Subject: [nemo] Route Optimization text

From: ivancic <[email-masked]>
Date: Fri, 11 Nov 2005 16:49:37 -0500

At the nemo working group meeting I indicated I would provide some text
related to route optimization. I think this probably fits better in the
route optimization problems statement draft than the analysis draft. I
am certainly open for suggestions on text.

Route Optimization Security Considerations

rules and architectures. The security policy rules may require all
traffic from the mobile node pass through the authoritative
organization’s firewalls and/or proxies in order to ensure proper
control of all traffic. These rules may be in place to allow for deep
packet inspection or ensure that IPsec only occurs between known
approved and trusted entities. One means to ensure that all traffic
passes through the authoritative organization’s network is by forcing
reverse-tunneling. Note reverse-tunneling disables route optimization.

Will

---

From: Masafumi Watari <[email-masked]>
Date: Tue, 15 Nov 2005 14:24:04 +0900

Hello,

> reverse-tunneling. Note reverse-tunneling disables route optimization.

The last sentence is not always true.  There is no clear definition of
what route optimization is for NEMO.  As we have with the RO problem
statement draft, RO can be something like decreasing the number of HAs
to go through when the NEMO is nested.

Anyway, what you've addressed seems to fit what we already have for
Section 2.5 of the problem statement draft.  Is the text not sufficient?

watari

---

From: ivancic <[email-masked]>
Date: Tue, 15 Nov 2005 15:23:05 -0500

Section 2.5 is similar, but not the same Section  2.5 is "Security
Policy Prohibiting Traffic From Visiting Nodes" and indicates nesting of
unauthorized visiting nodes may not be permitted.

The statement below in two fold.  First, a corresponding node outside
the authoritative organization's (corporate) network may not be
permitted to initiate the communication due to policy and proxies.  
Second, bidirectional tunneling (i.e. reverse tunneling) prohibits route
optimization between a corresponding node and the mobile network.  So,
perhaps the text  should be worded as follows:

2.X  Route Optimization Security Considerations

The security policy rules may require all traffic from the mobile node
pass through the authoritative organization’s firewalls and/or proxies
in order to ensure proper control of all traffic. These rules may be in
place to allow for deep packet inspection or ensure that IPsec only
occurs between known approved and trusted entities. One means to ensure
that all traffic passes through the authoritative organization’s network
is by forcing bidirectional tunneling (i.e. reverse-tunneling) which is
the only option in NEMO basic (RFC 3963). Note bidirectional-tunneling
disables route optimization between corresponding nodes and the mobile
network.

Will

******************************
William D. Ivancic

---

From: Chan-Wah Ng <[email-masked]>
Date: Wed, 16 Nov 2005 12:00:12 +0800

Hello William,

Thanks for the text.  I am, however, unsure where the text should be
placed.

Your text seems to suggest that the organization has policy that
disallow RO for MNN, because the organization wishes to enforce the rule
that all traffic into or out of the NEMO be inspected by the
organization firewall.

This is as opposed to Section 2.5, which only says that such security
policy is preventing VMN's traffic.  For Section 2.5, it is a motivation
for deploying RO,  Because with certain types of RO, it is conceivable
that the VMN's traffic need not pass through the firewall in the MR's
home network.

My opinion is that the text below is a consideration for NEMO RO
solution.  However, it is not a problem statement for NEMO-RO.  SO, I
would be more inclined to place this text somewhere in Section 4 of
nemo-ro-space-analysis draft rather than nemo-ro-problem-statement
draft.

Do you agree?

/rgds
/cwng

---

From: Masafumi Watari <[email-masked]>
Date: Wed, 16 Nov 2005 20:47:14 +0900

So this is like a tradeoff of having RO or being able control traffic
through the HA.  I'm not seeing the whole picture yet, but is this
something specific to NEMO or the same with MIP6?

If it's something specific to NEMO, I'd agree it would go in the
analysis draft, probably in Section 4.8 where we discuss security
concerns.

However, again, the use of MRHA tunnel can still provide optimization as
done by RRH, by decreasing the number of HAs on the path.

regards,
watari