Table Of Contents
Mobile IP Dynamic Security Association and Key Distribution
Prerequisites for Mobile IP Dynamic Security Association and Key Distribution
Restrictions for Mobile IP Dynamic Security Association and Key Distribution
Information About Mobile IP Dynamic Security Association and Key Distribution
Using the Cisco Secure ACS Server
Benefits of Mobile IP Dynamic Security Association and Key Distribution
Mobile IP Dynamic Security Association and Key Distribution
The Mobile IP Dynamic Security Association and Key Distribution feature enables a Mobile IP client (mobile node) to use the Microsoft Windows login information to generate the dynamic shared keys needed to create the security associations between it and the home agent. These security associations are used to authenticate the mobile device. In response to a successful registration, basic configuration parameters such as the DHCP server address, home address prefix length, and domain name system (DNS) address are also passed on to the mobile node in the form of extensions to the registration reply message sent by the home agent.
This feature eliminates the need for any configuration of the Mobile IP client software once it is installed. Now customers need not log in and authenticate multiple times, making the Mobile IP client software a "plug-and-play" operation.
Feature History for the Mobile IP Dynamic Security Association and Key Distribution Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Prerequisites for Mobile IP Dynamic Security Association and Key Distribution
•
•
Prerequisites for Mobile IP Dynamic Security Association and Key Distribution
Your network must be configured to run Mobile IP. The home agent must be configured with the authentication, authorization, and accounting (AAA) address of a RADIUS server that has access to the domain controller for authenticating the user in the Windows domain.
Because Mobile IP requires support on the host device, each mobile node must be appropriately configured for the desired Mobile IP service with client software.
Restrictions for Mobile IP Dynamic Security Association and Key Distribution
This feature can be used only in a Windows operating system environment.
Information About Mobile IP Dynamic Security Association and Key Distribution
This section describes the following concepts related to the Mobile IP Dynamic Security Association and Key Distribution feature:
•
•
Session Identifiers
This feature introduces the concept of a session identifier (session-id) that is available if a network access identifier (NAI) is specified in your configuration. The session identifier is optional and can be added by the mobile node in the initial registration request. For example, a single user can have multiple sessions (for example when logging through different devices such as a PDA, cellular phone, or laptop) and use the same NAI for all sessions. These individual sessions are identified by the session identifier. If the session identifier is present in the initial registration, it must be present in all subsequent registration renewals from the mobile node.
Using the Cisco Secure ACS Server
Because this feature leverages an existing authentication infrastructure, such as the Windows Domain Controller (DC) database or Active Directory (AD), you need not configure any Mobile IP client user information in a AAA server. You only need to configure the AAA so it can use the DC/AD to authenticate the Mobile IP client users upon receiving a RADIUS request from a home agent.
The following is a brief summary of the steps necessary to configure the Cisco Secure Access Control Server (ACS) to use a database to authenticate Mobile IP clients.
•
•
•
For more information on Cisco Secure ACS configuration, refer to the "Administering External User Databases" chapter of the Cisco Secure ACS Windows Server 3.1 User Guide.
Benefits of Mobile IP Dynamic Security Association and Key Distribution
•
•
Additional References
The following sections provide references related to the Mobile IP Dynamic Security Association and Key Distribution feature.
Related Documents
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Command Reference
This section documents modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 T command reference publications.
clear ip mobile binding
To remove mobility bindings, use the clear ip mobile binding command in EXEC mode.
clear ip mobile binding {all [load standby-group-name] | ip-address | nai string [session-id string]}
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
The home agent creates a mobility binding for each roaming mobile node. Associated with the mobility binding is the tunnel to the visited network and a host route to forward packets destined for the mobile node. Typically, there should be no need to clear the binding because it expires after the lifetime is reached or when the mobile node deregisters.
When the mobility binding is removed through the use of this command, the number of users on the tunnel is decremented and the host route is removed from the routing table. The mobile node is not notified.
If the nai string session-id string option is specified, only the binding entry with that session identifier is cleared. If the session-id keyword is not specified, all binding entries (potentially more than one with different session identifiers) for that NAI are cleared. You can determine the session-id string value by using the show ip mobile binding command.
Use this command with care, because it will disrupt any sessions used by the mobile node. After you use this command, the mobile node will need to reregister to continue roaming.
Examples
The following example administratively stops mobile node 10.2.0.1 from roaming:
Router# show ip mobile bindingMobility Binding List:Total 110.2.0.1:Care-of Addr 68.0.0.31, Src Addr 68.0.0.31,Lifetime granted 02:46:40 (10000), remaining 02:46:32Flags SbdmGvt, Identification B750FAC4.C28F56A8,Tunnel100 src 66.0.0.5 dest 68.0.0.31 reverse-allowedRouting Options - (G)GRERouter# clear ip mobile binding 10.2.0.1Router# show ip mobile bindingRelated Commands
clear ip mobile visitor
To remove visitor information, use the clear ip mobile visitor command in EXEC mode.
clear ip mobile visitor [ip-address | nai string [session-id string] [ip-address]]
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
The foreign agent creates a visitor entry for each accepted visitor. The visitor entry allows the mobile node to receive packets while in a visited network. Associated with the visitor entry is the ARP entry for the visitor. There should be no need to clear the entry because it expires after lifetime is reached or when the mobile node deregisters.
When a visitor entry is removed, the number of users on the tunnel is decremented and the ARP entry is removed from the ARP cache. The visitor is not notified.
If the nai string session-id string option is specified, only the visitor entry with that session identifier is cleared. If session-id is not specified, all visitor entries (potentially more than one, with different session identifiers) for that NAI are cleared. You can determine the session-id string value by using the show ip mobile visitor command.
Use this command with care because it may terminate any sessions used by the mobile node. After using this command, the visitor will need to reregister to continue roaming.
Examples
The following example administratively stops visitor 172.21.58.16 from visiting:
Router# clear ip mobile visitor 172.21.58.16Related Commands
show ip mobile visitor
Displays the table containing the visitor list of the foreign agent.
show ip mobile binding
To display the mobility binding table, use the show ip mobile binding command in EXEC mode.
show ip mobile binding [home-agent ip-address | nai string [session-id string] | summary]
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
The home agent updates the mobility binding table in response to registration events from mobile nodes. If the ip-address argument is specified, bindings are shown for only that mobile node. If the session-id string combination is specified, only the binding entry for that session identifier is displayed.
A session identifier is used to uniquely identify a Mobile IP flow. A Mobile IP flow is the set of {NAI, IP address}. The flow allows a single NAI to be associated with one or multiple IP addresses, for example, {NAI, ipaddr1}, {NAI, ipaddr2}, and so on. Thus, a single user can have multiple sessions (for example, when logging through different devices such as a PDA, cellular phone, or laptop). If the session identifier is present in the initial registration, it must be present in all subsequent registration renewals from that mobile node.
Examples
The following is sample output from the show ip mobile binding command:
Router# show ip mobile bindingMobility Binding List:Total 120.0.0.1:Care-of Addr 68.0.0.31, Src Addr 68.0.0.31,Lifetime granted 02:46:40 (10000), remaining 02:46:32Flags SbdmGvt, Identification B750FAC4.C28F56A8,Tunnel100 src 66.0.0.5 dest 68.0.0.31 reverse-allowedRouting Options - (G)GREService Options:NAT detectThe following is sample output from the show ip mobile binding command when mobile networks are configured or registered on the home agent:
Router# show ip mobile bindingMobility Binding List:Total 120.0.4.1:Care-of Addr 45.0.0.5, Src Addr 45.0.0.5Lifetime granted 00:02:00 (120), remaining 00:01:56Flags sbDmgvT, Identification B7A262C5.DE43E6F4Tunnel0 src 46.0.0.3 dest 45.0.0.5 reverse-allowedMR Tunnel1 src 46.0.0.3 dest 20.0.4.1 reverse-allowedRouting Options - (D)Direct-to-MN (T)Reverse-tunnelMobile Networks: 54.0.0.0/255.255.255.0(S)44.0.0.0/255.255.255.0 (D)46.0.0.0/255.0.0.0(D)The following is sample output from the show ip mobile binding command with session identifier information:
Router# show ip mobile bindingMobility Binding List:Total 1100.100.100.19:Care-of Addr 70.70.70.2, Src Addr 100.100.100.1.0.0.31,Lifetime granted 00:33:20 (20000), remaining 00:30:56Flags SbdmGvt, Identification BC1C2A04.EA42659C,Tunnel0 src 100.100.100.100 dest 70.70.70.2 reverse-allowedRouting OptionsSession identifierSPI 333 (decimal 819) MD5, Prefix-suffix, Timestamp +/-255, root keyKey 38a38987ad0a399cb80940835689da66SPI 334 (decimal 820) MD5, Prefix-suffix, Timestamp +/-255, session keyKey 34c7635a313038611dec8c16681b55e0Table 1 describes the significant fields shown in the display.
show ip mobile visitor
To display the table containing the visitor list of the foreign agent, use the show ip mobile visitor command in EXEC mode.
show ip mobile visitor [[pending] [address | summary] | nai string [session-id string]]
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
The foreign agent updates the table containing the visitor list of the foreign agent in response to registration events from mobile nodes.
A session identifier is used to uniquely identify a Mobile IP flow. A Mobile IP flow is the set of {NAI, IP address}. The flow allows a single NAI to be associated with one or multiple IP addresses, for example, {NAI, ipaddr1}, {NAI, ipaddr2}, and so on. Thus, a single user can have multiple sessions (for example when logging through different devices such as a PDA, cellular phone, or laptop). If the session identifier is present in the initial registration, it must be present in all subsequent registration renewals from that mobile node.
Examples
The following is sample output from the show ip mobile visitor command:
Router# show ip mobile visitorMobile Visitor List:Total 120.0.0.1:Interface Ethernet1/2, MAC addr 0060.837b.95ecIP src 20.0.0.1, dest 67.0.0.31, UDP src port 434HA addr 66.0.0.5, Identification B7510E60.64436B38Lifetime 08:20:00 (30000) Remaining 08:19:16Tunnel100 src 68.0.0.31, dest 66.0.0.5, reverse-allowedRouting Options - (T)Reverse-tunnelIf the mobile node has visited and is associated with a session identifier, then the visitor entry for the mobile node shows the session identifier as shown below:
Router#show ip mobile visitorMobile Visitor List:Total 1user01@cisco.comHome addr 100.100.100.17Interface Ethernet3/3, MAC addr 0004.6d25.b857IP src 0.0.0.0, dest 100.100.100.1, UDP src port 434HA addr 100.100.100.100, Identification BC189864.B2FE6CC4Lifetime 00:33:20 (2000) Remaining 00:33:06Tunnel0 src 70.70.70.2, dest 100.100.100.100, reverse-allowedRouting Options - (B)BroadcastSession identifier PDATable 2 describes the significant fields shown in the display.
Glossary
home agent—A router on a home network of the mobile node or that tunnels packets to the mobile node or mobile router while it is away from home. It keeps current location information for registered mobile nodes called a mobility binding.
mobile node—A host or router that changes its point of attachment from one network or subnet to another. A mobile node may change its location without changing its IP address; it may continue to communicate with other Internet nodes at any location using its home IP address, assuming that link-layer connectivity to a point of attachment is available.
NAI—network access identifier. The user ID submitted by the mobile node during registration to identify the user for authentication. The NAI might help route the registration request to the correct home agent.
Note
Copyright © 2003 Cisco Systems, Inc. All rights reserved.
