Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: Gerardo Giaretta <[email-masked]>
Date: Tue, 25 Oct 2005 14:47:46 +0200

> > If in your opinion exposing HA addresses in DNS is an issue, in
> > integrated scenario a DHCP-based solution may be used (see the
> > integarted scenario draft). 
> > 
> > > For the moment, with these proposals, the MSP has not the 
> > > possibility to
> > > manage its HA as he wants ...
> > > 
> > 
> > Why in DNS-based solution you think this is not possible? 
> 
> This is the MN that will choose the HA from the listed HA in the DNS.
> 

Not entirely. The SRV specification, as Henrik mentioned before in
another thread, provides for priorities between multiple Home Agents.
The list of HAs with priorities may be considered similar to the list
received by the MN via DHAAD. The MN will choose based on these
priorities. Otherwise, in integrated scenario, DHCP can be used. As
mentioned before, if you need a very strict control on the HA assignment
by the operator, IMHO the best way is to perform it during network
access authentication, but unfortunately this is not a general solution.

--Gerardo

> > 
> > > Regarding the two present solutions:
> > > o DNS-based DHAAD
> > > I don't like this solution because such mechanism gives the 
> > location,
> > > for a MSP, of all its HA, which are the MIPv6 point of 
> > failure and so
> > > the prioritized targets for "bad guys". You give the stick to 
> > > be beaten
> > > ... :(
> > 
> > Sorry are you referring to DNS-based HA discovery defined in
> > draft-ietf-mip6-bootstrapping-split-01
> 
> Yes.
> 
> >  or something else? I'm getting
> > confused with the acronym DHAAD since it is usually used to 
> refer the
> > solution defined in rfc3775.
> 
> Sorry :)
> 
> JMC.
> 
> > 
> > --Gerardo
> > 
> > > o ICMP-based mechanism
> > > Here again, the present mechanism gives all the HA but I 
> > > think it may be
> > > simply modified to give only one HA if the MSP wants to assign HA.
> > > The main issue is regarding its security ... Maybe 
> > > Alexandru's proposal
> > > or HAHA proposal would be interesting.
> > > 
> > > Best regards.
> > > 
> > > JMC.
> > > 
> > > France Telecom - R&D Division - MAPS/NSS   
> > > Jean-Michel COMBES, Internet/Intranet Security
> > > E-Mail: [email-masked]
> > > Phone: +33 (0)1 45 29 45 94
> > > Fax: +33 (0)1 45 29 65 19
> > > Mobile: +33 (0)6 07 29 30 16 
> > >  
> > > 
> > > > -----Original Message-----
> > > > From: [email-masked] [mailto:[email-masked]] On 
> > > > Behalf Of Narayanan Vidya-CVN065
> > > > Sent: Monday, October 24, 2005 5:21 PM
> > > > To: Francis Dupont; Petrescu Alexandru-AAP021
> > > > Cc: [email-masked]; Kilian Weniger; James Kempf
> > > > Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt 
> > > > 
> > > > >    
> > > > > => the two questions are:
> > > > >  - should we keep a DHAAD mechanism or HA assignment is 
> > the right 
> > > > > thing
> > > > >    to do?
> > > > >  - is the DNS-based DHAAD mechanism better enough to 
> > replace the 
> > > > > ICMP-base
> > > > >    one?
> > > > > 
> > > > 
> > > > These are good questions. I believe that a DNS-based 
> > > > mechanism is largely better than an ICMP-based mechansim. For 
> > > > those who wish to secure the operation, at least an option is 
> > > > available. Whether DNSSEC will be widely deployed is a 
> > > > separate question, but at least, it is an option. Also, it 
> > > > moves away from having to configure the home network prefix 
> > > > and removes the limitation of dynamic HA assignment within 
> > > > the same subnet, both of which are big pluses in my mind. 
> > > > 
> > > > Regards,
> > > > Vidya
> > > > 
> > > > _______________________________________________
> > > > Mip6 mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/mip6
> > > > 
> > > 
> > > _______________________________________________
> > > Mip6 mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/mip6
> > > 
> > 
> > 
> > Gruppo Telecom Italia - Direzione e coordinamento di Telecom 
> > Italia S.p.A.
> > 
> > ====================================================================
> > CONFIDENTIALITY NOTICE
> > This message and its attachments are addressed solely to the persons
> > above and may contain confidential information. If you have received
> > the message in error, be informed that any use of the content hereof
> > is prohibited. Please return it immediately to the sender and delete
> > the message. Should you have any questions, please send an 
> e_mail to 
> > [email-masked]. Thank you
> > ====================================================================
> > 
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 25 Oct 2005 17:03:22 +0200

priorities.

=> this is not fully accurate: the SRV mechanism uses weights too
(cf RFC 2782). It can be used for a static load balancing, something
the ICMP-based mechanism has not.

   As mentioned before, if you need a very strict control on the HA assignment
   by the operator, IMHO the best way is to perform it during network
   access authentication, but unfortunately this is not a general solution.
   
=> we agree about this point.

Thanks

[email-masked]

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 25 Oct 2005 17:23:10 +0200

> the ICMP-based mechanism has not.

Well, although the DHAAD Reply only contains a list of HA addresses and
there's no 'weight' field associated to each address, the order these
addresses appear in the list should be interpreted as priority.

If that's not expressive enough, the DHAAD Reply or the HA Switch
messages could be extended to introduce 'weight' or 'priority' fields.
Remark that the H-bit RAs sent by HAs do contain such priority fields
for each HA address.

I think.

Alex