Subject: RE: [Mip6] Mobile IPv6 and IKEv2

From: "Michael Roe" <[email-masked]>
Date: Wed, 20 Oct 2004 16:35:43 +0100

Vijay,

Thanks for circulating draft-ietf-mip6-ikev2-ipsec-00.txt.

In section 3.2, you say that:
   "It is not required to configure security policies per interface in
    order to protect return routability signaling messages."

This is true, but I found it misleading. The ability to configure
security policies per interface is still used to protect payload
packets, even though it is no longer used for RR messages. The
document doesn't make this very clear, because section 4.4 (Payload
packets) just refers you to RFC 3776 for the SPD entry. You have to
go and read section 5.2.4 of RFC 3776 to find out that per-interface
SPDs are still used:

     mobile node SPD OUT:
       - IF interface = IPv6 tunnel to home_agent_1 &
            source = home_address_1 & destination = any &
            proto = X
         THEN USE SA SA7

     mobile node SPD IN:
       - IF interface = IPv6 tunnel from home_agent_1 &
            source = any & destination = home_address_1 &
            proto = X
         THEN USE SA SA8

I have two suggestions that would solve the immediate problem:

(a) Section 3.2 should make it clear that if IPsec protection of payload packets
is implemented, then per interface SPDs are still required
and (b) Section 5.1.4 should describe the SPD entry for payload packets, rather
than referring the reader to RFC 3776, so that the whole SPD is described in one
document.

However, there's some deeper problems:

(a) RFC 3776 treats "interface = IPv6 tunnel to home_agent_1" as a selector.
In the new IPSec architecture, is it really a selector? Or are there just two SPD's
on different interfaces? So should it be something more like this:

     mobile node SPD OUT 1: # SPD on tunnel to home agent
       - IF source = home_address_1 & destination = any &
            proto = X
         THEN USE SA SA7

     mobile node SPD IN 1: # SPD on tunnel to home agent
       - IF source = any & destination = home_address_1 &
            proto = X
         THEN USE SA SA8

    mobile node SPD OUT 2: # SPD for other interfaces

    mobile node SPD IN 2: # SPD for other interfaces

(b) Is this a legitimate use of per-interface SPDs?

Now, I can understand how a machine with two physical
interfaces can have a different SPD for each one.
But here, when IPSec processes an outbound packet, it
has to decide whether "interface = IPv6 tunnel to home_agent_1"
is true BEFORE it decides to USE SA7 - ie. put the packet
in the tunnel. So this policy is saying "if the packet uses
the tunnel to the home agent, then use the tunnel to the
home agent". This looks like a circular dependency to me - I
think there's something not quite right about it.

Another way of modelling it might be to use the "SPD Selection
Function", and say that a mobile node with home addresses on
N different networks has (N+1) SPDs - and the MIPv6 code swaps
in the appropriate SPD every time the mobile node moves.
Maybe it should be like this:

     mobile node SPD OUT 1: # SPD when mobile is away from home
       - IF source = home_address_1 & destination = any &
            proto = X
         THEN USE SA SA7

     mobile node SPD IN 1: # SPD when mobile is away from home
       - IF source = any & destination = home_address_1 &
            proto = X
         THEN USE SA SA8

    mobile node SPD OUT 2: # SPD when mobile is at home

    mobile node SPD IN 2: # SPD when mobile is at home

Mike

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Thu, 21 Oct 2004 15:53:41 +0200

In your previous mail you wrote:

=> IMHO the basic issue is IKEv2 makes no sense outside the RFC 2401bis
(currently draft-ietf-ipsec-rfc2401bis-03.txt but perhaps it will be
updated 5 seconds after I send this message :-)...

[email-masked]