Subject: Re: [Mip6] one question about Return Routability procedure

From: xiazhongqi <[email-masked]>
Date: Mon, 21 Nov 2005 09:27:07 +0800

On November 21, 2005, Shina wrote:
>>When it comes to the receiving/sending HoTI/HoT over IPsec tunnel, I think it's general >>IPsec issue.  Let me expand it more:
>>
>>Assuming that MN and HA establish IPsec tunnel and MN performs movement changing its >>care-of address from CoA1 to CoA2.  MN in parallel initiates RR (somehow home keygen token >>is expired) by sending HoTI to its CN over the IPsec tunnel (endpoint is updated with >>CoA2).  Suppose BU is dropped on the fly by accident. Should HA drop the HoTI received >>from the uknown CoA ?
>>
>>I think the answer is No.  To my knowledge, there is no reason for HA to deny incoming >>packet (HoTI) as far as there is correct SA (even outer source address does not match with >>the address stored in SA).  But we should note that HA will forward the HoT to the wrong >>place, namley the old CoA of the MN (CoA1). So, RR will be incomplete.
>>
>>But this does not necessarily mean that we should not perform optimization (=perform RR in >>parallel) of course.  In most of the cases, we can benefit from the optimization, I think.

I think that if MN moves to a new CoA2, it should re-establish the SA. Before re-establishing the SA between moving MN and CN, the HA should ignore the HOTI message. After re-establishing the SA, I agree with Shina.

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Shinta Sugimoto <[email-masked]>
Date: Mon, 21 Nov 2005 13:28:29 +0900

On Mon, 21 Nov 2005 09:27:07 +0800

> I think that if MN moves to a new CoA2, it should re-establish the SA. Before re-establishing the SA between moving MN and CN, the HA should ignore the HOTI message. After re-establishing the SA, I…

Yes, MN/HA may re-establish of IPsec SA by running IKE phase-2
negotiation and update the endpoint address with MN's new CoA.
But, RFC3775/3776  assume that "MIPv6 somehow updates the endpoint
address of the IPsec tunnel" when the MN performs movement.
That is, MN/HA should not necessarily re-establish IPsec SA.
Instead, MN/HA can just update the endpoint address in accordance
with home registration.  How to do it is up to implementation.
One example is:

http://www.ietf.org/internet-drafts/draft-sugimoto-mip6-pfkey-migrate-01.txt

Regards,
Shinta

---

From: Vijay Devarapallli <[email-masked]>
Date: Tue, 22 Nov 2005 18:17:12 -0800

> I think that if MN moves to a new CoA2, it should re-establish the SA. Before re-establishing the SA between moving MN and CN, the HA should ignore the HOTI message. After re-establishing the SA, I…

disagree. the HoTi just needs to be preceded by a BU. remember the
check on the outer source address is done by Mobile IP module to
make sure the MN is using the right CoA before forwarding the inner
packet. IPsec does not check the source address on the outer IP
header.

Vijay