Mobile IP Lessons Learned

The early years

Updated_03-09-01

2001, Cisco Systems, Inc.

Who needs Mobile IP anyway?

Updated_03-09-01 Updated_01-02-01

2001, Cisco Systems, Inc.

A Word from the Nay Sayers

Nomads dont have any problems today

Dynamic addressing works just fine

We dont have enough v4 addresses as it is

Updated_03-09-01

2001, Cisco Systems, Inc.

Cellular Mobility
User can handover mid flow
Simplifies layer 2 macro mobility

Easier to manage than dynamic address pools

Important part of 3G standards

Cleaner user experience

Updated_03-09-01

2001, Cisco Systems, Inc.

Multiple Media Networks

Cost based network selection Go between 802.11, cellular, satellite, etc Supported in Ciscos IOS Mobile Network
Updated_03-09-01
2001, Cisco Systems, Inc.

Clients
Host device Pros
More features

Cons
Hard to deploy and manage

Terminal Based

Laptops, PDAs, etc

Embedded Handset, Network Proxy Access pt.

Mobile Router

Transparent to Tied to media, attached clients, fewer features, Easier to manage less security Clients not mobile, Central Management Harder to provision and deploy

Router

Updated_03-09-01

2001, Cisco Systems, Inc.

Infrastructure
What you really need to know to keep your job.
Updated_03-09-01 Updated_01-02-01
2001, Cisco Systems, Inc.

SAM, An Engineers Best Friend

Scalability Bigger is better Availability Uptime is king

Manageability Knowledge is power

Updated_03-09-01

2001, Cisco Systems, Inc.

Scalability

Maximum number of users per box Number of users per rack Max Users Throughput, registration rate & memory

Updated_03-09-01

2001, Cisco Systems, Inc.

Did you know

there is a significantly higher proportion of signaling traffic to user traffic required for mobility management than traditional dynamic IP routing Thats why we use Mobile IP. Traditional routing protocols would not scale with the quantity and frequency of mobility updates
Updated_03-09-01 10

2001, Cisco Systems, Inc.

Registration Rates

Even with large foreign agent provinces each user may reregister every 1-2 hours 1 million users reregistering every 2 hours is ~140 registrations per second. With 200k users per HA thats 28 registrations per second

Province The geographic area covered by a single foreign agent interface

Updated_03-09-01

2001, Cisco Systems, Inc.

11

AAA requirements
Every registration requires a Security Association lookup SAs can be stored locally or in a AAA server How do you handle 140 queries per second per million users?

Updated_03-09-01

2001, Cisco Systems, Inc.

12

AAA Deployment strategies

Pros Cons
Hard to scale, Latency can be a problem
Hard to plan, manage, deploy and provision Cache Management Problems

Centralized

Easy to manage and provision

Distributed

No WAN concerns or latency problems

Central + Cache

Best of both worlds

Updated_03-09-01

2001, Cisco Systems, Inc.

13

Tunnel requirements

1 tunnel per Foreign Agent 1 tunnel per co-located care of address Tunnels can limit scalability

Updated_03-09-01

2001, Cisco Systems, Inc.

14

Availability

Uptime is king
100% SYSTEM uptime is the goal Remember, system uptime is not box uptime
Updated_03-09-01
2001, Cisco Systems, Inc.

15

HA Availability

MN does not learn about HA failure until re-registration

Bindings are stateful

HA usually hosts a large number of subscribers
Updated_03-09-01
2001, Cisco Systems, Inc.

16

Ciscos HA Redundancy

Built on HSRP
Replicates bindings in near real time Transparent to Mobile Node

Bindings AND cached Security Associations are replicated

Updated_03-09-01

2001, Cisco Systems, Inc.

17

Manageability

Fast response to outages

Capacity Planning
Performance management

Updated_03-09-01

2001, Cisco Systems, Inc.

18

RFC 2006 MIB

Good fault management support

Total and per user counters for registrations and errors

Poor capacity/performance management support

Must iterate through the binding table to count bindings

Cisco MIB supports enhanced features

Updated_03-09-01

2001, Cisco Systems, Inc.

19

Extracting Performance data

HA Registration throughput and performance

haRegistrationAccepted & haRegRepliesSent vs time faRegRepliesRelayed & haRegRepliesSent vs time

FA Registration throughput and performance

faRegRequestsReceived & faRegRequestsRelayed vs time faRegRepliesRelayed & faRegRepliesRelayed vs time

Updated_03-09-01

2001, Cisco Systems, Inc.

20

Internet Deployment

Updated_03-09-01 Updated_01-02-01

2001, 2001, Cisco Cisco Systems, Systems, Inc. Inc.

21

Realities of MIP Deployment

The Internet was designed to support Broadband and Dial-up

Security concerns force tight network implementation Mobility doesnt fit naturally

Updated_03-09-01

2001, Cisco Systems, Inc.

22

Ingress filtering

A classic problem in MIP

Network designers block incoming traffic with an internal source address

HA

10.1.2.0

Unicast RPF is probably a more dangerous problem

Reverse Tunnels offer a solution
10.1.2.45

Internet

Updated_03-09-01

2001, Cisco Systems, Inc.

23

Ingress filtering

A classic problem in MIP

Network designers block incoming traffic with an internal source address

HA

10.1.2.0

Unicast RPF is probably a more dangerous problem

Reverse Tunnels offer a solution
10.1.2.45

Internet

Updated_03-09-01

2001, Cisco Systems, Inc.

24

Path MTU Discovery

Many network designers block all inbound ICMP

Triangle routing causes problems not normally seen TCP Session opens, but hangs Windows support black hole detection

Updated_03-09-01

2001, Cisco Systems, Inc.

25

WAP MTU length problems

WAP relies on IP fragmentation Fragmentation occurs at WAP gateway servers MTU

Fragments cant be fragmented

Gateway MTU must be <= path MTU including tunnel
Updated_03-09-01
2001, Cisco Systems, Inc.

26

Private Addressing

Good for Walled Gardens Large Scale NAT can be difficult

No support for overlapping addresses in the FA

Updated_03-09-01
2001, Cisco Systems, Inc.

27

It is worth it!

Updated_03-09-01 Updated_01-02-01

2001, 2001, Cisco Cisco Systems, Systems, Inc. Inc.

28

Dont Worry

A Mobile IP network is just as easy to build as any IP network. There are just a few new rules.

Updated_03-09-01

2001, Cisco Systems, Inc.

29

Sweet Rewards

Seamless IP connectivity
Transparent user experience Limitless Possibilities

Updated_03-09-01

2001, Cisco Systems, Inc.

30

Are you Ready?

There are plenty of challenging problems ahead, but the reward is great.

Updated_03-09-01

2001, Cisco Systems, Inc.

31

Fire Away?

Questions?

Updated_03-09-01

2001, Cisco Systems, Inc.

32