[Mip4] Issue #45; Seeking closure for on deregistration with FHAE

[Kent Leung <kleung at cisco.com>]

Hi folks.

I'll try to summarize to see if we can reach some closure on this
issue.

This is the scenario when the problem is encountered.

MN is registered to the HA and moves to a new FA.  The new FA
is somehow misconfigured with the wrong SA with the MN's HA.
This invalid SA means that any registration between FA and HA
will not work because authentication fails.  Just to note that if the
SA is valid or if there is no SA, then everything works fine.

The issue arises when MN deregisters on the new FA which has
an invalid SA with the HA.  The deregistration will not work.

I've maintained that in this scenario, MN will not be able to register
as well.  So it's a configuration error that needs to be fixed as
the security relationship between FA and HA should be upheld.
The FA is configured with FHAE and always add extension to
the RRQ directed to the HA.  HA always authenticate FHAE.  The
security logic is clear, authentication of message exchange between
FA and HA are provided when FHAE service is configured or set.

Charlie feels that this deregistration has nothing to do with the FA
so should not be prevented due to some misconfiguration on the
FA or HA.  To get around the security relationship, check certain
fields such as lifetime, care-of address, D-bit, etc. on the FA
(to decide if FHAE should be added) and HA to figure out the
intent of the RRQ.

Since I get to summarize, I'll add one more point.  :)  I believe that
we should be fine with specification that is simple and clear
for security relationship between FA and HA.  And if real deployment
problem is encountered by operators/customers, _then_ we can
add more logic to support specific scenario.  For now, please just
keep it straightforward.  Thanks.

Kent
--
     |           |                   Kent Leung
    :|:         :|:                  IP Mobility Development
   :|||:       :|||:                 Internet Technologies Division
  :|||||||:   :|||||||:              Voice: 408.526.5030
.:|||||||||:.:|||||||||:.             Fax:   408.525.1653
 c i s c o S y s t e m s             Email: kleung at cisco.com

--
Mip4 mailing list: Mip4 at ietf.org
   Web interface: https://www1.ietf.org/mailman/listinfo/mip4
    Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/