idnits 2.17.1 draft-ietf-netext-radius-pmip6-08.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (January 31, 2012) is 4468 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 4282 (Obsoleted by RFC 7542) ** Obsolete normative reference: RFC 3588 (Obsoleted by RFC 6733) Summary: 2 errors (**), 0 flaws (~~), 1 warning (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 netext F. Xia 3 Internet-Draft B. Sarikaya 4 Intended status: Standards Track Huawei USA 5 Expires: August 3, 2012 J. Korhonen, Ed. 6 Nokia Siemens Networks 7 S. Gundavelli 8 Cisco 9 D. Damic 10 Siemens 11 January 31, 2012 13 RADIUS Support for Proxy Mobile IPv6 14 draft-ietf-netext-radius-pmip6-08 16 Abstract 18 This document defines new attributes to facilitate Proxy Mobile IPv6 19 operations using the RADIUS infrastructure. The protocol defined in 20 this document uses Radius based interfaces of the mobile access 21 gateway and the local mobility anchor with the AAA server for 22 authentication, authorization and policy functions. The RADIUS 23 interactions between the mobile access gateway and the RADIUS-based 24 AAA server take place when the Mobile Node attaches, authenticates 25 and authorizes to a Proxy Mobile IPv6 domain. Furthermore, this 26 document defines the RADIUS-based interface between the local 27 mobility anchor and the AAA RADIUS server for authorizing received 28 Proxy Binding Update messages for the mobile node's mobility session. 29 In addition to the mobility session setup related interactions, this 30 document defines the baseline for the mobile access gateway and the 31 local mobility anchor generated accounting. 33 Status of this Memo 35 This Internet-Draft is submitted in full conformance with the 36 provisions of BCP 78 and BCP 79. 38 Internet-Drafts are working documents of the Internet Engineering 39 Task Force (IETF). Note that other groups may also distribute 40 working documents as Internet-Drafts. The list of current Internet- 41 Drafts is at http://datatracker.ietf.org/drafts/current/. 43 Internet-Drafts are draft documents valid for a maximum of six months 44 and may be updated, replaced, or obsoleted by other documents at any 45 time. It is inappropriate to use Internet-Drafts as reference 46 material or to cite them other than as "work in progress." 48 This Internet-Draft will expire on August 3, 2012. 50 Copyright Notice 52 Copyright (c) 2012 IETF Trust and the persons identified as the 53 document authors. All rights reserved. 55 This document is subject to BCP 78 and the IETF Trust's Legal 56 Provisions Relating to IETF Documents 57 (http://trustee.ietf.org/license-info) in effect on the date of 58 publication of this document. Please review these documents 59 carefully, as they describe your rights and restrictions with respect 60 to this document. Code Components extracted from this document must 61 include Simplified BSD License text as described in Section 4.e of 62 the Trust Legal Provisions and are provided without warranty as 63 described in the Simplified BSD License. 65 Table of Contents 67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 68 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 69 3. Solution Overview . . . . . . . . . . . . . . . . . . . . . . 5 70 4. Attribute definitions . . . . . . . . . . . . . . . . . . . . 9 71 4.1. MIP6-Feature-Vector . . . . . . . . . . . . . . . . . . . 9 72 4.2. Mobile-Node-Identifier . . . . . . . . . . . . . . . . . . 10 73 4.3. Service-Selection . . . . . . . . . . . . . . . . . . . . 11 74 4.4. PMIP6-Home-LMA-IPv6-Address . . . . . . . . . . . . . . . 12 75 4.5. PMIP6-Visited-LMA-IPv6-Address . . . . . . . . . . . . . . 13 76 4.6. PMIP6-Home-LMA-IPv4-Address . . . . . . . . . . . . . . . 14 77 4.7. PMIP6-Visited-LMA-IPv4-Address . . . . . . . . . . . . . . 15 78 4.8. PMIP6-Home-HN-Prefix . . . . . . . . . . . . . . . . . . . 16 79 4.9. PMIP6-Visited-HN-Prefix . . . . . . . . . . . . . . . . . 17 80 4.10. PMIP6-Home-Interface-ID . . . . . . . . . . . . . . . . . 19 81 4.11. PMIP6-Visited-Interface-ID . . . . . . . . . . . . . . . . 19 82 4.12. PMIP6-Home-IPv4-HoA . . . . . . . . . . . . . . . . . . . 20 83 4.13. PMIP6-Visited-IPv4-HoA . . . . . . . . . . . . . . . . . . 21 84 4.14. PMIP6-Home-DHCP4-Server-Address . . . . . . . . . . . . . 22 85 4.15. PMIP6-Visited-DHCP4-Server-Address . . . . . . . . . . . . 23 86 4.16. PMIP6-Home-DHCP6-Server-Address . . . . . . . . . . . . . 24 87 4.17. PMIP6-Visited-DHCP6-Server-Address . . . . . . . . . . . . 24 88 4.18. Calling-Station-Id . . . . . . . . . . . . . . . . . . . . 25 89 4.19. Chargeable-User-Identity . . . . . . . . . . . . . . . . . 25 90 5. MAG to RADIUS AAA interface . . . . . . . . . . . . . . . . . 26 91 5.1. Interface operations . . . . . . . . . . . . . . . . . . . 26 92 5.2. Table of Attributes . . . . . . . . . . . . . . . . . . . 27 93 6. LMA to RADIUS AAA interface . . . . . . . . . . . . . . . . . 28 94 6.1. Interface operations . . . . . . . . . . . . . . . . . . . 28 95 6.2. Table of Attributes . . . . . . . . . . . . . . . . . . . 29 96 7. Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . 31 97 7.1. Accounting at LMA . . . . . . . . . . . . . . . . . . . . 31 98 7.2. Accounting at MAG . . . . . . . . . . . . . . . . . . . . 31 99 7.3. Table of Attributes . . . . . . . . . . . . . . . . . . . 31 100 8. Security Considerations . . . . . . . . . . . . . . . . . . . 33 101 9. IANA consideration . . . . . . . . . . . . . . . . . . . . . . 33 102 9.1. Attribute Type Codes . . . . . . . . . . . . . . . . . . . 33 103 9.2. Namespaces . . . . . . . . . . . . . . . . . . . . . . . . 34 104 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 34 105 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 35 106 11.1. Normative References . . . . . . . . . . . . . . . . . . . 35 107 11.2. Informative references . . . . . . . . . . . . . . . . . . 35 108 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 36 110 1. Introduction 112 Proxy Mobile IPv6 (PMIPv6) [RFC5213] is a network-based mobility 113 management protocol which allows IP mobility support for a mobile 114 node without requiring the mobile node's participation in any 115 mobility-related signaling. The mobile management elements in the 116 network, the mobile access gateway (MAG) and the local mobility 117 anchor (LMA) are the two key functions in this network-based mobility 118 system. The mobile access gateway is responsible for detecting the 119 mobile node's movements in the network and for initiating the needed 120 mobility management signaling with the local mobility anchor (LMA). 121 Both the mobility management agents make use of the AAA 122 infrastructure to retrieve the mobile node's Policy Profile and for 123 performing service authorization. 125 This document defines a RADIUS-based [RFC2865] profile and 126 corresponding attributes to be used on the AAA interface between the 127 MAG and the AAA RADIUS server. This interface is used to carry the 128 per-MN Policy Profile from the remote Policy Store to the MAG. 129 Furthermore, this document also defines a RADIUS-based interface 130 between the LMA and the AAA RADIUS server for authorization of the 131 received Proxy Mobile IPv6 signaling messages. The AAA procedures 132 defined in this document cover the following two scenarios: 134 o a mobile node connects to the Proxy Mobile IPv6 domain from the 135 home network 137 o a mobile node connects to the Proxy Mobile IPv6 domain from a 138 visited network 140 2. Terminology 142 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 143 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 144 document are to be interpreted as described in [RFC2119]. 146 All the mobility related terms used in this document are to be 147 interpreted as defined in the Proxy Mobile IPv6 specification 148 [RFC5213] and [RFC5844]. Additionally, this document uses the 149 following abbreviations: 151 Network Access Server (NAS): 153 A function that provides authorization services for a device/user 154 access to the network as defined in [RFC2865]. This document 155 makes an assumption that the NAS function is co-located with the 156 MAG. In scenarios where the NAS function and MAG are decoupled, 157 the messaging interface needed between them for the operation of 158 PMIP6 is beyond the scope of this document. 160 Home AAA (HAAA): 162 An Authentication, Authorization, and Accounting (AAA) server 163 located in MN's home network. This sever has access to the mobile 164 node's policy profiles. 166 Visited AAA (VAAA): 168 An Authentication, Authorization, and Accounting (AAA) server 169 located in MN's visited network. The VAAA server takes the role 170 of a proxy-server, forwarding the received AAA service request to 171 the HAAA server in the mobile node's home network and relaying the 172 response to the requesting node, after applying any local access 173 network policies. 175 3. Solution Overview 177 This document defines the RADIUS-based AAA interactions with the two 178 mobility management elements in the Proxy Mobile IPv6 domain. 180 o Interactions between a MAG and a RADIUS-based AAA Server 181 o Interactions between a LMA and a RADIUS-based AAA Server 183 The mobile node's Policy Profile [RFC5213] is present in a policy 184 store and is needed by the PMIPv6 mobility management elements for 185 authorizing the mobile node for mobility management service and for 186 obtaining various service related parameters. This policy store 187 could be locally collocated with the mobility management agents 188 enabling direct local access, or could be available from a AAA server 189 through a RADIUS-based AAA interface. 191 When a mobile node attaches to an access network, the NAS on that 192 access network may activate the network access authentication 193 procedure. The choice of the authentication mechanism is specific to 194 the access network deployment, however it is typically based on the 195 Extensible Authentication Protocol (EAP) [RFC3748]. The NAS performs 196 the network access authentication and queries the HAAA using AAA 197 protocol, such as RADIUS. If the network access authentication 198 succeeds, the MN's Policy Profile is obtained as part of the RADIUS 199 message exchange with the AAA server. 201 The mobile node may be an IPv4-only node, IPv6-only node, or a dual- 202 stack (IPv4/v6) node. Based on the policy specified in the Policy 203 Profile, the network access authentication procedure SHOULD provide 204 the unambiguous indication of the type of address(es) to be assigned 205 for the MN in the network and with all other service related and 206 policy parameters relevant to the mobility service. 208 After the successful network access authentication and obtaining the 209 mobile node's Policy Profile, the MAG sends a Proxy Binding Update 210 (PBU) to the LMA. Upon receiving the PBU, the LMA interacts with the 211 HAAA for obtaining the mobile node's Policy Profile, which is 212 required for authorizing and activating mobility service. 214 This document adds support for three distinct PMIPv6 mobility use 215 cases, taking into account the administrative domains to which the 216 MAG and the LMA belong to. The following are the three relevant 217 deployment models. 219 1. the MAG and LMA are both in the home network, 220 2. the MAG and LMA are both in the visited network 221 3. the MAG is in the visited network while the LMA is in the home 222 network. 224 Figure 1 shows participating network entities for the PMIPv6 mobility 225 session which is located in the home network. The MAG and LMA 226 interact only with the HAAA. 228 +--------+ 229 | HAAA & | RADIUS +-----+ 230 | Policy |<-------->| LMA | 231 | Profile| +-----+ 232 +--------+ | <--- LMA-Address 233 ^ | 234 | // \\ 235 +---|------------- //---\\----------------+ 236 ( | IPv4/IPv6 // \\ ) 237 ( | Network // \\ ) 238 +---|-----------//---------\\-------------+ 239 | // \\ 240 RADIUS // <- Tunnel1 \\ <- Tunnel2 241 | // \\ 242 | |- MAG1-Address |- MAG2-Address 243 | +----+ +----+ 244 +---->|MAG1| |MAG2| 245 +----+ +----+ 246 | | 247 | | 248 MN1 MN2 250 Figure 1: The MAG and LMA are both in the home network 252 Figure 2 shows both the LMA and MAG are in the visited network. The 253 MAG and LMA exchange signaling with the HAAA through the VAAA which 254 acts as a Proxy. The visited network may append additional 255 information to the HAAA replies in order to reflect the local policy. 257 +---------------+ 258 | HAAA & | 259 +----------| Policy Profile| 260 | +---------------+ 261 | 262 +--------+ 263 | VAAA & | RADIUS +-----+ 264 | Policy |<-------->| LMA | 265 | Profile| +-----+ 266 +--------+ | <--- LMA-Address 267 ^ // \\ 268 +---|------------- //---\\----------------+ 269 ( | IPv4/IPv6 // \\ ) 270 ( | Network // \\ ) 271 +---|-----------//---------\\-------------+ 272 | // \\ 273 RADIUS // <- Tunnel1 \\ <- Tunnel2 274 | // \\ 275 | |- MAG1-Address |- MAG2-Address 276 | +----+ +----+ 277 +---->|MAG1| |MAG2| 278 +----+ +----+ 279 | | 280 MN1 MN2 282 Figure 2: The MAG and LMA are both in the visited network 284 Figure 3 illustrates a topology where the MAG resides in the visited 285 network while the associated LMA is in MN's home network. Any 286 message between the MAG and the HAAA passes through the VAAA that 287 acts as a Proxy. During the network authentication, the visited 288 network's specific policy may also be propagated from the VAAA to the 289 MAG. The LMA has a direct access to the HAAA. 291 +---------------+ 292 | HAAA & | 293 +----------| Policy Profile| 294 | +---------------+ 295 | | 296 | RADIUS 297 +--------+ | 298 | VAAA & | +-----+ 299 | Policy | | LMA | 300 | Profile| +-----+ 301 +--------+ | <--- LMA-Address 302 ^ // \\ 303 +---|------------- //---\\----------------+ 304 ( | IPv4/IPv6 // \\ ) 305 ( | Network // \\ ) 306 +---|-----------//---------\\-------------+ 307 | // \\ 308 RADIUS // <- Tunnel1 \\ <- Tunnel2 309 | // \\ 310 | |- MAG1-Address |- MAG2-Address 311 | +----+ +----+ 312 +---->|MAG1| |MAG2| 313 +----+ +----+ 314 | | 315 MN1 MN2 317 Figure 3: Visited MAG and home LMA topology 319 4. Attribute definitions 321 4.1. MIP6-Feature-Vector 323 Diameter [RFC3588] reserves AVP Code space 1-255 as RADIUS attribute 324 compatibility space. The MIP6-Feature-Vector attribute (Type value 325 124) defined in [RFC5447] is of type OctetString and contains a 64 326 bit flags field of supported mobility capabilities. This document 327 reserves two new capability bits according to the rules in [RFC5447], 328 and reuses the PMIPv6 capability bits defined by [RFC5779]. The 329 following capability flag bits are used or defined in this document: 331 PMIP6_SUPPORTED (0x0000010000000000) 333 This capability bit is used as defined in [RFC5779]. 335 IP4_HOA_SUPPORTED (0x0000020000000000) 337 This capability bit is used as defined in [RFC5779]. Assignment 338 of the IPv4-HoA is defined by [RFC5844]. 340 LOCAL_MAG_ROUTING_SUPPORTED (0x0000040000000000) 342 This capability bit is used as defined in [RFC5779]. 344 IP4_TRANSPORT_SUPPORTED (TBD17) 346 This capability bit is used for negotiation of the IPv4 transport 347 support between the MAG and AAA. When the MAG sets this flag bit 348 in the MIP6-Feature-Vector, it indicates ability of the MAG to 349 provide IPv4 transport (i.e., IPv4-based encapsulation) for 350 carrying IP traffic between the MAG and the LMA. If this flag bit 351 is unset in the returned MIP6-Feature-Vector attribute, the AAA 352 does not authorize the use of IPv4 transport on the MAG-to-LMA 353 tunnel. 355 IP4_HOA_ONLY_SUPPORTED (TBD18) 357 This capability bit is used for determination of the authorized 358 PMIPv6 mobility mode. When this bit is set by the AAA it 359 indicates PMIPv6 mobility with IPv4 support has only been 360 authorized for the MN. As a result, the RADIUS Access-Accept 361 SHOULD NOT carry the IPv6 Home Network Prefix (IPv6 HNP). When 362 this bit is set the PMIP6_SUPPORTED flag MUST also be set, and the 363 IP4_HOA_SUPPORTED flag MUST NOT be set. 365 The MIP6-Feature-Vector attribute is also used on the LMA to the 366 RADIUS AAA interface. This capability announcement attribute enables 367 direct capability negotiation between the LMA and the AAA. The 368 capabilities that are announced by both parties in the MIP6-Feature- 369 Vector are known to be mutually supported. The LMA may use this 370 mechanism during authorization of the received PBU against the AAA to 371 check individual PMIPv6 feature permissions for a particular MN. 373 If the RADIUS Access-Accept contains contradicting combination of the 374 capability flag bits such as both the PMIP6_SUPPORTED and the 375 IP4_HOA_SUPPORTED flags are set, then the RADIUS client MUST treat 376 the Access-Accept as an Access-Reject and SHOULD log the event. 377 Similarly, if the RADIUS Access-Request contains contradicting 378 combination of the capability flag bits, then the RADIUS server MUST 379 reply with an Access-Reject message and SHOULD log the event. 381 4.2. Mobile-Node-Identifier 383 The Mobile-Node-Identifier attribute (Type value TBD1) is of type 384 String and contains the mobile node identifier (MN-Identifier), see 385 [RFC5213]), in a form of a Network Access Identifier (NAI) [RFC4282]. 386 This identifier and the identifier used for access authentication may 387 be different, however, there needs to be a mapping between the two 388 identities as specified in Section 6.6 of [RFC5213]) This attribute 389 is used on the interface between MAG and the AAA server. The Mobile- 390 Node-Identifier attribute is designed for deployments where the 391 identity used during Network Access Authentication and the identity 392 used for mobility management is decoupled. It may also be the case 393 where the MAG does not have means to find out the MN identity that 394 could be used in subsequent PBU and Proxy Binding Acknowledgement 395 (PBA) exchanges (e.g., due to identity hiding during the network 396 access authentication) or when the HAAA wants to assign periodically 397 changing identities to the MN. 399 The Mobile-Node-Identifier attribute MAY be returned by HAAA in the 400 RADIUS Access-Accept message that completes a successful 401 authentication and authorization exchange between the MAG and the 402 HAAA. The MAG MUST use the received MN-Identifier. 404 0 1 2 3 405 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 406 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 407 | Type | Length | Mobile Node Identifier... ~ 408 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 410 Type: 411 Mobile-Node-Identifier TBD1. 413 Length: 414 In octets, including Type and Length fields (>= 3). 416 Mobile Node Identifier: 417 This field is of type String and contains the MN-Identifier 418 of the MN to be used in the PBU/PBA exchange. 420 4.3. Service-Selection 422 The Service-Selection attribute (Type value TBD2) is of type UTF-8 423 text and contains the name of the service or the external network 424 that the mobility service for the particular MN SHOULD be associated 425 with [RFC5149]. The identifier MUST be unique within the PMIPv6 426 Domain when normalized using the selected normalization form 427 [unicode] for the particular PMIPv6 Domain deployment. For instance, 428 [RFC5149] uses the Normalization Form KC (NFKC). 430 The MAG MUST include the Service-Selection attribute in the Access- 431 Request sent to the AAA if the information was acquired, e.g. by 432 operator-specific configuration. The AAA MAY include the Service- 433 Selection attribute in the Access-Accept response message to the MAG 434 even if it was not included in the Access-Request as a means of 435 indicating the MN's default service. 437 The service-selection mobility option defined in [RFC5149] can be 438 used in PBU/PBA messages between the MAG and LMA. On the LMA-to-AAA 439 interface, the LMA MAY populate the Service-Selection attribute in 440 the Access-Request message using the service information found in the 441 received PBU, if such mobility option was included. The Service- 442 Selection identifier should be used to assist the PBU authorization, 443 the assignment of the MN-HNP and the IPv4-MN-HoA as described in 444 [RFC5149] and [RFC5779]. 446 0 1 2 3 447 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 448 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 449 | Type | Length | Service Identifier... ~ 450 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 452 Type: 453 Service-Selection TBD2. 455 Length: 456 In octets, including Type and Length fields (>= 3). 458 Text: 459 This field is of type UTF-8 text and contains the Service 460 Identifier the MN is associated with. 462 4.4. PMIP6-Home-LMA-IPv6-Address 464 The PMIP6-Home-LMA-IPv6-Address attribute (Type value TBD3) is of 465 type IPv6 address and is used to deliver the IPv6 address of the LMA 466 located in the Home network. 467 Before the MAG can initiate Proxy Mobile IPv6 signaling it must be 468 aware of the LMA's IP address. 470 When the LMA is assigned to the MN from the home network, this 471 attribute MAY be sent by the HAAA to the MAG in the RADIUS Access- 472 Accept message. 474 0 1 2 3 475 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 476 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 477 | Type | Length | Home LMA IPv6 address 478 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 479 Home LMA IPv6 address 480 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 481 Home LMA IPv6 address 482 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 483 Home LMA IPv6 address 484 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 485 Home LMA IPv6 address | 486 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 488 Type: 489 PMIP6-Home-LMA-IPv6-Address TBD3. 491 Length: 492 = 18 octets 494 Home LMA IPv6 address: 495 128-bit IPv6 address of the assigned home LMA IPv6 address. 497 4.5. PMIP6-Visited-LMA-IPv6-Address 499 The PMIP6-Visited-LMA-IPv6-Address attribute (Type value TBD4) is of 500 type IPv6 address and is used to propose a particular LMA in the 501 Visited network, and to authorize the use of the LMA in the Visited 502 network. 504 PMIP6-Visited-LMA-IPv6-Address attribute MAY be included by the MAG 505 to the VAAA entity in the RADIUS Access-Request message. It enables 506 the MAG to request an LMA in the visited network. The LMA in the 507 visited network may be assigned by the visited AAA as the result of 508 retrieved Policy Profile. If included by the VAAA in the RADIUS 509 Access-Accept sent to the MAG, the use of the LMA in the visited 510 network is authorized and the attribute SHALL carry the IPv6 address 511 of the visited LMA assigned for the particular MN. 513 The attribute SHOULD NOT be included if the use of LMA in the Home 514 Network is authorized (attribute PMIP6-Home-LMA-IPv6-Address is 515 already present). However, if the VAAA local policy allows both home 516 and visited LMA addresses to be delivered to the MAG, then the MAG 517 has to select either visited or home network LMA based on its local 518 policy. 520 0 1 2 3 521 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 522 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 523 | Type | Length | Visited LMA IPv6 address 524 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 525 Visited LMA IPv6 address 526 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 527 Visited LMA IPv6 address 528 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 529 Visited LMA IPv6 address 530 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 531 Visited LMA IPv6 address | 532 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 534 Type: 535 PMIP6-Visited-LMA-IPv6-Address TBD4. 537 Length: 538 = 18 octets 540 Visited LMA IPv6 address: 541 128-bit IPv6 address of the assigned visited LMA IPv6 address. 543 4.6. PMIP6-Home-LMA-IPv4-Address 545 The PMIP6-Home-LMA-IPv4-Address attribute (Type value TBD5) is of 546 type IPv4 address and contains the IPv4 address of the LMA assigned 547 by the HAAA. The [RFC5844] supports Proxy Mobile IPv6 signaling 548 exchange between MAG and LMA using the IPv4 transport. 550 When the LMA is located in the home network, this attribute MAY be 551 sent by the HAAA to the MAG in the RADIUS Access-Accept message. 553 0 1 2 3 554 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 555 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 556 | Type | Length | Home LMA IPv4 address 557 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 558 Home LMA IPv4 address | 559 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 561 Type: 562 PMIP6-Home-LMA-IPv4-Address TBD5. 564 Length: 565 = 6 octets 567 Home LMA IPv4 address: 568 32-bit IPv4 address of the assigned LMA. 570 4.7. PMIP6-Visited-LMA-IPv4-Address 572 The PMIP6-Visited-LMA-IPv4-Address attribute (Type value TBD6) is of 573 type IPv4 address and is used to propose a particular LMA in the 574 Visited network, and to authorize the use of the LMA in the Visited 575 network. 577 PMIP6-Visited-LMA-IPv4-Address attribute MAY be included by the MAG 578 to VAAA in the RADIUS Access-Request packet as a proposal to allocate 579 the particular LMA to the MN. The LMA in the visited network may be 580 assigned by the visited AAA as the result of retrieved Policy 581 Profile. If included by VAAA in the RADIUS Access-Accept sent to the 582 MAG, the use of the LMA in the visited network is authorized and the 583 attribute SHALL carry the IPv4 address of the assigned visited LMA. 585 The attribute SHOULD NOT be included if the use of LMA in the Home 586 Network is authorized (attribute PMIP6-Home-LMA-IPv4-Address is 587 already present). However, if the VAAA local policy allows both home 588 and visited LMA addresses to be delivered to the MAG, then the MAG 589 has to select either visited or home network LMA based on its local 590 policy. 592 0 1 2 3 593 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 594 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 595 | Type | Length | Visited LMA IPv4 address 596 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 597 Visited LMA IPv4 address | 598 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 600 Type: 601 PMIP6-Visited-LMA-IPv4-Address TBD6. 603 Length: 604 = 6 octets 606 IPv4 LMA address: 607 32-bit IPv4 address of the assigned LMA. 609 4.8. PMIP6-Home-HN-Prefix 611 The PMIP6-Home-HN-Prefix attribute (Type value TBD7) is of type IPv6 612 prefix. It contains Mobile Node's Home Network Prefix (MN-HNP) which 613 is the IPv6 prefix assigned to the link between the MN and the MAG. 614 The MN configures its IP interface from its home network prefix(es). 615 When the LMA is located in the home network, PMIP6-Home-HN-Prefix 616 attribute is used to deliver the MN-HNP from the HAAA to the MAG. 618 The PMIP6-Home-HN-Prefix attribute is also used on the LMA-to-HAAA 619 interface containing the prefix assigned to the MN. If the LMA 620 delegates the MN-HNP assignment to the HAAA, the attribute MUST 621 contain all zeroes address (i.e., '::') in the Access-Request 622 message. The attribute MUST be present in RADIUS Access-Accept 623 message if the prior request already included one, and SHOULD carry 624 the MN-HNP the HAAA assigned to the MN. 626 0 1 2 3 627 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 628 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 629 | Type | Length | Reserved | Prefix-Length | 630 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 631 | Home MN-HNP 632 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 633 Home MN-HNP 634 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 635 Home MN-HNP 636 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 637 Home MN-HNP | 638 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 640 Type: 641 PMIP6-Home-HN-Prefix TBD7. 643 Length: 644 = at least 4 and no larger than 20. 646 Reserved: 647 Reserved for future use. The bits MUST be set to zero by the 648 sender, and MUST be ignored by the receiver. 650 Prefix-Length: 651 The 8-bit unsigned integer indicating the prefix length of 652 the Home Network Prefix (at least 0 and no larger than 128). 653 If the Home Network Prefix contains all zeroes address 654 (i.e., '::') then the Prefix-Length MUST be set to 128. 656 Home Network Prefix: 657 Home Network Prefix for the MN's IPv6 address configuration. 658 The Prefix field is up to 16 octets in length. Bits outside of 659 the Prefix-Length, if included, must be zero. 661 4.9. PMIP6-Visited-HN-Prefix 663 The PMIP6-Visited-HN-Prefix attribute (Type value TBD8) is of type 664 IPv6 prefix. It contains Mobile Node's Home Network Prefix (MN-HNP) 665 which is the IPv6 prefix assigned to the link between the MN and the 666 MAG. The MN configures its IP interface from its home network 667 prefix(es). When the LMA is located in the visited network, PMIP6- 668 Visited-HN-Prefix attribute is used to deliver the MN-HNP from the 669 VAAA to the MAG. 671 The PMIP6-Visited-HN-Prefix attribute is also used on the LMA to VAAA 672 interface containing the IPv6 prefix assigned to the MN. If the LMA 673 delegates the assignment of the MN-HNP to the VAAA, the attribute 674 MUST contain all zeroes address (i.e., '::') in the RADIUS Access- 675 Request message. The attribute MUST be present in Access-Accept 676 message if the prior request already included one, and SHOULD carry 677 the MN-HNP the VAAA assigned to the MN. 679 The attribute SHOULD NOT be included if the use of LMA in the Home 680 Network is authorized (attributes PMIP6-Home-HN-Prefix and/or PMIP6- 681 Home-LMA-IPv6-Address are already present). However, if the VAAA 682 local policy allows both home and visited LMA addresses to be 683 delivered to the MAG, then this attribute MAY also be included. 685 0 1 2 3 686 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 687 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 688 | Type | Length | Reserved | Prefix-Length | 689 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 690 | Visited MN-HNP 691 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 692 Visited MN-HNP 693 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 694 Visited MN-HNP 695 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 696 Visited MN-HNP | 697 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 699 Type: 700 PMIP6-Visited-HN-Prefix TBD8. 702 Length: 703 = at least 4 and no larger than 20. 705 Reserved: 706 Reserved for future use. The bits MUST be set to zero by the 707 sender, and MUST be ignored by the receiver. 709 Prefix-Length: 710 The 8-bit unsigned integer indicating the prefix length of 711 the Visited MN-HNP (at least 0 and no larger than 128). If 712 the Visited Home Network Prefix contains all zeroes address 713 (i.e., '::') then the Prefix-Length MUST be set to 128. 715 Visited Home Network Prefix: 716 Home Network Prefix for the MN's IPv6 address configuration. 717 The Prefix field is up to 16 octets in length. Bits outside of 718 the Prefix-Length, if included, must be zero. 720 4.10. PMIP6-Home-Interface-ID 722 The PMIP6-Home-Interface-ID attribute (Type value TBD9) is of type 723 String and contains MN's interface identifier. The selection of the 724 interface identifier SHOULD NOT allow tracking of individual MNs or 725 users between PMIPv6 mobility session for privacy reasons. This 726 attribute is applicable in network systems and link technologies, 727 where the network explicitly delivers an interface identifier to the 728 MN during the link setup. 3GPP and PPP link technologies are examples 729 of such. 731 This attribute MAY be sent by the LMA or the MAG to the HAAA in the 732 RADIUS Access-Request packet as a proposal. This attribute MAY be 733 sent by HAAA to the LMA or to the MAG in an Access-Accept packet, 734 however it MUST be present if the prior request already included one. 736 0 1 2 3 737 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 738 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 739 | Type | Length | Home Interface Identifier 740 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 741 Home Interface Identifier 742 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 743 Home Interface Identifier | 744 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 746 Type: 747 PMIP6-Home-Interface-ID TBD9. 749 Length: 750 = 10 octets. 752 Home Interface Identifier: 753 The a 64 bit long interface identifier (8 octets). 755 4.11. PMIP6-Visited-Interface-ID 757 The PMIP6-Visited-Interface-ID attribute (Type value TBD10) is of 758 type String and contains MN's interface identifier. The selection of 759 the interface identifier SHOULD NOT allow tracking of individual MNs 760 or users between PMIPv6 mobility session for privacy reasons. This 761 attribute is applicable in network systems and link technologies, 762 where the network explicitly delivers an interface identifier to the 763 MN during the link setup. 3GPP and PPP link technologies are examples 764 of such. 766 This attribute MAY be sent by the LMA or the MAG to the VAAA in the 767 RADIUS Access-Request packet as a proposal. This attribute MAY be 768 sent by VAAA to the LMA or to the MAG in an Access-Accept packet, 769 however it MUST be present if the prior request already included one. 771 0 1 2 3 772 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 773 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 774 | Type | Length | Visited Interface Identifier 775 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 776 Visited Interface Identifier 777 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 778 Visited Interface Identifier | 779 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 781 Type: 782 PMIP6-Visited-Interface-ID TBD10. 784 Length: 785 = 10 octets. 787 Visited Interface Identifier: 788 The a 64 bit long interface identifier (8 octets). 790 4.12. PMIP6-Home-IPv4-HoA 792 [RFC5844] specifies extensions to Proxy Mobile IPv6 protocol which 793 enable IPv4 home address mobility support to the MN. The PMIP6-Home- 794 IPv4-HoA attribute (Type value TBD11) is of type Address and contains 795 the IPv4 Home Address of the MN. The primary use of this attribute 796 is to deliver the assigned IPv4-HoA from HAAA to the MAG. 798 The PMIP6-Home-IPv4-HoA is also used on the LMA-to-HAAA interface. 799 If the LMA in the home network delegates the assignment of the IPv4- 800 HoA to the HAAA, the attribute MUST contain all zeroes address (i.e., 801 0.0.0.0) in the Access-Request message. The attribute MUST be 802 included in by HAAA in the Access-Accept message if the previous 803 request included it, and it contains the IPv4-HoA assigned to the MN. 805 0 1 2 3 806 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 807 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 808 | Type | Length | Reserved |Prefix-Len | 809 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 810 | Home IPv4 HoA | 811 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 813 Type: 814 PMIP6-Home-IPv4-HoA TBD11. 816 Length: 817 = 8 octets 819 Reserved 820 The 10-bit field reserved for future use. Value MUST be 821 initialized to zero by sender, and MUST be ignored by the 822 receiver. 824 Prefix-Len 825 The 6-bit unsigned integer indicating the prefix length of the 826 IPv4 HoA. If the Home IPv4 HoA contains all zeroes address 827 (i.e., '0.0.0.0') then the Prefix-Len MUST be set to 32. 829 Home IPv4 HoA: 830 This field is of type Address and contains the IPv4 home 831 address of the MN in the home network. 833 4.13. PMIP6-Visited-IPv4-HoA 835 When both MAG and the LMA are in the visited network, the PMIP6- 836 Visited-IPv4-HoA attribute (Type value TBD12) is of type Address and 837 is used to exchange information between the VAAA and the MAG on the 838 assignment of the IPv4 Home Address to the MN being present in the 839 Visited network. 841 The PMIP6-Visited-IPv4-HoA is also used on the LMA-to-VAAA interface. 842 If the LMA delegates the assignment of the IPv4-HoA to the VAAA, the 843 attribute MUST contain all zeroes address (i.e., 0.0.0.0) in the 844 RADIUS Access-Request message. The Access-Accept message MUST have 845 the attribute present if the prior request to the VAAA already 846 included one. 848 The attribute SHOULD NOT be included if the use of LMA in the Home 849 Network is authorized (attributes PMIP6-Home-IPv4-HoA and/or PMIP6- 850 Home-LMA-IPv4-Address are already present). However, if the VAAA 851 local policy allows both home and visited LMA addresses to be 852 delivered to the MAG, then this attribute MAY also be included. 854 0 1 2 3 855 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 856 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 857 | Type | Length | Reserved |Prefix-Len | 858 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 859 | Visited IPv4 HoA | 860 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 862 Type: 863 PMIP6-Visited-IPv4-HoA TBD12. 865 Length: 866 = 8 octets 868 Reserved: 869 The 10-bit field reserved for future use. Value MUST be 870 initialized to zero by the sender, and MUST be ignored by the 871 receiver. 873 Prefix-Len: 874 6-bit unsigned integer indicating the prefix length of the 875 IPv4 HoA. If the Visited IPv4 HoA contains all zeroes address 876 (i.e., '0.0.0.0') then the Prefix-Len MUST be set to 32. 878 Visited IPv4 HoA: 879 This field is of type Address and contains the IPv4 home 880 address of the MN in the visited network. 882 4.14. PMIP6-Home-DHCP4-Server-Address 884 The PMIP6-Home-DHCP4-Server-Address (Type value TBD13) is of type 885 Address and contains the IPv4 address of the DHCPv4 server in the 886 home network. The particular DHCP server address is indicated to the 887 MAG that serves the concerning MN. The HAAA MAY assign a DHCP server 888 to the MAG in deployments where the MAG acts as a DHCP Relay, as 889 defined in [RFC5844]. 891 0 1 2 3 892 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 893 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 894 | Type | Length | Home DHCPv4 server address 895 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 896 Home DHCPv4 server address | 897 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 899 Type: 900 PMIP6-Home-DHCP4-Server-Address TBD13. 902 Length: 903 = 6 octets. 905 Home DHCPv4 server address: 906 This field is of type Address and contains a 4-octet IPv4 address 907 of the DHCP server. 909 4.15. PMIP6-Visited-DHCP4-Server-Address 911 PMIP6-Visited-DHCP4-Server-Address attribute (Type value TBD14) of 912 type Address and delivers the IPv4 address of the DHCPv4 server from 913 the visited network to the MAG. When both MAG and the LMA are in the 914 visited network, the VAAA MAY assign a DHCPv4 server to the MAG in 915 deployments where the MAG acts as a DHCP Relay, as defined in 916 [RFC5844]. 918 0 1 2 3 919 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 920 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 921 | Type | Length | Visited DHCPv4 server address 922 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 923 Visited DHCPv4 server address | 924 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 926 Type: 927 PMIP6-Visited-DHCP4-Server-Address TBD14. 929 Length: 930 = 6 octets 932 Visited DHCPv4 server address: 933 This field is of type Address and contains a 4-octet IPv4 address 934 of the DHCPv4 server 936 4.16. PMIP6-Home-DHCP6-Server-Address 938 The PMIP6-Home-DHCP6-Server-Address (Type value TBD15) is of type 939 IPv6 address and contains the IPv6 address of the DHCPv6 server in 940 the home network indicated by the HAAA to the MAG that serves the MN. 941 The HAAA MAY assign a DHCPv6 server to the MAG in deployments where 942 the MAG acts as a DHCP Relay, as defined in [RFC5213]. 944 0 1 2 3 945 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 946 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 947 | Type | Length | Home DHCPv6 server address 948 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 949 Home DHCPv6 server address 950 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 951 Home DHCPv6 server address 952 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 953 Home DHCPv6 server address 954 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 955 Home DHCPv6 server address | 956 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 958 Type: 959 PMIP6-Home-DHCP6-Server-Address TBD15. 961 Length: 962 = 18 octets 964 Home DHCPv6 server address: 965 This field is of type Address and contains 16-octet IPv6 address 966 of the DHCPv6 server. 968 4.17. PMIP6-Visited-DHCP6-Server-Address 970 The PMIP6-Visited-DHCP6-Server-Address attribute (Type value TBD16) 971 is of type IPv6 address and contains the IPv6 address of the DHCPv6 972 server in the visited network indicated by the VAAA to the MAG that 973 serves the MN. When both MAG and the LMA are located in the visited 974 network, the VAAA MAY assign a DHCPv6 server to the MAG in 975 deployments where the MAG acts as a DHCP Relay, as defined in 976 [RFC5213]. 978 0 1 2 3 979 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 980 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 981 | Type | Length | Visited DHCPv6 server address 982 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 983 Visited DHCPv6 server address 984 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 985 Visited DHCPv6 server address 986 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 987 Visited DHCPv6 server address 988 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 989 Visited DHCPv6 server address | 990 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 992 Type: 993 PMIP6-Visited-DHCP6-Server-Address TBD16. 995 Length: 996 = 18 octets 998 Visited DHCPv6 server address: 999 This field is of type Address and contains the 16-octet IPv6 1000 address of the DHCPv6 server. 1002 4.18. Calling-Station-Id 1004 The Calling-Station-Id attribute (Type value 31) is of type String 1005 [RFC2865]. When used within PMIPv6 deployments the attribute 1006 contains the link-layer identifier of the MN as defined in [RFC5213], 1007 Sections 2.2 and 8.6. 1009 4.19. Chargeable-User-Identity 1011 The Chargeable-User-Identity attribute or CUI (Type value 89) is an 1012 unique temporary handle used as means to, for example, correlate 1013 authentication, accounting and bill post-processing for a particular 1014 chargeable subscriber. The CUI format and use follows guidelines 1015 defined by [RFC4372]. 1017 In scope of this document, the CUI attribute MAY be present in the 1018 Access-Request. The CUI MAY also be present in the Access-Accept. 1019 The CUI Identity MUST be present in the Access-Accept if it was 1020 present in the Access-Request. If the use of the Chargeable User 1021 Identity is supported, then the MAG and/or the LMA commits to include 1022 the Chargeable User Identity in all subsequent RADIUS Accounting 1023 packets they send for the given user. 1025 5. MAG to RADIUS AAA interface 1027 5.1. Interface operations 1029 The MAG to the AAA RADIUS server interface is used for retrieval of 1030 the Policy Profile when a MN tries to attach, authenticate and 1031 authorize to a PMIPv6 domain. Depending on the policies and network 1032 capabilities the MAG may retrieve different sets of PMIPv6-session 1033 related parameters: 1035 o Configuration attributes for Home or Visited Network access 1036 scenario, depending on the location and attachment point of the 1037 MN, 1039 o The IPv6 or IPv4 address of the designated LMA, depending on the 1040 access network's actual IP topology, 1042 o The IPv6 or IPv4 configuration parameters for the MN, depending on 1043 the utilized IP configuration method and individual MN's service 1044 Policy, 1046 o The DHCP Relay support attributes (IPv4 or IPv6) in case such 1047 functionality is supported in the network. 1049 In addition to PMIPv6-specific attributes, other RADIUS attributes 1050 are to be used on the MAG-to-AAA interface. 1052 The User-Name attribute MUST be present in the Access-Request. It 1053 MUST carry a correctly formed identifier that SHOULD correspond to a 1054 MN identity unless the identity is being suppressed for policy 1055 reasons, for example, when identity hiding is in effect. The MN 1056 identity, if available, MUST be in Network Access Identifier (NAI) 1057 [RFC4282] format. At minimum, the home realm of the MN MUST be 1058 available at the MAG when the network access authentication takes 1059 place. Otherwise, the MAG is not able to route RADIUS request 1060 messages towards the correct HAAA. The MN identity used on the MAG- 1061 to-HAAA interface and in the User-Name attribute MAY entirely be 1062 related to the network access authentication, and therefore not 1063 suitable to be used as the MN-Identifier mobility option value in the 1064 subsequent PBU/PBA messages. In this case the HAAA MUST provide the 1065 MN-Identifier for PBU/PBA messages using the Mobile-Node-Identifier 1066 attribute (see Section 4.2). 1068 At least one of the NAS-IP-Address, NAS-IPv6-Address or NAS- 1069 Identifier attributes MUST be present in the Access-Request. The 1070 Service-Type attribute set to value 1 (Login) and the NAS-Port-Type 1071 attribute SHOULD be present in the Access-Request. 1073 5.2. Table of Attributes 1075 The following table provides a guide to attributes that may be found 1076 in authentication and authorization RADIUS messages between MAG and 1077 the AAA Server. 1079 Request Accept Reject Challenge # Attribute 1081 1 0-1 0 0 1 User-Name 1082 0-1 0 0 0 4 NAS-IP-Address 1083 0-1 0-1 0 0 5 NAS-Port 1084 0-1 0-1 0 0 6 Service-Type 1085 0-1 0-1 0 0-1 24 State 1086 0 0-1 0 0 25 Class 1087 0 0-1 0 0-1 27 Session-Timeout 1088 0-1 0 0 0 31 Calling-Station-Id 1089 0-1 0 0 0 32 NAS-Identifier 1090 0+ 0+ 0+ 0+ 33 Proxy-State 1091 0-1 0 0 0 69 NAS-Port-Type 1092 0+ 0+ 0+ 0+ 79 EAP-Message 1093 1 1 1 1 80 Message-Authenticator 1094 0-1 0-1 0 0 89 Chargeable-User-Identity 1095 0-1 0 0 0 95 NAS-IPv6-Address 1096 0-1 0-1 0 0 124 MIP6-Feature-Vector 1097 0 1 0 0 TBD1 Mobile-Node-Identifier 1098 0-1 0-1 0 0 TBD2 Service-Selection 1099 0 0-1 0 0 TBD3 PMIP6-Home-LMA-IPv6-Address 1100 0-1 0-1 0 0 TBD4 PMIP6-Visited-LMA-IPv6-Address 1101 0 0-1 0 0 TBD5 PMIP6-Home-LMA-IPv4-Address 1102 0-1 0-1 0 0 TBD6 PMIP6-Visited-LMA-IPv4-Address 1103 0 0+ 0 0 TBD7 PMIP6-Home-HN-Prefix 1104 0 0+ 0 0 TBD8 PMIP6-Visited-HN-Prefix 1105 0 0-1 0 0 TBD9 PMIP6-Home-Interface-ID 1106 0 0-1 0 0 TBD10 PMIP6-Visited-Interface-ID 1107 0 0-1 0 0 TBD11 PMIP6-Home-IPv4-HoA 1108 0 0-1 0 0 TBD12 PMIP6-Visited-IPv4-HoA 1109 0 0-1 0 0 TBD13 PMIP6-Home-DHCP4-Server-Address 1110 0 0-1 0 0 TBD14 PMIP6-Visited-DHCP4-Server-Address 1111 0 0-1 0 0 TBD15 PMIP6-Home-DHCP6-Server-Address 1112 0 0-1 0 0 TBD16 PMIP6-Visited-DHCP6-Server-Address 1114 6. LMA to RADIUS AAA interface 1116 6.1. Interface operations 1118 The LMA-to-HAAA interface may be used for multiple purposes. These 1119 include the authorization of the incoming PBU, updating the LMA 1120 address to the HAAA, delegating the assignment of the MN-HNP (home 1121 network prefix) or the IPv4-HoA (home address) to the HAAA, and for 1122 accounting and PMIPv6 session management. The primary purpose of 1123 this interface is to update the HAAA with the LMA address information 1124 in case of dynamically assigned LMA, and exchange the MN address 1125 assignment information between the LMA and the HAAA. 1127 Whenever the LMA sends a Access-Request message to the HAAA, the 1128 User-Name attribute SHOULD contain the MN's identity. The LMA- 1129 provided identity in the User-Name attribute is strongly RECOMMENDED 1130 to be the same as the MN's identity information in the PBU MN- 1131 Identifier mobility option. The identity SHOULD also be the same as 1132 used on the MAG-to-HAAA interface, but in case those identities 1133 differ the HAAA MUST have a mechanism of mapping the MN identity used 1134 on the MAG-to- HAAA interface to the identity used on the LMA-to-HAAA 1135 interface. 1137 If the PBU contains the MN Link-Layer Identifier option, the Calling- 1138 Station-Id attribute SHOULD be included in the request message 1139 containing the received link-layer identifier. Furthermore, if the 1140 PBU contains the Service Selection mobility option [RFC5149], the 1141 Service-Selection attribute SHOULD be included in the request message 1142 containing the received service identifier. Both the MN link-layer 1143 identifier and the service selection can be used to provide more 1144 information for the PBU authorization step in the HAAA. 1146 The Service-Type attribute MUST be set to the value 17 (Authorize 1147 Only). If the HAAA is not able to authorize the subscriber's 1148 mobility service session, then the Access-Reject message to the LMA 1149 MAY contain the Reply-Message attribute describing the reason for 1150 rejecting the authorization. A failed authorization obviously 1151 results in a rejection of the PBU, and a PBA with an appropriate 1152 error Status Value MUST be sent back to the MAG. 1154 The authorization step MUST be performed at least for the initial PBU 1155 session up to a mobility session, when the LMA-to-HAAA interface is 1156 deployed. For the subsequent re-registration and handover PBUs, the 1157 authorization step MAY be repeated (in this case, the LMA-to-HAAA 1158 interface should also maintain an authorization session state). 1160 In case of a dynamic LMA discovery and assignment [RFC6097], the HAAA 1161 and the remote policy store may need to be updated with the selected 1162 LMA address information. The update can be done during the PBU 1163 authorization step using the LMA-to-HAAA interface. This 1164 specification uses the PMIP6-*-LMA-*-Address attribute for carrying 1165 the LMA's address information from the LMA to the HAAA. The LMA 1166 address information in the request message MUST contain the IP 1167 address of the LMA or the Fully Qualified Domain Name (FQDN) 1168 identifying uniquely the LMA, or both. The LMA address information 1169 refers to the PMIPv6 part of the LMA, not necessarily the LMA part 1170 interfacing with the AAA infrastructure. 1172 The LMA and the HAAA use the PMIP6-Home-HN-Prefix/ 1173 PMIP6-Visited-HN-Prefix attributes to exchange the MN-HNP when 1174 appropriate. Similarly, the LMA and the HAAA use the PMIP6-Home- 1175 IPv4-HoA/PMIP6-Visited-IPv4-HoA attributes to exchange the IPv4-MN- 1176 HoA when appropriate. The MN address information exchange is again 1177 done during the PBU authorization step. The HAAA MAY also use the 1178 LMA-provided MN address information as a part of the information used 1179 to authorize the PBU. 1181 Which entity is actually responsible for the address management is 1182 deployment specific within the PMIPv6 Domain and MUST be pre-agreed 1183 on per deployment basis. When the LMA is responsible for the address 1184 management, the PMIP6-*-HN-Prefix/PMIP6-*-IPv4-HoA attributes are 1185 used to inform the HAAA and the remote policy store of the MN-HNP/ 1186 IPv4-MN-HoA assigned to the MN. It is also possible that the LMA 1187 delegates the address management to the HAAA. In this case, the MN- 1188 HNP/IPv4-MN-HoA are set to undefined addresses in the Access-Request 1189 message sent from the LMA to the HAAA. The LMA expects to receive 1190 the HAAA assigned HNP/IPv4-MN-HoA in the corresponding Access-Accept 1191 message. 1193 6.2. Table of Attributes 1195 The following table provides a guide to which attributes may be found 1196 in authorization process between LMA and the AAA. 1198 Request Accept Reject Challenge # Attribute 1200 1 0-1 0 0 1 User-Name 1201 0-1 0-1 0 0 4 NAS-IP-Address 1202 0-1 0-1 0 0 5 NAS-Port 1203 1 0-1 0 0 6 Service-Type 1204 0 0-1 0 0 25 Class 1205 0 0-1 0 0-1 27 Session-Timeout 1206 0-1 0 0 0 31 Calling-Station-Id 1207 1 0 0 0 32 NAS-Identifier 1208 0+ 0+ 0+ 0+ 33 Proxy-State 1209 1 0 0 0 69 NAS-Port-Type 1210 1 1 1 1 80 Message-Authenticator 1211 0-1 0-1 0 0 89 Chargeable-User-Identity 1212 0-1 0-1 0 0 95 NAS-IPv6-Address 1213 0-1 0-1 0 0 124 MIP6-Feature-Vector 1214 1 0 0 0 TBD1 Mobile-Node-Identifier 1215 0-1 0-1 0 0 TBD2 Service-Selection 1216 0-1 0 0 0 TBD3 PMIP6-Home-LMA-IPv6-Address 1217 0-1 0 0 0 TBD4 PMIP6-Visited-LMA-IPv6-Address 1218 0-1 0 0 0 TBD5 PMIP6-Home-LMA-IPv4-Address 1219 0-1 0 0 0 TBD6 PMIP6-Visited-LMA-IPv4-Address 1220 0+ 0+ 0 0 TBD7 PMIP6-Home-HN-Prefix 1221 0+ 0+ 0 0 TBD8 PMIP6-Visited-HN-Prefix 1222 0-1 0-1 0 0 TBD9 PMIP6-Home-Interface-ID 1223 0-1 0-1 0 0 TBD10 PMIP6-Visited-Interface-ID 1224 0-1 0-1 0 0 TBD11 PMIP6-Home-IPv4-HoA 1225 0-1 0-1 0 0 TBD12 PMIP6-Visited-IPv4-HoA 1227 7. Accounting 1229 Radius based interfaces at the MAG and LMA with the AAA server 1230 enables metering of traffic associated with the MN, commonly called 1231 accounting. If accounting is turned on in the mobile node's Policy 1232 Profile, the local routing SHOULD NOT be enabled [RFC5213]. 1234 7.1. Accounting at LMA 1236 The accounting at the LMA to AAA server interface is based on 1237 [RFC2865] and [RFC2866]. This interface MUST support the transfer of 1238 accounting records needed for service control and charging. These 1239 records should include (but may not be limited to): time of binding 1240 cache entry creation and deletion, number of the octets sent and 1241 received by the MN over the bi-directional tunnel, etc. 1243 7.2. Accounting at MAG 1245 The accounting at the MAG to AAA server interface is based on 1246 [RFC2865] and [RFC2866]. The interface MUST also support the 1247 transfer of accounting records which should include: time of binding 1248 cache entry creation and deletion, number of the octets sent and 1249 received by the MN over the bi-directional tunnel, etc. 1251 If there is data traffic between a visiting MN and a correspondent 1252 node that is locally attached to an access link connected to the same 1253 MAG, the mobile access gateway MAY optimize on the delivery efforts 1254 by locally routing the packets instead of using reverse tunneling to 1255 the mobile node's LMA. In this case, the local data traffic too MUST 1256 be reported to AAA Accounting servers by means of RADIUS protocol. 1258 7.3. Table of Attributes 1260 The following table provides a list of attributes that may be 1261 included in the RADIUS Accounting messages. These attributes are to 1262 complement the set of accounting attributes already required by 1263 [RFC2866] and [RFC2869]. 1265 Request Interim Stop # Attribute 1267 0-1 0-1 0-1 TBD1 Mobile-Node-Identifier 1268 0-1 0 0-1 TBD2 Service-Selection 1269 0-1 0 0-1 TBD3 PMIP6-Home-LMA-IPv6-Address 1270 0-1 0 0-1 TBD4 PMIP6-Visited-LMA-IPv6-Address 1271 0-1 0 0-1 TBD5 PMIP6-Home-LMA-IPv4-Address 1272 0-1 0 0-1 TBD6 PMIP6-Visited-LMA-IPv4-Address 1273 0+ 0 0+ TBD7 PMIP6-Home-HN-Prefix 1274 0+ 0 0+ TBD8 PMIP6-Visited-HN-Prefix 1275 0-1 0 0-1 TBD11 PMIP6-Home-IPv4-HoA 1276 0-1 0 0-1 TBD12 PMIP6-Visited-IPv4-HoA 1277 0-1 0 0-1 31 Calling-Station-Id 1278 0-1 0-1 0-1 80 Message-Authenticator 1279 0-1 0-1 0-1 89 Chargeable-User-Identity 1280 0-1 0 0-1 124 MIP6-Feature-Vector 1282 8. Security Considerations 1284 The RADIUS messages may be transported between the MAG and/or the LMA 1285 to the RADIUS server via one or more AAA brokers or RADIUS proxies. 1286 In this case the LMA to the RADIUS AAA server communication relies on 1287 the security properties of the intermediate AAA brokers and RADIUS 1288 proxies. 1290 Regarding the privacy threats associated with sending MN specific 1291 information between the MAG and AAA server and between the LMA and 1292 AAA server, considerations of the Radius Base protocol [RFC2865], 1293 [RFC2866], and the Radius EAP application [RFC3579] are applicable to 1294 this document. The MAG, LMA and AAA server SHOULD avoid including 1295 attributes containing personally identifying information such as an 1296 MN's Interface ID, link-layer address or NAI, except as needed, and 1297 SHOULD pay special attention if identity hiding is desired. 1299 9. IANA consideration 1301 9.1. Attribute Type Codes 1303 This specification defines the following new RADIUS attribute type 1304 values: 1306 Mobile-Node-Identifier 1307 Service-Selection 1308 PMIP6-Home-LMA-IPv6-Address 1309 PMIP6-Visited-LMA-IPv6-Address 1310 PMIP6-Home-LMA-IPv4-Address 1311 PMIP6-Visited-LMA-IPv4-Address 1312 PMIP6-Home-HN-Prefix 1313 PMIP6-Visited-HN-Prefix 1314 PMIP6-Home-Interface-ID 1315 PMIP6-Visited-Interface-ID 1316 PMIP6-Home-IPv4-HoA 1317 PMIP6-Visited-IPv4-HoA 1318 PMIP6-Home-DHCP4-Server-Address 1319 PMIP6-Visited-DHCP4-Server-Address 1320 PMIP6-Home-DHCP6-Server-Address 1321 PMIP6-Visited-DHCP6-Server-Address 1323 9.2. Namespaces 1325 This specification defines new values to the Mobility Capability 1326 registry (see [RFC5447]) for use with the MIP6- Feature-Vector AVP: 1328 Token | Value 1329 ----------------------------------+-------------------- 1330 IP4_TRANSPORT_SUPPORTED | 1331 IP4_HOA_ONLY_SUPPORTED | 1333 10. Acknowledgements 1335 First of all, the authors would like to acknowledge the 1336 standardization work and people of the WiMAX Forum that have set the 1337 foundation for this document. 1339 The authors would like to thank Basavaraj Patil, Glen Zorn, Avi Lior, 1340 Alan DeKok and Pete McCann for reviewing the document and providing 1341 valuable input. The authors also thank Elwyn Davies, Pete Resnick, 1342 Bernard Aboba, Jari Arkko and Stephen Farrell for their reviews on 1343 the document during the IESG process. 1345 The authors would also like to thank the authors of [RFC5779] as this 1346 document re-uses some procedural ideas of the aforementioned 1347 specification. 1349 11. References 1351 11.1. Normative References 1353 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1354 Requirement Levels", BCP 14, RFC 2119, March 1997. 1356 [RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, 1357 "Remote Authentication Dial In User Service (RADIUS)", 1358 RFC 2865, June 2000. 1360 [RFC5213] Gundavelli, S., Leung, K., Devarapalli, V., Chowdhury, K., 1361 and B. Patil, "Proxy Mobile IPv6", RFC 5213, August 2008. 1363 [RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The 1364 Network Access Identifier", RFC 4282, December 2005. 1366 [RFC5447] Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C., 1367 and K. Chowdhury, "Diameter Mobile IPv6: Support for 1368 Network Access Server to Diameter Server Interaction", 1369 RFC 5447, February 2009. 1371 [RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. 1372 Arkko, "Diameter Base Protocol", RFC 3588, September 2003. 1374 [RFC5844] Wakikawa, R. and S. Gundavelli, "IPv4 Support for Proxy 1375 Mobile IPv6", RFC 5844, May 2010. 1377 [RFC5779] Korhonen, J., Bournelle, J., Chowdhury, K., Muhanna, A., 1378 and U. Meyer, "Diameter Proxy Mobile IPv6: Mobile Access 1379 Gateway and Local Mobility Anchor Interaction with 1380 Diameter Server", RFC 5779, February 2010. 1382 [RFC4372] Adrangi, F., Lior, A., Korhonen, J., and J. Loughney, 1383 "Chargeable User Identity", RFC 4372, January 2006. 1385 11.2. Informative references 1387 [RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication 1388 Dial In User Service) Support For Extensible 1389 Authentication Protocol (EAP)", RFC 3579, September 2003. 1391 [RFC2866] Rigney, C., "RADIUS Accounting", RFC 2866, June 2000. 1393 [RFC2869] Rigney, C., Willats, W., and P. Calhoun, "RADIUS 1394 Extensions", RFC 2869, June 2000. 1396 [RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H. 1398 Levkowetz, "Extensible Authentication Protocol (EAP)", 1399 RFC 3748, June 2004. 1401 [RFC5149] Korhonen, J., Nilsson, U., and V. Devarapalli, "Service 1402 Selection for Mobile IPv6", RFC 5149, February 2008. 1404 [RFC6097] Korhonen, J. and V. Devarapalli, "Local Mobility Anchor 1405 (LMA) Discovery for Proxy Mobile IPv6", RFC 6097, 1406 February 2011. 1408 [unicode] Davis, M. and M. Duerst, "Unicode Standard Annex #15; 1409 Unicode Normalization Forms", Unicode 5.0.0, October 2006. 1411 Authors' Addresses 1413 Frank Xia 1414 Huawei USA 1415 1700 Alma Dr. Suite 500 1416 Plano, TX 75075 1418 Phone: +1 972-509-5599 1419 Email: xiayangsong@huawei.com 1421 Behcet Sarikaya 1422 Huawei USA 1423 1700 Alma Dr. Suite 500 1424 Plano, TX 75075 1426 Phone: +1 972-509-5599 1427 Email: sarikaya@ieee.org 1429 Jouni Korhonen (editor) 1430 Nokia Siemens Networks 1431 Linnoitustie 6 1432 Espoo FI-02600 1433 Finland 1435 Email: jouni.nospam@gmail.com 1436 Sri Gundavelli 1437 Cisco 1438 170 West Tasman Drive 1439 San Jose, CA 95134 1441 Email: sgundave@cisco.com 1443 Damjan Damic 1444 Siemens 1445 Heinzelova 70a 1446 Zagreb 10000 1447 Croatia 1449 Email: damjan.damic@siemens.com