Subject: RE: [Mip6] Concensus Call: Proxy DAD on HoA

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 7 Dec 2005 11:43:13 -0500

>  In your previous mail you wrote:
 > 
 >    In case B, running DAD upon reception of the BU doesn't make
 >    sense. If the address is allocated dynamically, then the HA
 >    needs to make sure that there is no collision at the time the 
 >    address is allocated.
 > 
 > => this is what I believe at the exception of the mobility case.

=> What's the mobility case? 

 > Why? Because in the mobility case the client/MN can move so can
 > come back to the home link, something which is bit hairy to handle.
 > So I prefer the whole proxy NDP service, including the proxy DAD
 > function, is provided by the mobility code.

=> The proxy NDP service would still take place, but for the 
initial negotiation I believe we need a proper IKE policy check.
After that we can keep doing what 3775 recommends.

 >    
 > Of course it is a matter of taste but option 1 keeps the code
 > in IKEv2 far simpler when we had already written it for the
 > mobility (I speak as a mobility and IKE programmer).

=> I don't know if it's a matter of taste actually. I think
not doing the IKE check breaks the solution because we can't
guarantee the uniqueness of the address-MN association.

Thanks, 
Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Wed, 07 Dec 2005 19:52:21 +0100

>    needs to make sure that there is no collision at the time the 

=> it seems we mean different things by collision. I think about DAD,
not collision with allocations by the same entity (something which
must be avoided of course).

   
=> when the allocation is done a mobile client.

   
=> so IKE should check it doesn't allocate twice the same addres,
but who IYHO should provide the proxy NDP service? IKE or the
mobility code.
   
Thanks

[email-masked]

PS: I've got an answer from Pasi: IPsec VPN servers don't use proxy ARP
and co, they usually use what we call a virtual home link.
BTW we don't do this with our HAs because we'd like to test the return
to home, so when you contrapose you understand we'll get no help
about this issue from IPsec community (:-).

---

From: Greg Daley <[email-masked]>
Date: Thu, 08 Dec 2005 09:43:30 +1100

Hi Hesham,

Soliman, Hesham wrote:
[cut]
> guarantee the uniqueness of the address-MN association.

We can guarantee the uniqueness of the address-MN association
within the confines of the HA, which is all that is needed to
construct the SAs.

The uniqueness of the address binding in general (on the link)
can be argued as related to the tunnelled packet delivery service,
which is activated at initial binding time (which may be later),
and therefore may be checked then.

The requirement to go out and check addresses allocated from
an IP subnet is either a general IKEvY issue, or it's not.
If there's going to be further specification of this elsewhere,
that's OK.  Certainly I don't think there's a need to push for
this as mobility-specific.

Greg