Subject: RE: [Mip6] WG Last call: draft-ietf-mip6-ikev2-ipsec-06.txt

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 21 Apr 2006 17:31:36 -0700

> >  > > => I don't think it's a tradeoff that is worth the trouble. 
 > >  > > You get an additional header, more complexity in the 
 > >  > implementation, 
 > >  > > more trouble classifying packets in the access, potential
 > >  > > interoperability
 > >  > > problems ...etc and the gain is one SA instead of 2. 
 > >  > 
 > >  > one SA instead of four. you can end up with
 > >  > one SA for BU/BAck, one for HoTi/HoT, one
 > >  > for MPS/MPA and one for tunneling payload
 > >  > traffic. you could send all this traffic
 > >  > through one SA.
 > > 
 > > => So I take you understand the other points I've raised in
 > > addition to the number of SAs. I think we all know that we
 > > wouldn't end up with 4 SAs if we used the HAO, so this statement
 > > is not accurate.
 > 
 > if we tunnel everything we end up with one
 > tunnel SA. the packet format would be

=> Not the point I was raising, I don't know why you keep coming 
back to this. 

Hesham

 > 
 > IPv6 hdr (src=CoA, dst=HA)
 > ESP header in tunnel mode
 > IPv6 hdr (src=HoA, dst=CN/HA)
 > Payload
 > 
 > the "Payload" can be BU, MPS, HoTi or any
 > traffic to the CN.
 > 
 > Vijay
 > 
 > > 
 > > Hesham
 > 
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Soliman, Hesham" <[email-masked]>
Date: Sun, 30 Apr 2006 11:12:13 -0700

> => for IPsec the transport mode is strictly end-to-end so either
 > the real end node is the CN and tunnel mode is required, or the
 > tunnel between MN-HA and the forwarding to/from CN is part of the
 > "MIPv6 application" 

=> Ok. So at least there is one agreement here, that is, for the 
"MIPv6 application" transport mode makes sense since the communication
is between MN and HA. Also, there is no double tunneling since there is 
only one header in this case and the HAO. There would be unnecessary
tunnelling IMO in tunnel mode for the BU or MPD.

   and my concern about double tunneling is more
 > important. BTW the term SG (security gateway) implies tunnel mode.
 >    

=> Ok. So we don't agree about the utility of transport mode in this 
scenario. I'm fine with doing what we agree on and leaving the SGW case
out.

Hesham