Subject: [MEXT] update firewall drafts

From: "QIU Ying" <[email-masked]>
Date: Thu, 17 Apr 2008 19:25:57 +0800

Hi, folks

It seems it is time to update the firewall drafts. My suggestions is below:

Regarding vendor draft:
I agree with Henrik comments: the time out of 420 seconds (7 minutes) is too 
long for the binging update signal processing. The pinholes for the mobility 
head type 1~6 (HoTI/HoT, CoTI/CoT, BU/BA) are no longer necessary when they 
get the return messages (HoT, CoT, BA), respectively. So 30 seconds should 
be enough. But as for the pinhole for data packets, it is necessary to 
associate its lifetime to the ones of a binding cache entry.  Hence, the 
last sentence in section 4 could move to the end of section 5.

Regarding admin draft:
The section 4.2 and 6.3 are talking about IKE negotiation. It is the generic 
security issue. So these sections could be removed from the document.

Section 5.5 deals with the tunneled issue between 2 fixed IP addresses (HA 
and CN). So it should be removed, too.

There are some minor editor errors in the draft:
In section 6.2, please change the sentence “described in section 5.1” to 
“described in section 4.1”
In Figure 1, please change “Home Agent of A” to “Home Agent”.
In figure 2, please change “CN C” to “CN”.

Regards
Qiu Ying

------------ Institute For Infocomm Research - Disclaimer -------------This email is confidential and may be privileged.  If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you.--------------------------------------------------------
_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext

---

From: "Suresh Krishnan" <[email-masked]>
Date: Thu, 17 Apr 2008 08:39:29 -0400

Hi Qiu,
  I am already in the process of updating the drafts and I am just
waiting for comments frm the co-authors before I submit a new revision.
Please see comments inline.

> -----Original Message-----
> From: QIU Ying [mailto:[email-masked]] 
> Sent: April-17-08 7:26 AM
> To: Suresh Krishnan; marcelo bagnulo; Julien Laganier; mext
> Subject: update firewall drafts
> 
> Hi, folks
> 
> I agree with Henrik comments: the time out of 420 seconds (7 
> minutes) is too long for the binging update signal 
> processing. The pinholes for the mobility head type 1~6 
> (HoTI/HoT, CoTI/CoT, BU/BA) are no longer necessary when they 
> get the return messages (HoT, CoT, BA), respectively. So 30 
> seconds should be enough. But as for the pinhole for data 
> packets, it is necessary to associate its lifetime to the 
> ones of a binding cache entry.  Hence, the last sentence in 
> section 4 could move to the end of section 5.

I have added a configurable interval for this pinhole. I have no issues
setting different lifetimes for different messages as Henrik suggested.
The issue is to agree on reasonable defaults.

> 
> Regarding admin draft:
> The section 4.2 and 6.3 are talking about IKE negotiation. It 
> is the generic security issue. So these sections could be 
> removed from the document.

I am not sure about this. This is not a generic security issue . This
IKE signaling is opened up explicitly for MIPv6 to work. I would
personally prefer to keep this in the document, but I am willing to be
convinced otherwise.

> 
> Section 5.5 deals with the tunneled issue between 2 fixed IP 
> addresses (HA and CN). So it should be removed, too.

I have removed this in the new revision. I have also removed section
4.3. Please check if this is OK with you.

> In section 6.2, please change the sentence "described in 
> section 5.1" to "described in section 4.1"
> In Figure 1, please change "Home Agent of A" to "Home Agent".
> In figure 2, please change "CN C" to "CN".

OK.

Thanks
Suresh

---

From: "QIU Ying" <[email-masked]>
Date: Fri, 18 Apr 2008 11:34:52 +0800

Hi, Suresh

Thanks for your updating these drafts. Unfortunately, I have not got them in 
time :-(
Please refer my responses inline.

>----- Original Message ----- 
>From: "Suresh Krishnan" <[email-masked]>

>The issue is to agree on reasonable defaults.

I noted that you introduce a parameter STATEFUL_PINHOLE_LIFETIME and I am 
sure that it should be employed to all dynamic pinholes. But we know the 
pinholes for the binding update signalling are just used one time, after 
passing HoTI/HoT, CoTI/CoT, BU/BA, these pinholes are not used anymore until 
next update (when the location and CoA might be changed).  Meanwhile the 
pinholes for data packet should be open during the communication. Moreover, 
the more pinholes are opened, the weaker the firewall is.

>personally prefer to keep this in the document, but I am willing to be

The pattern the draft suggested is also suitable for the normal IPv6 
scenarios which IKE is used. Of course, in MIP6 network, we can not ignore 
IKE issue. So, to be or not to be?

>4.3. Please check if this is OK with you.

That's fine for me.

Regards
Qiu Ying

---

From: "Suresh Krishnan" <[email-masked]>
Date: Fri, 18 Apr 2008 01:19:43 -0400

Hi Qiu,
  Thanks for your comments. I am removing the issues we agree on.

> the more pinholes are opened, the weaker the firewall is.

I can try to add text which mentions that the pinhole opened for the
CoT, HoT and the BA must be closed after the expected messages pass
through. The issue I see is that retransmissions due to loss will not
get through. Let me know how you want to proceed with this issue.

> IKE issue. So, to be or not to be?

I will leave this in there for now unless someone has a strong reason
for this to be removed. 

Thanks
Suresh

---

From: "QIU Ying" <[email-masked]>
Date: Fri, 18 Apr 2008 13:46:27 +0800

Hi, Suresh

>get through. Let me know how you want to proceed with this issue.

My opinion is: if MN can not receive the return messages (HoT, CoT, BA) 
after timeout, it should resend initial messages (HoTI, CoTI and BU) and let 
firewall to open these pinholes again because only initiator (MN here) can 
know if the round signaling is finished. It is not reasonable to let 
firewall to check the statuses due to overhead.

Regards
QIu Ying

----- Original Message ----- 
From: "Suresh Krishnan" <[email-masked]>
To: "QIU Ying" <[email-masked]>; "marcelo bagnulo" 
<[email-masked]>; "Julien Laganier" <[email-masked]>; "mext" 
<[email-masked]>
Sent: Friday, April 18, 2008 1:19 PM
Subject: RE: update firewall drafts

Hi Qiu,

Thanks
Suresh