Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: Gerardo Giaretta <[email-masked]>
Date: Tue, 25 Oct 2005 15:32:22 +0200

> > > > If in your opinion exposing HA addresses in DNS is an issue, in 
> > > > integrated scenario a DHCP-based solution may be used (see the 
> > > > integarted scenario draft).
> > > > 
> > > > > For the moment, with these proposals, the MSP has not the 
> > > > > possibility to manage its HA as he wants ...
> > > > > 
> > > > 
> > > > Why in DNS-based solution you think this is not possible? 
> > > 
> > > This is the MN that will choose the HA from the listed HA 
> > in the DNS.
> > > 
> > 
> > Not entirely. The SRV specification, as Henrik mentioned 
> > before in another thread, provides for priorities between 
> > multiple Home Agents.
> > The list of HAs with priorities may be considered similar to 
> > the list received by the MN via DHAAD. The MN will choose 
> > based on these priorities.
> 
> What does prevent the MN to contact the HA he wants? Nothing 
> as far as I
> can see.
> 

I agree. This is true also for DHAAD. 
Besides the motivation why a MN will prevent another HA that is
theoretically more loaded, the operator may let the HA refuse the IPsec
SA setup during IKEv2 through its AAA infrastructure. But I agree this
is not a clean approach.

> >  Otherwise, in integrated scenario, 
> > DHCP can be used. As mentioned before, if you need a very 
> > strict control on the HA assignment by the operator, IMHO the 
> > best way is to perform it during network access 
> > authentication, but unfortunately this is not a general solution.
> 
> Agree. But I think a operator must have the possibility to 
> assign the HA
> in any cases.
> 

DHCP-based solution seems to achieve this. Do you see any issue on that?

--Gerardo

> > 
> > 
> > --Gerardo
> 
> Regards.
> 
> JMC.
> 
> France Telecom - R&D Division - MAPS/NSS   
> Jean-Michel COMBES, Internet/Intranet Security
> E-Mail: [email-masked]
> Phone: +33 (0)1 45 29 45 94
> Fax: +33 (0)1 45 29 65 19
> Mobile: +33 (0)6 07 29 30 16 
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 25 Oct 2005 18:55:04 +0200

In your previous mail you wrote:

=> it is not so bad but:
 - it is not so easy to implement (another IKE/MIPv6 interaction,
   the MIPv6 codes I know try other HAs when BUs fail)
 - with a timeout it is not efficient, with an ICMP message it is
   a security hole (trivial DoS)
 - any secured mechanism will take time and participate to the load

=> I know well DHCPv6 and I don't believe it is the right tool for
this job. I'll comment the general bootstrapping draft
(draft-ietf-mip6-bootstrapping-integrated-dhc-00.txt isn't it?)
because there are many ways to use DHCPv6, including just transmitting
AAA stuff to the MN...

Regards

[email-masked]

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 25 Oct 2005 16:02:37 -0700

> DHCP-based solution seems to achieve this. Do you see any issue on that?

yes. DHCP based solution would require the Operator to
first update the access network too. what many operators
would like to do (initially atleast) is to just plug in
a HA and introduce new mobile devices that can use the
new features. no upgrades anywhere else.

Vijay