Subject: Re: [mobile-ip] Mobility Extension Header (was ISSUE: Design teamrecommendation: New recommendation on piggybacking)

From: Erik Nordmark <[email-masked]>
Date: Sun, 17 Mar 2002 02:13:07 +0100 (CET)

> The current proposal is to use both a final and non-final Mobility
> Header (MH). In Case 1, the non-final MH is used (because it is 
> being piggybacked). And when the intermediate router (SG) receives
> this packet, it treats the MH as a normal extension header, scans
> past it, finds the payload and applies the appropriate IPSec
> policy. This should work.
> 
> You were right, but the problem exists with the earlier proposal. 
> Not with the most current piggybacking proposal which has both
> a final and non-final MH.

Vijay,

How do the know header types allow the sender to determine the policy
at the SG?

Suppose the SG has a policy saying that the MH header type needs to be
protected. Are you disallowing such policies at the SG?

I also don't understand why the writeup says
   IPsec does this for any packet. If no policy exists, the
   final header type MAY be changed to the non-final extension,

If it doesn't get changed then the SG can't have a policy for the payload
either.
So I think it should be a MUST instead of a MAY above, but the note
doesn't explain the reasoning for the MAY.

  Erik

---

From: Vijay Devarapalli <[email-masked]>
Date: Sat, 16 Mar 2002 19:52:42 -0800

hi Erik,

> protected. Are you disallowing such policies at the SG?

I definitely dont want an intermediate SG to apply any IPSec
policy to the Mobility Header. Protection for the Mobility Header
is end-to-end.

> doesn't explain the reasoning for the MAY.

I am not sure I understood this paragraph. I am here in Minneapolis
the whole of sunday. I will talk to you sometime.....

regards
Vijay