Subject: RE: [seamoby] Paging ID submission

From: <[email-masked]>
Date: Mon, 1 Oct 2001 19:21:36 -0400

Hi Pars,

Do not assume that IPsec is inherently high bandwidth. IPsec adds an extra
level of encapsulation, which implies a fixed overhead per packet. If you
want to use nested SAs for ingress filtering, then this doubles the
per-packet overhead, but the outer tunnel terminates at the access gateway,
so the extra overhead only applies to the leg across the public Internet.
Similarly, if a gateway discovery protocol is used, the extra packets would
not actually reach the mobile node.

IPsec SA setup can take as many as 9 messages or as few as 2, depending on
which key management protocol you use. I don't know if IPSP gateway
discovery will be used in public environments. The technology is not very
mature.

Andrew
-------------------------------------------
Upon closer inspection, I saw that the line
dividing black from white was in fact a shade
of grey. As I drew nearer still, the grey area
grew larger. And then I was enlightened.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, September 26, 2001 9:32 PM
> To: [email-masked]
> Cc: 'Behcet Sarikaya'; [email-masked]
> Subject: Re: [seamoby] Paging ID submission
>
>
>
> Hello and thank you for the reply.
>
>
> Andrew Krywaniuk wrote:
>
> > Hi Pars,
> >
> > It is possible to use IPsec in a nested tunnels
> configuration. Envision the
> > following connection profile:
> >
> > A ----{Internet}------ gateway ------ B
> >
> > In scenarios where one wishes to provide authenticated
> ingress filtering to
> > a LAN, the recommended solution is to set up two tunnels.
> The outer tunnel,
> > from A to the gateway, is authentication only; it provides source
> > authentication and DoS filtering. The inner tunnel, from A
> to B, provides
> > end-to-end security. This scenario has not been widely
> deployed yet, but the
> > IPsec and IPSP WGs have been careful to ensure that it will
> work. The route
> > through the gateway can be preconfigured on each authorized
> host, or it can
> > be discovered through DNS or via a gateway discovery protocol (to be
> > developed by IPSP).
>
> Do you think that the IPSP protocol is being designed for a
> cellular public
> network with millions of ``highly mobile'' hosts and millions
> of cells?
> Secondly,
> one important motivation of paging is to minimize the
> signaling costs due to
> location management in cellular networks. IPsec and IPSP
> based solutions would
> require many message exchanges upon each dormant mode registration of
> each host. This may reduce the motivations of paging.
>
> Another question that comes to mind: is IPSP possible in a public
> environment. What do you think?
>
> Finally, the IPSP language is complicated for a wireless environment.
> We should not forget that paging is used for saving scarce resources
> e.g. bandwidth and battery.
>
> More comments? Thanks.
>
> Regards,
> pars
>
>
>