Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
Date: Tue, 25 Oct 2005 16:33:40 +0200

> -----Original Message-----
> From: Gerardo Giaretta [mailto:[email-masked]] 
> Sent: Tuesday, October 25, 2005 3:32 PM
> To: COMBES Jean-Michel RD-MAPS-ISS
> Cc: [email-masked]; Kilian Weniger; James Kempf; Narayanan 
> Vidya-CVN065; Francis Dupont; Petrescu Alexandru-AAP021
> Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt
> 
> > > > > If in your opinion exposing HA addresses in DNS is an 
> issue, in 
> > > > > integrated scenario a DHCP-based solution may be used 
> (see the 
> > > > > integarted scenario draft).
> > > > > 
> > > > > > For the moment, with these proposals, the MSP has not the 
> > > > > > possibility to manage its HA as he wants ...
> > > > > > 
> > > > > 
> > > > > Why in DNS-based solution you think this is not possible? 
> > > > 
> > > > This is the MN that will choose the HA from the listed HA
> > > in the DNS.
> > > > 
> > > 
> > > Not entirely. The SRV specification, as Henrik mentioned 
> before in 
> > > another thread, provides for priorities between multiple Home 
> > > Agents.
> > > The list of HAs with priorities may be considered similar to the 
> > > list received by the MN via DHAAD. The MN will choose 
> based on these 
> > > priorities.
> > 
> > What does prevent the MN to contact the HA he wants? 
> Nothing as far as 
> > I can see.
> > 
> 
> I agree. This is true also for DHAAD.

Yes if the MN knows all the HA but in the case where DHAAD only provide
one HA, it will be harder for the MN to choose another one.
 
> Besides the motivation why a MN will prevent another HA that 
> is theoretically more loaded, the operator may let the HA 
> refuse the IPsec SA setup during IKEv2 through its AAA 
> infrastructure. But I agree this is not a clean approach.

Agree.

> 
> > >  Otherwise, in integrated scenario, DHCP can be used. As 
> mentioned 
> > > before, if you need a very strict control on the HA assignment by 
> > > the operator, IMHO the best way is to perform it during network 
> > > access authentication, but unfortunately this is not a general 
> > > solution.
> > 
> > Agree. But I think a operator must have the possibility to 
> assign the 
> > HA in any cases.
> > 
> 
> DHCP-based solution seems to achieve this. Do you see any 
> issue on that?

Drawback with a DHCP based solution (in the split case): you have to
deploy a DHCP-Relay in all the potential Access Network because even if
the MN knows the DHCP server's unicast address, this one will refuse to
communicate directly with the MN (cf. RFC3315, section 22.12).

So, the possible solutions I see : 
- the Vidya's proposal on an entity playing the role of a lightweight HA
and after doing HA switch
- the Alexandru's proposal on a pseudo anycast address with DHAAD
(modified to only send one HA address) to be able to secure it

JMC.

> 
> --Gerardo
> 
> > > 
> > > 
> > > --Gerardo
> > 
> > Regards.
> > 
> > JMC.
> > 
> > France Telecom - R&D Division - MAPS/NSS   
> > Jean-Michel COMBES, Internet/Intranet Security
> > E-Mail: [email-masked]
> > Phone: +33 (0)1 45 29 45 94
> > Fax: +33 (0)1 45 29 65 19
> > Mobile: +33 (0)6 07 29 30 16
> > 
> 
> 
> Gruppo Telecom Italia - Direzione e coordinamento di Telecom 
> Italia S.p.A.
> 
> ====================================================================
> CONFIDENTIALITY NOTICE
> This message and its attachments are addressed solely to the persons
> above and may contain confidential information. If you have received
> the message in error, be informed that any use of the content hereof
> is prohibited. Please return it immediately to the sender and delete
> the message. Should you have any questions, please send an e_mail to 
> [email-masked]. Thank you
> ====================================================================
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 25 Oct 2005 19:16:40 +0200

In your previous mail you wrote:

=> I confirm: there must be a DHCP relay on each link (a real IPv6
link with link-local addresses and multicast). After relays can talk
with the server through multicast routers, routers or a relay chain.

This should be in the applicability statement for the DHCP-based solution.

Regards

[email-masked]

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 26 Oct 2005 11:49:06 +0300

> This should be in the applicability statement for the DHCP-based
solution.

Well, this is what a regular DHCP deployment requires, in other words,
it is not specific to this particular usage of DHCP.

Alper