Subject: [Mip6] Comment on draft-krishnan-mip6-firewall-01

From: "Jean-Michel Combes" <[email-masked]>
Date: Wed, 25 Jul 2007 00:08:26 +0200

Hi,

regarding the MN-HA signalling (i.e. BU/BA), I've checked in different RFCs:

o Authentication and transport mode are mandatory
"When securing Binding Updates, Binding Acknowledgements, and prefix
discovery, both the mobile nodes and the home agents MUST support and
SHOULD use the Encapsulating Security Payload (ESP) [3] header in
transport mode and MUST use a non-null payload authentication
algorithm to provide data origin authentication, connectionless
integrity and optional anti-replay protection." (RFC3776)
"When securing Binding Updates, Binding Acknowledgements, and Mobile
Prefix Discovery messages, both the mobile node and the home agent
MUST support the use of the Encapsulating Security Payload (ESP) [6]
header in transport mode and MUST use a non-null payload
authentication algorithm to provide data origin authentication,
connectionless integrity, and optional anti-replay protection." (RFC
4877)

o Tunnel mode is optional
"Support for protecting these messages using ESP in tunnel mode is
optional." (RFC 4877)

And the BU/BA packets looks like (RFC 3776):

      IPv6 header (source = care-of address,
                   destination = home agent)
      Destination Options header
         Home Address option (home address)
      ESP header in transport mode
      Mobility header
         Binding Update
            Alternate Care-of Address option (care-of address)

      IPv6 header (source = home agent,
                   destination = care-of address)
      Routing header (type 2)
         home address
      ESP header in transport mode
      Mobility header
         Binding Acknowledgement

So a FW is able to look at the HoA in the BU/BA and so it is possible
to set up a policy based on MN HoA even if you use ESP with
encryption.

Best regards.

JMC.

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6