RADIUS Support for Proxy Mobile IPv6
draft-xia-netext-radius-00

Versions: 00                                                            
Network Working Group                                             F. Xia
Internet-Draft                                               B. Sarikaya
Intended status: Standards Track                              Huawei USA
Expires: July 11, 2010                                       J. Korhonen
                                                  Nokia Siemens Networks
                                                           S. Gundavelli
                                                                   Cisco
                                                                D. Damic
                                                              Siemens AG
                                                         January 7, 2010


                  RADIUS Support for Proxy Mobile IPv6
                       draft-xia-netext-radius-00

Abstract

   This document defines new attributes to facilitate Proxy Mobile IPv6
   operations using RADIUS infrastructure.  The RADIUS interactions take
   place when the Mobile Node attaches, authenticates and authorizes to
   a Proxy Mobile IPv6 domain.  Furthermore, this document also defines
   a RADIUS based interface between the Local Mobility Anchor and the
   RADIUS server for authorizing received initial Proxy Binding Update
   messages for the mobility service session.  In addition to the
   mobility session setup related RADIUS interaction, this document
   defines the baseline for both the Mobile Access Gateway and the Local
   Mobility Anchor generated accounting.

Status of this Memo

   This Internet-Draft is submitted to IETF in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.



Xia, et al.               Expires July 11, 2010                 [Page 1]


Internet-Draft                RADIUS-PMIPv6                 January 2010


   This Internet-Draft will expire on July 11, 2010.

Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the BSD License.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.























Xia, et al.               Expires July 11, 2010                 [Page 2]


Internet-Draft                RADIUS-PMIPv6                 January 2010


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4
   3.  Solution Overview  . . . . . . . . . . . . . . . . . . . . . .  5
   4.  Attribute definitions  . . . . . . . . . . . . . . . . . . . .  8
     4.1.  MIP6-Feature-Vector  . . . . . . . . . . . . . . . . . . .  8
     4.2.  Mobile-Node-Identifier . . . . . . . . . . . . . . . . . . 10
     4.3.  PMIP6-Home-LMA-IPv6-Address  . . . . . . . . . . . . . . . 10
     4.4.  PMIP6-Visited-LMA-IPv6-Address . . . . . . . . . . . . . . 11
     4.5.  PMIP6-Home-LMA-IPv4-Address  . . . . . . . . . . . . . . . 12
     4.6.  PMIP6-Visited-LMA-IPv4-Address . . . . . . . . . . . . . . 13
     4.7.  PMIP6-Home-LMA-FQDN  . . . . . . . . . . . . . . . . . . . 14
     4.8.  PMIP6-Visited-LMA-FQDN . . . . . . . . . . . . . . . . . . 15
     4.9.  PMIP6-Home-HL-Prefix . . . . . . . . . . . . . . . . . . . 16
     4.10. PMIP6-Visited-HL-Prefix  . . . . . . . . . . . . . . . . . 17
     4.11. PMIP6-Home-Interface-ID  . . . . . . . . . . . . . . . . . 18
     4.12. PMIP6-Visited-Interface-ID . . . . . . . . . . . . . . . . 18
     4.13. PMIP6-Home-IPv4-HoA  . . . . . . . . . . . . . . . . . . . 19
     4.14. PMIP6-Visited-IPv4-HoA . . . . . . . . . . . . . . . . . . 20
     4.15. PMIP6-Home-DHCP4-Server-Address  . . . . . . . . . . . . . 21
     4.16. PMIP6-Visited-DHCP4-Server-Address . . . . . . . . . . . . 22
     4.17. PMIP6-Home-DHCP6-Server-Address  . . . . . . . . . . . . . 23
     4.18. PMIP6-Visited-DHCP6-Server-Address . . . . . . . . . . . . 24
     4.19. Service-Selection  . . . . . . . . . . . . . . . . . . . . 25
     4.20. Calling-Station-Id . . . . . . . . . . . . . . . . . . . . 26
   5.  MAG to RADIUS server interface . . . . . . . . . . . . . . . . 26
     5.1.  General  . . . . . . . . . . . . . . . . . . . . . . . . . 26
     5.2.  Table of Attributes  . . . . . . . . . . . . . . . . . . . 26
   6.  LMA to RADIUS server interface . . . . . . . . . . . . . . . . 27
     6.1.  General  . . . . . . . . . . . . . . . . . . . . . . . . . 27
     6.2.  Table of Attributes  . . . . . . . . . . . . . . . . . . . 27
   7.  Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . 28
     7.1.  Accounting at LMA  . . . . . . . . . . . . . . . . . . . . 28
     7.2.  Accounting at MAG  . . . . . . . . . . . . . . . . . . . . 28
     7.3.  Table of Attributes  . . . . . . . . . . . . . . . . . . . 28
   8.  Security Considerations  . . . . . . . . . . . . . . . . . . . 29
   9.  IANA consideration . . . . . . . . . . . . . . . . . . . . . . 29
     9.1.  Attribute Type Codes . . . . . . . . . . . . . . . . . . . 29
     9.2.  Namespaces . . . . . . . . . . . . . . . . . . . . . . . . 29
   10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 30
   11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 31
     11.1. Normative References . . . . . . . . . . . . . . . . . . . 31
     11.2. Informative references . . . . . . . . . . . . . . . . . . 31
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 33






Xia, et al.               Expires July 11, 2010                 [Page 3]


Internet-Draft                RADIUS-PMIPv6                 January 2010


1.  Introduction

   Proxy Mobile IPv6 (PMIPv6) [RFC5213] is network based mobility
   management protocol which allows IP mobility session continuity for a
   Mobile Node (MN) without its involvement in mobility management
   signaling.  A Mobile Access Gateway (MAG) represents the MN and is
   authorized to send mobility management signaling messages on behalf
   of the MN.  Before the MAG is able to perform the required mobility
   management signaling, it needs to know at minimum a Local Mobility
   Anchor (LMA) address and the MN Identifier (MN-ID).  This per MN
   Policy Profile (PP) information is stored in a Policy Store (PS),
   which may be local to the MAG or remote accessible, for example,
   through an authentication, authorization and accounting (AAA)
   infrastructure.

   This document defines a RADIUS [RFC2865] based profile and
   corresponding attributes to be used on the AAA interface between the
   MAG and the RADIUS server.  The interface that is used to download
   the per MN Policy Profile from the remote Policy Store.  The RADIUS
   interactions take place when the MN attaches, authenticates and
   authorizes to a PMIPv6 Domain.  Furthermore, this document also
   defines a RADIUS based interface between the LMA and the RADIUS
   server for authorizing received initial Proxy Binding Update (PBU)
   messages for the mobility service session.  In addition to the
   mobility session setup related RADIUS interaction, this document
   defines the baseline for both the MAG and the LMA generated
   accounting.


2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].

   The terminology in this document is based on the definitions found in
   [RFC5213] and [I-D.ietf-netlmm-pmip6-ipv4-support].  The following
   additional or clarified terms are also used in this document:

   Network Access Server (NAS):

      A device that provides an access service for a user to a network.
      In the context of this document the NAS may be integrated into or
      co-located to a MAG.  The NAS contains a Diameter client function.







Xia, et al.               Expires July 11, 2010                 [Page 4]


Internet-Draft                RADIUS-PMIPv6                 January 2010


   Home AAA (HAAA):

      An Authentication, Authorization, and Accounting (AAA) server
      located in MN's home network.  A HAAA is essentially a RADIUS
      server in this document.

   Visited AAA (VAAA):

      An Authentication, Authorization, and Accounting (AAA) server
      located in MN's visited network.  A VAAA is essentially a RADIUS
      server in this document.  When the MN moves to the visited
      network, VAAA acting as a proxy receives an authentication (or
      accounting) request from an AAA client (such as a NAS), forwards
      the request to a HAAA server, receives the reply from the HAAA,
      and sends that reply to the client, possibly with changes to
      reflect local administrative policy.



3.  Solution Overview

   This document defines RADIUS based AAA interactions between the MAG
   and the AAA, and between the LMA and the AAA.  The policy profile is
   downloaded from the AAA to the MAG during the MN attachment to the
   PMIPv6 Domain; the LMA request authorization to the RADIUS server
   when receiving initial Proxy Binding Update (PBU) messages for the
   mobility service session.

   When a MN attaches to a PMIPv6 Domain, a network access
   authentication procedure is usually started.  The choice of the
   authentication mechanism is specific to the access network
   deployment, but could be based on the Extensible Authentication
   Protocol (EAP) [RFC3748].  During the network access authentication
   procedure, the MAG acting as a Network Access Server (NAS) queries
   the HAAA through the AAA infrastructure using the RADIUS protocol.
   If the HAAA detects that the subscriber is also authorized for the
   PMIPv6 service, PMIPv6 specific information is returned along with
   the successful network access authentication answer to the MAG.

   After the MN has been successfully authenticated, the MAG sends a PBU
   to the LMA based on the MN's policy profile information.  Upon
   receiving the PBU, the LMA interacts with the HAAA through the AAA
   infrastructure,and fetches the relevant parts of the subscriber
   policy profile and authorization information related to the mobility
   service session.  In this specification, the AAA has the role of the
   PMIPv6 policy store.

   Based on administrative domains which the MAG and LMA belong to,



Xia, et al.               Expires July 11, 2010                 [Page 5]


Internet-Draft                RADIUS-PMIPv6                 January 2010


   there are three scenarios: the MAG and LMA are both in the home
   network, The MAG and LMA are both in the visited network, and The MAG
   is in the visited network while the LMA is in the home network.

   Figure 1 shows the participating network entities which are in the
   home network.  The MAG and LMA interact with the HAAA.


       +--------+
       | HAAA & |  RADIUS  +-----+
       | Policy |<-------->| LMA |
       | Profile|          +-----+
       +--------+             | <--- LMA-Address
            ^                 |
            |               // \\
        +---|------------- //---\\----------------+
       (    |  IPv4/IPv6  //     \\                )
       (    |   Network  //       \\               )
        +---|-----------//---------\\-------------+
            |          //           \\
          RADIUS      // <- Tunnel1  \\ <- Tunnel2
            |        //               \\
            |        |- MAG1-Address   |- MAG2-Address
            |     +----+             +----+
            +---->|MAG1|             |MAG2|
                  +----+             +----+
                     |                 |
                     |                 |
                   [MN1]             [MN2]


          Figure 1: The MAG and LMA are both in the home network

   Figure 2 shows both the LMA and the MAG are in the visited network.
   The MAG and LMA exchange signaling with the HAAA through the VAAA
   which acts as a proxy.  Some visited network specific information may
   be added to the replies from HAAA to the MAG and LMA.














Xia, et al.               Expires July 11, 2010                 [Page 6]


Internet-Draft                RADIUS-PMIPv6                 January 2010


                       +---------------+
                       |    HAAA &     |
            +----------| Policy Profile|
            |          +---------------+
            |
       +--------+
       | VAAA & |  RADIUS  +-----+
       | Policy |<-------->| LMA |
       | Profile|          +-----+
       +--------+             | <--- LMA-Address
            ^               // \\
        +---|------------- //---\\----------------+
       (    |  IPv4/IPv6  //     \\                )
       (    |   Network  //       \\               )
        +---|-----------//---------\\-------------+
            |          //           \\
          RADIUS      // <- Tunnel1  \\ <- Tunnel2
            |        //               \\
            |        |- MAG1-Address   |- MAG2-Address
            |     +----+             +----+
            +---->|MAG1|             |MAG2|
                  +----+             +----+
                     |                 |
                   [MN1]             [MN2]


         Figure 2: The MAG and LMA are both in the visited network

   Figure 3 illustrates the MAG is in the visited network while the LMA
   is in the home network.  Any message between the MAG and the HAAA is
   through the VAAA acting as a proxy.  Some visited network specific
   policy may also be downloaded from the VAAA to the MAG.  The LMA
   accesses HAAA without any proxying.


















Xia, et al.               Expires July 11, 2010                 [Page 7]


Internet-Draft                RADIUS-PMIPv6                 January 2010


                       +---------------+
                       |    HAAA &     |
            +----------| Policy Profile|
            |          +---------------+
            |                 |
            |               RADIUS
       +--------+             |
       | VAAA & |          +-----+
       | Policy |          | LMA |
       | Profile|          +-----+
       +--------+             | <--- LMA-Address
            ^               // \\
        +---|------------- //---\\----------------+
       (    |  IPv4/IPv6  //     \\                )
       (    |   Network  //       \\               )
        +---|-----------//---------\\-------------+
            |          //           \\
          RADIUS      // <- Tunnel1  \\ <- Tunnel2
            |        //               \\
            |        |- MAG1-Address   |- MAG2-Address
            |     +----+             +----+
            +---->|MAG1|             |MAG2|
                  +----+             +----+
                     |                 |
                   [MN1]             [MN2]


               Figure 3: Only MAG is in the visited network


4.  Attribute definitions

4.1.  MIP6-Feature-Vector

   Diameter [RFC3588] reserves AVP Code space 1-255 as RADIUS attribute
   compatibility space.  The MIP6-Feature-Vector AVP (AVP Code 124)
   defined in [RFC5447] is of type Unsigned64 and contains a 64-bit
   flags field of supported mobility capabilities.  This document
   reserves new capability bits according to the rules in [RFC5447], and
   reuses some of capability bits defined in [I-D.ietf-dime-pmip6].  The
   following capability flag bits are defined or used in this document:

   PMIP6_SUPPORTED (0x0000010000000000)

      This is defined in [I-D.ietf-dime-pmip6].  When the MAG/NAS sets
      this bit in the MIP6-Feature-Vector attribute, it is an indication
      to the RADIUS server that the NAS supports PMIPv6.  When the
      RADIUS server sets this bit in the response MIP6-Feature-Vector



Xia, et al.               Expires July 11, 2010                 [Page 8]


Internet-Draft                RADIUS-PMIPv6                 January 2010


      AVP, it indicates that the RADIUS server also has PMIPv6 support.
      This capability flag bit can also be used to allow PMIPv6 mobility
      support in a subscription granularity.

   IP4_HOA_SUPPORTED (0x0000020000000000)

      This is defined in [I-D.ietf-dime-pmip6].  Assignment of the IPv4-
      HoA is supported [I-D.ietf-netlmm-pmip6-ipv4-support].  When the
      MAG sets this bit in the MIP6-Feature-Vector attribute, it
      indicates that the MAG implements a minimal functionality of a
      DHCP server (and a relay) and is able to deliver IPv4-HoA to the
      MN.  When the RADIUS server sets this flag bit in the response
      MIP6-Feature-Vector attribute, it indicates that the RADIUS server
      has authorized the use of IPv4-HoA for the MN.  If this bit is
      unset in the returned MIP6-Feature-Vector attribute, the RADIUS
      server does not authorize the configuration of IPv4 address.

   LOCAL_MAG_ROUTING_SUPPORTED (0x0000040000000000)

      This is defined in [I-D.ietf-dime-pmip6].  Direct routing of IP
      packets between MNs anchored to the same MAG is supported.  When a
      MAG sets this flag bit in the MIP6-Feature-Vector, it indicates
      that routing IP packets between MNs anchored to the same MAG is
      supported, without reverse tunneling packets via the LMA or
      requiring any Route Optimization related signaling (e.g. the
      Return Routability Procedure in [RFC3775]) prior to direct
      routing.  If this flag bit is unset in the returned MIP6-Feature-
      Vector AVP, the RADIUS server does not authorize direct routing of
      packets between MNs anchored to the same MAG.  This policy feature
      MUST be supported per MN and subscription basis.

   IP4_TRANSPORT_SUPPORTED (0x0000080000000000)

      This document defines this bit for IPv4 transport support
      negotiation between the MAG and AAA.  When the MAG sets this flag
      bit in the MIP6-Feature-Vector, it indicates that IPv4 transport
      is used for traffic between the MAG and the LMA.  If this flag bit
      is unset in the returned MIP6-Feature-Vector AVP, the AAA does not
      authorize IPv4 transport.


   The MIP6-Feature-Vector attribute is also used on the LMA to the
   RADIUS server interface.  Using the capability announcement attribute
   it is possible to perform a simple capability negotiation between the
   LMA and the RADIUS server.  Those capabilities that are announced by
   both parties are also known to be mutually supported.





Xia, et al.               Expires July 11, 2010                 [Page 9]


Internet-Draft                RADIUS-PMIPv6                 January 2010


4.2.  Mobile-Node-Identifier

   The Mobile-Node-Identifier attribute is of String and contains the
   mobile node identifier (MN-Identifier, see [RFC5213]) in a NAI
   [RFC4282] format.  This AVP is used on the MAG to the RADIUS server
   interface.  The Mobile-Node-Identifier attribute is designed for
   deployments where the MAG does not have a way to find out such MN
   identity that could be used in subsequent PBU/PBA exchanges (e.g.,
   due to identity hiding during the network access authentication) or
   the HAAA wants to assign periodically changing identities to the MN.

   The Mobile-Node-Identifier attribute is returned in the Access-Accept
   message that ends a successful authentication (and possibly an
   authorization) exchange between the MAG and the HAAA, assuming the
   HAAA is also able to provide the MAG with the MN-Identifier in the
   first place.


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |   Mobile Node Identifier...   ~
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

     Mobile-Node-Identifier to be defined by IANA.

   Length:

      >= 3 octets

   Mobile Node Identifier:

      This field is of type String and contains the MN-ID
      of the MN to be used in the PBUs.


4.3.  PMIP6-Home-LMA-IPv6-Address

   Before the MAG can engage in Proxy Mobile IPv6 signaling with the
   LMA, it should either know the IP address of the LMA via pre-
   configuration, or dynamically discover it.  After the MN has been
   successfully authenticated, the MAG can get the IPv6 address of the
   LMA by downloading MN's policy profile information from AAA.

   When the LMA is located in the home network, this attribute MAY be
   sent by the HAAA to the MAG in an Access-Accept packet.  The



Xia, et al.               Expires July 11, 2010                [Page 10]


Internet-Draft                RADIUS-PMIPv6                 January 2010


   attribute carries the home LMA IPv6 address being assigned to the
   MAG.


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |          Reserved             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                   Home LMA IPv6 address                       |
   .                        ...  ...                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

     PMIP6-Home-LMA-IPv6-Address to be defined by IANA.

   Length:

      = 20 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Home LMA IPv6 address:

      128-bit IPv6 address of the assigned home LMA IPv6 address.



4.4.  PMIP6-Visited-LMA-IPv6-Address

   Figure 1 shows the interactions among the MAG, LMA, and AAA server.
   When the mobile node moves into a visited network, the MAG interacts
   with the HAAA through a visited AAA, and a visited LMA may be
   assigned by the visited AAA during the interaction.

   This attribute MAY be sent by the MAG to the VAAA in an Access-
   Request packet as a proposal by the MAG to allocate LMAs to the MN.
   This attribute MAY be sent by the VAAA to the MAG in an Access-Accept
   packet.  The attribute carries the visited LMA IPv6 address being
   assigned to the MAG.







Xia, et al.               Expires July 11, 2010                [Page 11]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |          Reserved             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                   Visited LMA IPv6 address                    |
   .                        ...  ...                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

     PMIP6-Visited-LMA-IPv6-Address to be defined by IANA.

   Length:

      = 20 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Visited LMA IPv6 address:

      128-bit IPv6 address of the assigned visited LMA IPv6 address.



4.5.  PMIP6-Home-LMA-IPv4-Address

   [I-D.ietf-netlmm-pmip6-ipv4-support] supports Proxy Mobile IPv6
   signaling exchange between the MAG and LMA over IPv4 transport,that
   is, the LMA has an IPv4 address.

   The PMIP6-Home-LMA-IPv4-Address attribute contains the IPv4 address
   of the LMA assigned by the HAAA.  When the LMA is located in the home
   network, this attribute MAY be sent by the HAAA to the MAG in an
   Access-Accept packet.













Xia, et al.               Expires July 11, 2010                [Page 12]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |         Reserved              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Home LMA IPv4 address                     |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

     PMIP6-Home-LMA-IPv4-Address to be defined by IANA.

   Length:

      = 8 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Home LMA IPv4 address:

      32-bit IPv4 address of the assigned LMA.



4.6.  PMIP6-Visited-LMA-IPv4-Address

   When the LMA with IPv4 address is located in the visited network, the
   VAAA may assign the LMA to the MAG during MN's authentication.

   PMIP6-Visited-LMA-IPv4-Address attribute MAY be sent by the MAG to
   VAAA in an Access-Request packet as a proposal by the MAG to allocate
   a LMA to the MN.  This attribute MAY be sent by the VAAA to the MAG
   in an Access-Accept packet.















Xia, et al.               Expires July 11, 2010                [Page 13]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |         Reserved              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                     Visited LMA IPv4 address                  |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

     PMIP6-Visited-LMA-IPv4-Address to be defined by IANA.

   Length:

      = 8 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   IPv4 LMA address:

      32-bit IPv4 address of the assigned LMA.



4.7.  PMIP6-Home-LMA-FQDN

   An AAA server may assign an Fully Qualified Domain Name (FQDN) of the
   LMA to the MAG.  The MAG can perform DNS query with the FQDN to
   derive the LMA address.  When the LMA is located in the home network,
   PMIP6-Home-LMA-FQDN contains FQDN of the LMA.

   This attribute is sent by the HAAA to the MAG in an Access-Accept
   packet.  The attribute carries the FQDN of the assigned LMA.















Xia, et al.               Expires July 11, 2010                [Page 14]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |      FQDN of home LMA....
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

      PMIP6-Home-LMA-FQDN to be defined by IANA.

   Length:

      Variable length.

   FQDN of the assigned HA:

      The data field MUST contain a FQDN as described in RFC 1035.



4.8.  PMIP6-Visited-LMA-FQDN

   When the LMA is located in the visited network, PMIP6-Home-LMA-FQDN
   MAY be sent by the MAG to VAAA in an Access-Request packet as a
   proposal by the MAG to allocate a LMA to the MN.  This attribute is
   sent by VAAA to the MAG in an Access-Accept packet.  The attribute
   carries the FQDN of the assigned LMA.


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |       FQDN of visited LMA....
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

      PMIP6-Visited-LMA-FQDN to be defined by IANA.

   Length:

      Variable length.

   FQDN of the assigned HA:

      The data field MUST contain a FQDN as described in RFC 1035.





Xia, et al.               Expires July 11, 2010                [Page 15]


Internet-Draft                RADIUS-PMIPv6                 January 2010


4.9.  PMIP6-Home-HL-Prefix

   Mobile Node's Home Network Prefix (MN-HNP) is a prefix assigned to
   the link between the MN and the MAG.  The MN configures its interface
   from its home network prefix(es).  When the LMA is located in the
   home network, PMIP6-Home-HL-Prefix attribute is used to carry the MN-
   HNP from the HAAA to the MAG.  The low 64 bits of the prefix MUST be
   all zeroes.

   The PMIP6-Home-HL-Prefix attribute is also used on the LMA-to-HAAA
   interface containing the prefix assigned to the MN.  If the LMA
   delegates the assignment of the MN-HNP to the HAAA, the AVP MUST
   contain all zeroes address (i.e., 0::0) in the request message.  If
   the LMA delegated the MN-HNP assignment to the HAAA, then the AVP
   contains the HAAA assigned MN-HNP in the response message.


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |   Reserved    | Prefix-Length |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   .                       Home Link Prefix                        .
   .                                                               .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

      PMIP6-Home-HL-Prefix to be defined by IANA.

   Length:

      = 20 octets.

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Prefix-Length:

      This field indicates the prefix length of the Home Link Prefix.

   Home Link Prefix:

      Home link prefix for the MN's address configuration.




Xia, et al.               Expires July 11, 2010                [Page 16]


Internet-Draft                RADIUS-PMIPv6                 January 2010


4.10.  PMIP6-Visited-HL-Prefix

   When the LMA is located in the visited network, PMIP6-Visited-HL-
   Prefix attribute is used to carry the MN-HNP, if available, from the
   VAAA to the MAG.  The low 64 bits of the prefix MUST be all zeroes.

   The PMIP6-Visited-HL-Prefix attribute is also used on the LMA to VAAA
   interface containing the prefix assigned to the MN.  If the LMA
   delegates the assignment of the MN-HNP to the VAAA, the AVP MUST
   contain all zeroes address (i.e., 0::0) in the request message.  If
   the LMA delegated the MN-HNP assignment to the VAAA, then the AVP
   contains the VAAA assigned MN-HNP in the response message.


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |   Reserved    | Prefix-Length |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   .                     Visited Home Link Prefix                  .
   .                                                               .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

      PMIP6-Visited-HL-Prefix to be defined by IANA.

   Length:

      = 20 octets.

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Prefix-Length:

      This field indicates the prefix length of the Home Link.

   Visited Home Link Prefix:

      Home link prefix for the MN's address configuration.







Xia, et al.               Expires July 11, 2010                [Page 17]


Internet-Draft                RADIUS-PMIPv6                 January 2010


4.11.  PMIP6-Home-Interface-ID

   The home link prefixes assigned to the mobile node have to be
   maintained on a per-interface basis.  When the LMA is located in the
   home network, PMIP6-Home-Interface-ID attribute conveys 64 bits
   interface identifier representing different interfaces.  There can be
   multiple unique home link prefix for each interface of the mobile
   node.  In some cases, the attribute may be assigned by the HAAA for
   MN-HoA formulation.

   This attribute MAY be sent by the LMA or the MAG to the HAAA in an
   Access-Request packet as a proposal.  This attribute MAY be sent by
   HAAA to the LMA in an Access-Accept packet.


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |          Reserved             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   .                   Home Interface Identifier                   .
   .                                                               .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

      PMIP6-Home-Interface-ID to be defined by IANA.

   Length:

      = 12 octets.

   Home Interface Identifier:

      64 bits long using for differentiating different interfaces of the
      MN.


4.12.  PMIP6-Visited-Interface-ID

   When the LMA is located in the visited network, PMIP6-Visited-
   Interface-ID attribute MAY be sent by the LMA or the MAG to the VAAA
   in an Access-Request packet as a proposal.  This attribute MAY be
   sent by the VAAA to the LMA in an Access-Accept packet.






Xia, et al.               Expires July 11, 2010                [Page 18]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |          Reserved             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   .                 Visited Interface Identifier                  .
   .                                                               .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

      PMIP6-Home-Interface-ID to be defined by IANA.

   Length:

      = 12 octets.

   Visited Interface Identifier:

      64 bits long using for differentiating different interfaces of the
      mobile node.


4.13.  PMIP6-Home-IPv4-HoA

   [I-D.ietf-netlmm-pmip6-ipv4-support] specifies extensions to Proxy
   Mobile IPv6 protocol which enable IPv4 home address mobility support
   to the MN.  The PMIP6-Home-IPv4-HoA attribute is of type Address and
   contains the IPv4-HoA of the MN.  The primary use of this attribute
   is to carry the IPv4-HoA from the HAAA to the MAG.

   The PMIP6-Home-IPv4-HoA is also used on the LMA-to-HAAA interface.
   If the LMA in the home network delegates the assignment of the IPv4-
   HoA to the HAAA, the attribute MUST contain all zeroes address in the
   request message, and then the attribute contains the HAAA assigned
   IPv4-HoA in the response message.














Xia, et al.               Expires July 11, 2010                [Page 19]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |        Reserved               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Home IPv4 HoA                              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


   Type:

     PMIP6-Home-IPv4-HoA to be defined by IANA.

   Length:

      = 8 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Home IPv4 HoA:
      This field is of type Address and contains the  IPv4 home
      address of the MN in the home network.


4.14.  PMIP6-Visited-IPv4-HoA

   When both the MAG and the LMA are in the visited network, the PMIP6-
   Visited-IPv4-HoA is used for containing IPv4-HoA of the MN.  This
   attribute is of type Address and the primary usage is to carry the
   IPv4-HoA from VAAA to the MAG.

   The PMIP6-Visited-IPv4-HoA is also used on the LMA-to-VAAA interface.
   If the LMA delegates the assignment of the IPv4-HoA to the VAAA, the
   attribute MUST contain all zeroes address in the request message, and
   then the attribute contains the VAAA assigned IPv4-HoA in the
   response message.












Xia, et al.               Expires July 11, 2010                [Page 20]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |        Reserved               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                  Visited IPv4 HoA                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


   Type:

     PMIP6-Visited-IPv4-HoA to be defined by IANA.

   Length:

      = 8 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Visited IPv4 HoA:

      This field is of type Address and contains the  IPv4 home
      address of the MN in the visited network.


4.15.  PMIP6-Home-DHCP4-Server-Address

   The PMIP6-Home-DHCP4-Server-Address contains the IP address of the
   DHCPv4 server in the home network assigned to the MAG serving the
   newly attached MN.  The HAAA MAY assign a DHCP server to the MAG in
   deployments where the MAG acts as a DHCP Relay
   [I-D.ietf-netlmm-pmip6-ipv4-support].
















Xia, et al.               Expires July 11, 2010                [Page 21]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |          Reserved             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |              Home DHCPv4 server address                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


   Type:

     PMIP6-Home-DHCP4-Server-Address to be defined by IANA.

   Length:

      = 8 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Home DHCPv4 server address:

      This field contains 4-octet DHCPv4 server address for the MN in
      the home network.


4.16.  PMIP6-Visited-DHCP4-Server-Address

   When both the MAG and the LMA are in the visited network, the PMIP6-
   Visited-DHCP4-Server-Address contains the IP address of the DHCPv4
   server in the visited network assigned to the MAG serving the newly
   attached MN.  The VAAA MAY assign a DHCPv4 server to the MAG in
   deployments where the MAG acts as a DHCP Relay
   [I-D.ietf-netlmm-pmip6-ipv4-support].















Xia, et al.               Expires July 11, 2010                [Page 22]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |          Reserved             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |              Visited DHCPv4 server address                    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


   Type:

     PMIP6-Visited-DHCP4-Server-Address to be defined by IANA.

   Length:

      = 8 octets

   Reserved:

      Reserved for future use.  The bits MUST be set to zero by the
      sender, and MUST be ignored by the receiver.

   Visited DHCPv4 server address:

      This field contains 4-octet DHCPv4 server address for the MN in
      the visited network.


4.17.  PMIP6-Home-DHCP6-Server-Address

   The PMIP6-Home-DHCP6-Server-Address contains the IP address of the
   DHCPv6 server in the home network assigned to the MAG serving the
   newly attached MN.  The HAAA MAY assign a DHCPv6 server to the MAG in
   deployments where the MAG acts as a DHCP Relay [RFC5213].

















Xia, et al.               Expires July 11, 2010                [Page 23]


Internet-Draft                RADIUS-PMIPv6                 January 2010


  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |      Type     |   Length      |          Reserved             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                                                               |
 .                  Home DHCPv6 server address                   .
 .                                                               .
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


 Type:

   PMIP6-Home-DHCP6-Server-Address to be defined by IANA.

 Length:

    = 20 octets

 Reserved:

    Reserved for future use.  The bits MUST be set to zero by the
    sender, and MUST be ignored by the receiver.

 Home DHCPv6 server address:

    This field contains 16-octet DHCPv6 server address for the MN in the
    home network.


4.18.  PMIP6-Visited-DHCP6-Server-Address

   When both the MAG and the LMA are in the visited network, the PMIP6-
   Visited-DHCP6-Server-Address contains the IP address of the DHCPv6
   server in the visited network assigned to the MAG serving the newly
   attached MN.  The VAAA MAY assign a DHCPv6 server to the MAG in
   deployments where the MAG acts as a DHCP Relay [RFC5213].














Xia, et al.               Expires July 11, 2010                [Page 24]


Internet-Draft                RADIUS-PMIPv6                 January 2010


  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |      Type     |   Length      |          Reserved             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                                                               |
 .                  Visited DHCPv6 server address                .
 .                                                               .
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


 Type:

   PMIP6-Visited-DHCP6-Server-Address to be defined by IANA.

 Length:

    = 20 octets

 Reserved:

    Reserved for future use.  The bits MUST be set to zero by the
    sender, and MUST be ignored by the receiver.

 Visited DHCPv6 server address:

    This field contains 16-octet DHCPv6 server address for the MN in the
    visited network.


4.19.  Service-Selection

   The Service-Selection attribute is of type String and contains the
   name of the service or the external network that the mobility service
   should be associated with.  The RADIUS server MAY return the Service-
   Selection attribute to the MAG and in that way indicate the default
   service to the MAG.  Between the LMA to the RADIUS server interface,
   the LMA MAY populate the Service-Selection attribute with the service
   information found from the received PBU, if such information is
   available [RFC5149].











Xia, et al.               Expires July 11, 2010                [Page 25]


Internet-Draft                RADIUS-PMIPv6                 January 2010


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |    Service Identifier...      ~
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:

     Service-Selection to be defined by IANA.

   Length:

      >= 3 octets

   Service Identifier:
      This field is of type String and contains the Service Identifier
      the MN MUST be associated with.


4.20.  Calling-Station-Id

   The Calling-Station-Id attribute is of type String and contains a
   Link-Layer Identifier of the MN.  This identifier may correspond to a
   real physical interface or something that the MAG has generated.


5.  MAG to RADIUS server interface

5.1.  General

   The MAG to the RADIUS server interface is primarily used for
   downloading the Policy Profile (i.e., to bootstrap the PMIPv6
   mobility service session) when a MN attaches and authenticates and
   authorizes to a PMIPv6 domain.  Whenever the MAG sends a RADIUS
   request message to the RADIUS server, the User-Name attribute SHOULD
   contain the MN identity.  At minimum the home realm of the MN MUST be
   available at the MAG when the network access authentication takes
   place.  Otherwise the MAG is not able to route the RADIUS request
   messages towards the correct RADIUS server.  The MN identity MUST be
   in Network Access Identifier (NAI) [RFC4282] format.

5.2.  Table of Attributes

   The following table provides a guide to which attributes may be found
   in authentication and authorization process.






Xia, et al.               Expires July 11, 2010                [Page 26]


Internet-Draft                RADIUS-PMIPv6                 January 2010


   Request   Accept   Reject   Challenge   #    Attribute
   0         0-1      0        0           TBD  PMIP6-Home-LMA-IPv6-Address
   0-1       0-1      0        0           TBD  PMIP6-Visited-LMA-IPv6-Address
   0         0-1      0        0           TBD  PMIP6-Home-LMA-IPv4-Address
   0-1       0-1      0        0           TBD  PMIP6-Visited-LMA-IPv4-Address
   0         0-1      0        0           TBD  PMIP6-Home-LMA-FQDN
   0-1       0-1      0        0           TBD  PMIP6-Visited-LMA-FQDN
   0         0-1      0        0           TBD  PMIP6-Home-HL-Prefix
   0         0-1      0        0           TBD  PMIP6-Visited-HL-Prefix
   0         0-1      0        0           TBD  PMIP6-Home-Interface-ID
   0         0-1      0        0           TBD  PMIP6-Visited-Interface-ID
   0         0-1      0        0           TBD  PMIP6-Home-IPv4-HoA
   0         0-1      0        0           TBD  PMIP6-Visited-IPv4-HoA
   0         0-1      0        0           TBD  PMIP6-Home-DHCP4-Server-Address
   0-1       0-1      0        0           TBD  PMIP6-Visited-DHCP4-Server-Address
   0         0-1      0        0           TBD  PMIP6-Home-DHCP6-Server-Address
   0-1       0-1      0        0           TBD  PMIP6-Visited-DHCP6-Server-Address
   0         1        0        0           TBD  Mobile-Node-Identifier
   0-1       0-1      0        0           124  MIP6-Feature-Vector
   0-1       0-1      0        0           TBD  Service-Selection
   0-1       0        0        0           31   Calling-Station-Id



6.  LMA to RADIUS server interface

6.1.  General

   The LMA-to-HAAA interface may be used for multiple purposes.  These
   include the authorization of the incoming PBU, updating the LMA
   address to the HAAA, accounting and PMIPv6 session management.

6.2.  Table of Attributes

   The following table provides a guide to which attributes may be found
   in authentication and authorization process.


   Request   Accept   Reject   Challenge   #    Attribute
   0-1       0-1      0        0           TBD  PMIP6-Home-HL-Prefix
   0-1       0-1      0        0           TBD  PMIP6-Home-IPv4-HoA
   0         0-1      0        0           TBD  PMIP6-Home-Interface-ID
   0         0-1      0        0           TBD  PMIP6-Visited-Interface-ID
   1         0        0        0           TBD  Mobile-Node-Identifier
   0-1       0-1      0        0           124  MIP6-Feature-Vector
   0-1       0-1      0        0           TBD  Service-Selection
   0-1       0        0        0           31   Calling-Station-Id




Xia, et al.               Expires July 11, 2010                [Page 27]


Internet-Draft                RADIUS-PMIPv6                 January 2010


7.  Accounting

7.1.  Accounting at LMA

   The accounting at the LMA to AAA server interface is based on
   [RFC2865] and [RFC2866].  The interface must support the transfer of
   accounting records needed for service control and charging.  These
   include (but may not be limited to): time of binding cache entry
   creation and deletion, octets sent and received by the MN in bi-
   directional tunneling, etc.

7.2.  Accounting at MAG

   The accounting at the MAG to AAA server interface is based on
   [RFC2865] and [RFC2866].  The interface must also support the
   transfer of accounting records which include: time of binding cache
   entry creation and deletion, octets sent and received by the MN in
   bi-directional tunneling, etc.

   If there is data traffic between a visiting mobile node and a
   correspondent node that is locally attached to an access link
   connected to the mobile access gateway, the mobile access gateway MAY
   optimize on the delivery efforts by locally routing the packets and
   by not reverse tunneling them to the mobile node's local mobility
   anchor.  In this case, local data traffic MUST be reported to AAA
   servers through RADIUS protocol.

7.3.  Table of Attributes

   The following table provides a guide to which attributes may be found
   in accounting messages.


         Request   Interim  Stop     Attribute
         0-1       0        0-1      PMIP6-Home-LMA-IPv6-Address
         0-1       0        0-1      PMIP6-Visited-LMA-IPv6-Address
         0-1       0        0-1      PMIP6-Home-LMA-IPv4-Address
         0-1       0        0-1      PMIP6-Visited-LMA-IPv4-Address
         0-1       0        0-1      PMIP6-Home-HL-Prefix
         0-1       0        0-1      PMIP6-Visited-HL-Prefix
         0-1       0        0-1      PMIP6-Home-IPv4-HoA
         0-1       0        0-1      PMIP6-Visited-IPv4-HoA
         0-1       0        0-1      Service-Selection
         0-1       0        0-1      MIP6-Feature-Vector
         0-1       0-1      0-1      Mobile-Node-Identifier
         0-1       0        0-1      Calling-Station-Id





Xia, et al.               Expires July 11, 2010                [Page 28]


Internet-Draft                RADIUS-PMIPv6                 January 2010


8.  Security Considerations

   The RADIUS messages may be transported between the MAG and/or the LMA
   to the RADIUS server via one or more AAA brokers or RADIUS proxies.
   In this case the HA to the RADIUS server AAA communication relies on
   the security properties of the intermediate AAA brokers and RADIUS
   proxies.


9.  IANA consideration

9.1.  Attribute Type Codes

   This specification defines the following new RADIUS attribute type
   codes:


           Mobile-Node-Identifier             is set to TBD
           PMIP6-Home-LMA-IPv6-Address        is set to TBD
           PMIP6-Visited-LMA-IPv6-Address     is set to TBD
           PMIP6-Home-LMA-IPv4-Address        is set to TBD
           PMIP6-Visited-LMA-IPv4-Address     is set to TBD
           PMIP6-Home-LMA-FQDN                is set to TBD
           PMIP6-Visited-LMA-FQDN             is set to TBD
           PMIP6-Home-HL-Prefix               is set to TBD
           PMIP6-Visited-HL-Prefix            is set to TBD
           PMIP6-Home-Interface-ID            is set to TBD
           PMIP6-Visited-Interface-ID         is set to TBD
           PMIP6-Home-IPv4-HoA                is set to TBD
           PMIP6-Visited-IPv4-HoA             is set to TBD
           PMIP6-Home-DHCP4-Server-Address    is set to TBD
           PMIP6-Visited-DHCP4-Server-Address is set to TBD
           PMIP6-Home-DHCP6-Server-Address    is set to TBD
           PMIP6-Visited-DHCP6-Server-Address is set to TBD
           Service-Selection                  is set to TBD
           Calling-Station-Id                 is set to TBD


9.2.  Namespaces

   This specification defines new values to the Mobility Capability
   registry (see [RFC5447]) for use with the MIP6- Feature-Vector AVP:


     Token                             | Value
     ----------------------------------+--------------------
     PMIP6_SUPPORTED                   | 0x0000010000000000
     IP4_HOA_SUPPORTED                 | 0x0000020000000000



Xia, et al.               Expires July 11, 2010                [Page 29]


Internet-Draft                RADIUS-PMIPv6                 January 2010


     LOCAL_MAG_ROUTING_SUPPORTED       | 0x0000040000000000
     IP4_TRANSPORT_SUPPORTED           | 0x0000080000000000



10.  Acknowledgements

   The authors would like to thank Glen Zorn, Avi Lior for reviewing the
   document.  The authors would also like to thank the authors of
   [I-D.ietf-dime-pmip6] as this document re-uses some procedural ideas
   of the mentioned specification.








































Xia, et al.               Expires July 11, 2010                [Page 30]


Internet-Draft                RADIUS-PMIPv6                 January 2010


11.  References

11.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
              "Remote Authentication Dial In User Service (RADIUS)",
              RFC 2865, June 2000.

   [RFC5213]  Gundavelli, S., Leung, K., Devarapalli, V., Chowdhury, K.,
              and B. Patil, "Proxy Mobile IPv6", RFC 5213, August 2008.

   [RFC4282]  Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The
              Network Access Identifier", RFC 4282, December 2005.

   [RFC5447]  Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C.,
              and K. Chowdhury, "Diameter Mobile IPv6: Support for
              Network Access Server to Diameter Server Interaction",
              RFC 5447, February 2009.

   [RFC3588]  Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
              Arkko, "Diameter Base Protocol", RFC 3588, September 2003.

11.2.  Informative references

   [RFC2866]  Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.

   [RFC3748]  Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
              Levkowetz, "Extensible Authentication Protocol (EAP)",
              RFC 3748, June 2004.

   [RFC5149]  Korhonen, J., Nilsson, U., and V. Devarapalli, "Service
              Selection for Mobile IPv6", RFC 5149, February 2008.

   [RFC3775]  Johnson, D., Perkins, C., and J. Arkko, "Mobility Support
              in IPv6", RFC 3775, June 2004.

   [I-D.ietf-netlmm-pmip6-ipv4-support]
              Wakikawa, R. and S. Gundavelli, "IPv4 Support for Proxy
              Mobile IPv6", draft-ietf-netlmm-pmip6-ipv4-support-17
              (work in progress), September 2009.

   [I-D.ietf-dime-pmip6]
              Korhonen, J., Bournelle, J., Chowdhury, K., Muhanna, A.,
              and U. Meyer, "Diameter Proxy Mobile IPv6: Mobile Access
              Gateway and Local Mobility Anchor Interaction with



Xia, et al.               Expires July 11, 2010                [Page 31]


Internet-Draft                RADIUS-PMIPv6                 January 2010


              Diameter Server", draft-ietf-dime-pmip6-04 (work in
              progress), September 2009.

















































Xia, et al.               Expires July 11, 2010                [Page 32]


Internet-Draft                RADIUS-PMIPv6                 January 2010


Authors' Addresses

   Frank Xia
   Huawei USA
   1700 Alma Dr. Suite 500
   Plano, TX  75075

   Phone: +1 972-509-5599
   Email: xiayangsong@huawei.com


   Behcet Sarikaya
   Huawei USA
   1700 Alma Dr. Suite 500
   Plano, TX  75075

   Phone: +1 972-509-5599
   Email: sarikaya@ieee.org


   Jouni Korhonen
   Nokia Siemens Networks

   Email: jouni.nospam@gmail.com


   Sri Gundavelli
   Cisco
   170 West Tasman Drive
   San Jose, CA  95134

   Email: sgundave@cisco.com


   Damjan Damic
   Siemens AG

   Email: damjan.damic@siemens.com













Xia, et al.               Expires July 11, 2010                [Page 33]