Mobile IP Challenge and Response Extensions

Mobile IP, as originally implemented, defines a Mobile-Foreign Authentication extension by which a mobile node can authenticate itself to a foreign agent. This Mobile-Foreign Authentication extension does not provide complete replay protection for the foreign agent and does not allow the foreign agent to use existing methods, such as Challenge Handshake Authentication Protocol (CHAP) to authenticate a mobile node. The Mobile IP--Foreign Agent Challenge/Response Extensions feature extends the Mobile IP agent advertisements and the registration requests that enable a foreign agent to use a challenge/response mechanism to authenticate a mobile node.

When the Mobile IP--Foreign Agent Challenge/Response Extensions feature is configured, the foreign agent expects the mobile node to include a challenge extension with a challenge value that the mobile node had previously advertised. The foreign agent also expects to receive this challenge extension within a specific time interval. The mobile node must also send an extension for authentication (MFAE or MN-AAA.)

SUMMARY STEPS

1.    enable

2.    configure {terminal | memory | network}

3.    router mobile

4.    ip mobile foreign-agent care-of interface

5.    interface type number

6.    ip address ip-address mask

7.    ip irdp

8.    ip irdp holdtime seconds

9.    ip irdp maxadvertinterval seconds

10.    ip irdp minadvertinterval seconds

11.    ip mobile foreign-service challenge {timeout value | window number}

12.    ip mobile foreign-service challenge

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables higher privilege levels, such as privileged EXEC mode. Enter your password if prompted.
Step 2	configure {terminal | memory | network} Example: Router# configure terminal	Enters global configuration mode.
Step 3	router mobile Example: Router(config)# router mobile	Enables Mobile IP on the router.
Step 4	ip mobile foreign-agent care-of interface Example: Router(config)# ip mobile foreign-agent care-of serial0	Enables Foreign Agent services when at least one care-of address is configured. This is the foreign network termination point of the tunnel between the Foreign Agent and Home Agent. The care-of address is the IP address of the interface. The interface, whether physical or loopback, need not be the same as the visited interface.
Step 5	interface type number Example: Router(config)# interface serial0	Configures an interface and enters interface configuration mode.
Step 6	ip address ip-address mask Example: Router(config-if)# ip address 10.1.0.1 255.255.255.255	Sets a primary IP address of the interface.
Step 7	ip irdp Example: Router(config-if)# ip irdp	Enables IRDP processing on an interface.
Step 8	ip irdp holdtime seconds Example: Router(config-if)# ip irdp holdtime 9000	Length of time in seconds that advertisements are held valid. Default is three times the maxadvertintervalperiod. When foreign agent challenge extensions are implemented, this value must be set to 9000 seconds.
Step 9	ip irdp maxadvertinterval seconds Example: Router(config-if)# ip irdp maxadvertinterval 9000	(Optional) Specifies the maximum interval in seconds between advertisements.
Step 10	ip irdp minadvertinterval seconds Example: Router(config-if)# ip irdp minadvertinterval 7	(Optional) Specifies the minimum interval in seconds between advertisements.
Step 11	ip mobile foreign-service challenge {timeout value | window number} Example: Router(config-if)# ip mobile foreign-service challenge timeout 10	Enables Foreign Agent service on an interface. Configures the challenge timeout value and the number of valid recently sent challenge values.
Step 12	ip mobile foreign-service challenge Example: forward-mfce Example: Router(config-if)# ip mobile foreign-service challenge forward-mfce	Enables the foreign agent to send MFCEs to the home agent in registration requests.

SUMMARY STEPS

1.    enable

2.    show ip mobile globals

3.    show ip mobile interface

4.    show ip mobile traffic

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables higher privilege levels, such as privileged EXEC mode. Enter your password if prompted.
Step 2	show ip mobile globals Example: Router# show ip mobile globals	(Optional) Displays global information for mobile agents.
Step 3	show ip mobile interface Example: Router# show ip mobile interface	(Optional) Displays advertisement information for interfaces that are providing foreign agent service or are home links for mobile nodes.
Step 4	show ip mobile traffic Example: Router# show ip mobile traffic	(Optional) Displays protocol counters.