Deploying Mobile IP. Session ACC Copyright 2003, Cisco Systems, Inc. All rights reserved. Printed in USA. 8018_05_2003_c1.

Transcription

1 Deploying Mobile IP Session 2 Copyright Printed in USA.

2 Agenda What Is Mobility Mobile IP Enterprise Mobile IP Clients Proxy Mobile IP Cisco IOS Mobile Networks Closing and Futures 3 What Is Mobility? 4 Copyright Printed in USA.

3 Obligatory Grand Vision Any Device, Any Place, Any Time, Always Connected! 5 Mobility Components Portability The ability to move easily Laptop or PDA Roaming The ability to be reached anywhere Dynamic DNS or a pager Handoff or handover The ability to change your access link without interruption A cell phone in call 6 Copyright Printed in USA.

4 Mobility Components Portability The ability to move easily Laptop or PDA Roaming The ability to be reached anywhere Dynamic DNS or a pager Handoff or handover The ability to change your access link without interruption A cell phone in call 7 Mobility Components Portability The ability to move easily Laptop or PDA Roaming The ability to be reached anywhere Dynamic DNS or a pager Handoff or handover The ability to change your access link without interruption A cell phone in call 8 Copyright Printed in USA.

5 Mobility Math Portability = Nomadic Mobility Dynamic addressing with dial-up and DHCP User chooses the access link Portability + Roaming = Nomadic Server Mobility Dynamic DNS allows Nomadic node to be reached Portability + Roaming + Handover = Full Mobility Cell phones Mobility is transparent to the user 9 Mobility Protocol Requirements Move Detection Discover when access links change Location Discovery Identify access edge Update Signaling Inform the network of the new location Path (Re)establishment Data Update the delivery method so that traffic is delivered to the new location All Are Logical, but Not Necessarily Physical! 10 Copyright Printed in USA.

6 Mobility Protocol Requirements Move Detection Discover when access links change Location Discovery Identify access edge Update Signaling Inform the network of the new location Path (Re)establishment Update the delivery method so that traffic is delivered to the new location All Are Logical, but Not Necessarily Physical! 11 Mobility Protocol Requirements Move Detection Discover when access links change Location Discovery Identify access edge Update Signaling Inform the network of the new location Path (Re)establishment Update Update the delivery method so that traffic is delivered to the new location All Are Logical, but Not Necessarily Physical! 12 Copyright Printed in USA.

7 Mobility Protocol Requirements Move Detection Discover when access links change Location Discovery Identify access edge Update Signaling Inform the network of the new location Path (Re)establishment Data Update the delivery method so that traffic is delivered to the new location All Are Logical, but Not Necessarily Physical! 13 Nomadic Laptop Mobility Protocol Move Detection User must disconnect cable or know they are out of coverage Location Discovery User needs to choose access link Update Signaling DHCP, PPP IPCP and maybe DDNS Path (Re)establishment Restart All applications and maybe reboot What a pain! 14 Copyright Printed in USA.

8 Full Mobility and the Stack Application Presentation Session Transport Network Link Physical Layer 4 7 IETF drafts propose adding a session identifier so that identification can be independent of delivery; useful for NAT, IPSec, etc.; some proprietary solutions Layer 3 Provides Link layer independence without requiring application support Layer 1 2 Fast mobility, but not as scalable; link layer dependant 15 Mobility Review You Should Be familiar with portability, roaming and handoff Know the difference between nomadic and full mobility Understand mobility requirements Move Detection Location Discovery Update Signaling Path (Re)establishment Believe that full mobility at Layer 3 is the only way to go 16 Copyright Printed in USA.

9 Mobile IP Layer 3 17 IP Routing /24 Mobile Node A B Internet C D Route x.x Next A Route 192.x.x.x Next B Standard IP routing follows the longest prefix to reach the destination address Routing information is aggregated 18 Copyright Printed in USA.

10 IP Routing and Full Mobility Mobile Node /24? A B D Route x.x Next A Internet C Route 192.x.x.x Next B /24 Full mobility requires a constant address even when changing access links 19 Routing Protocol Review What does a routing protocol do? Finds neighbors Figures out where they can deliver traffic Selects best paths Updates based on changes and failures 20 Copyright Printed in USA.

11 Components of a Routing Protocol High level characteristics Path selection method Convergence (Path (re)establishment) Scalability Complexity Implementation details Update messages (Update Signaling) Neighbor Discovery (Location Discovery) Metrics Special use features (Move Detection) 21 Mobility with Traditional RPs Local Area Mobility (LAM) ARP discovery based host routing Mobile host routes redistributed into IGP Not scalable! 22 Copyright Printed in USA.

12 The Solution Mobile IP Route Next Tunnel A B Internet C Route Next E0 D Route Next x.x A Route Next 192.x.x.x B Mobile Node Mobile IP Is a Dynamic Routing Protocol where Mobile Devices Signal Their Own Routing Updates and Dynamic Tunnels Are Used to Eliminate the Need for Host Route Propagation 23 Mobile IP Terminology Home HA, Home Agent Anchor point attached to the network from which the Mobile Nodes address is allocated (Home Network) Responsible for keeping the state of the mobile node and knowing how to deliver traffic to it Internet COA FA MN COA, Care of Address An address at the edge of the network reachable by normal routing Termination point for the tunnel Can be on a Foreign Agent (FA) or collocated with the mobile node (CCOA) MN, Mobile Node An IP host that maintains network connectivity using its home address, regardless of which subnet (or network) it is connected to 24 Copyright Printed in USA.

13 Home Address and Home Network Home FA MN / Home Network A Network attached to the Home Agent Can be a physical or logical interface Logical is usually easier to use Cisco IOS logical networks are called virtual networks Home Address An IP address on the Home Network allocated to a Mobile Node Used for all communication, this is the address that is truly mobile Can be static or allocated at the beginning of each session 25 Home Address and Home Network Home FA MN / Home Network A Network attached to the Home Agent Can be a physical or logical interface Logical is usually easier to use Cisco IOS logical networks are called virtual networks Home Address An IP address on the Home Network allocated to a Mobile Node Used for all communication, this is the address that is truly mobile Can be static or allocated at the beginning of each session 26 Copyright Printed in USA.

14 Home vs. Roaming Mobile IP has very specific meanings for Home and Roaming Home The Home Network is a physical network The Mobile Node is attached to the Home Network Normal routing is used, Mobile IP is not used Roaming The Mobile Node not attached to the Home Network The Home Address is not reachable via normal routing Mobile IP is used to route traffic to the Mobile Node 27 Care-of Address (COA) COA Home FA MN / Traffic is tunneled from the Home Agent to the Care-of Address The Care-of Address much be reachable via standard routing 28 Copyright Printed in USA.

15 Collocated Care-of Address (CCOA) Home FA MN / Mobile Node terminates the tunnel Mobile Node must acquire a locally routable address (Static, DHCP, IPCP, etc.) Local address is only used to terminate the tunnel Inefficient use of IP Addresses 29 Foreign Agent (FA) COA Home FA MN / Must be a router on the Layer 3 edge Terminates tunnels for many many Mobile Nodes with one Care-of Address COA can be any interface address on the Foreign Agent, but loopbacks are best 30 Copyright Printed in USA.

16 Tunneling is the solution to Path (Re)establishment IP in IP is the default, GRE is an option Tunnel is established between HA and COA HAadds a host route to Home Address via the Tunnel FAuses a link local delivery mechanism like the ARP table HA only creates one tunnel to each COA 31 Tunneling Triangle Routing Home Agent Correspondent Host COA Foreign Agent Mobile Node Inbound Traffic is sent to the home subnet The Home Agent intercepts the traffic while the mobile node is registered as away Traffic is tunneled to the COA and forwarded to MN Traffic from the mobile node is forwarded directly to the correspondent host via the FA 32 Copyright Printed in USA.

17 Tunneling Reverse Tunneling Home Agent Correspondent Host COA Foreign Agent Mobile Node Ingress filtering and urpf will drop packets that have topologically incorrect source address Reverse Tunneling Traffic is sent from the MN to the HA via the tunnel, then delivered via routing 33 Agent Advertisements Agent Advertisements are used for both Location Discovery and Move Detection ICMP Router Discovery Protocol (IRDP) messages with Mobile IP extensions Sent as broadcast or multicast beacons from the edge router Advertise the services offered by the mobility agent 34 Copyright Printed in USA.

18 Move Detection IP only move detection is handled by 2 evaluations of Agent Advertisements Lifetime Expiration We haven t heard from the FA within the announced window we must have moved Prefix Length Extension This FAis on a different subnet on the same interface, we must have moved Most Mobile Node clients implement link-state based algorithms Usually just up/down Some offer signal quality evaluation 35 Location Discovery Hi!, I am an FA. I support reverse tunneling. My Care-of Address is This message will repeat in 3 seconds, if you don t hear from me within the next 10 seconds assume I am dead. FA Care-of-Address Mobile IP Location An address on the FA (access router) Learned from an extension on the Agent Advertisement Tunnel end point 36 Copyright Printed in USA.

19 Handover Policy Mobile Nodes with multiple links might want to handover based on factors other than link-state RFC 3344 does not define policies Vendor specific implementation Proactive Handover when ever a link with a better metric (speed, preference, etc.) becomes available Reactive When the MN needs to handover it looks at all available links and chooses based on metrics 37 Agent Advertisement Solicitation The problem: Mobile Nodes using link state Move Detection don t want to wait for periodic advertisements to learn their new location After all advertisements expire Mobile Nodes want to actively search for new mobile agents IRDP Solicitations are Mobile Node initiated requests for Agent Advertisements Sent to either: All routers multicast address ( ) Broadcast address ( ) 38 Copyright Printed in USA.

20 Registration Messages Mobile IP is an edge intelligent Protocol - All routing decisions are made at the edge. Registration Request (RRQ) are used for Update Signaling are routing updates signaled from the Mobile Node contain Identification, Requested Services Options and Authentication Parameters Registration Reply (RRP) are RRQ Accept messages sent from the HAor, RRQ Reject messages sent from either the HAor FA 39 RRQ Identification Network Access Identifier (NAI) A user name appended as an extension Already used in dial-up Either user or user@realm Most common identification method Home Address MN must be pre-configured with it s address Original identification method 40 Copyright Printed in USA.

21 RRQ Services Options Flags Decapsulation by the Mobile Node (Collocated Care-of Addressing) Reverse Tunneling Use GRE tunneling Forward broadcast packets from Home Network And more 41 RRQ Service Options Lifetime Lifetime The maximum amount of time a binding will be kept active without a re-registration Ranges from 1 to seconds Lifetime of 0 is deregistration Lifetime of is infinite Lifetime selection Lowest always wins FAadvertises it s max in Agent Advertisement MN is pre-configured with a max MN Registers with the shorter of the two HAcan lower the value in the RRP (accept or reject) 42 Copyright Printed in USA.

22 RRQ Service Options Extensions Vendor Specific Extensions Used for Cisco IOS Mobile Networks 43 Registration Authentication Authentication of Registration Messages is the only security provided by Mobile IP Authentication Extension is a cryptographic hash of the preceding content Pre-shared keys are used for bi-directional security Security can be between MN and HA, MN and FA, FA and HA and MN and AAA 44 Copyright Printed in USA.

23 Registration Authentication SA Security Association (SA) A set of security parameters which are used to sign the registration message Replay protection Timestamps or nonces Hash Algorithm HMAC or keyed MD5 Key 128 bit key Pre-shared Must be configured the same on both devices Security Parameter Index (SPI) A numeric identifier for the SA to enable several SAs to be configured between two devices 45 RR{Q,P} Authentication AE IP Header UDP Header Mobile IP Registration MH Auth. Ext. MF Auth. Ext. Authentication Extension (AE) The authentication information for the registration Type and or Subtype define relationship SPI selects Security Association Authenticator is the signature Signs everything between the UDP header and the Authenticator Several AEs can be used on a single message 46 Copyright Printed in USA.

24 Registration Reply (RRP) Ack/Nack style for service options Reply codes can be 0 to Success Error from the Foreign Agent Error from the Home Agent Unallocated Lifetime can be lowered without sending a Reject code 47 The RRQ Packet Flow Mobile Node Sends a UDP Packet to port 434 of the Foreign Agent Foreign Agent Processes any AEs Reviews Service Options Forwards RRQ to HA Home Agent Processes AEs Processes Service Options Brings up Tunnel Sends Gratuitous (proxy) ARP on Home Subnet Sends RRP 48 Copyright Printed in USA.

25 Mobile IP Review You Should Know the role of the Home Agent (HA,) Foreign Agent (FA,) and Mobile Node (MN) Understand how Agent Advertisements meet the Motion Detection requirements Be familiar with Update Signaling using Registration messages Understand how Path (Re)Establishment works using tunneling Be ready to get Mobile IP up and running! 49 Integrating Mobile IP into an Enterprise Network 50 Copyright Printed in USA.

26 Wireless LAN Rollout Good fixed network design promotes subnetting Wireless design requires all access points in 1 subnet to achieve mobility Most people don t want to run a new physical network to support wireless Mobile IP to the rescue! 51 Enterprise Network Designed to use what is already in place Most enterprise networks already have AAA and DHCP servers is likely 1 subnet per floor or per building AAA DHCP 52 Copyright Printed in USA.

27 Adding Mobile IP Adding Mobile IP is as simple as adding a HA or enabling the HA on an existing router and installing client software Mobile IP will run in Collocated Care of Address mode MN AAA DHCP Home 53 HA Configuration aaa new-model aaa authorization ipmobile default group radius! interface FastEthernet0/0 ip address ! router mobile! ip classless ip route ip mobile home-agent ip mobile host address pool dhcp-proxy-client dhcp-server interface FastEthernet0/0 aaa load-sa! radius-server host key itsasecret 54 Copyright Printed in USA.

28 Verifying the HA HomeAgent#show ip mobile globals IP Mobility global information: Home Agent Registration lifetime: 10:00:00 (36000 secs) Broadcast disabled Replay protection time: 7 secs Reverse tunnel enabled ICMP Unreachable enabled Strip realm disabled NAT Traversal disabled Foreign Agent is not enabled, no care-of address 1 interface providing service Encapsulations supported: IPIP and GRE Tunnel fast switching enabled Tunnel path MTU discovery aged out after 10 min 55 Client Configuration All clients are different Minimum configuration NAI and/or Home address Home Agent address SPI and key Screenshot from Lifix Go! 56 Copyright Printed in USA.

29 Verifying Registration Check for a valid binding HomeAgent#show ip mobile binding nai user@example Mobility Binding List: user@example (Bindings 0): Check for errors HomeAgent#show ip mobile host nai user@example Mobile Host List: user@example: Allowed lifetime 10:00:00 (36000/default) Roam status -Unregistered-, Home link on int G3/0 Accepted 0, Last time -never- Overall service time -never- Denied 2, Last time 03/18/02 14:49:12 Last code 'insufficient resources (130)' Total violations 1 Tunnel to MN - pkts 0, bytes 0 Reverse tunnel from MN - pkts 0, bytes 0 57 Common Error Codes 129 Administratively Prohibited Denied by an access list 130 Insufficient Resources Could not assign a Home Address 131 Mobile Node Failed Authentication Mismatched keys or SPI 133 Registration Identification Mismatch Clocks out of sync; should retry automatically 58 Copyright Printed in USA.

30 Troubleshooting Registration HomeAgent#debug ip mobile host nai IP mobility for mobile node debugging is on HomeAgent# MobileIP: ParseRegExt... MobileIP: HA 113 rcv registration for MN on FastEthernet0/0 using HomeAddr COA HA lifetime 7200 options sbdmgvt MobileIP: Authenticating MN using SPI 100 MobileIP: Invalid authenticator for MN %IPMOBILE-6-SECURE: Security violation on HA from MN - errcode MN failed authentication (131), reason Bad authenticator (2) MobileIP: HA rejects registration for MN - MN failed authentication (131) MobileIP: MN MHAE added (SPI 100) to MN MobileIP: MN - HA sent reply to A Good Binding user@example has successfully registered and has an active binding HomeAgent#show ip mobile binding nai user@example Mobility Binding List: user@example (Bindings 1): Home Addr Care-of Addr , Src Addr Lifetime granted 02:00:00 (7200), remaining 01:59:33 Flags sbdmgvt, Identification C D1FE629 Tunnel1 src dest reverse-allowed Routing Options - 60 Copyright Printed in USA.

31 Adding an FA At a minimum Collocated Care-of Addressing requires 2 addresses per MN Reduces DHCP server load Conserves HA tunnel resources The Foreign Agent was introduced to help conserve address space Mobile IPv6 does not use an FA 61 Turning on the FA The FA needs be enabled on all your edge routers FA is only minimal overhead Reverse tunneling may not be needed inside an enterprise network MN FA AAA DHCP Home 62 Copyright Printed in USA.

32 FA Configuration interface FastEthernet0/0 ip address ip irdp ip mobile foreign-service ip mobile prefix-length! interface FastEthernet0/1 ip address ip irdp ip mobile foreign-service ip mobile prefix-length! router mobile! ip mobile foreign-agent care-of FastEthernet0/0 63 Validating the FA Same basic idea as the Home Agent Check the global configuration show ip mobile global Check the visitor tables show ip mobile visitor 64 Copyright Printed in USA.

33 HA Redundancy or HA HA MN does not learn about HA failure until re-registration Bindings are stateful HA usually hosts a large number of MNs Supports load balancing Very flexible, but usually used in it s simplest form MN FA AAA DHCP Home Home 65 HA Redundancy Config Primary and Secondary must have the same Home Agent configuration Security Association must be defined between the two Home Agents interface FastEthernet0/0 ip address standby ip standby name mip! ip mobile home-agent redundancy mip ip mobile secure home-agent spi 100 key hex abcdef abcdef 66 Copyright Printed in USA.

34 FA Redundancy FA Redundancy is built into the Mobile IP protocol MN listens for advertisements Prefix length helps determine if it has moved Lower IRDP timer to speed failure detection 67 Clients 68 Copyright Printed in USA.

35 Clients Mobile IP is an edge intelligent routing Protocol Mobile IP clients run at the stack level MN signals its own routing update Transparent to upper layer applications 69 Clients Types Host Device Pros Cons Terminal- Based Laptops, PDAs, etc. More Features Hard to Deploy and Manage Embedded Proxy Handset, Access Point, etc. Transparent to Attached Clients, Easier to Manage Tied to Media, Fewer Features, Less Security Mobile Router Router Clients not Mobile, Central Management Harder to Provision and Deploy 70 Copyright Printed in USA.

36 PC Clients Full featured, stable commercial clients available from Birdstep and others HUT Dynamics is a good open source client for Linux (and Windows) Support WLAN roaming and inter-link roaming 71 Aironet Proxy Mobile IP 72 Copyright Printed in USA.

37 Aironet Proxy Mobile IP Inter-subnet roaming without a client Transparent to all devices Integrates with existing fixed and wireless network designs Supported in both VxWorks and Cisco IOS APs 73 Subnet Mapping Authoritative AP /24 H/F H/F /24 Subnet Mapping Authoritative APs (AAP) keep track of the HA IP address for each subnet AAP addresses are configured in each AP At power up each AP listens for Agent Advertisements offering both HA and FAservices AP registers subnet and HA address with AAP AAP sends full subnet map table to AP 74 Copyright Printed in USA.

38 Initial Association H/F H/F / / Mobile Node associates with AP and uses DHCP to get an IP address AP functions transparently, PMIP not is use Standard IP routing delivers traffic to the Mobile node 75 Roaming H/F H/F / / Mobile Node associates with new AP MNs IP address is not part of the local subnet New AP looks up the MNs HA in subnet map New AP generates a Registration Request and forwards it to the local FA 76 Copyright Printed in USA.

39 Roaming H/F H/F / /24 Normal Mobile IP FA validates RRQ and forwards it to the HA HA validates RRQ, builds tunnel, sends gratuitous ARP and then sends an RRP HA forwards traffic to the FA via the tunnel FA delivers traffic using the MAC address for the ARP table 77 Important Points: DHCP Issues Only when a client roams does MIP come into play Microsoft This occurs when physical link is lost or when a PC comes out of standby [most of the time] An IP release/renew will result in a new DHCP request and will break all existing sessions and will negate this Proxy MIP implementation; we need to be able to configure the client to suppress media sense where appropriate 78 Copyright Printed in USA.

40 Microsoft Media Sense Windows 2000 automatically sends an IP release/renew on link update (media reconnect) Media reconnect breaks Proxy Mobile IP support Media Sense _und_autoconfiguration.htm To disable this feature see _pro_disableautoconfiguration.htm 79 Security APs must include a MN-HA security association Can be configured manually on each AP/HA Both AP and HA can point to a RADIUS server (ACS) Cisco IOS Mobile IP allows a group key to be configured for a range of IP addresses Proxy MIP defeats Mobile IP security and relies on AP security 80 Copyright Printed in USA.

41 FA Forwarding Caveat The Cisco IOS FA use the standard CEF table to deliver traffic to mobile nodes Visitor and CEF entries are not cleared until the lifetime expires Traffic routed via the FA to the Home address gets black holed after MN moves 81 FA Forwarding Caveat (Cont.) Often not an issue outside the lab Usually only peer to peer traffic impacted Cisco IOS 12.2T use hidden command: ip mobile binding-update Catalyst and older Cisco IOS use lower lifetime 82 Copyright Printed in USA.

42 Cisco IOS Mobile Networks 83 Cisco IOS Mobile Networks Enables mobility for entire networks The Router is Mobile IP aware Attached devices do not need a Mobile IP Client Commonly used in transportation and public safety, but the possibilities are endless 84 Copyright Printed in USA.

43 Mobile Router Basics /24 Home The Mobile Router runs a Mobile IP Client stack A second tunnel is used to route traffic from the the HA to the mobile networks The second tunnel is between the HA and the Home Address of the Mobile Router 85 Mobile IP and the Mobile Router Mobile Routers use standard Mobile IP Listen for and solicit Agent Advertisements Send and receive Registration messages Operate with a FA or Collocated Care-of Address 86 Copyright Printed in USA.

44 Mobile Router Features Automatically handover to higher priority and/or faster links when available Dynamic registration of mobile networks Support for asymmetric links HSRP style redundancy 87 Mobile Networks Rail Example Rail Operator Network IPSec GW Home Agent Home Foreign Agent Station 1 Foreign Agent Station 2 F1/0 F2/0 Train Network /24 88 Copyright Printed in USA.

45 Mobile Networks Config interface Loopback0 ip address ! interface FastEthernet0/1 ip address ! interface FastEthernet1/0 ip address ip mobile router-service roam ip mobile router-service solicit! interface FastEthernet2/0 ip address ip mobile router-service roam priority 10 ip mobile router-service solicit! router mobile! ip mobile secure home-agent spi 100 key ascii itsasecret ip mobile router address home-agent register lifetime 7200 mobile-network FastEtherenet0/1 89 Mobile Networks HA Config Not much new here! router mobile! ip mobile home-agent ip mobile virtual-network ip mobile host virtual-network ip mobile mobile-networks register ip mobile secure host spi 100 key ascii cisco 90 Copyright Printed in USA.

46 Things to Watch for Always configure the Home Address on a Loopback Always use virtual networks at the HA Don t test mobile network connectivity by pinging between MR and HA Testing is best done from a client on the Mobile Network 91 Closing and Future 92 Copyright Printed in USA.

47 Coming Attractions v4 NAT Traversal UDP Tunneling Registration Revocation Regional Registration Dynamic Keying 93 Coming Attractions v6 Final RFC!?!? Tightly integrated with IPv6 Eliminates Foreign Agent Minimizes Asymmetric Routing Cisco IOS Mobile IPv6 Technology Preview 94 Copyright Printed in USA.

48 References More at Networkers 2003 ACC-2021: Designing Networks in Motion Using Mobile IP and the Mobile Router ACC-2012: Advanced Designs for Voice-Enabled Enterprise Roaming 96 Copyright Printed in USA.

49 Please Complete Your Evaluation Form Session Copyright Printed in USA.