Subject: RE: [Mip6] comments on draft-ietf-mip6-nemo-v4traversal-00 (2)

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 4 Nov 2005 18:05:02 -0500

> > - In Section 2.2, there are descriptions about use of 
 > IPsec for sending
 > > and receiving MPS/MPA.  However, I found the texts are not 
 > clear about
 > > how the IPsec should be applied to the MIPv6 messages.  Does the
 > > specification recommend to use IPsec as similar to the MIPv6's case
 > > (RFC 3776) ?  Or does it (intentionally) leave it to operation ?

=> There should be no difference from 3775/6. If you see issues 
with this please let us know.

 > > - Related to the above question, I found there is few 
 > description about
 > > IPsec processing.  How should IPsec be applied to 
 > v4traversal scenario
 > > should be provided, IMHO.  If it is expected to be similar 
 > to MIPv6 case
 > > (RFC 3776), the spec should say so.
 > 
 > actually that is still being discussed. whether to provide transport
 > mode ESP protection for the BU and MPD messages and then
 > tunnel them or provide tunnel mode protection directly. I guess
 > both should be possible. I would like to hear what you think

=> I don't understand what the issue is. Both are allowed just 
like 3775/6. 

 > 
 > > - In Section 3.1.1, header format of IPv4 home address 
 > option is defined.
 > > If I understand it correctly, the option allows BU to 
 > carry both IPv4
 > > home address and MNP in a common formant.  Let me clarify 
 > a little bit
 > > more: I assume that the single IPv4 home address option is 
 > allowed in a
 > > BU message but is it right ?  As for IPv4 MNP, does the 
 > spec allow BU
 > > message to carry multiple IPv4 MNPs as in NEMO base 
 > protocol (I hope so) ?
 > 
 > we might need another option to carry the IPv4 MNP. I think
 > for now draft-shima-nemo-v4prefix-01 is the most complete
 > one for supporting IPv4 MNP.

=> Shinta's question was about allowing more than one MNP. 
The option in the current draft allows one MNP. I think
we can allow more than one option without any problems. 
This will allow more than one MNP. 
Question to Shinta: Why do we need more than one?

Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapallli <[email-masked]>
Date: Fri, 4 Nov 2005 15:11:05 -0800

> => I don't understand what the issue is. Both are allowed just

RFC 3775 and 3776 only show transport mode for BU and
MPS in the examples. sending tunnel mode BU has always
been a possibility but not explicitly show in RFC 3776.

we have clarified this (on Francis's insistence) in section 5 of
draft-ietf-mip6-ikev2-ipsec-04.txt

Vijay

---

From: Shinta Sugimoto <[email-masked]>
Date: Sun, 06 Nov 2005 07:06:28 -0800

On Fri, 4 Nov 2005 18:05:02 -0500

> with this please let us know.

I basically agree with your assessment that RFC3776-style IPsec
protection can be simply applied in v4traversal case.  But I see
possibility to leverage IPv4-IPv6 combined IPsec tunnel to protect
some signaling messages and payload, which allows us to optimize
tunneling overhead.  For detail, please see my reply to Vijay.
On top of that, I think there is certainly a security concern with
HA's inbound packet processing, which I mentioned in the last bullet
in my first email.

> Question to Shinta: Why do we need more than one?

Just to make it more useful/flexible.  I don't see why it should
be prohibited.  In IPv4, availability of IP addresses is more scarce
and we may need a flexible mechanism to manage them efficiently.

Regards,
Shinta