Subject: [Mip6] Re: concerns about draft-devarapalli-mip6-ikev1-bootstrap-00.txt

From: Francis Dupont <[email-masked]>
Date: Thu, 27 Oct 2005 01:58:42 +0200

In your previous mail you wrote:

   >=> IPsec tunnel mode SAs are not real interfaces, they have no 
   >link-local addresses for instance, when DHCPv6 requires a *link*.

   You just need to configure a IPv6-in-IPv6 tunnel interface (so
   that you get a link-local address) and use transport mode SA
   to protect the DHCPv6 traffic. Once you get the home address,
   you setup ipsec tunnel mode SAs using RFC 3775.
   
=> this is not what is the document ("IPsec tunnel") and the drawback
is the IKE has to be reestablished...

Regards

[email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: [email-masked]
Date: Wed, 26 Oct 2005 16:06:27 -0700

>
>   > - I am not convinced DHCPv6 can be used over IKE as described:
>   >   DHCPv6 is designed to run between the client and the first 
>   >relay/server
>   >   over a link using multicast and link-local addresses. So it 
>   >runs without
>   >   problem over L2TP/PPP between a client and a NAS. Here we 
>   >have a tunnel
>   >   mode IPsec which is pretty different than a real tunnel 
>interface.
>   
>   RFC 3775 assumes that IPsec is modeled as an interface.
>

-mohan