Table Of Contents

Mobile IP—Challenge/Response Extensions

Contents

Prerequisites for Mobile IP—Challenge/Response Extensions

Restrictions for Mobile IP—Challenge/Response Extensions

Information About Foreign Agent Challenge/Response Extensions

Challenge/Response Extensions

How to Configure Foreign Agent Challenge/Response Extensions

Configuring FA Challenge/Response Extensions

Prerequisites

Verifying Foreign Agent Service Configuration

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

Mobile IP—Challenge/Response Extensions

---

The Mobile IP—Challenge/Response Extensions feature enables a foreign agent (FA) to authenticate a mobile node (MN) by sending mobile foreign challenge extensions (MFCE) and mobile node-AAA authentication extensions (MNAE) to the home agent (HA) in registration requests.

Feature Specifications for Mobile IP—Challenge/Response Extensions

Feature History
Release	Modification
12.2(13)T	This feature was introduced.
Supported Platforms
For platforms supported in Cisco IOS Release 12.2(13)T, consult Cisco Feature Navigator.

Determining Platform Support Through Cisco Feature Navigator

Cisco IOS software is packaged in feature sets that are supported on specific platforms. To get updated information regarding platform support for this feature, access Cisco Feature Navigator. Cisco Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.

Cisco Feature Navigator is a web-based tool that enables you to determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image. You can search by feature or release. Under the release section, you can compare releases side by side to display both the features unique to each software release and the features in common.

To access Cisco  Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

http://www.cisco.com/register

Cisco Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Cisco Feature Navigator home page at the following URL:

http://www.cisco.com/go/fn

Availability of Cisco IOS Software Images

Platform support for particular Cisco IOS software releases is dependent on the availability of the software images for those platforms. Software images for some platforms may be deferred, delayed, or changed without prior notice. For updated information about platform support and availability of software images for each Cisco IOS software release, refer to the online release notes or, if supported, Cisco Feature Navigator.

Contents

•Prerequisites for Mobile IP—Challenge/Response Extensions

•Restrictions for Mobile IP—Challenge/Response Extensions

•Information About Foreign Agent Challenge/Response Extensions

•How to Configure Foreign Agent Challenge/Response Extensions

•Additional References

•Command Reference

Prerequisites for Mobile IP—Challenge/Response Extensions

In the Mobile IP—Challenge/Response Extensions feature, the foreign agent expects mobile node RRQs to contain the following extensions:

•Mobile node network address identifier

•MHAE

•Mobile node-foreign agent challenge extension

•Mobile node-AAA extension authenticator computed based on a shared secret between the mobile node and the AAA server.

If unique per-user passwords are configured on the AAA and the mobile nodes, and the mobile node or home agent security association is configured on the AAA server, the HA expects mobile node RRQs received from the FA CoA to contain the following:

•MFCE

•Mobile node -AAA extension authenticator

Restrictions for Mobile IP—Challenge/Response Extensions

The Mobile IP—Challenge/Response Extensions feature has the following restrictions:

•Mobile Node Colocated care-of address (CCOA) mode is not supported.

Information About Foreign Agent Challenge/Response Extensions

To configure the Mobile IP—Foreign Agent Challenge/Response feature, you must understand the following concepts:

•Challenge/Response Extensions

Challenge/Response Extensions

Mobile IP, as originally implemented, defines a Mobile-Foreign Authentication extension by which a mobile node can authenticate itself to a foreign agent. This Mobile-Foreign Authentication extension does not provide complete replay protection for the foreign agent and does not allow the foreign agent to use existing methods, such as Challenge Handshake Authentication Protocol (CHAP) to authenticate a mobile node. The Mobile IP—Foreign Agent Challenge/Response Extensions feature extends the Mobile IP agent advertisements and the registration requests that enable a foreign agent to use a challenge/response mechanism to authenticate a mobile node.

When the Mobile IP—Foreign Agent Challenge/Response Extensions feature is configured, the foreign agent expects the mobile node to include a challenge extension with a challenge value that the mobile node had previously advertised. The foreign agent also expects to receive this challenge extension within a specific time interval. The mobile node must also send an extension for authentication (MFAE or MN-AAA.)

How to Configure Foreign Agent Challenge/Response Extensions

This section includes the following procedures:

•Configuring FA Challenge/Response Extensions

•Verifying Foreign Agent Service Configuration

Configuring FA Challenge/Response Extensions

Perform this task to configure a foreign agent to authenticate a mobile node by sending MFCEs and MNAEs in registration requests.

Prerequisites

If unique per-user passwords are configured on the AAA and the mobile nodes, and the mobile node or home agent security association is configured on the AAA server, the HA expects mobile node RRQs received from the FA CoA to contain the following:

•MFCE

•Mobile node -AAA extension authenticator

If the MFCE and MN-AAA extension authenticator are not forwarded to the home agent, the AAA server storing the mobile node/ home agent SAs must have identical passwords for all users to aid SA retrieval.

---

Note If the Mobile Node is registering in FA-COA mode and the Security Associations (SAs) must be obtained from AAA, the user password must be configured as "cisco".

---

SUMMARY STEPS

1. enable

2. configure {terminal | memory | network}

3. router mobile

4. ip mobile foreign-agent care-of interface

5. interface type number

6. ip address ip-address mask

7. ip irdp

8. ip irdp holdtime seconds

9. ip irdp maxadvertinterval seconds

10. ip irdp minadvertinterval seconds

11. ip mobile foreign-service challenge {timeout value | window number}

12. ip mobile foreign-service challenge forward-mfce

DETAILED STEPS

	Command	Purpose
Step 1	enable Example: Router> enable	Enables higher privilege levels, such as privileged EXEC mode. •Enter your password if prompted.
Step 2	configure {terminal | memory | network} Example: Router# configure terminal	Enters global configuration mode.
Step 3	router mobile Example: Router(config)# router mobile	Enables Mobile IP on the router.
Step 4	ip mobile foreign-agent care-of interface Example: Router(config)# ip mobile foreign-agent care-of serial0	Enables Foreign Agent services when at least one care-of address is configured. •This is the foreign network termination point of the tunnel between the Foreign Agent and Home Agent. The care-of address is the IP address of the interface. The interface, whether physical or loopback, need not be the same as the visited interface.
Step 5	interface type number Example: Router(config)# interface serial0	Configures an interface and enters interface configuration mode.
Step 6	ip address ip-address mask Example: Router(config-if)# ip address 10.1.0.1 255.255.255.255	Sets a primary IP address of the interface.
Step 7	ip irdp Example: Router(config-if)# ip irdp	Enables IRDP processing on an interface.
Step 8	ip irdp holdtime seconds Example: Router(config-if)# ip irdp holdtime 9000	Length of time in seconds that advertisements are held valid. •Default is three times the maxadvertinterval period. When foreign agent challenge extensions are implemented, this value must be set to 9000 seconds.
Step 9	ip irdp maxadvertinterval seconds Example: Router(config-if)# ip irdp maxadvertinterval 9000	(Optional) Specifies the maximum interval in seconds between advertisements.
Step 10	ip irdp minadvertinterval seconds Example: Router(config-if)# ip irdp minadvertinterval 7	(Optional) Specifies the minimum interval in seconds between advertisements.
Step 11	ip mobile foreign-service challenge {timeout value | window number} Example: Router(config-if)# ip mobile foreign-service challenge timeout 10	Enables Foreign Agent service on an interface. •Configures the challenge timeout value and the number of valid recently sent challenge values.
Step 12	ip mobile foreign-service challenge forward-mfce Example: Router(config-if)# ip mobile foreign-service challenge forward-mfce	Enables the foreign agent to send MFCEs to the home agent in registration requests.

Verifying Foreign Agent Service Configuration

Perform this task to optionally verify that the interface has been configured to provide foreign agent services.

SUMMARY STEPS

1. enable

2. show ip mobile globals

3. show ip mobile interface

4. show ip mobile traffic

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables higher privilege levels, such as privileged EXEC mode. Enter your password if prompted.
Step 2	show ip mobile globals Example: Router# show ip mobile globals	(Optional) Displays global information for mobile agents.
Step 3	show ip mobile interface Example: Router# show ip mobile interface	(Optional) Displays advertisement information for interfaces that are providing foreign agent service or are home links for mobile nodes.
Step 4	show ip mobile traffic Example: Router# show ip mobile traffic	(Optional) Displays protocol counters.

Additional References

The following sections provide additional references related to the Mobile IP—Challenge/Response Extensions feature:

•Related Documents

•Standards

•MIBs

•RFCs

•Technical Assistance

Related Documents

Related Topic	Document Title
Authentication	The part "Authentication, Authorization, and Accounting (AAA)" in the Cisco IOS Security Configuration Guide, Release  12.2
IKE and IPSec security protocols	The part "IP Security and Encryption" in the Cisco IOS Security Configuration Guide, Release  12.2
Mobile IP	Introduction to Mobile IP
Cisco mobile networks	Cisco Mobile Networks
Mobile wireless configuration	Cisco IOS Mobile Wireless Configuration Guide, Release 12.2
Mobile wireless commands	Cisco IOS Mobile Wireless Command Reference, Release 12.2

Standards

Standards	Title
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.	—

MIBs

MIBs1	MIBs Link
•RFC2006-MIB •CISCO-MOBILE-IP-MIB	To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL: http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

1 Not all supported MIBs are listed.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://tools.cisco.com/ITDIT/MIBS/servlet/index

If Cisco  MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco  MIBs page at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

http://www.cisco.com/register

RFCs

RFCs1	Title
RFC 2002	IP Mobility Support
RFC 2003	IP Encapsulation within IP
RFC 2005	Applicability Statement for IP Mobility Support
RFC 2006	The Definitions of Managed Objects for IP Mobility Support
RFC 3024	Reverse Tunneling for Mobile IP, revised

1 Not all supported RFCs are listed.

Technical Assistance

Description	Link
Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/public/support/tac/home.shtml

Command Reference

The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List.

•debug ip mobile advertise

•ip mobile foreign-service

•show ip mobile traffic

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.