Diameter Proxy Mobile IPv6: Mobile Access Gateway and Local Mobility Anchor Interaction with Diameter Server
Extracted elements (27)
The Mobile-Node-Identifier AVP is designed for deployments where identity hiding during network access authentication prevents the MAG from learning the MN identity needed for PBU/PBA exchanges, or where the HAAA assigns periodically changing identities to the MN.
This specification deliberately avoids defining new Diameter Application-IDs or Command Codes. It is intentionally generic to any existing Diameter application (e.g., NASREQ, EAP) suitable for network access authentication and authorization, allowing reuse of existing infrastructure.
When both MAG-to-HAAA and LMA-to-HAAA interfaces are deployed, a single PMIPv6 mobility session will have two distinct Diameter sessions at the HAAA. The HAAA SHOULD allow multiple Diameter sessions for the same PMIPv6 mobility session to accommodate this architecture.
The MN identity used on the MAG-to-HAAA interface and in the User-Name AVP MAY be entirely related to the network access authentication, and therefore not suitable for use as the MN-ID mobility option value in subsequent PBU/PBA messages.
For session management and service authorization purposes, session state SHOULD be maintained on the MAG-to-HAAA interface.
On the LMA-to-HAAA interface, the Auth-Request-Type AVP MUST be set to AUTHORIZE_ONLY. If the HAAA cannot authorize the mobility service session, the reply MUST have the Result-Code AVP set to DIAMETER_AUTHORIZATION_REJECTED (5003), and the LMA MUST send a PBA with an appropriate error Status Value back to the MAG.
On the LMA-to-HAAA interface, the User-Name AVP SHOULD contain the MN's identity, which is strongly RECOMMENDED to be the same as the MN's identity in the PBU MN-ID mobility option. If the MAG-to-HAAA and LMA-to-HAAA identities differ, the HAAA MUST have a mechanism to map between them.
The entity responsible for MN address management (LMA or HAAA) MUST be pre-agreed on a per-deployment basis. When the LMA delegates MN-HNP or IPv4-MN-HoA assignment to the HAAA, the respective AVP MUST be set to all-zeroes address in the Diameter request.
The home realm of the MN MUST be available at the MAG when network access authentication takes place; without it, the MAG cannot route Diameter request messages to the correct HAAA.
The LMA-to-HAAA authorization step MUST be performed at least for the initial PBU that establishes a mobility session. For subsequent re-registration and handover PBUs, the authorization step MAY be repeated.
The Service-Selection AVP service identifier MUST be unique within the PMIPv6 Domain. If the MAG receives service selection information from the MN via a lower-layer mechanism, the MAG MUST include the Service-Selection AVP in MAG-to-HAAA request messages.
When the LMA updates the HAAA with its address, the LMA address information in the request MUST contain either the IP address or the FQDN uniquely identifying the LMA, or both. When HAAA includes MIP6-Agent-Info in an answer back to the LMA (indicating no relocation), it MUST set MIP-Home-Agent-Address to all zeroes and omit MIP-Home-Agent-Host.
Whenever the MAG sends a Diameter request message to the HAAA, the User-Name AVP SHOULD contain the MN's identity unless suppressed for policy reasons such as identity hiding. The MN identity, if available, MUST be in NAI format.
MIP6-Agent-Info (AVP Code 486) is extended with the new PMIP6-IPv4-Home-Address sub-AVP to carry IPv4-MN-HoA alongside LMA addressing information and MN-HNP. If MIP-Home-Agent-Address is set to all zeroes (0::0), the receiver MUST ignore that sub-AVP.
MIP6-Feature-Vector AVP is extended with three new capability flag bits: PMIP6_SUPPORTED (0x0000010000000000) indicating PMIPv6 support, IP4_HOA_SUPPORTED (0x0000020000000000) indicating IPv4-MN-HoA assignment capability, and LOCAL_MAG_ROUTING_SUPPORTED (0x0000040000000000) indicating direct routing between MNs anchored to the same MAG.
MIP6-Home-Link-Prefix AVP (AVP Code 125) carries the MN-HNP. The low 64 bits of the prefix MUST be all zeroes. An all-zeroes value (0::0) in an LMA-to-HAAA request indicates that the LMA is delegating MN-HNP assignment to the HAAA.
Mobile-Node-Identifier AVP (AVP Code 506) is of type UTF8String and carries the MN-Identifier in NAI format. The MAG MUST use the received MN-Identifier if it has no other means to obtain it, but MUST silently discard it if it already has a valid mobile node identifier.
PMIP6-DHCP-Server-Address AVP (AVP Code 504) is of type Address and carries the IP address of the DHCP server assigned to the MAG for the attached MN. The Address type MUST be IPv4 for DHCPv4 server addresses and MUST be IPv6 for DHCPv6 server addresses.
PMIP6-IPv4-Home-Address AVP (AVP Code 505) is of type Address and carries the IPv4-MN-HoA. On the MAG-to-HAAA interface, it SHOULD only be present for statically provisioned MNs. On LMA-to-HAAA, a value of 0.0.0.0 in the request indicates delegation of IPv4-MN-HoA assignment to the HAAA.
PMIPv6 session termination uses standard Diameter Session-Termination-Request (STR) sent by LMA or MAG to HAAA, answered by Session-Termination-Answer (STA). Conversely, HAAA MAY send Abort-Session-Request (ASR) to LMA or MAG to request session termination, answered by Abort-Session-Answer (ASA).
Service-Configuration AVP (AVP Code 507) is a grouped AVP that pairs a service with an LMA, enabling the HAAA to inform the MAG of multiple subscribed services and their hosting LMAs in a single response. ABNF: `Service-Configuration ::= < AVP-Header: 507 > [ MIP6-Agent-Info ] [ Service-Selection ] * [ AVP ]`.
Four new Diameter AVP codes are registered: PMIP6-DHCP-Server-Address (504), PMIP6-IPv4-Home-Address (505), Mobile-Node-Identifier (506), and Service-Configuration (507).
Three new values are added to the Mobility Capability registry (MIP6-Feature-Vector AVP namespace from RFC 5447): PMIP6_SUPPORTED (0x0000010000000000), IP4_HOA_SUPPORTED (0x0000020000000000), and LOCAL_MAG_ROUTING_SUPPORTED (0x0000040000000000).
The security considerations of the Diameter Base protocol (RFC 3588), Diameter EAP application (RFC 4072), Diameter NASREQ application (RFC 4005), and Diameter Mobile IPv6 bootstrapping (RFC 5447) all apply. Diameter messages between the LMA and the Diameter server may traverse AAA brokers or Diameter agents, and security depends on the trustworthiness of these intermediaries.
PMIPv6 Diameter entities (HAAA, MAG, LMA) SHOULD be stateful and maintain the Authorization Session State Machine defined in RFC 3588. A PMIPv6 mobility session identified by BCE Lookup Keys MUST map to a single Diameter Session-Id; if service selection is also a differentiator, one Diameter Session-Id MUST map to the BCE Lookup Keys plus selected service combination.
Calling-Station-Id AVP (AVP Code 31) encodes the MN link-layer identifier in ASCII format, upper case only, with octet values separated by a hyphen (e.g., '00-23-32-C9-79-38'). This encoding matches MAC address encoding in RFC 3580 Section 3.21.
The extended MIP6-Agent-Info grouped AVP (AVP Code 486) ABNF: `MIP6-Agent-Info ::= < AVP-Header: 486 > *2[ MIP-Home-Agent-Address ] [ MIP-Home-Agent-Host ] [ MIP6-Home-Link-Prefix ] [ PMIP6-IPv4-Home-Address ] * [ AVP ]`.