Subject: RE: [Mip6] Concensus Call: Proxy DAD on HoA

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 7 Dec 2005 14:15:58 -0500

>     >    In case B, running DAD upon reception of the BU doesn't make
 >     >    sense. If the address is allocated dynamically, then the HA
 >     >    needs to make sure that there is no collision at 
 > the time the 
 >     >    address is allocated.
 > 
 > => it seems we mean different things by collision. I think about DAD,
 > not collision with allocations by the same entity (something which
 > must be avoided of course).

=> But how can it be avoided without a check for whether address
was already allocated or not? That's the aspect of DAD that I was 
concerned about. As for doing DAD in general, sure I'm fine with
that.

 > 
 >     > => this is what I believe at the exception of the 
 > mobility case.
 >    
 >    => What's the mobility case? 
 >    
 > => when the allocation is done a mobile client.

=> I can't parse this. It's always a mobile client.

 >    => The proxy NDP service would still take place, but for the 
 >    initial negotiation I believe we need a proper IKE policy check.
 >    After that we can keep doing what 3775 recommends.
 >    
 > => so IKE should check it doesn't allocate twice the same addres,
 > but who IYHO should provide the proxy NDP service? IKE or the
 > mobility code.

=> The mobility code. In my earlier email I was saying that the initial
check for *address allocation* should be done by IKE. This doesn't exclude
normal operation afterwards with DAD, NDP poxying ...etc as specified in
3775. So it doesn't affect the case where the MN returns home.

 > PS: I've got an answer from Pasi: IPsec VPN servers don't 
 > use proxy ARP
 > and co, they usually use what we call a virtual home link.

=> Sure, but of course with virtual links they will still make
sure that the allocation is not duplicated. 

 > BTW we don't do this with our HAs because we'd like to test 
 > the return
 > to home, 

=> You can certainly deploy HAs with virtual home links. Of course
testing for a particular case is something else and should not
affect deployment.

Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Thu, 08 Dec 2005 12:06:32 +0100

=> But how can it be avoided without a check for whether address
   was already allocated or not?

=> it can't. There are two different things:
 - only allocate an address once at a time: this must be performed
   by the allocation facility (i.e., inside IKEv2 or in AAA or in DHCP...)
 - check using the DAD procedure of NDP there is no other node defending
   the address. This is not critical, BTW if there is no real link then
   it even doesn't make sense.

   That's the aspect of DAD that I was concerned about.
   As for doing DAD in general, sure I'm fine with that.

=> we agree.

   
=> I considered the general case of a VPN server which can be used
as a mobility HA or in another context. In both cases there can be
a need for proxy ARP (the client is an IPv4 host), proxy NDP (the
client is an IPv6 host) or routing injection (the client is a router).
When the client is a mobile IPv6 host, the proxy NDP service which
includes the proxy DAD function can be performed by IKEv2 from the
home address allocation phase or by the mobility code following
the RFC 3775.

   
=> yes, to give the same address to two clients would work only
with a NAT-PT which is *not* considered in IPv6 (:-).

So we seem to agree. The initial message IMHO is clear enough
about what it means by proxy-DAD to ask you to reply again
(I believe you mean option 1).
If you believe there should be a statement about the unique-at-a-time
(wording?) allocation I'll support you.

Thanks

[email-masked]