Subject: RE: [Mip6] WG Last call: draft-ietf-mip6-ikev2-ipsec-06.txt

From: "Soliman, Hesham" <[email-masked]>
Date: Sun, 23 Apr 2006 15:31:34 -0700

>    => I'm talking about removing the HAO option for tunneled 
 > traffic to
 >    the HA and using tunnel mode. Of course this was added in 3776. 
 >    
 > => the transport mode is end to end, so it can't be used from the
 > MN to the CN using the HA both as a router and the end of the SAs.

=> Yes I know, again, I didn't say it should be used with the CN. 

 > 
 >    => Where did I claim that we should use transport mode to the CN? 
 > 
 > => you didn't explain your idea.
 > 
 >    I've been talking about the BU in every email...This *is* 
 > what the new
 >    section 3 in the draft modifies. 
 >    Transport mode is used for the BU now and MPD now. It can 
 > also be used 
 >    for all tunneled traffic to the HA (to protect payload 
 > traffic) if we
 >    use the HAO.
 > 
 > => you want to use a transport mode with a HAO for the 
 > tunneled traffic,
 > i.e.:
 >     IPv6 header (src=CoA, dst=HA)
 >     HAO (with HoA)
 >     ESP header
 >     IPv6 header (src=HoA, dst=*)
 >     Payload
 > Is your proposal?

=> My poroposal two fold: 
A. Remove the current section 3 and replace it with the one in the
previous 
   version. I.e. do not propose a new format for the BU. 

B. For protecting payload traffic (VPN style) we can do the packet
format
   you describe above. 

 >    => Know != supported in implementations.
 >    
 > => yes but in this case the issue is not technical.

=> Oh come on. If you're going to mandate that we do something 
extra (MIP6-IPsec API, K flag ...etc) when there is an easier way of 
doing it that doesn't require these changes (the format above) you need
to
motivate it. Of course that's technical.

Hesham

 >    
 > Regards
 > 
 > [email-masked]
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Mon, 24 Apr 2006 23:18:58 +0200

B. For protecting payload traffic (VPN style) we can do the packet
   format you describe above. 
   
=> so your proposal is some kind of "transport all" mode. I am not
in favor of it because it adds a HAO to every packets. If we consider
the HAO as a degenerate tunnel, it is a spurious double tunneling.

Regards