Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: "Kilian Weniger" <[email-masked]>
Date: Mon, 24 Oct 2005 17:25:22 +0200

Hi Francis, Alex,

>    Both ideas have appeal to me.  Both could be supported by some
>    argumentation.
> 
> => this is why we should have this discussion.

I agree that DNS-based DHAAD can be more secure, but one advantage of
anycast-based DHAAD I can see is that load balancing is better supported
since load conditions can be considered faster (probably cannot be
distributed fast enough in DNS).

> => IMHO HA assignement is far better but there is not yet a mechanism
> providing it *and* applicable in the general case.

Security-wise yes. But which entity assigns the HA? And how do you
discover this HA assignment entity? And what about the signaling
overhead then? And the signaling overhead can be pretty high, e.g., if
MN first needs to request DNS to discover assignment entity and
subsequently establishes SA with assignment entity, gets HA assigned and
finally establishes SA with this HA.

Wouldn't it be possible to integrate HA discovery and assignment somehow
in an IKEv2 exchange, similar as HoA assignment is integrated in IKE
exchange in the bootstrapping solution? E.g., the first IKE message
(IKE_SA_INIT) sent by MN would have anycast address as destination
address (reply and all other IKE messages use unicast addresses as
source/destination) and the Configuration Payload in the IKE_AUTH may
contain an HA address for assignment to MN (only used if the HA that
received the anycast IKE_SA_INIT shall not be used, e.g., because this
HA is overloaded). 

> 
>    >  - is the DNS-based DHAAD mechanism better enough to 
> replace the ICMP-base
>    >    one?

What about the alternative to change the transport protocol, e.g.,
UDP-based instead of ICMP-based anycast DHAAD?

> - AFIK, there is no way currently standardized to securely update
> anycast routing except to manually insert host routes into the subnet
> router handling the anycast address. So maintaining an anycast address
> would require extra maintenance effort, manually inserting and
deleting
> the routes when HAs are added or deleted.

Interesting point, but isn't such a mechnism needed for almost all
anycast-based protocols? I.e., isn't there a need for such a
standardized mechanism anyway?

Regards,

Kilian

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Mon, 24 Oct 2005 17:45:30 +0200

In your previous mail you wrote:

=> IMHO load balancing should not be provided by a DHAAD mechanism
but by HA assignment or HA-switch.

   > providing it *and* applicable in the general case.
   
   Security-wise yes. But which entity assigns the HA?

=> the network (the MSP in the bootstrapping terminology).

   And how do you discover this HA assignment entity?

=> this is something to specify with the whole HA assignment mechanism.
We don't discuss about a particular mechanism but about the function.

   And what about the signaling
   
   in an IKEv2 exchange,

=> this is the Security Gateway discovery issue. It is in the scope
of the IPsec WG but I am afraid we should not wait for a solution
from them, on another hand it has to be secure and IPsec people
should be better...

   similar as HoA assignment is integrated in IKE
   
=> note this is in fact Security Gateway assignment.

   
=> the ICMP filtering issue is only one part of the problem.

   deleting

=> no, the anycast-based protocols are request/reply protocols so
they don't need responder stability.

Regards

[email-masked]