Subject: [Mip6] IPsec and return to home

From: Francis Dupont <[email-masked]>
Date: Mon, 24 Oct 2005 19:04:14 +0200

In RFC 3776 and 3776bis (IKEv2) there is:

   o  When the mobile node returns home and de-registers with the Home
      Agent, the tunnel between the home agent and the mobile node's
      care-of address is torn down.  The security policy entries, which
      were used for protecting tunneled traffic between the mobile node
      and the home agent MUST be made inactive (for instance, by
      removing them and installing them back later through an API).  The
      corresponding security associations could be kept as they are or
      deleted depending on how they were created.  If the security
      associations were created dynamically using IKE, they are
      automatically deleted when they expire.  If the security
      associations were created through manual configuration, they MUST
      be retained and used later when the mobile node moves away from
      home again.  The security associations protecting Binding Updates
      and Acknowledgements, and prefix discovery SHOULD NOT be deleted
      as they do not depend on care-of addresses and can be used again.

This is a bit problematic to support in some current KAME OSs because
the mandatory control on the position in the SPD of new entries is
not supported, i.e., if some SPD entries are removed and inserted
back the order is not preserved... Even it is really a bug I've looked
for alternatives and IMHO the tunnel IPsec DB entries must be made
inactive only when they can give spurious protection to packets,
i.e., with the local_mh_type=HoTi and remote_mh_type=HoT there will
never be an interesting packet matching the IPsec DB entries and
it doesn't matter to keep them. This is a new benefit of the fine
grain selectors of 2401bis.
If at the opposite there is an ESP tunnel for all packets and someone
wants to keep privacy, the obvious solution is to keep the registration
(and of course the IPsec database entries).

[email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6