Subject: [Mip6] [issue43] Review by Steve Bellovin: Dropping of ESP packets

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 02 Oct 2005 13:57:18 +0000

New submission from Hannes Tschofenig <[email-masked]>:

Steve: > >5.1:
> >	It's not so much that firewalls drop ESP by default, it's that
> >	they can't tell if inbound ESP packets are legitimate, since
> >	there's no useful state created by the outbound ESP packets.

this sentence sounds good to me. let me change the following paragraph from:

"
   Issue 1: When the MN A connects to the network, it should acquire a
      local IP address (CoA), and send a Binding Update to its Home
      Agent to update the HA with its current point of attachment.  The
      Binding Updates and Acknowledgements should be protected by IPsec
      ESP according to the MIPv6 specifications [1].  However, as a
      default rule, many firewalls drop ESP packets.  This may cause the
      Binding Updates and Acknowledgements between the Mobile Nodes and
      their Home Agent to be dropped.
"

to 

"
   Issue 1: When the MN A connects to the network, it should acquire a
      local IP address (CoA), and send a Binding Update to its Home
      Agent to update the HA with its current point of attachment.  The
      Binding Updates and Acknowledgements should be protected by IPsec
      ESP according to the MIPv6 specifications [1].  However, as a
      default rule, many firewalls drop IPsec ESP packets because they cannot 
determine whether inbound ESP packets are legitimate, since it is difficult or 
impossible to create useful state by observing the outbound ESP packets. This 
may cause the
      Binding Updates and Acknowledgements between the Mobile Nodes and
      their Home Agent to be dropped. 
"

----------
category: Editorial
draft: draft-ietf-mip6-firewalls
messages: 162
nosy: bpatil, franckle, hannes, mip6, sfaccin
priority: Should fix
status: Text proposed
title: Review by Steve Bellovin: Dropping of ESP packets

_________________________________________________
Mip6 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip6/issue43>
_________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6