Subject: RE: [mobile-ip] Routing header Vs tunneling

From: "Casati, Alessio (Alessio)" <[email-masked]>
Date: Mon, 10 Dec 2001 18:48:22 -0000

*At 11:35 AM -0600 12/10/01, Glenn Morrow wrote:
*>GM] Why would the mobile not want to use route optimization?
*
*For privacy reasons, the owner of the mobile device may not 
*wish to reveal
*it's current location in the network to its correspondent(s).
*
*Steve

Location privacy is not obtained simply by disabling 
route optimization: the visited net addr (Care-of address) 
is revealed to the CN by sending to it IPv6 packets 
(with source address set to the CoA)... Not using the CoA as 
source address comes with some ingress filtering problems...

Alessio

---

From: Steve Deering <[email-masked]>
Date: Mon, 10 Dec 2001 12:17:54 -0800

>source address comes with some ingress filtering problems...

You do bidirectional tunneling through the home agent when you want to
keep your location hidden from your corrrespondents (i.e., you disable
route optimization on both directions).  The outer source address in
the tunneled packets from MH to HA is the care-of address, so it
gets through the ingress filters fine, and then gets removed by the
HA as a natural side-effect of decapsulation, before the packet goes
to the correspondent.

Steve

---

From: Michael Thomas <[email-masked]>
Date: Mon, 10 Dec 2001 12:38:11 -0800 (PST)

> HA as a natural side-effect of decapsulation, before the packet goes

   Right, and I think that given the hazard for the
   CN with spooofed HAO, there needs to be a failsafe
   way for the MN to communicate with the CN if, for
   whatever reason, the CN will not accept the binding
   updated.

		Mike

---

From: "Jari T. Malinen" <[email-masked]>
Date: Mon, 10 Dec 2001 13:31:17 -0800

Steve,

> HA as a natural side-effect of decapsulation, before the packet goes

Good idea. However, nodes not requiring this don't need to abandon route
optimization and due to routing scalability reasons and single point of
failure issue of the HA constantly on path, also route optimization is
a desired feature. I see your suggestion as a possible new mode of operation
for a new requirement. When adding new tasks and requirements for mobility
beyond those in the charter, reverse tunneling to HA is very useful. We also
suggested that in a draft, discussed in the monet (Mobile Networks) mailing list,
cf

http://search.ietf.org/internet-drafts/draft-kniveton-mobrtr-00.txt

And, as you say, HAO need not be there, reverse tunneling works just with
IP addresses in inner and outer packets. But, mobile routers were considered
out of scope here..

> Steve

BR,

-Jari

---

From: "Jari T. Malinen" <[email-masked]>
Date: Mon, 10 Dec 2001 13:46:07 -0800

>    whatever reason, the CN will not accept the binding

However, and this also applies to the early work we've done in
mobile routers, if the scalability requirement of extending beyond
infrastructures in authentication are taken seriously, also the leg
from HA to CN is equally M to N tunneling: weak authentication (or 
something) would logically be needed even with the reverse tunneling
via HA.

BR,

-Jari