Subject: RE: [mobile-ip] RE: BU Authorization method: design team recommen dation

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Wed, 6 Feb 2002 17:36:40 +0100

=> This might be a stupid question, but where 
are the 'major additions' to the HA functionality?

You can setup a bidirectional tunnel between
the MN and HA immediately after receiving the
BU from the MN. From there on reverse 
tunnelling is pretty straight forward. 

Where is the complication?

Hesham

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Thu, 7 Feb 2002 13:29:03 +0100

I have assumed that since general-purpose reverse 
  > tunnelling was not included in MIPv6 design from the 
  > beginning, it would not be reasonable to introduce it for 
  > the purposes of security. Maybe it was a wrong assumption.

=> It was mentioned in one of the earlier revisions,
I haven't looked at the latest draft though.
It's just the MN's decision anyway so there 
isn't much to be said. HAs should always setup
bidirectional tunnels after BU reception.
I think FreeBSD does it be default. 

  > 
  > (Jari, BTW, the security of reverse tunnelling with the 
  > unauthenticated home agents needs more thought.) 

=> What do you mean by 'unauthenticated HA'?

Hesham