Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
Date: Tue, 25 Oct 2005 15:20:43 +0200

> -----Original Message-----
> From: Gerardo Giaretta [mailto:[email-masked]] 
> Sent: Tuesday, October 25, 2005 2:48 PM
> To: COMBES Jean-Michel RD-MAPS-ISS
> Cc: [email-masked]; Kilian Weniger; James Kempf; Narayanan 
> Vidya-CVN065; Francis Dupont; Petrescu Alexandru-AAP021
> Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt
> 
> > > If in your opinion exposing HA addresses in DNS is an issue, in 
> > > integrated scenario a DHCP-based solution may be used (see the 
> > > integarted scenario draft).
> > > 
> > > > For the moment, with these proposals, the MSP has not the 
> > > > possibility to manage its HA as he wants ...
> > > > 
> > > 
> > > Why in DNS-based solution you think this is not possible? 
> > 
> > This is the MN that will choose the HA from the listed HA 
> in the DNS.
> > 
> 
> Not entirely. The SRV specification, as Henrik mentioned 
> before in another thread, provides for priorities between 
> multiple Home Agents.
> The list of HAs with priorities may be considered similar to 
> the list received by the MN via DHAAD. The MN will choose 
> based on these priorities.

What does prevent the MN to contact the HA he wants? Nothing as far as I
can see.

>  Otherwise, in integrated scenario, 
> DHCP can be used. As mentioned before, if you need a very 
> strict control on the HA assignment by the operator, IMHO the 
> best way is to perform it during network access 
> authentication, but unfortunately this is not a general solution.

Agree. But I think a operator must have the possibility to assign the HA
in any cases.

> --Gerardo

Regards.

JMC.

France Telecom - R&D Division - MAPS/NSS   
Jean-Michel COMBES, Internet/Intranet Security
E-Mail: [email-masked]
Phone: +33 (0)1 45 29 45 94
Fax: +33 (0)1 45 29 65 19
Mobile: +33 (0)6 07 29 30 16 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 25 Oct 2005 18:17:52 +0200

In your previous mail you wrote:

   But I think a operator must have the possibility to assign the HA
   in any cases.
   
=> is it a request to provide a HA assignment mechanism in any cases?

And if the answer is yes do other operators agree?

And if again the answer is yes is it a request to put the highest
priority on the topics and to phase out DHAAD as soon as the WG
specifies a HA assignment mechanism covering the general case or some
mechanisms covering together every cases (if the previous fails)?

Thanks

[email-masked]

PS: I'll try to involve the IPsec people into the HA assignment
in IKEv2 which IMHO is the missing part.