  It also includes +   the section in which the error code is first mentioned in this +   document. + +   Error Name       Value  Section  Description +   ---------------  -----  -------  ----------------------------- +   NONZERO-HA-REQD   90     5.2     Non-zero HA address required +                                    in Registration Request. +   REDIRECT-HA-REQ   143    5.3     Re-register with redirected HA. + +8.  IANA Considerations + +   The code value NONZERO-HA-REQD is a Mobile IP response code [1] taken +   from the range of values associated with rejection by the foreign +   agent (i.e., value in the range 64-127). + +   The code value REDIRECT-HA-REQ is a Mobile IP response code [1] taken +   from the range of values associated with rejection by the home agent +   (i.e., value in the range 128-192). + +   The Dynamic HA Extension is assigned from the range of values +   associated with skippable extensions at the home agent (i.e., value +   in the range 128-255). + +   IANA has recorded the values as defined in Sections 7 and 3.4. + +9.  Security Considerations + +   This specification assumes that a security configuration has been +   preconfigured between the MN and the HA or is configured along with +   the initial Registration Request/Registration Reply as per [7]. + +   There is a possibility of more than one HA creating a mobility +   binding entry for a given MN, if a man in the middle captures the +   Registration Request with the HA field set to ALL-ZERO-ONE-ADDR and +   forwards it to other HAs.  This scenario assumes that the rogue node +   can find out the addresses of the HAs that are able to authenticate +   the Registration Request.  It also assumes that the rogue node has +   the capability to store, duplicate, and send packets to the other HAs + + + +Kulkarni, et al.            Standards Track                    [Page 20] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   within the limited time of the replay window.  Otherwise, these HAs +   will reject the Registration Requests anyway.  In addition, this type +   of attack is only possible when the Requested HA Extension is not +   included in the registration message.  The mobile node can minimize +   the duration of this condition by using a short lifetime (e.g., 5 +   seconds) in the Registration Request. + +   This specification does not change the security model established in +   Mobile IPv4 [1].  Mobile nodes are often connected to the network via +   wireless links, which may be more prone to passive eavesdropping or +   replay attacks.  Such an attack might lead to bogus registrations or +   redirection of traffic or denial of service. + +   As per the messaging in this document, the Assigned Home Agent will +   process the incoming Registration Request as per Mobile IPv4 [1]. +   Hence the Assigned Home Agent will have the same security concerns as +   those of the home agent in Mobile IPv4 [1].  They are addressed in +   Section 5, "Security Considerations", of Mobile IPv4 [1]. + +   The Registration Request and Registration Reply messages are +   protected by a valid authenticator as specified in Mobile IPv4 [1]. +   Configuring security associations is a deployment-specific issue and +   is covered by other Mobile IP specifications.  There can be many ways +   of configuring security associations, but this specification does not +   require any specific way. + +   An example is where the security association between an MN and an +   individual HA (Requested or Assigned) is dynamically derived during +   the registration process based on a shared secret between MN and AAA +   infrastructure, as defined in [7].  The Registration Request is +   protected with MN-AAA Authentication Extension, and Registration +   Reply is protected with MN-HA Authentication Extension.  Because the +   security association is shared between MN and AAA, any dynamically +   assigned HA in the local domain can proxy authenticate the MN using +   AAA as per [7]. + +   The Assigned Home Agent authenticates each Registration Request from +   the mobile node as specified in Mobile IPv4 [1] and/or RFC 3012.  The +   MN also authenticates the Registration Reply from the Assigned HA; +   thus, the existing trust model in Mobile IPv4 [1] is maintained. + +10.  Backward-Compatibility Considerations + +   In this section, we examine concerns that may arise when using this +   specification in a mixed environment where some nodes implement the +   specification and others do not.  In each of the examples below, we +   consider the case where one node is a "legacy" node, which does not +   implement the specification in the context of other nodes that do. + + + +Kulkarni, et al.            Standards Track                    [Page 21] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +   Legacy Home Agent: + +   Legacy home agents may reject the Registration Request with error +   code 136 because the Home Agent field is not a unicast address. +   However, some legacy HA implementations may coincidentally process +   the Registration Request in accordance with this document, when the +   HA field in Registration Request is set to ALL-ZERO-ONE-ADDR. + +   Legacy Foreign Agent: + +   Legacy foreign agents may forward a Registration Request with home +   agent field set to ALL-ZERO-ONE-ADDR by setting the destination IP +   address to ALL-ZERO-ONE-ADDR.  This will result in the packet being +   dropped or incidentally handled by a next-hop HA, adjacent to the FA. +   The MN may not be aware of the dropped Registration Request and may +   probably retry registration, thereby increasing the delay in +   registration. + +   To reduce the delay in registration, the MN should take the following +   steps: + +   1.  The MN should send the Registration Request as specified in this +       specification.  In other words, the MN should set the Home Agent +       field in the Registration Request to ALL-ZERO-ONE-ADDR and also +       add the Requested HA Extension. + +   2.  If the MN does not receive a Registration Reply within some time +       and/or after sending a few Registration Requests, it can assume +       that the Registration Request(s) has been dropped, either by a +       legacy FA or an incorrect HA.  In addition, if the registration +       is denied with error code 70 (poorly formed Request), the MN can +       assume that the legacy FA cannot process this message.  In either +       case, the MN should fall back to a recovery mechanism.  The MN +       should quickly send a new Registration Request as mentioned in +       Section 4.1 step 2.  This step will ensure that a legacy FA will +       forward the Registration Request to the home agent thereby making +       dynamic HA assignment possible. + +   Legacy Mobile Node: + +   An MN that sends a Registration Request to an FA that can do dynamic +   HA assignment, but does not set the HA field to ALL-ZERO-ONE-ADDR +   will continue to be registered with its statically configured HA, +   exactly according to RFC 3344. + + + + + + + +Kulkarni, et al.            Standards Track                    [Page 22] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +11.  Acknowledgements + +   The authors would like to thank Pete McCann for thorough review, +   suggestions on security considerations, and definition of ALL-ZERO- +   ONE-ADDR.  Thanks to Kuntal Chowdhury for extensive review and +   comments on this document.  Also thanks to Henrik Levkowetz for +   detailed reviews and suggestions.  Thomas Narten highlighted issues +   for legacy FA considerations.  Thanks to Ahmad Muhanna for pointing +   out scenario of multiple bindings on HAs, documented in the Security +   Considerations section. + +   The authors would like to thank Mike Andrews, Madhavi Chandra, and +   Yoshi Tsuda for their review and suggestions. + +12.  Normative References + +   [1]  Perkins, C., "IP Mobility Support for IPv4", RFC 3344, August +        2002. + +   [2]  Calhoun, P. and C. Perkins, "Mobile IP Network Access Identifier +        Extension for IPv4", RFC 2794, March 2000. + +   [3]  Senie, D., "Changing the Default for Directed Broadcasts in +        Routers", BCP 34, RFC 2644, August 1999. + +   [4]  Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor +        Extensions", RFC 2132, March 1997. + +   [5]  Perkins, C. and P. Calhoun, "Mobile IPv4 Challenge/Response +        Extensions", RFC 3012, November 2000. + +   [6]  Bradner, S., "Key words for use in RFCs to Indicate Requirement +        Levels", BCP 14, RFC 2119, March 1997. + +   [7]  Perkins, C. and P. Calhoun, "Authentication, Authorization, and +        Accounting (AAA) Registration Keys for Mobile IPv4", RFC 3957, +        March 2005. + + + + + + + + + + + + + + +Kulkarni, et al.            Standards Track                    [Page 23] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +Authors' Addresses + +   Milind Kulkarni +   Cisco Systems Inc. +   170 W.  Tasman Drive, +   San Jose, CA 95134 +   USA + +   Phone: +1 408-527-8382 +   EMail: mkulkarn@cisco.com + + +   Alpesh Patel +   Cisco Systems Inc. +   170 W.  Tasman Drive, +   San Jose, CA 95134 +   USA + +   Phone: +1 408-853-9580 +   EMail: alpesh@cisco.com + + +   Kent Leung +   Cisco Systems Inc. +   170 W.  Tasman Drive, +   San Jose, CA 95134 +   USA + +   Phone: +1 408-526-5030 +   EMail: kleung@cisco.com + + + + + + + + + + + + + + + + + + + + + +Kulkarni, et al.            Standards Track                    [Page 24] + +RFC 4433                 Dynamic HA Assignment                March 2006 + + +Full Copyright Statement + +   Copyright (C) The Internet Society (2006). + +   This document is subject to the rights, licenses and restrictions +   contained in BCP 78, and except as set forth therein, the authors +   retain all their rights. + +   This document and the information contained herein are provided on an +   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS +   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET +   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, +   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE +   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED +   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + +   The IETF takes no position regarding the validity or scope of any +   Intellectual Property Rights or other rights that might be claimed to +   pertain to the implementation or use of the technology described in +   this document or the extent to which any license under such rights +   might or might not be available; nor does it represent that it has +   made any independent effort to identify any such rights.  Information +   on the procedures with respect to rights in RFC documents can be +   found in BCP 78 and BCP 79. + +   Copies of IPR disclosures made to the IETF Secretariat and any +   assurances of licenses to be made available, or the result of an +   attempt made to obtain a general license or permission for the use of +   such proprietary rights by implementers or users of this +   specification can be obtained from the IETF on-line IPR repository at +   http://www.ietf.org/ipr. + +   The IETF invites any interested party to bring to its attention any +   copyrights, patents or patent applications, or other proprietary +   rights that may cover technology that may be required to implement +   this standard.  Please address the information to the IETF at +   ietf-ipr@ietf.org. + +Acknowledgement + +   Funding for the RFC Editor function is provided by the IETF +   Administrative Support Activity (IASA). + + + + + + + +Kulkarni, et al.            Standards Track                    [Page 25] + |