Subject: RE: [Mip6] WG Last call: draft-ietf-mip6-ikev2-ipsec-06.txt

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 28 Apr 2006 14:07:09 -0700

> 
 > => I consider the HAO as a degenerated tunnel so you have double
 > tunneling (one tunnel for IPsec, one for MIPv6) when obviously only
 > one is needed.

=> Understood. I do think this is a matter of taste though not
architecture.

 >    I think
 >    it's a more "correct" use of IPsec to not use tunnel mode
 >    between two end nodes.
 > 
 > => but is the right end the HA or the CN (:-)?

=> It's always the HA as far as IPsec is concernced. In some
cases the messages are processed by the HA (BU, MPD), in others
the HA is treated like a security GW (HOTI, payload). So as far as
IPsec is concerned the end node is always the HA. The fact that 
the packet is then forwarded somewhere else is irrelevant to IPsec. 

Hesham

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 28 Apr 2006 14:46:06 -0700

> the packet is then forwarded somewhere else is irrelevant to IPsec. 

hmm no... this doesnt fit in with the IPsec
architecture. if after decapsulation, the inner
packet needs to be sent out of the node to
another node, it becomes a gateway automatically.
the destination of the packets is now not the
gateway. typically a tunnel mode SA is used to
protect such packets.

Vijay

---

From: Francis Dupont <[email-masked]>
Date: Sun, 30 Apr 2006 14:18:57 +0200

=> yes, it is a matter of taste about an architectural view of things...

   
=> for IPsec the transport mode is strictly end-to-end so either
the real end node is the CN and tunnel mode is required, or the
tunnel between MN-HA and the forwarding to/from CN is part of the
"MIPv6 application" and my concern about double tunneling is more
important. BTW the term SG (security gateway) implies tunnel mode.
   
Regards

[email-masked]