Subject: [IPsec] Use of IKE to obtain address of home agent

From: <[email-masked]>
Date: Thu, 18 Sep 2008 10:17:30 +0200

This mail-list is of course not responsible for all uses of the IKE
protocol.  But I wonder if the following case has been or is being
discussed.

3GPP has in document TS 24.302 (can be retrieved from  
http://www.3gpp.org/ftp/Specs/html-info/24302.htm), section 7.2.2, 
specified a use of IKE, where IKE sets up a secure tunnel to 
a security gateway, denoted ePDG, and expects this security gateway 
to return both an address to the mobile node, which normally 
will be a care-of address, and the address(es) of the home agent.
The said document thinks this possible by having two Configuration
Payloads.  IKEv2bis, and previous documents, only indicated one
Configuration Payload to be present, and with the recent discussion
in mind where the order of the payloads in an IKE packet should 
not matter, then having two Configuration Payloads is not a viable 
approach.  It would be better to introduce two new configuration 
attributes, for example named INTERNAL_IP4_HA and INTERNAL_IP6_HA.

Let me know if this has already been discussed.

Christian
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 18 Sep 2008 13:43:26 +0300

> attributes, for example named INTERNAL_IP4_HA and INTERNAL_IP6_HA.

Yes, it would be better to have 2 new configuration options. The
section 7.2.2. does not actually specify which configuration attribute
type is used to negotiate Home Agent addresses.

Including more than one configuration payloads in the exchange, would
be bad idea, as the configuration payloads do not hve any kind of
transaction id or similar, meaning there is no way to know which
CFG_REPLY matches which CFG_REQUEST if there is multiple configuration
payloads (of same CFG TYPE) in same exchange.

Another option is to use the INTERNAL_IP{4,6}_DHCP attribute in IKEv2
and then get the home agent address from the DHCP server.
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Julien Laganier <[email-masked]>
Date: Thu, 18 Sep 2008 13:17:41 +0200

Christian and Tero,

Quick follow-up on this topic:

On Thursday 18 September 2008, Tero Kivinen wrote:
> section 7.2.2. does not actually specify which configuration
> attribute type is used to negotiate Home Agent addresses.
>
> CFG_REPLY matches which CFG_REQUEST if there is multiple
> configuration payloads (of same CFG TYPE) in same exchange.

I have a different reading of 3GPP TS 24.302; I think there's a little 
mistake in the text and what it want to say is that "the UE may also 
request the address(es) of a Home Agent for DSMIPv6 related signaling, 
by including a corresponding _attribute_ in the CFG_REQUEST 
configuration payload." 

That would be in-line with the Editor's note that follows which 
state "it is FFS which type of attribute (private or assigned by IANA) 
is used in the configuration payload.

I see absolutely no reason to use two CFG_REQUEST be needed...

Thus TS 24.302 has to be fixed.

> and then get the home agent address from the DHCP server.

The alternative of getting the HA information via DHCP is already 
covered as part of 3GPP TS 24.303 "Mobility Management based on 
Dual-Stack Mobile IPv6", amongst other alternatives (DNS, and GTP 
Protocol Configuration Options.)

--julien

---

From: "Hui Deng" <[email-masked]>
Date: Sat, 20 Sep 2008 19:54:26 +0800

Please allow me cut in,
If we plan to specifiy INTERNAL_IP4_HA and INTERNAL_IP6_HA,
do we have to specifiy INTERNAL_IP4_LMA and INTERNAL_IP6_MAG as well for
PMIP6?

thanks

-Hui

2008/9/18 <[email-masked]>

---

From: "Hui Deng" <[email-masked]>
Date: Sat, 20 Sep 2008 19:59:17 +0800

Please allow me to cut in,

2008/9/18 Tero Kivinen <[email-masked]>

> payloads (of same CFG TYPE) in same exchange.
==> I can't imagine the issue if we include two payloads even without an
transaction ID here. could you help to elaborate more, bascially, I assume
there are consecutively ordered.

thanks

-Hui

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 22 Sep 2008 17:06:02 +0300

> there are consecutively ordered.

There is nothing in the current documents that says that the reply
payloads inside the reply packet must be in same order the request
payloads were in the request packet. Thus complient implementation
would be allowed to reorder them if they want to. Thus the initiator
receiving the reply cannot know which reply payloads was reply to
which request payload. Complient recipient can also remove some of the
requested attributes, and add new ones, so detecting things from the
attributes might not be possible. We could add such text to IKEv2bis,
but I think it is better not to add multiple configuration payloads to
one packet.
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Giaretta, Gerardo" <[email-masked]>
Date: Fri, 19 Sep 2008 08:30:54 -0700

Hi Julien, all,

See a comment inline.

> -----Original Message-----
> From: Julien Laganier [mailto:[email-masked]]
> Sent: Thursday, September 18, 2008 4:18 AM
> To: [email-masked]
> Cc: Tero Kivinen; [email-masked]
> Subject: Re: [IPsec] Use of IKE to obtain address of home agent
>
> Christian and Tero,
>

Julien's understanding is correct. In 3GPP CT1 we have left still open and there was no discussion. There was some discussion of having a vendor specific attribute for this.

Note that this is optional as the MN can always discover the HA via DNS

> Protocol Configuration Options.)

TS 23.402 (the corresponding stage2) mandates the assignment of the HA address within IKEv2 signaling. DHCP-based HA assignment is specified but for another scenario.

Gerardo

---

From: "Hui Deng" <[email-masked]>
Date: Tue, 23 Sep 2008 23:02:49 +0800

thanks for your kind help to make it clarified.

-Hui

2008/9/22 Tero Kivinen <[email-masked]>