Subject: RE: [Mip6] Concensus Call: Proxy DAD on HoA

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 7 Dec 2005 18:36:33 -0500

> >  >    
 > >  > Of course it is a matter of taste but option 1 keeps the code
 > >  > in IKEv2 far simpler when we had already written it for the
 > >  > mobility (I speak as a mobility and IKE programmer).
 > > 
 > > => I don't know if it's a matter of taste actually. I think
 > > not doing the IKE check breaks the solution because we can't
 > > guarantee the uniqueness of the address-MN association.
 > 
 > We can guarantee the uniqueness of the address-MN association
 > within the confines of the HA, which is all that is needed to
 > construct the SAs.

=> Right, how?

 > 
 > The uniqueness of the address binding in general (on the link)
 > can be argued as related to the tunnelled packet delivery service,
 > which is activated at initial binding time (which may be later),
 > and therefore may be checked then.
 > 
 > The requirement to go out and check addresses allocated from
 > an IP subnet is either a general IKEvY issue, or it's not.
 > If there's going to be further specification of this elsewhere,
 > that's OK.  Certainly I don't think there's a need to push for
 > this as mobility-specific.

=> I'm not pushing for this as a mobility specific issue. Here is
what I'm saying in a more articulate way:

In order for the IKE implementation to allocate an address to
the MN, it needs to make sure it's unique. This can simply
be done by allocating from a virtual link. In this case, the 
implementation grabs the next available address. 
However, in the case where the admin is brain dead (:) enough
to not allocate from a separate virtual link (i.e. not the 
same pool as permanent allocation or those prefixes on
the physical link) then of course IKE has to trigger DAD. I
can't see any other way to guarantee uniqueness. So the IKE
policy check needs to make sure that the address is unique
"somehow". 

Hesham

 > Greg

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Fri, 16 Dec 2005 10:54:00 -0800

So I support the suggestion to put some text into the split draft requring 
the IRAS to check uniqueness, but not requiring it to do DAD. I think if 
CGAs are ever deployed for IKEv2, DAD will probably be required but I don't 
think the bootstrapping draft is the right place to work though the details 
of that.

Also, I think the split draft should allow the HA to not do DAD if the IRAS 
(which is after all co-located with the HA) checks for uniquenes.

            jak