RADIUS Support for Proxy Mobile IPv6
updated by
- rfc-8044 — Data Types in RADIUS
Extracted elements (29)
The Mobile-Node-Identifier attribute is introduced for deployments where the authentication identity and the PMIPv6 PBU/PBA mobility identity are decoupled, or when identity hiding is in effect during network access authentication, or when the HAAA assigns periodically changing identities to the MN.
Three deployment models are supported: (1) both MAG and LMA in the home network, (2) both in the visited network with VAAA acting as proxy to HAAA, and (3) MAG in the visited network while LMA is in the home network with direct HAAA access. This drives the parallel 'Home' and 'Visited' attribute pairs throughout the specification.
The NAS function is assumed co-located with the MAG. Where NAS and MAG are decoupled, the messaging interface between them required for PMIPv6 operation is explicitly out of scope for this document.
Both the LMA-to-AAA and MAG-to-AAA interfaces MUST support transfer of accounting records (binding cache entry creation/deletion times, octet counts). Local data traffic routed by the MAG without reverse tunneling MUST also be reported to AAA Accounting servers via RADIUS.
If accounting is enabled in the MN's policy profile, local routing at the MAG SHOULD NOT be enabled, per RFC 5213.
If the HAAA returns a Mobile-Node-Identifier in the RADIUS Access-Accept, the MAG MUST use the received MN-Identifier in subsequent Proxy Binding Update and Proxy Binding Acknowledgement exchanges.
If the RADIUS Access-Accept contains contradicting MIP6-Feature-Vector bits (e.g., both IP4_HOA_ONLY_SUPPORTED and IP4_HOA_SUPPORTED set), the RADIUS client MUST treat the Access-Accept as an Access-Reject and SHOULD log the event. Symmetrically, if the Access-Request contains contradicting bits, the RADIUS server MUST reply with Access-Reject and SHOULD log.
On the LMA-to-HAAA interface, the Service-Type attribute MUST be set to value 17 (Authorize Only). A failed PBU authorization MUST cause the LMA to send a PBA with an appropriate error Status Value back to the MAG.
The authorization step MUST be performed at least for the initial PBU establishing a mobility session when the LMA-to-HAAA interface is deployed. For re-registration and handover PBUs the authorization step MAY be repeated.
The Chargeable-User-Identity (CUI, Type 89) MUST be present in the Access-Accept if it was present in the Access-Request. Once supported, the MAG and/or LMA commits to include the CUI in all subsequent RADIUS Accounting packets for that user.
The PMIP6-Home-IPv4-Gateway address (Type 161) MUST belong to the subnet defined in the PMIP6-Home-IPv4-HoA attribute, and is populated into the PMIPv6 IPv4 Default-Router Address Option per RFC 5844.
The selection of the interface identifier carried in PMIP6-Home-Interface-ID and PMIP6-Visited-Interface-ID SHOULD NOT allow the tracking of individual MNs or users between PMIPv6 mobility sessions, for privacy reasons.
The Service-Selection identifier MUST be unique within the PMIPv6 Domain when normalized using the selected normalization form (e.g., NFKC). The MAG MUST include the Service-Selection attribute in the Access-Request if the information was acquired by operator-specific configuration.
The User-Name attribute MUST be present in every MAG Access-Request and MUST carry an NAI-format identifier. At least one of NAS-IP-Address, NAS-IPv6-Address, or NAS-Identifier MUST also be present. Service-Type SHOULD be set to 1 (Login).
When IP4_HOA_ONLY_SUPPORTED is set in the MIP6-Feature-Vector, the PMIP6_SUPPORTED flag MUST also be set and IP4_HOA_SUPPORTED MUST NOT be set; the Access-Accept SHOULD NOT carry the IPv6 Home Network Prefix.
When the LMA delegates MN-HNP assignment to the HAAA, the PMIP6-Home-HN-Prefix attribute MUST contain all zeroes ('::') in the Access-Request and Prefix-Length MUST be set to 128. The attribute MUST be present in the Access-Accept if the prior request included one and SHOULD carry the assigned MN-HNP.
Which entity is responsible for MN address management (LMA vs. HAAA) is deployment-specific and MUST be pre-agreed on a per-deployment basis; the PMIP6-*-HN-Prefix and PMIP6-*-IPv4-HoA attributes carry zeroes when delegating to the HAAA and the assigned addresses when the LMA is informing the HAAA.
Per Section 8, privacy threats arise from sending MN-specific information (NAI, Interface ID, link-layer address) across the MAG-to-AAA and LMA-to-AAA interfaces; implementations SHOULD minimize inclusion of such attributes and give special attention when identity hiding is required.
MIP6-Feature-Vector (RADIUS Type 124, reusing Diameter AVP Code space) carries a 64-bit capability flags field. This document adds IP4_TRANSPORT_SUPPORTED (0x0000800000000000) and IP4_HOA_ONLY_SUPPORTED (0x0001000000000000) to the existing PMIPv6 capability bits from RFC 5779, enabling direct capability negotiation between MAG/LMA and AAA.
Section 9.1 registers 18 new RADIUS attribute type codes: Mobile-Node-Identifier (145), Service-Selection (146), PMIP6-Home-LMA-IPv6-Address (147), PMIP6-Visited-LMA-IPv6-Address (148), PMIP6-Home-LMA-IPv4-Address (149), PMIP6-Visited-LMA-IPv4-Address (150), PMIP6-Home-HN-Prefix (151), PMIP6-Visited-HN-Prefix (152), PMIP6-Home-Interface-ID (153), PMIP6-Visited-Interface-ID (154), PMIP6-Home-IPv4-HoA (155), PMIP6-Visited-IPv4-HoA (156), PMIP6-Home-DHCP4-Server-Address (157), PMIP6-Visited-DHCP4-Server-Address (158), PMIP6-Home-DHCP6-Server-Address (159), PMIP6-Visited-DHCP6-Server-Address (160), PMIP6-Home-IPv4-Gateway (161), PMIP6-Visited-IPv4-Gateway (162).
Section 9.2 adds two new values to the Mobility Capability registry (RFC 5447) for use with the MIP6-Feature-Vector AVP: IP4_TRANSPORT_SUPPORTED (0x0000800000000000) indicating MAG ability to provide IPv4-based encapsulation, and IP4_HOA_ONLY_SUPPORTED (0x0001000000000000) indicating only IPv4 PMIPv6 mobility is authorized.
RADIUS messages between MAG/LMA and the AAA server may traverse one or more AAA brokers or RADIUS proxies; the security of those exchanges depends on the trustworthiness of those intermediaries. MAG, LMA, and AAA server SHOULD avoid including personally identifying attributes (Interface ID, link-layer address, NAI) except as needed, especially when identity hiding is desired.
Mobile-Node-Identifier attribute (Type 145): Type (1 octet) + Length (1 octet, >= 3) + Mobile Node Identifier field of type String in NAI format. Used to carry the MN-Identifier for use in subsequent PBU/PBA exchanges when it differs from the network access authentication identity.
PMIP6-Home-HN-Prefix (Type 151): variable length 4–20 octets — Type (1) + Length (1) + Reserved (1) + Prefix-Length (1, 0–128) + Home MN-HNP (up to 16 octets). If delegating prefix assignment to HAAA, the address field MUST contain '::' and Prefix-Length MUST be 128.
PMIP6-Home-Interface-ID (Type 153): fixed 10 octets — Type (1) + Length (1, = 10) + 64-bit Home Interface Identifier (8 octets). The 64-bit IID is exchanged between MAG/LMA and HAAA for use in link technologies that explicitly deliver an interface identifier (e.g., 3GPP, PPP).
PMIP6-Home-IPv4-HoA (Type 155): fixed 8 octets — Type (1) + Length (1, = 8) + Reserved (10 bits) + Prefix-Len (6 bits) + Home IPv4 HoA (32 bits). When the HoA is all zeroes (delegation), Prefix-Len MUST be set to 32.
PMIP6-Home-LMA-IPv4-Address (Type 149): fixed 6 octets — Type (1) + Length (1, = 6) + 32-bit Home LMA IPv4 address (4 octets). Supports IPv4 transport for PMIPv6 signaling as defined in RFC 5844.
PMIP6-Home-LMA-IPv6-Address (Type 147): fixed 18 octets — Type (1) + Length (1, = 18) + 128-bit Home LMA IPv6 address (16 octets). Delivers the home-network LMA's IPv6 address from HAAA to the MAG.
Service-Selection attribute (Type 146): Type (1 octet) + Length (1 octet, >= 3) + Service Identifier as UTF-8 text. Contains the service or external network name with which the MN's mobility service is associated; MUST be NFKC-normalized within the PMIPv6 domain.