Subject: RE: [Mip6] Changes to draft-ietf-mip6-ikev2-ipsec

From: "Vijay Devarapalli" <[email-masked]>
Date: Mon, 10 Apr 2006 17:41:36 -0700

> I've parsed the diff from 05 to 06 and had some comments/questions.
> In the "tunnel all" mode, do you assume that the IKEv2 takes the
> role of updating the outer endpoint address of the IPsec tunnel
> established between the MN and HA ?  

it is still the binding update that updates the 
outer address of the IPsec tunnel. when you 
decapsulate the packet (or process the tunneled
BU), you need to relax the check for the outer
source address if the packet contains a BU that
is updating the CoA.

> I mean, in my view, BU message
> meant to be the trigger for updating the endpoint address.  In this
> sense, it is actually convinient for the MN and HA to have transport
> mode SA pair which is agnostic on MN's CoA.  

true. it is harder for an implementation to 
update the IPsec tunnel SA if the message that 
is going to do the update is also coming 
through the same tunnel. actually we had this 
discussion just before Mobile IPv6 became an 
RFC. I remember Tero Kivinen, Jari Arkko, 
Santeri Paavolainen and myself discussing this. 
I believe that discussion was one of the 
triggers to form the MOBIKE WG. :) 

> If we assume that all
> mobility signals (including BU) are sent over the IPsec tunnel,
> I believe MN and HA are required to run MOBIKE (or re-establish the
> IPsec SA) prior to the home registration.  

the goal is not to require MOBIKE. MOBIKE can
be used if you want to.

> So, I think the draft
> should mention implications/side-effect that "tunnel all" mode have.

sure. I will add some text. 

Vijay

> 
> 
> Regards,
> Shinta
> 
> On Wed, 5 Apr 2006 16:29:21 -0700
> "Vijay Devarapalli" <[email-masked]> wrote:
> 
> > Hello all,
> > 
> > I want to add some more text to 
> > draft-ietf-mip6-ikev2-ipsec to clarify the use
> > of "tunnel all" mode. a pre-06 version of the
> > draft is at
> > http://www.dvijay.com/ietf/internet-drafts/mip6/mip6_ikev2.txt
> > a diff from version 05 to 06 is at
> > http://www.dvijay.com/ietf/internet-drafts/mip6/diff-05to06.html
> > 
> > the current status for this draft is "AD 
> > Evaluation". it was felt that the changes are 
> > significant enough to refer the changes to the
> > working group before making the changes. there
> > will be a short working group call later on
> > on these changes.
> > 
> > the tunnel mode was already introduced with 
> > the addition of the section on IPsec granularity 
> > considerations in version 04. the new text is
> > only for better clarity.
> > 
> > comments are welcome.
> > 
> > Vijay
> > 
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
> 
> 
> 
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Shinta Sugimoto <[email-masked]>
Date: Tue, 11 Apr 2006 08:48:06 +0300

On Mon, 10 Apr 2006 17:41:36 -0700

> source address if the packet contains a BU that

Ok, I see.  So there should be exceptional handling to check inner
packet when outer source address verification fails.

> triggers to form the MOBIKE WG. :) 

I see.

> the goal is not to require MOBIKE. MOBIKE can

Ok.

> sure. I will add some text. 

Thnaks.

Shinta