Re: [Dime] [HOKEY] DiME ERP: new Application ID or not ?(non-roaming case)

[Qin Wu <sunseawq at huawei.com>]

Hi, Hannes:
Thank for your reply. please see inline.
-Qin
----- Original Message ----- 
From: "Hannes Tschofenig" <Hannes.Tschofenig at gmx.net>
To: "'Qin Wu'" <sunseawq at huawei.com>; "'Julien Bournelle'" <julien.bournelle at gmail.com>
Cc: "'Glen Zorn'" <glenzorn at comcast.net>; <dime at ietf.org>; <hokey at ietf.org>
Sent: Thursday, March 12, 2009 6:07 PM
Subject: RE: [HOKEY] [Dime] DiME ERP: new Application ID or not ?(non-roaming case)


> Hi Qin, 
> 
>>Hi:
>>If my understanding is correct, the ERP re-authentication with 
>>a AAA server through a Hokey server will happen in the intial 
>>EAP exchange or in  the bootstrapping phase.
> 
> If I understood Glen correctly so far then this is not the model. 
> The Diameter (or RADIUS signaling for that matter) messages are not routed
> through the HOKEY server but the AAA entities interact with the HOKEY
> server(s) using some other protocol mechanism. To me that sounded like a
> reasonable approach. 

[Qin]  I agree it is a good way to make AAA entities interact with Hokey server using existing mechanism.
As regarding whether hokey server can be viewed as proxy AAA or an independent ER server, I am not sure. Maybe this is what DiME ERP 
needs to find out or define.

>>e.g., when the peer firstly enter into one visited AAA domain 
>>away from the home AAA server, intial EAP exchange between the 
>>peer and home AAA server is required.
> 
> Are you talking now about the regular Diameter EAP exchange. 

[Qin]  It is not regualr Diameter EAP exchange but ERP for intial EAP exchange.
As regarding ERP for intial EAP exchange, please refer to the figure 3 of RFC5296.

>>  However when the peer 
>>move between two adjacent authenticator within the same AAA 
>>domain,  the ERP re-authentication does not happen with a AAA 
>>server but with a local hokey server which is a optimized 
>>approach to reduce handoff latency.
> Currently, this is the HOKEY re-authentication exchange. 

[Qin] You understanding is correct.

> Ciao
> Hannes
> 
>>
>>Best Regards!
>>-Qin
>>----- Original Message -----
>>From: "Hannes Tschofenig" <Hannes.Tschofenig at gmx.net>
>>To: "'Julien Bournelle'" <julien.bournelle at gmail.com>; "'Qin 
>>Wu'" <sunseawq at huawei.com>
>>Cc: "'Glen Zorn'" <glenzorn at comcast.net>; <dime at ietf.org>; 
>><hokey at ietf.org>
>>Sent: Thursday, March 12, 2009 5:13 PM
>>Subject: RE: [HOKEY] [Dime] DiME ERP: new Application ID or 
>>not ?(non-roaming case)
>>
>>
>>> 
>>>> 1/ re-uses full EAP authentication with Diameter EAP
>>> 
>>>> 2/ perform a reauthentication using ERP.
>>> 
>>>> If we use 2/, and we have a new Diameter ERP app-id, a 
>>>>distinct AAA server may be reached. 
>>> 
>>> If I understood Glen correctly from previous conversations 
>>then the Diameter
>>> ERP re-authentication does not happen with a AAA server but 
>>with a HOKEY
>>> server. Hence, I am not sure that there is an issue. 
>>> 
>>> Ciao
>>> Hannes
>>>
>>
>