Subject: [EME] Traversing HIP-aware NATs and Firewalls: Problem Statement and Requirements

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 18 Jun 2007 22:09:17 +0200

This document might be related and relevant:
http://www.tschofenig.com/drafts/draft-tschofenig-hiprg-hip-natfw-traversal-04.txt

I wonder whether someone ever looked at it.

_______________________________________________
EME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/eme

---

From: Paul Francis <[email-masked]>
Date: Mon, 18 Jun 2007 17:24:14 -0400

Hi Hannes,

I'm responding to your emails out of order...

This draft certainly is relevant.  I would not claim to have been intimately
familiar with it when we wrote the EME drafts, but speaking for myself I was
vaguely aware of it.  (As you can see, we were quite lazy about citing much
of anything.  Especially the design draft is meant to trigger getting
feedback...it is certainly our intent to do a better job with citations once
we think we are on the right track.)

As far as the HIP nat traversal stuff relates to NUTSS, Am I right in saying
that it suffers from the problem of assymetric paths (i.e. with multihomed
sites)?  If this is the case, then NUTSS seems very complimentary to HIP (as
Tom and others are suggesting).

Sorry if this is a stupid question, but am I right in assuming that with hip
nat/fw traversal, the middleboxes can authenticate the HIP setup, but not
data packets themselves (which after all are vanilla IPSec packets)?

PF

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]] 
> Sent: Monday, June 18, 2007 4:09 PM
> To: [email-masked]
> Subject: [EME] Traversing HIP-aware NATs and Firewalls: 
> Problem Statement andRequirements
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 19 Jun 2007 09:11:08 +0200

Hi Paul,

> we think we are on the right track.)
Hmmm.

> Tom and others are suggesting).
It depends what you call "suffer". There are various ways to solve these 
problems. It is just not beautiful when NAT/Firewall traversal is dumped 
into HIP. It works nicely when you use other protocols that are designed 
for this purpose.

On the other hand, stateful packet filtering firewalls just don't work 
nicely with asymmetric paths. It's just the way how they work; it's 
their purpose.

> data packets themselves (which after all are vanilla IPSec packets)
>   
That's true unless you use
* digitally sign each packet
* Establish IPsec tunnels recursively, or
* use something similar to the stuff suggested in 
http://www.ambient-networks.org/docs/Advanced_HIP_based_Firewall_Traversal.pdf 

But again, there is the question why you actually need this functionality.

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 19 Jun 2007 09:49:40 +0200

> But again, there is the question why you actually need this 

Btw, you don't need to verify the data traffic when you are concerned 
that someone injects traffic that will be processed by the end point. If 
an adversary would do that then the packet would be discarded at the end 
point since it would not pass IPsec processing.

Ciao
Hannes

---

From: Paul Francis <[email-masked]>
Date: Tue, 19 Jun 2007 11:49:18 -0400

Something along the lines of >
http://www.ambient-networks.org/docs/Advanced_HIP_based_Firewall_Traversal.pd
f would be interesting in the context of NUTSS...allows middleboxes to do
per-packet authentication without requiring recursive/nested IPsec tunnels...

PF

> Sent: Tuesday, June 19, 2007 3:11 AM
> To: Paul Francis
> Cc: [email-masked]
> Subject: Re: [EME] Traversing HIP-aware NATs and Firewalls: 
> > This draft certainly is relevant.  I would not claim to have been 
> > intimately familiar with it when we wrote the EME drafts, 
> but speaking 
> > for myself I was vaguely aware of it.  (As you can see, we 
> were quite 
> > lazy about citing much of anything.  Especially the design draft is 
> > meant to trigger getting feedback...it is certainly our 
> intent to do a 
> > better job with citations once we think we are on the right track.)
> >   
> Hmmm.
> 
> > As far as the HIP nat traversal stuff relates to NUTSS, Am 
> I right in 
> > saying that it suffers from the problem of assymetric paths 
> (i.e. with 
> > multihomed sites)?  If this is the case, then NUTSS seems very 
> > complimentary to HIP (as Tom and others are suggesting).
> >   
> It depends what you call "suffer". There are various ways to 
> solve these problems. It is just not beautiful when 
> NAT/Firewall traversal is dumped into HIP. It works nicely 
> when you use other protocols that are designed for this purpose.
> 
> On the other hand, stateful packet filtering firewalls just 
> don't work nicely with asymmetric paths. It's just the way 
> how they work; it's their purpose.
> 
> > Sorry if this is a stupid question, but am I right in assuming that 
> > with hip nat/fw traversal, the middleboxes can authenticate the HIP 
> > setup, but not data packets themselves (which after all are vanilla 
> > IPSec packets)
> >