Subject: [mobile-ip] [mobile-IP]: Comments on draft-ietf-mobileip-vpn-problem-statemen t-00

From: "Tessier, Serge" <[email-masked]>
Date: Fri, 31 May 2002 16:40:48 +0200

This draft appears to be a product of the working group so I address my comments (minor -maybe very personnal- and major -technical- ones) to the authors through the mailing list.

a. Abstract & Introduction:
 When VPN is mentionned I think it should be precised L3-based VPN or even IPSec-based VPN since in the rest of the document IPSec is mentioned but never L2 tunneling mechanisms.
Somehow, the following limited scope should be stated : "The scenarios described here assume that the VPN solution is based on L3 mechansims" or alternatively: "The scenarios described here excludes any L2-based VPN realisation".
It could even be justified that for the sake of coherence since for interaction purposes (triggerring event notification) mobility and security may need to be put on the 'same level' i.e. network layer (maybe too much implementation specific). It is also an obvious benefit to maintain the well-known Mobile IP link layer independancy through the exclusion of L2TP solution.

a'.
 There may be a lack of 'motivation' chapter (see also d.). In such a chapter it would be the place to mention that for example one could extend already deployed VPN solutions through the offer of 'mobility services' as a VPN add-on feature.

b.
 In all the figures the terms 'GW' is missing in each boxes containing the text 'IPSec-based VPN'

c.
 Also some typos (ASCII conversion) in the text...

d. Page 4. After figure 4.0b: 
 This motivation is very important and should be put IMO at the beginning of the document (abstract). Even if it is mentioned in the introduction I think it comes too late, it is too vague (on the contrary, the references to EDGE, GPRS, UMTS do not bring IMO any motivation per se). Sorry, I do not propose anything better.

e. Page 5:
 "Dr. Joe needs to establish an IPsec tunnel to the VPN gateway first so that he can register with the home agent while roaming outside the home network. This implies that the MIPv4 traffic destined to the home network has to run inside an IPsec tunnel."
Here I am a bit puzzle: It is indeed a bit hard to state that spontaneously without any introduction/motivation about the fact that the tunnels should be put in that order.
I am not sure we (at least I) have reached an exhaustive understanding and I would be happy to have discussion for clarifying these issues (draft-ietf-mobileip-ipsec-use-00.txt is maybe a starting point (?), not the proposal itself but the general philosophy especially the requirements, but it expired in 1998. There are other studies about that topic).
There was also a thread on the mobileip-nat-vpn mailing list..
Why not including a section describing tunneling order, listing at least the alternatives and the pros/cons or, at the minimum, letting the door open for issues that are IMHO not understood? With a statement like:
"It has still to be investigated in a further version of this document weather the Mobile IP tunnel should be put within the IPSec tunnel or the other way around. In this document we do not make any assumption regarding the tunnelling order."

f. Page 5. Section 5.2:
 If the imaginary mobile user Dr. Joe is introduced, then why not using him here?
This document should be about usage scenario so it could be helpfull to state that in the case 1, Dr. Joe visit a 'branch office' (e.g. surgery dept.) outside the hospital's main building.
Anyway, more important here:
"The FA is trusted, i.e. an SA has been established a priori between the FA and the home VPN gateway."
Wouldn't it be more generic to state that there is a GW-to-GW security scheme between a VPN GW located at the edge of the Foreign Network and the 'IPSec-based VPN (GW)' at the edge of the home network?
IMHO it would more fit in existing usage scenario, at least the ones I can foreseen.

g. Page 7. Figure 6.1b:
 "Figure 6.1b u Shows IPsec tunnel endpoints, MN-CoA and the VPN External IP address, in co-located mode"
It is here abruptly stated that the MN-CoA is the tunnelling end point of the IPSec tunnel.
It is a consequence of page 5 sections.
I know some other possible combination, which I do not pretend to be better.
Wouldn't it be possible to write 'for example' in the previous statement, once again not to preclude any solution?
Please also see my comment e.

Thanks

-Serge