Subject: RE: v4 CoA and route optimization [Re:[Mip6] draft-solimananddraf t-wakikawa]

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Thu, 7 Apr 2005 15:00:23 -0500

Vijay,
If other mechanisms such as the AUTH option are standardized, and if IKEv2 is not used to set up the SA between MN/MR and HA, a solution for NAT traversal that has a dependency on IKEv2 will have a problem. Given that this is a possibility, do we really want to make this the solution? 

In my mind, it is fine to use IKEv2 to detect NATs when it is used - but, it doesn't seem to me that we can assume it will always be used? 

I somehow didn't raise it at IETF, but nevertheless, seems important to discuss :) 

Vidya

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Thursday, April 07, 2005 12:02 PM
To: [email-masked]; Petrescu Alexandru-AAP021
Cc: [email-masked]
Subject: RE: v4 CoA and route optimization [Re:[Mip6] draft-solimananddraft-wakikawa]

Pascal,

RFC 3775, 3776 and 3963 all use IPsec by default for
setting up security associations between the MN/MR and 
the HA. once draft-ietf-mip6-ikev2-ipsec is approved, I 
believe IKEv2 will become the default mechanism for 
setting up security associations between the MN/MR and 
the HA.

so what are you objecting to? the use of IKEv2 or the use
of IKEv2 for detecting NATs? 

IKEv2 has a NAT detection mechanism. and if MN/MR and 
the HA use IKEv2 to set up security associations, then it
is natural to use IKEv2 to detect NATs also.

if the WG feels we need another MIP specific mechanism
for detecting NATs, we can work on it. we had that 
question on the slides presented at the last IETF meeting. there wasnt any feedback at that time.

Vijay

> -----Original Message-----
> From: ext Pascal Thubert (pthubert) [mailto:[email-masked]]
> Sent: Thursday, April 07, 2005 12:21 AM
> To: Devarapalli Vijay (Nokia-NRC/MtView); 
> [email-masked]
> Cc: [email-masked]
> Subject: RE: v4 CoA and route optimization [Re:[Mip6] 
> draft-solimananddraft-wakikawa]
> 
> 
> 
> 
> | -----Original Message-----
> | From: [email-masked] [mailto:[email-masked]] On Behalf
> Of
> | [email-masked]
> | Sent: Wednesday, April 06, 2005 7:42 PM
> | To: [email-masked]
> | Cc: [email-masked]
> | Subject: RE: v4 CoA and route optimization [Re:[Mip6] draft- 
> | solimananddraft-wakikawa]
> | 
> | > > and in the slides we presented at the IETF, we had a
> | > question for the
> | > > WG, if we need to come up with another NAT detection mechanisn
> based
> | > > on MIPv6 (similar to what MIPv4 does), but we didnt get any
> | > response.
> | > > if the WG thinks we need one based on MIPv6, I have an idea
> | > on how to
> | > > do it.
> | >
> | > How?
> | 
> | let the WG first decide on whether IKEv2 is sufficient for detecting 
> | NATs when the MN and the HA run IKEv2 between them. if the WG things 
> | we need another MIP specific mechanism we will get to this later. 
> | this discussio will only be a distraction now.
> | 
> Hi Vijay:
> 
> I would not approve a solution that makes a dependency to IKEv2 for 
> traversing NATs, unless IKEv2 becomes universal for MRHA. At the 
> moment, the relation between the key negotiation and IPv4 traversal 
> mechanisms seems pretty loose so I would not forcefully tie them, even 
> if it actually works.
> 
> I'd rather have a modular approach in the solutions that we
> put in place
> for the problems that we want to solve.
> 
> But maybe I missed what you really mean here. Could you clarify?
> 
> Pascal
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Thu, 7 Apr 2005 13:43:06 -0700

Vidya,

The AUTH option isn't standardized, it is an Informational draft.

            jak

----- Original Message ----- 
From: "Narayanan Vidya-CVN065" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; "Petrescu
Alexandru-AAP021" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, April 07, 2005 1:00 PM
Subject: RE: v4 CoA and route optimization [Re:[Mip6]
draft-solimananddraft-wakikawa]

> Vijay,
> If other mechanisms such as the AUTH option are standardized, and if IKEv2
is not used to set up the SA between MN/MR and HA, a solution for NAT
traversal that has a dependency on IKEv2 will have a problem. Given that
this is a possibility, do we really want to make this the solution?
>
> In my mind, it is fine to use IKEv2 to detect NATs when it is used - but,
it doesn't seem to me that we can assume it will always be used?

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 07 Apr 2005 13:41:28 -0700

> If other mechanisms such as the AUTH option are standardized, and if IKEv2 is not used to set up the SA between MN/MR and HA, a solution for NAT traversal that has a dependency on IKEv2 will have a…

yes. this is a valid issue. I am fine with developing a
MIP specific mechanism for NAT detection in addition to
IKEv2.

Vijay