Subject: [Mip6] Concensus Call: Proxy DAD on HoA

From: "James Kempf" <[email-masked]>
Date: Mon, 5 Dec 2005 13:35:43 -0800

This issue has been the object of discussion and the authors of the 
bootstrapping draft would like to hear from other WG members to judge WG 
concensus. The issue is when Proxy DAD should be done on an HoA allocated 
through the Home Agent: during the MIP6 transaction as stated in RFC 3775 or 
during the IKEv2 transaction when the address is allocated.The following two 
options have been discussed on the list:

1) As specified in RFC 3775, the HoA should be Proxy-DADed when the MN 
bootstraps MIP6 with the HA.

2) The HoA should be Proxy-DADed when the MN allocates the HoA through 
IKEv2. The relevant changes should be made in the IKEv2 specification 
through text proposed by the MIP6 WG in 
draft-eronen-ipsec-ikev2-clarifications-XX.txt. Text should be put into the 
bootstrapping draft indicating that the HA should use DAD during IKEv2 to 
confirm the address and not DAD the address during the initial MIP6 
registration if bootstrapping is used.

When you send a reply to the list, please indicate which solution you 
prefer. We will run the concensus call for about 2 weeks, until around Dec. 
20.

                        jak 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 06 Dec 2005 01:05:31 +0100

Option 1) but this doesn't mean the IKEv2 specification doesn't need
to be fixed. In fact IMHO the only case it doesn't need to be fixed
is when and only when IKEv2 is used by a HA handling MNs in the
bootstrap phase.
And the proxy DAD question should be extended to the proxy NDP which
is BTW really critical (i.e., if nobody provides the function packets
to the MN won't be intercepted and forwarded).
As IMHO the proxy DAD is a part of the proxy NDP I assume both are
done by the same entity.
For IPv4 and NEMO the equivalent are proxy ARP and route injection.

Regards

[email-masked]
   
PS: if draft-dukes-ike-mode-cfg-02.txt or draft-ietf-ipsec-ikev2-17.txt
define nothing about dynamic DNS update in my ipsec-tools code I
can see a "UNITY_DDNS_HOSTNAME". There is no proxy ARP but a script
is called with the right parameters...

---

From: Shinta Sugimoto <[email-masked]>
Date: Tue, 06 Dec 2005 13:10:03 +0900

I am for option 1) which makes HA to perform Proxy-DAD for the
serving MN.  I think that role of allocating an IP address for
the requestor and serving as an proxy for claimed IP address are
conceptually different.  In MIPv6 bootstrapping scenario with
IKEv2, the former is the role of SGW and the latter is the role
of HA, IMHO.  Of course, they can be handled by the same entity.
However, I don't think we need to mandate it.  It should also be
noted that Proxy-DAD may not be necessary in some network
configuration where the home link does not physically exist
(virtual home link).

Regards,
Shinta

On Mon, 5 Dec 2005 13:35:43 -0800

---

From: suraj <[email-masked]>
Date: Tue, 06 Dec 2005 15:59:13 +0530

Hi,

Section 15.7 in RFC 3775 speaks about the security considerations of data
packets that are sent from the Mobile Node to the Correspondent node via the
Home Agent. 

The security for data through IPv6 tunnel is recommended, but not mandatory
for the Mobile IPv6 protocol .At the same time the protection of Return
Routability packets is mandated for Mobile IPv6 using Tunnel mode IPSec ESP
(SECTION 10.4.6). 

Security Policy must always be applied to tunnel interface during
Encapsulation and decapsulation.

This results in all data being filtered for check of return routability
packets, resulting in high overhead of processing at the Home Agent.

If the Return Routability packets can be separately identified using
something as a router alert option, the security checks can be added for
only the RR packets making processing more efficient for data at the Home
Agent, Although there is some minimal overhead for the RR packets being
processed at every hop.

This may need changes at all the MN, CN and HA. But if some method can be
thought to make this backward compatible to RFC 3775, it can be used
optionally by such clients alone.

Any suggestions/opinions regarding this?

Regards,
Suraj

---

From: Francis Dupont <[email-masked]>
Date: Tue, 06 Dec 2005 11:58:21 +0100

In your previous mail you wrote:

   
=> yes, it is the price for security: all packets have to be inspected
in order to check if the security policies were correctly applied.
I shan't comment publicly the remainder of this message (:-).

Regards

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 06 Dec 2005 10:57:31 -0800

option 1. I dont think we should wait extensions for IKEv2.
and I serious doubts on whether IKEv2 can be extended for
this now.

BTW, the authors of the IKEv2 clarifications document are
trying very hard to avoid new features. it is supposed to
clarify sections of IKEv2 that people have found not to be
clear or interoperable.

Vijay

James Kempf wrote:
> concensus. The issue is when Proxy DAD should be done on an HoA 
> allocated through the Home Agent: during the MIP6 transaction as stated 
> in RFC 3775 or during the IKEv2 transaction when the address is 
> allocated.The following two options have been discussed on the list:
> 
> draft-eronen-ipsec-ikev2-clarifications-XX.txt. Text should be put into 
> the bootstrapping draft indicating that the HA should use DAD during 
> IKEv2 to confirm the address and not DAD the address during the initial 
> MIP6 registration if bootstrapping is used.
> 
> prefer. We will run the concensus call for about 2 weeks, until around 
> Dec. 20.
> 
>                        jak
>

---

From: Greg Daley <[email-masked]>
Date: Wed, 07 Dec 2005 11:01:43 +1100

Hi James,

I prefer relying on option 1 at this stage.

Even if changes were made to IKEv2 documents
to make them more explicit, the signalling is already
in-place to ensure that the (proxy-DAD) occurs
correctly at MIPv6 time if it hasn't already been done.

It's not essential to pursue this at this stage,
but I don't think it would be hard to write a separate
draft (or sentence in bootstrapping) saying: if the HA
performed DAD during IKEv2, skip it on the first BU.

Greg

As an aside, the proxy-DAD isn't secured :)