Subject: RE: [Mip4] WGLC Comments: draft-ietf-mip4-mobike-connectivity-01.txt

From: "Vijay Devarapalli" <[email-masked]>
Date: Wed, 13 Dec 2006 19:54:58 -0800

> > > 4. The document doesn't touch on simultaneous bindings and 
> > I think it 
> > > should. Some enterprises treat the internal wireless access 
> > networks 
> > > similar to untrusted networks (thereby requiring a VPN over 
> > it) and it 
> > > is quite common to have simultaneous wired and wireless 
> > connectivity.
> > > One of those may be routed through a VPN, while the other may be 
> > > routed directly.
> > 
> > The typical behavior when this happens would be for the 
> > client to indicate to the user 
> 
> Which client? MIP or IPsec? My IPsec client does not indicate that. 

The IPsec VPN client.

> >it is connected to the trusted 
> > network and terminate the IPsec tunnel.
> > Only the wired connection would be used. At least thats my 
> experience.
> > 
> 
> Well, an example is this - we use IPsec over internal WLANs to access
> the network. There are several times I forget to disconnect 
> my VPN when
> I undock and dock my laptop and it stays on, along with my ethernet
> connection. In the cases where we are only talking about external to
> internal network transition, it is not that important, since a gap in
> physical/RF connectivity is going to cause the VPN to disconnect,
> alerting the user of the same. However, if the transition is seamless,
> which is hopefully what the world is moving towards, this is 
> a problem. 

Once you dock the laptop, the policy configuration on
your laptop should start using the ethernet connection
and not use the VPN tunnel anymore. From my experience
the VPN tunnel is disconnected once you plug into the
campus wired network.

I am not talking about the gap in connectivity at all.

> > > Is the MN allowed to register both interfaces with the HA?
> > > Unfortunately, the only form of simultaneous bindings supported by
> > > RFC3344 is bicasting, which is not-so-desirable here, 
> > since, there may 
> > > be long periods of time when wired and wireless interfaces are 
> > > simultaneously active. So, perhaps the right thing to do is to 
> > > recommend against simultaneous bindings, but, I'm not sure.
> > 
> > If you are attached to the trusted network, you should stop 
> > using the connection from the untrusted network.
> 
> What I've said above holds. Additionally, I sometimes keep a data card
> (say, EV-DO) connected while I'm also attached to an internal 
> network -
> this is especially true if I frequently disconnect from the direct
> intranet connection, since keeping the data card connected 
> provides more
> seamlessness than trying to connect after I've lost my network
> connection. 
> 
> So, I think we should be planning for having multiple simultaneously
> active interfaces and not ruling them out. We can rule them out from a
> MIP perspective (say, no simultaneous bindings) and that's probably
> okay. 

I am all for simultanouesly active interfaces. But being
connected to a corporate intranet and at the same time
have an interface active into an untrusted network is a
bad idea.

Vijay

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 14 Dec 2006 11:57:12 -0800

> 
> Once you dock the laptop, the policy configuration on your 
> laptop should start using the ethernet connection and not use 
> the VPN tunnel anymore. 

Sure, that can be a policy thing. 

> From my experience the VPN tunnel is 
> disconnected once you plug into the campus wired network.
> 

>From my experience, it is not :) It happens to me almost everyday, since
we use VPNs over our internal WLAN access. I have my ethernet plugged in
to the corporate network and my VPN up, since I previously had my
ethernet disconnected. I realize much later (when my computer is showing
signs of being sluggish :)) and then disconnect my VPN.. Sometimes, I
never realize and the VPN stays up until I lose connectivity. 

> > > If you are attached to the trusted network, you should stop using 
> > > the connection from the untrusted network.
> > 

I don't understand this. You can have a policy to stop using your
untrusted connection - that doesn't mean that connection is *disabled* -
it only means that data is not going through that connection at that
time. 

> > (say, EV-DO) connected while I'm also attached to an 
> internal network 
> > - this is especially true if I frequently disconnect from 
> the direct 
> > intranet connection, since keeping the data card connected provides 
> > more seamlessness than trying to connect after I've lost my network 
> > connection.
> > 
> connected to a corporate intranet and at the same time have 
> an interface active into an untrusted network is a bad idea.
> 

Why so? 

Vidya