Subject: [Mip6] The test specification that uses IKEv1 with Mobile IPv6

From: "K.Kawaguchi" <[email-masked]>
Date: Fri, 10 Feb 2006 19:34:08 +0900

Hi all,

I am making the test specification of Mobile IPv6 in TAHI project.

	http://cert.v6pc.jp/mipv6/

Now, we try to add the test specification that uses IKEv1 with Mobile
IPv6.  We are making the test specification that secures the interoperability
based on RFC3776.  Since the IKE operation is not clear in RFC3776,
we think there could be two implementations based on it.

Please look at the following two cases. 

  Case.A
    HA <------------------------------------------> MN
     IKE: Initiator,Responder                        IKE: Initiator,Responder
          (It becomes an initiator by own demand.)        (It becomes an initiator by own demand.)

     HA and MN have Initiator and Responder function of IKE.
     In this case, HA and MN only have to establish IPsec by using IKE
     when oneself transmits the Mobile IPv6 signaling.

  Case.B
    HA <------------------------------------------- MN
     IKE: Responder                                  IKE: Initiator
                                                          (It is always an initiator because it maintains IPsec.)

     HA have only Responder function.  MN have only Initiator function.
     (Because MN is Initiator of SA at the first registration, it seems
      to be natural that MN is Initiator of all SA.)
     In this case, if MN has not established SA, HA cannot send the Mobile
     IPv6 signaling.  MN should begin IKE for keeping SA, because MN should
     always receive the Mobile IPv6 signaling from HA side.

  Note)
    HA of Case.A and MN of Case.B have the interoperability.
    But, HA of Case.B and MN of Case.A don't have the interoperability at time.

When we say that the Mobile IPv6 device support IKEv1, we want to obtain
a clear answer as follows. 

    (1) The Mobile IPv6 device must/should support Case.A.

    (2) The Mobile IPv6 device must/should support Case.B.

    (3) Not mandatory. Both Case.A and Case.B are acceptable depending on local system.

PS.
  Please give the opinion to me if there are operation other than Case.A and Case.B.
  Moreover, please give the opinion to me if there are ideas other than (1)-(3).

Best regards
---
Kiyoaki KAWAGUCHI [email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "K.Kawaguchi" <[email-masked]>
Date: Fri, 17 Feb 2006 10:52:40 +0900

Hi,

I'm sorry, I ask again. 
Haven't someone any opinion?

I think that it should decide either (1) or (2) by the standard
so that all Mobile equipment can secure the interconnectivity
in global network.
If Mobile IPv6 with IKE is only used in local network, (3) might
be good. 

Best regards
---

In message <[email-masked]>
"[Mip6] The test specification that uses IKEv1 with Mobile IPv6"

---

From: Francis Dupont <[email-masked]>
Date: Fri, 17 Feb 2006 21:20:41 +0100

In your previous mail you wrote:

   I'm sorry, I ask again. 
   
=> if the question is whether the HA may be only a responder the
answer is this depends on the policy used to protect HoTi/HoT:
 - if very fine grain policy are used, i.e., protecting HoTi from
   MN to HA, HoT from HA to MN and *no* other case, then the HA should
   be never triggered to setup the tunnel SA pair so to make it responder
   only (aka passive mode) is safe.
 - if not another mobile trying to optimize the routing with the MN sends
   a HoTi packet on the HA to MN way which can trigger the setup the tunnel
   SA pair by the HA (i.e., with the HA in the initiator role).
This is theory because the security of the first option is very questionable
for the mobile to mobile case, and in the second option it doesn't really
matter to break one of the two ways to optimize the routing...
So IMHO it is not a problem to make the HA always the responder.

Thanks

[email-masked]

PS: very fine grain selectors have another (and nice) side effect on
the transport SAs: there is no more need to delete them when the MN
comes back to home because the traffic they protect can exit only
when the MN is in visit.

---

From: "K.Kawaguchi" <[email-masked]>
Date: Mon, 20 Feb 2006 10:20:14 +0900

Thank you for the answer. 

Is your opinion near (1)?

Some people think that they can secure the interoperability
for all SA by (2).
(All SA mean ISAKAMP SA and SA1-SA8 in RFC3776.)
Their ideas are that MN always cares for the maintenance of
all SA as well as Home Registration.
In this case, HA to work only as responder on all scenes.
(They think that HA used as VPN-GW doesn’t have to equip
 Initiator functions.)

What do you think of this idea?

Best regards
---

In message <[email-masked]>
"Re: [Mip6] The test specification that uses IKEv1 with Mobile IPv6 "

---

From: Francis Dupont <[email-masked]>
Date: Sun, 26 Feb 2006 17:42:13 +0100

=> this seems a very reasonnable idea.

   
=> for pratical/deployment reasons you can't fight against it so
IMHO you can consider it is the default option.

Regards