Subject: Re: [mobile-ip] observation on the mip/ipsec draft

From: Erik Nordmark <[email-masked]>
Date: Sun, 3 Nov 2002 23:37:45 +0100 (CET)

> What I realized and have been chatting with the
> authors about is that there is another general
> approach to the authorization problem we can
> take. That is we can *defer* the authorization
> check back into the MIP module itself. 

Mike,

While I can see such an approach working for traffic destined to
the HA, I don't see how it would apply to packets forwarded
by the HA. In the latter case wouldn't you have to defer
the authorization to the "IP forwarding" module?
Or do you view this as being done in the "IP tunneling" module?

   Erik

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 7 Nov 2002 14:37:36 +0100 (CET)

>    I assume you're talking about the filtering
>    question? This could also be dealt with with
>    ACL's and/or RPF checks on the HA.

Depends how you define "filtering" :-)

For MH packets arriving from the MN (and any packets arriving from the MN
if data traffic needs to be IPsec protected) the check is to verify that
the encapsulated packets from the MN that are about to be forwarded
in fact have the proper IPsec (with the right SA) applied. Is this what
you call filtering?

For packets towards the MN the HA needs to decide, based on whether the payload
is MH or something else, whether to apply IPsec as part of tunneling the
packet.

I don't see how anything I would call filtering/ACLs/RPF would relate
to the second part.

  Erik