Cisco Mobile Wireless Home Agent Release 5.2 for Cisco IOS Release 12.4(22)YD2
Assigning a Home Address on the Home Agent
Downloads: This chapterpdf (PDF - 164.0KB) The complete bookPDF (PDF - 5.78MB) | Feedback

Assigning a Home Address on the Home Agent

Table Of Contents

Assigning a Home Address on the Home Agent

Home Address Assignment

Address Assignment Feature

Static IP Address

Static Home Addressing Without NAI

Static Home Addressing with NAI

Local Authorization

AAA Authorization

Dynamic Home Agent Assignment

Dynamic IP Address

Fixed Addressing

Local Pool Assignment

DHCP Allocation

Dynamic Addressing from AAA

Address Assignment for Same NAI - Multiple Static Addresses

Address Assignment For Same NAI - Different Mobile Terminal

Configuration Examples

DHCP-Proxy-Client Configuration


Assigning a Home Address on the Home Agent


This chapter discusses how the Cisco Mobile Wireless Home Agent assigns home addresses to a mobile node, the different address types, and provides configuration details and examples.

This chapter includes the following sections:

Home Address Assignment

Address Assignment Feature

Static IP Address

Dynamic Home Agent Assignment

Dynamic IP Address

Configuration Examples

Home Address Assignment

The Home Agent assigns a home address to the mobile node based on user NAI received during Mobile IP registration. The IP addresses assigned to a mobile station may be statically or dynamically assigned. The Home Agent does not permit simultaneous registrations for different NAIs with the same IP address, whether it is statically or dynamically assigned.

Address Assignment Feature

The Address Assignment with session overwrite feature removes a stale session to allow a new session to be established for a device. The MAC address of the device remains the same, but the NAI (which may be obtained from outer EAP identity) and HoA may change.

The NAI realm (i.e., not the Home Address field in the RRQ) determines if static IP pool or dynamic IP pool address management is used.

In Home Agent Release 5.0, both CMIPv4 and PMIPv4 are supported. The address management performed is based on the MAC address in the registration.

The following conditions apply for a RRQ with and without MAC address (provided in the PMIPv4 Device ID Extension):

If RRQ does not contain MAC address (CMIP), the session is managed based on R4.0 matrix

If RRQ contains MAC address (PMIP), the session is managed based on R5.0 matrix.

There is no handoff between CMIP and PMIP.

Domain of CMIP users and PMIP users are not same.

Home Addresses of CMIP users and PMIP users are not same. If VRF is used and CMIP users and PMIP users are in different VRFs, the HoA address may be same.

Client-based Mobile IPv4

CMIPv4 is based on HA Release 4.0 address assignment method. Configuration examples are illustrated below.

Static IP Pool:

ip mobile host nai @domain static-address local-pool pool_001

AAA assigns the HoA, and the HoA is set in the MIP RRQ for the initial registration.

Dynamic IP Pool Allowing Static Access:

ip mobile host nai @domain static-address local-pool pool_002 address pool local pool_002

If HoA is sent in the MIP RRQ for the initial registration, the HA establishes a session with the HoA. If HoA is not sent in the MIP RRQ for the initial registration, the HA assigns a HoA and establishes a session.

Dynamic IP Pool:

ip mobile host nai @domain address pool local pool_003

The HA assigns the HoA. The HoA is not set (0.0.0.0) in the MIP RRQ for the initial registration. The existing address management is described below using following pool types:

Proxy Mobile IPv4

PMIPv4 is based on the HA Release 5.0 address assignment method. The Address Assignment with HoA Overwrite feature removes a stale session to allow a new session to be established for a device. The MAC address of the device remains the same, but the NAI (which may be obtained from outer EAP identity) and HoA may change.

The NAI realm (not the Home Address field in the RRQ) determines if static IP pool or dynamic IP pool address management is used. The configuration examples are illustrated below:

Static IP Pool:

ip mobile host nai @domain static-address local-pool pool_001

AAA assigns the HoA. The HoA is set in the MIP RRQ for the initial registration.

Dynamic IP Pool:

ip mobile host nai @domain address pool local pool_003

The HA assigns the HoA. The HoA is either set or not set (0.0.0.0) in the MIP RRQ for the initial registration.

To enable the deletion of stale bindings, perform the following task:

 
Command
Purpose

Step 1 

Router(config)# ip mobile home-agent binding-overwrite

Enables or disables the deletion of a stale binding identified by the Home Address, MAC address, and NAI information in the registration request.

Step 2 

router#debug ip mobile host mac H.H.H


Enables MAC Address-based debugging.


Note The revocation message does not need to include NAI extension because multiple HA IP addresses are used for VRF support.


Here are three configuration examples to illustrate how to use the Address Assignment feature. :

MAC-based Session Using Static IP Pool HA Configuration

HA Config

ip local pool cisco-static-pool 5.1.0.1 5.1.1.0

ip mobile host nai @cisco.com static-address local-pool  
cisco-static-pool interface Null0 aaa load-sa

FA Config
     
simulator mip mn profile 1
description ctc-mac-static
registration lifetime 65535
registration retries 0
registration flags 42
revocation flags 00
home-agent 81.81.81.81
home-address 5.1.0.1
secure home-agent spi 100 key ascii cisco
nai cisco-%f@cisco.com
pmip skip subtype 2 idtype mac
no extension fa-challenge
no extension mn-fa
no extension nat traversal
extension revocation

MAC-based Session Using Dynamic IP Pool

HA Config

ip local pool cisco-pool 5.1.0.1 5.1.1.0

ip mobile host nai @cisco.com address pool local cisco-pool   
interface Null0 aaa load-sa

FA Config
     
simulator mip mn profile 1
  description ctc-mac-static
  registration lifetime 65535
  registration retries 0
  registration flags 42
  revocation flags 00
  home-agent 81.81.81.81
  home-address 5.1.0.1
  secure home-agent spi 100 key ascii cisco
  nai cisco-%f@cisco.com
  pmip skip subtype 2 idtype mac
  no extension fa-challenge
  no extension mn-fa
  no extension nat traversal
  extension revocation

Overwrite Existing Binding

HA Config

ip mobile home-agent binding-overwrite

ip local pool cisco-pool 5.1.0.1 5.1.1.0

ip mobile host nai @cisco.com address pool local cisco-pool   
interface Null0 aaa load-sa

FA Config
     
simulator mip mn profile 3
  registration lifetime 65535
  registration retries 0
  registration flags 42
  revocation flags 00
  home-agent 81.81.81.81
  secure home-agent spi 100 key ascii cisco
  secure aaa spi 2 key ascii cisco
  nai cisco-%f@cisco.com
  pmip skip subtype 2 idtype mac
  no extension mn-aaa
  no extension mn-fa
  no extension nat traversal
  extension revocation

simulator mip mn profile 4
  registration lifetime 65535
  registration retries 0
  registration flags 42
  revocation flags 00
  home-agent 81.81.81.81
  home-address 5.0.0.2 0
  secure home-agent spi 100 key ascii cisco
  secure aaa spi 2 key ascii cisco
  nai pepsi-%f@cisco.com
  pmip skip subtype 2 idtype mac
  no extension mn-aaa
  no extension mn-fa
  no extension nat traversal
  extension revocation

simulator mip scenario 3
  mn profile 3
  fa 2.2.2.200
  mn id 20

  simulator mip scenario 4
  mn profile 4
  fa 2.2.2.200

mn id 21

Static IP Address

A static IP address is an address that is pre-assigned to the mobile station, and possibly preconfigured at the mobile device. The Home Agent supports static addresses that might be public IP addresses, or addresses in private domain.


Note Use of private addresses for Mobile IP services requires reverse tunneling between the PDSN/FA and the Home Agent.


The mobile user proposes the configured or available address as a non-zero home address in the registration request message. The Home Agent may accept this address or return another address in the registration reply message. The Home Agent may obtain the IP address by accessing the home AAA server or DHCP server. The home AAA server may return the name of a local pool, or a single IP address. On successful Mobile IP registration, Mobile IP based services are made available to the user.

Static Home Addressing Without NAI

The original Mobile IP specification supported only static addressing of mobile nodes. The home IP address served as the "user name" portion of the authentication. Static addressing can be beneficial because it allows each device to keep the same address all the time no matter where it is attached to the network. This allows the user to run mobile terminated services without updating the DNS, or some other form of address resolution. It is also easy to manage MNs with static addressing because the home address and the Home Agent are always the same. However, provisioning and maintenance are much more difficult with static addressing because address allocation must be handled manually, and both the Home Agent and MN must be updated. Here is an example configuration:

router (config)# ip mobile host 10.0.0.5 interface FastEthernet0/0
router (config)# ip mobile host 10.0.0.10 10.0.0.15 interface FastEthernet0/0
router (config)# ip mobile secure host 10.0.0.12 spi 100 key ascii secret

Static Home Addressing with NAI

Static home addressing can also be used in conjunction with NAI to support a NAI based authorization and other services. It is also possible to allow a single user to use multiple static IP addresses either on the same device, or multiple devices, while maintaining only one AAA record and security association. A user must be authorized to use an address before the registration will be accepted. Addresses can be authorized either locally, or through a AAA server. If a MN requests an address which is already associated with a binding that has a different NAI, the HA will attempt to return another address from the pool unless the command is set.

Here is a sample configuration:

router (config)# ip mobile home-agent reject-static-addr

Local Authorization

A static address can be authorized on a per MN or per realm basis using configuration commands. Per MN configurations require that you define a specific NAI in the user or user@realm form. Per realm configurations require that you define a generic NAI in the @realm form, and allow only the specification of a local pool.

Here is a sample configuration:

router (config)# ip local pool static-pool 10.0.0.5 10.0.0.10
router (config)# ip mobile host nai user@staticuser.com static-address 10.0.0.1 10.0.0.2
   interface FastEthernet0/0
router (config)# ip mobile host nai user@staticuser.com static-address local-pool 
   static-pool interface FastEthernet0/0
router (config)# ip mobile host nai @static.com static-address local-pool static-pool 
   interface FastEthernet0/0

AAA Authorization

It is also possible to store either the authorized addresses, or local pool name in a AAA server. Each user must have either the static-ip-addresses attribute or the static-ip-pool attribute configured in the AAA server. Unlike the static address configuration on the command line, the static-ip-addresses attribute is not limited in the number of addresses that can be returned.

Here is a sample configuration.

HA configuration:

router (config)# ip local pool static-pool 10.0.0.5 10.0.0.10
router (config)# ip mobile host nai user@staticuser.com interface FastEthernet0/0 aaa
router (config)# ip mobile host nai @static.com interface FastEthernet0/0 aaa

Radius Attributes:

Cisco-AVPair = "mobileip:static-ip-addresses=10.0.0.1 10.0.0.2 10.0.0.3"

Cisco-AVPair = "mobileip:static-ip-pool=static-pool"

Dynamic Home Agent Assignment

The Home Agent can be dynamically assigned in a CDMA2000 network when the following qualifications exist.

The first qualification is that the Home Agent receives a Mobile IP registration request with a value of 0.0.0.0 in the Home Agent field. Upon authentication/authorization, the PDSN retrieves the HA's IP address. The PDSN then uses this address to forward the Registration Request to the HA, but does not update the actual HA address field in the Registration Request.

The Home Agent sends a Registration Reply, and places it's own IP address in the Home Agent field. At this point, any re-registration requests that are received would contain the Home Agent's IP address in the Home Agent field.

The second qualification is a function of the PDSN/Foreign Agent, and is included here for completeness. In this case, a AAA server is used to perform the dynamic Home Agent assignment function. Depending on network topology, either the local-AAA, or the home-AAA server would perform this function. When an access service provider is also serving as an ISP, Home Agents would be located in the access provider network. In this service scenario, a local-AAA server would perform Home Agent assignment function. Based on the user NAI received in the access request message, the AAA server would return a elected Home Agent's address in an access reply message to the PDSN.

A pool of Home Agent addresses is typically configured at the AAA server. For the access provider serving as an ISP, multiple pools of Home Agents could be configured at the local AAA server; however, this depends on SLAs with the domains for which Mobile IP, or proxy-Mobile IP services are supported. You can configure the Home Agent selection procedure at the AAA server, using either a round-robin or a hashing algorithm over user NAI selection criteria.

The PDSN/Foreign Agent sends the Registration Request to the Home Agent; however, there is no IP address in the HA field of the MIP RRQ (it is 0.0.0.0). When the PDSN retrieves the IP address from AAA, it does not update the MIP RRQ; instead, it forwards the RRQ to the HA address retrieved. The PDSN cannot alter the MIP RRQ because it does not know the MN-HA SPI, and key value (which contains the IP address of the Home Agent in the "Home Agent" field). Depending on network topology, either the local AAA, or the home AAA server would perform this function. In situations where the Home Agents are located in the access provider network, the local AAA server would perform Home Agent assignment function. Additionally, multiple pools of Home Agents could be configured at the local AAA server, depending on SLAs with the domains for which Mobile IP, or proxy Mobile IP services are supported.

Dynamic IP Address

It is not necessary for a home IP address to be configured in the mobile station to access packet data services. A mobile user may request a dynamically assigned address by proposing an all-zero home address in the registration request message. The Home Agent assigns a home address and returns it to the MN in the registration reply message. The Home Agent obtains the IP address by accessing the home AAA server. The AAA server returns the name of a local pool or a single IP address. On successful registration, Mobile IP based services are made available to the user.

Fixed Addressing

It is possible to configure the Home Agent with a fixed address for each NAI. The fixed address is assigned to the MN each time it registers. This provides users all the benefits of static addressing while simplifying the configuration of the MN. We do not recommend fixed addressing for large-scale deployment because the Home Agent configuration must be updated to perform user all maintenance.

Here is a sample configuration:

router# ip mobile host nai user@realm.com address 10.0.0.1 interface FastEthernet0/0

Local Pool Assignment

Local pool assignment requires that one or more address pools be configured on the HA. The HA allocates addresses from the pool on a first come, first served basis. The MN will keep the address as long as it has an active binding in the HA. The MN may update it's binding by sending a RRQ with either the allocated address, or 0.0.0.0 as it's home address. When the binding expires the address is immediately returned to the pool.


Note Currently local pool allocation cannot be used with the peer-to-peer HA Redundancy model. The number of local pools which, can be configured is limited only by the available memory on the router.


Here is a sample configuration:

router (config)# ip local pool mippool 10.0.0.5 10.0.0.250
router (config)# ip mobile host nai @localpool.com address pool local mippool 
virtual-network 10.0.0.0 255.255.255.0

DHCP Allocation

The Dynamic Host Configuration Protocol (DHCP) is already a widely used method of allocating IP addresses for desktop computers. IOS Mobile IP leverages the existing DHCP proxy client in IOS to allow the home address to be allocated by a DHCP server. The NAI is sent in the Client-ID option and can be used to provide dynamic DNS services.

Here is a sample configuration:

router(config)# ip mobile host nai @dhcppool.com address pool dhcp-proxy-client 
dhcp-server 10.1.2.3 interface FastEthernet 0/0

Note Currently DHCP cannot be used with the peer-to-peer HA Redundancy model.


Dynamic Addressing from AAA

Dynamic addressing from AAA allows you to support fixed and/or per session addressing for MNs without the trouble of maintaining addressing at the MN or HA. The AAA server can return either a specific address, a local pool name, or a DHCP server address. If the AAA server is used to return a specific address, the home address can be configured either as an attribute on the NAI entry in the RADIUS database, or can be allocated from a pool depending on the capabilities of the AAA server being used. The AAA server can also return the name of a local pool configured on the HA or a DHCP server IP address.

Here is a sample configuration.

On the HA:

router (config)# ip local pool dynamic-pool 10.0.0.5 10.0.0.10
router (config)# ip mobile host nai user@staticuser.com interface FastEthernet0/0 aaa
router (config)# ip mobile host nai @static.com interface FastEthernet0/0 aaa

AAA Address assignment:
Cisco-AVPair = "mobileip:ip-address=65.0.0.71"

AAA Local Pool attribute:
Cisco-AVPair = "mobileip:ip-pool=dynamic-pool"

AAA DHCP server attribute:
Cisco-AVPair = "mobileip:dhcp-server=10.1.5.10"


Note The Framed-IP-Address attribute is also supported


Address Assignment for Same NAI - Multiple Static Addresses

The Cisco Home Agent supports multiple Mobile IP registrations for the same NAI with different static addresses. This is accomplished by configuring static-ip-address pool(s) at the home-AAA or DHCP server. When the HA receives a Registration Request message from the mobile user, the HA accesses the home-AAA for authentication, and possibly for assignment of an IP address. The NAI provided by the mobile user is sent to the home-AAA. The home-AAA server returns a list of static-IP-addresses or the static-ip-pool name corresponding to this NAI.

Address Assignment For Same NAI - Different Mobile Terminal

When the same NAI is used for registration from two different mobiles, the behavior is as follows:

If static address assignment is used in both cases, they are viewed as independent cases.

If dynamic address assignment is used in both cases, the second registration replaces the first.

If static is used for the first, and dynamic for the second, the dynamic address assignment replaces the static address assignment.

If dynamic is used for the first, and static for the second, they are viewed as independent cases.

Additionally, two flows originating from the same mobile using the same NAI—but two different Home Agents—are viewed as independent cases.

Configuration Examples

DHCP-Proxy-Client Configuration

Active-HA configuration


no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname mwt10-7206b
!
aaa new-model
!
aaa authentication ppp default local group radius
aaa authorization config-commands
aaa authorization ipmobile default group radius
aaa authorization network default group radius
aaa session-id common
!
ip subnet-zero
ip cef
!
interface Loopback0 
ip address 10.0.0.1 255.255.255.255 
interface Ethernet2/0
 description to PDSN/FA
 ip address 10.0.0.2 255.0.0.0
 no ip route-cache
 no ip mroute-cache
 duplex half
 standby ip 10.0.0.4
 standby priority 110
 standby preempt delay sync 100
 standby name cisco
!
interface Ethernet2/2
 description to AAA
 ip address 172.16.1.8 255.255.0.0
 no ip route-cache
 no ip mroute-cache
 duplex half
!
router mobile
!
ip classless
no ip http server
ip pim bidir-enable
ip mobile home-agent
ip mobile home-agent redundancy
ip mobile virtual-network 10.0.0.0 255.0.0.0 
ip mobile host nai user01@cisco.com address pool dhcp-proxy-client
dhcp-server 10.0.0.101 virtual-network 10.0.0.0 255.0.0.0 
ip mobile secure home-agent 10.0.0.3 spi 100 key ascii redundancy
algorithm md5 mode 
prefix-suffix
!
ip mobile virtual-network 10.0.0.0 255.0.0.0 
ip mobile host nai user01@cisco.com address pool dhcp-proxy-client
dhcp-server 10.0.0.101 virtual-network 10.0.0.0 255.0.0.0 
radius-server host 172.16.0.2 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key cisco
call rsvp-sync
!
mgcp profile default
!
dial-peer cor custom
!
gatekeeper
 shutdown
!
line con 0
line aux 0
line vty 0 4
!
end

Standby-HA configuration


no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname mwt10-7206b
!
aaa new-model
!
aaa authentication ppp default local group radius
aaa authorization config-commands
aaa authorization ipmobile default group radius
aaa authorization network default group radius
aaa session-id common
!
ip subnet-zero
ip cef
!
interface Loopback0 
ip address 10.0.0.2 255.255.255.255 
interface Ethernet2/0
 description to PDSN/FA
 ip address 10.0.0.3 255.0.0.0
 no ip route-cache
 no ip mroute-cache
 duplex half
 standby ip 10.0.0.4
 standby name cisco
!
interface Ethernet2/2
 description to AAA
 ip address 172.16.1.7 255.255.0.0
 no ip route-cache
 no ip mroute-cache
 duplex half
!
router mobile
!
ip local pool ha-pool 10.0.0.1 10.0.0.255
ip classless
no ip http server
ip pim bidir-enable
ip mobile home-agent
ip mobile home-agent redundancy
ip mobile secure home-agent 10.0.0.2 spi 100 key ascii redundancy
algorithm md5 mode 
prefix-suffix
ip mobile virtual-network 10.0.0.0 255.0.0.0 
ip mobile host nai user01@cisco.com address pool dhcp-proxy-client
dhcp-server 10.0.0.101 virtual-network 10.0.0.0 255.0.0.0 
!
radius-server host 150.2.0.2 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key cisco
call rsvp-sync
!
mgcp profile default
!
dial-peer cor custom
!
gatekeeper
 shutdown
!
line con 0
line aux 0
line vty 0 4
!

end