IP Mobility Support
obsoleted by
- rfc-3220 — IP Mobility Support for IPv4
updated by
- rfc-2290 — Mobile-IPv4 Configuration Option for PPP IPCP
Extracted elements (30)
Foreign agent care-of address mode is preferred over co-located care-of address because it allows many mobile nodes to share a single IP address, reducing pressure on the limited IPv4 address space. Co-located addresses require maintaining per-foreign-subnet address pools, which is difficult to manage efficiently.
Mobile IP requires no protocol changes to hosts or routers not acting as mobile nodes, home agents, or foreign agents. Correspondent nodes communicate with a mobile node's permanent home address without awareness of its current location, ensuring full backward compatibility with existing IP stacks.
A foreign agent and home agent MUST NOT increase the Lifetime selected by the mobile node in the Registration Request. If the Reply Lifetime is greater than the Request Lifetime, the Request Lifetime MUST be used; if less, the Reply Lifetime MUST be used.
A home agent MUST be able to attract and intercept datagrams destined to the home address of any of its registered mobile nodes, using proxy ARP and gratuitous ARP mechanisms (Section 4.6) when the home agent is on the same link as the mobile node's home address.
A mobile node using a co-located care-of address MUST be located on the link identified by the network prefix of that address; otherwise datagrams tunneled to that address would be undeliverable.
After sending three initial solicitations at up to one per second, a mobile node MUST reduce the solicitation rate using binary exponential backoff up to a maximum interval of at least one minute. The mobile node MUST NOT increase the rate unless it receives a positive indication of movement to a new link.
Agent Advertisement sequence numbers MUST start at 0 after boot, increment by 1 for each subsequent advertisement, and MUST roll from 0xffff to 256 (not 0), so mobile nodes can distinguish a reboot (small sequence number) from a rollover.
All Mobile IP implementations MUST implement the default keyed-MD5 authentication algorithm in 'prefix+suffix' mode producing a 128-bit authenticator over the shared secret, protected fields, and shared secret again. Any SPI value MUST be associable with any implemented authentication algorithm.
All Registration Requests and Registration Replies MUST include exactly one Mobile-Home Authentication Extension, which MUST be the last non-foreign-agent-specific extension. This protects against remote redirection attacks caused by uncontrolled propagation of ICMP Redirects.
If a mobile node is registering a foreign agent care-of address, the mobile node MUST register via that foreign agent. If registering a co-located care-of address without a foreign agent on the link, the mobile node MUST register directly with its home agent.
The IP TTL field in Agent Solicitation messages MUST be set to 1. Agent Advertisement IP TTL MUST also be set to 1.
When an unrecognized Extension with type 0–127 is encountered, the entire message MUST be silently discarded. When an unrecognized Extension with type 128–255 is encountered, that Extension is ignored but the remaining Extensions and message data MUST still be processed.
A mobility binding is the association of a mobile node's home address with a care-of address and remaining lifetime. Registration creates or modifies a binding at the home agent; a Lifetime of zero indicates deregistration.
A Mobility Security Association is a collection of security contexts between a pair of nodes, indexed by SPI and IP address. Each context specifies an authentication algorithm and mode, a shared secret or key pair, and a replay protection style. SPI values 0–255 are reserved and MUST NOT be used.
Mobile IP control messages (Registration Request type 1, Registration Reply type 3) are sent via UDP to well-known port 434. Agent Discovery reuses ICMP Router Advertisement and Solicitation messages extended with Mobile IP extensions.
Mobile IP defines three new architectural entities: Mobile Node (host/router that changes attachment without changing IP address), Home Agent (router on home network that tunnels datagrams to the mobile node), and Foreign Agent (router on visited network providing routing services to registered mobile nodes).
Two care-of address types are defined: a 'foreign agent care-of address' is the IP address of a foreign agent advertised in its Agent Advertisements, and a 'co-located care-of address' is a locally acquired address (e.g., via DHCP) associated with one of the mobile node's own network interfaces.
Extension Type numbers are split into two orthogonal namespaces: Mobile IP control message extensions (Types 32 Mobile-Home Auth, 33 Mobile-Foreign Auth, 34 Foreign-Home Auth) and ICMP Router Discovery extensions (Types 0 One-byte Padding, 16 Mobility Agent Advertisement, 19 Prefix-Lengths). Up-to-date values are maintained in Assigned Numbers.
Registration Reply Code values define registration outcomes: 0 (accepted), 1 (accepted, simultaneous bindings unsupported); foreign agent denials 64–88 (reason unspecified through ICMP errors); home agent denials 128–136 (reason unspecified through unknown home agent address). Maintained in Assigned Numbers.
Agent Advertisement and Solicitation messages carry no Mobile IP authentication; they MAY optionally be protected by the IP Authentication Header. The lack of mandatory authentication for discovery messages is an acknowledged limitation.
All registration messages must be authenticated using the Mobile-Home Authentication Extension to prevent remote redirection attacks. The protocol is vulnerable if authentication keys are compromised, as an attacker could redirect datagrams or deny service to a mobile node.
Key management for establishing mobility security associations is not defined by this protocol. Implementers must use secure out-of-band means to distribute keys. The protocol notes that datagrams forwarded through the tunnel are not encrypted by default, leaving privacy dependent on other mechanisms such as IPsec.
Replay protection for Registration Requests is required via the 64-bit Identification field using either timestamp-based (Section 5.6.1) or nonce-based (Section 5.6.2) methods. Timestamps require time synchronization; nonces require the home agent to initiate a challenge-response exchange.
A mobile node operates in one of two states: (1) at-home — no mobility services active, deregisters with home agent upon return; (2) away-from-home — registers care-of address with home agent, re-registers on move detection or lifetime expiry, deregisters (Lifetime=0) when returning home. Transitions are triggered by Agent Advertisement receipt, Lifetime expiry, or sequence number anomalies indicating agent reboot.
Authentication Extensions (Mobile-Home Type 32, Mobile-Foreign Type 33, Foreign-Home Type 34) each carry: Type (1 byte), Length (1 byte), SPI (4 bytes), Authenticator (variable). Length = 4 plus Authenticator bytes. The Authenticator covers UDP payload, all prior extensions, and the Type and Length of the authentication extension itself.
Mobile IP Extensions use a Type-Length-Value encoding: Type (1 byte), Length (1 byte, excludes Type and Length), Data (variable). The One-byte Padding Extension (Type 0) is an exception encoded as a single byte with no Length or Data field.
The Mobility Agent Advertisement Extension (Type 16) appended to ICMP Router Advertisements carries: Sequence Number (2 bytes), Registration Lifetime (2 bytes), flags byte (R,B,H,F,M,G,V bits), reserved byte, and zero or more 4-byte Care-of Addresses. Length = 6 + 4*N.
The Prefix-Lengths Extension (Type 19) follows the Mobility Agent Advertisement Extension and contains one prefix-length byte per router address listed in the ICMP Router Advertisement, encoded in the same order as those router addresses. Length equals the Num Addrs value.
The Registration Reply (Type 3, UDP port 434) fixed portion contains: Type (1 byte), Code (1 byte), Lifetime (2 bytes), Home Address (4 bytes), Home Agent (4 bytes), Identification (8 bytes), followed by extensions. If Code indicates denial, Lifetime MUST be ignored.
The Registration Request (Type 1, UDP port 434) fixed portion contains: Type (1 byte), flags S/B/D/M/G/V (1 byte), Lifetime (2 bytes), Home Address (4 bytes), Home Agent (4 bytes), Care-of Address (4 bytes), Identification (8 bytes), followed by extensions including the mandatory Mobile-Home Authentication Extension.